Abnormity detection positioning method and system based on programmable network, and medium

Abstract

The invention discloses an anomaly detection positioning method and system based on a programmable network, and a medium, and belongs to the technical field of data processing. The method comprises the steps that S1, INT header information is added to an entry node, a first data packet passes through an INT source switch, an INT header label is added to the first data packet, a metadata field is added, and a second data packet is obtained; s2, if the intermediate node is abnormal, adding abnormal information to the second data packet to obtain a third data packet, and outputting the third data packet to a next-hop switch; s3, when the final data packet arrives at the last hop of switch, judging whether the final data packet needs to be sent to the INT server by using the Bloom filter, and finally updating the Bloom filter; and S4, after each detection period is finished, clearing the Bloom filter and the hash table of the switch. Abnormality judgment and recording are carried out on the data plane, so that the method can directly carry out anomaly detection in the transmission process of the data stream, and the data volume sent to the INT server is remarkably reduced.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to a method, system and medium for detecting and locating anomalies based on a programmable network. Background Art

[0002] In programmable networks, INT technology achieves transparent transmission of detection information by adding telemetry data to the packet header. This data can completely cover the entire network path and is eventually collected in the INT server at the exit, providing a basis for fine-grained performance detection. This technology significantly enhances network visibility, allowing network administrators to understand key information such as the transmission path, delay, and packet loss of data packets in detail, thereby helping to achieve more sophisticated anomaly detection. However, INT technology causes significant additional overhead, including data plane overhead, that is, the hop-by-hop increase in packet size due to carrying measurement information; control plane overhead, that is, the overhead of sending INT information from programmable switches to INT servers. Therefore, how to reduce the additional overhead brought by INT while maintaining the advantages of INT technology is an important challenge facing current research.

[0003] In order to reduce telemetry overhead, INT can be sampled to detect only some flows. INT sampling is performed at the network inlet switch, and the sampling rate can be flexibly adjusted according to the detection requirements. The inlet switch adds the INT header to the sampling group of a specific flow, and the intermediate node writes the measurement data to the data packet with the INT header to detect only the flow with the INT header. However, the sampling INT method cannot detect the performance of each data packet, resulting in a decrease in overall measurement accuracy. Another way to reduce telemetry overhead is to record abnormal information on the data plane and report it to the controller uniformly after the receipt cycle ends. In the second method, the detection information in the data packet header will not increase hop by hop, reducing the data plane overhead, and the INT information of the data packet does not need to be sent to the INT server, reducing the control plane overhead. Related research uses sketch to record detection information in programmable switches to reduce additional overhead, but due to hash conflicts, sketch will inevitably produce recording errors, resulting in limited detection accuracy. Summary of the invention

[0004] The purpose of the present invention is to overcome the deficiencies of the prior art and to provide a method, system and medium for abnormality detection and positioning based on a programmable network.

[0005] The object of the present invention is achieved through the following technical solutions: The first aspect of the present invention provides: a method for detecting and locating anomalies based on a programmable network, comprising the following steps: S1, adding INT header information at the ingress node, the first data packet passes through the INT source switch, the first data packet is added with an INT header tag and a metadata field is added to obtain a second data packet, the metadata field includes the INT source switch ID and timestamp information; S2, when the second data packet arrives at the first switch, the intermediate node abnormality is judged and recorded to obtain a third data packet, which is output to the next hop switch; if the intermediate node is abnormal, the abnormal information is added to the second data packet to obtain the third data packet and output to the next hop switch; S3, when the final data packet reaches the last hop switch, use the Bloom filter to determine whether it needs to be sent to the INT server. If necessary, send the final data packet to the INT server; then determine whether there is an exit node abnormality based on the timestamp information of the final data packet, and record it if there is an exit node abnormality; then determine whether the telemetry data of the final data packet needs to be sent to the INT server. If necessary, send the telemetry data of the final data packet to the INT server; finally update the Bloom filter; S4, after each detection cycle, clear the Bloom filter and hash table of the switch.

[0006] Preferably, the intermediate node abnormality judgment and recording further includes the following steps: S21: The first switch reads the previous hop timestamp information recorded in the second data packet; S22: The first switch subtracts the current timestamp from the previous hop timestamp information recorded in the second data packet to obtain the current hop delay; then compares the current hop delay with the preset threshold, and executes S23 if the current hop delay does not exceed the preset threshold; if the current hop delay exceeds the preset threshold, executes S24; S23: Determine that the intermediate node is normal and update the intermediate node information to obtain a third data packet; S24: Determine that the intermediate node is abnormal, and the first switch uses a hash table to record the first switch ID and the abnormal delay. If a conflict occurs in the hash table, S25 is executed. If no conflict occurs in the hash table, a third data packet is obtained. S25: The first switch adds the ID of the conflicting switch and the delay information of the conflicting switch ID to the second data packet to obtain a third data packet.

[0007] Preferably, after the final data packet is forwarded by the egress node, the INT header information and telemetry data of the final data packet are deleted.

[0008] Preferably, when any of the ingress node, intermediate node, and egress node attempts to record abnormal information and fails, an update data packet is constructed and sent to the INT server, wherein the update data packet has target data flow id information, switch id involved in the abnormality, and target abnormal delay information.

[0009] Preferably, the INT header tag and metadata field are added between the IP layer and the transport layer of the first data packet and the IP layer protocol number is changed, and the original IP layer protocol number is retained to obtain the second data packet. Preferably, detection is performed periodically, and in each detection period, the controller obtains the hash table information of the programmable data plane and the telemetry data received by the INT server; the Bloom filter records all data streams to be sent to the INT server, and the abnormal data streams not recorded by the programmable data plane are directly sent to the INT server; the abnormal data streams recorded by the programmable data plane are not sent to the INT server; for the data stream whose length of the INT header field is within the preset length, it is recorded as a normal data stream and is not sent to the INT server.

[0010] The second aspect of the present invention provides: a programmable network-based anomaly detection and positioning system, used to implement any of the above-mentioned programmable network-based anomaly detection and positioning methods, including: a programmable control plane, the programmable control plane is connected to the programmable data plane; the programmable control plane includes a controller and an INT server, the controller is used to issue routing instructions, and the INT server is used to receive telemetry data uploaded by each node in the programmable data plane and parse the telemetry data to detect and locate abnormal situations; each node in the programmable data plane is a programmable switch.

[0011] Preferably, the controller generates a routing path by acquiring global network topology information, and then obtains routing instructions and sends them to each node in the programmable data plane.

[0012] Preferably, each node in the programmable data plane forwards the first data packet according to the routing instructions, and at the same time, the programmable switch of each node measures the hop-by-hop delay of the data packet of each hop and determines whether there is abnormal information. If there is, the programmable data plane records the abnormal information. If a hash conflict is sent during recording, the current abnormal information is added to the header of the current data packet and handed over to the next hop switch for recording. If the current abnormal information cannot be recorded until the last hop switch, it is sent to the INT server.

[0013] The third aspect of the present invention provides: a computer-readable storage medium, wherein the computer-readable storage medium stores computer-executable instructions, and when the computer-executable instructions are loaded and executed by a processor, any of the above-mentioned programmable network-based anomaly detection and positioning methods is implemented.

[0014] The beneficial effects of the present invention are: 1) Anomaly judgment and recording are performed on the data plane, so that the present invention can directly perform anomaly detection during the transmission of data streams, thereby significantly reducing the amount of data sent to the INT server. In addition, the present invention makes full use of the programmable characteristics of the data plane and can use downstream storage resources to record abnormal information when conflicts occur. This innovative design not only improves the accuracy of anomaly detection, but also optimizes the utilization of network resources, providing new ideas for building an efficient and reliable network anomaly detection system.

[0015] 2) A fat tree topology was built based on the Bmv2 and Mininet platforms, and experiments verified that the present invention has significant advantages over traditional INT measurement technology in terms of additional overhead. Under the condition of reasonable setting of data plane storage resources, the present invention can effectively record abnormal flow information on the data plane, thereby greatly reducing the network transmission burden and providing strong support for improving network performance. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 The flowchart of the anomaly detection and positioning method based on programmable network is as follows; Figure 2 This is the flow chart for determining abnormality at the intermediate node; Figure 3 This is a block diagram of an anomaly detection and positioning system based on a programmable network; Figure 4 This is a schematic diagram of the INT-MD data packet format; Figure 5 This is a schematic diagram of data processing at the entry node; Figure 6 It is a schematic diagram of data processing at the intermediate node; Figure 7 This is a schematic diagram of data processing at the egress node; Figure 8 This is a schematic diagram of the anomaly detection process; Fig. 9 Parsing flow chart for data packets; Fig.10 It is a flowchart for reverse parsing of data packets; Fig.11 This is a schematic diagram of the data packet header changes; Fig.12 It is a fat tree topology diagram; Fig.13 This is a schematic diagram of the flow size distribution in the trace; Fig.14 This is a schematic diagram of the data plane detection ratio under different storage sizes; Fig.15This is a schematic diagram of FPR result analysis; Fig.16 This is a schematic diagram of the control plane overhead ratio under different storage sizes; Fig.17 This is a schematic diagram of INT overhead analysis; Fig.18 This is a comparison chart of additional expenses. DETAILED DESCRIPTION

[0017] The technical solution of the present invention will be clearly and completely described below in conjunction with the embodiments. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0018] INT technology embeds measurement information in the header of the data packet, so that the switch can collect and report relevant data on the network status while forwarding the data packet, thereby achieving accurate measurement of the hop-by-hop delay. However, according to the original design of IT technology, if the measurement information of each hop is attached to the data header, and the abnormal information is sent to the INT server at the egress node, this will result in significant additional overhead and impose a heavy burden on the INT server. The present invention uses a hash table in the data plane to accurately record the abnormal information, and adds the abnormal information to the data packet when a hash conflict occurs, and delivers it to the next-hop switch for recording. The switch on the data plane records the abnormal information to the best of its ability, and only when it cannot be recorded, will this part of the information be handed over to the egress node to report to the INT server for further processing. Specifically, for each data packet entering the network, the entry node adds an INT header and timestamp information; the intermediate node obtains the hop-by-hop delay based on the timestamp information of the previous hop and the timestamp of the data packet's arrival. If the delay value is greater than the threshold, it is considered that an abnormality has occurred. The intermediate node records the abnormal information. If a hash conflict occurs during recording, the abnormal information is added to the packet header and the recording task is delivered to the next hop; the exit node restores the data packet to its initial state and delivers the abnormalities that the data plane cannot record to the INT server, thereby ensuring the recording of all abnormal information.

[0019] See also Figure 1-Figure 18 The first aspect of the present invention provides: a method for detecting and locating anomalies based on a programmable network, comprising the following steps: S1, adding INT header information at the ingress node, the first data packet passes through the INT source switch, the first data packet is added with an INT header tag and a metadata field is added to obtain a second data packet, the metadata field includes the INT source switch ID and timestamp information; S2, when the second data packet arrives at the first switch, the intermediate node abnormality is judged and recorded to obtain a third data packet, which is output to the next hop switch; if the intermediate node is abnormal, the abnormal information is added to the second data packet to obtain the third data packet and output to the next hop switch; S3, when the final data packet reaches the last hop switch, use the Bloom filter to determine whether it needs to be sent to the INT server. If necessary, send the final data packet to the INT server; then determine whether there is an exit node abnormality based on the timestamp information of the final data packet, and record it if there is an exit node abnormality; then determine whether the telemetry data of the final data packet needs to be sent to the INT server. If necessary, send the telemetry data of the final data packet to the INT server; finally update the Bloom filter; S4, after each detection cycle, clear the Bloom filter and hash table of the switch.

[0020] In this embodiment, in order to accurately measure the hop-by-hop delay of a data packet during transmission, the present invention is designed as follows: Figure 4 The INT data packet structure shown in the figure. However, it is worth noting that as the data packet is transmitted hop by hop in the network, the overhead of the INT metadata field will continue to increase, which undoubtedly puts a heavy burden on network resources. In order to effectively alleviate this problem, the present invention innovatively designs the INT data field so that it can record the switch ID and key timestamp information. Through this design, the present invention can significantly reduce the overhead of the INT metadata field while ensuring measurement accuracy, thereby optimizing the utilization efficiency of network resources. According to the INT second version protocol standard, the present invention defines the format of the INT-MD metadata header and the metadata itself such as Figure 4As shown, in the original INT design, a 4-byte or 8-byte metadata field is added to the data packet after each hop. However, in the present invention, the length of the INT metadata field does not increase with the number of hops. The original INT technology adds metadata fields every hop. Compared with the original INT, the invented lightweight INT has an abnormality judgment process. Only when there is an abnormality, the abnormal information will be added to the packet header. Therefore, the length of each INT metadata field does not increase with the number of hops. Based on the INT of the IP protocol, the INT header is placed after the IP protocol header. The present invention focuses on the detection of the IP flow during the abnormality detection process to ensure that the insertion of INT does not interfere with the normal processing flow of the IP layer. Strictly follow the existing INT specifications to ensure compatibility with the existing network architecture. When the INT data is written to the data packet for the first time, we fill the PROTOCOL field in the IP header with INT TYPE to identify that the data packet uses INT technology. The first field of the INT header is INT OPTION. It contains two key information: one is the original value of the PROTOCOL field in the IP header, that is, the OPTION field; the other is the number of INT data items. This design allows the present invention to restore the original IP message field at the last hop of the data packet, ensuring the integrity and accuracy of the data. After the INT OPTION field, the present invention allocates a variable length INT data stack for storing specific INT data items in Figure 4 In the protocol, each INT data item (INT) occupies 4 bytes and contains the switch ID and timestamp information. It is used for subsequent fault detection and location. The encapsulation and decapsulation of the INT header are all performed in the network, so the INT protocol is transparent to the terminal host.

[0021] In order to implement anomaly measurement based on lightweight INT, in the telemetry system, different processing is required for data packets entering the ingress node, intermediate node, and egress node. Among them, the ingress node needs to add the INT header field and the first switch metadata, namely the switch ID and timestamp information, to the data packet; the intermediate node needs to perform anomaly judgment and anomaly recording, and handle hash collision problems; in addition to anomaly judgment and anomaly recording, the egress node needs to use Bloom filters to record the telemetry information transmitted to the INT server. The ingress node switch adds the INT header field and metadata field to each data packet, such as Figure 5 As shown in the figure, the INT header field and the switch ID and timestamp information are added between the IP layer and the transport layer. In addition, at the ingress node, the protocol number of the IP layer is changed to INT TYPE. When the subsequent switch parses INT TYPE, it will obtain the INT header information, and the original IP layer protocol number is retained in the OPTION field of the INT header.

[0022] In some embodiments, the intermediate node abnormality judgment and recording further includes the following steps: S21: The first switch reads the previous hop timestamp information recorded in the second data packet; S22: The first switch subtracts the current timestamp from the previous hop timestamp information recorded in the second data packet to obtain the current hop delay; then compares the current hop delay with the preset threshold, and executes S23 if the current hop delay does not exceed the preset threshold; if the current hop delay exceeds the preset threshold, executes S24; S23: Determine that the intermediate node is normal and update the intermediate node information to obtain a third data packet; S24: Determine that the intermediate node is abnormal, and the first switch uses a hash table to record the first switch ID and the abnormal delay. If a conflict occurs in the hash table, S25 is executed. If no conflict occurs in the hash table, a third data packet is obtained. S25: The first switch adds the ID of the conflicting switch and the delay information of the conflicting switch ID to the second data packet to obtain a third data packet.

[0023] In this embodiment, at the intermediate node, after the data is parsed to obtain the INT layer information, the timestamp information of the previous hop is used to judge and record the anomaly. Hash conflicts may occur during recording. In this case, the anomaly information needs to be carried in the data header and the recording task is delivered to the next hop switch. The specific process is shown in Algorithm 1.

[0024] Algorithm 1 First, handle special cases and check the hash table to determine whether the current flow has been recorded. If it has been recorded, record it directly. If it has not been recorded, execute the subsequent process. The switch obtains the timestamp of the data packet at the previous hop, subtracts the timestamp from the current local timestamp, and obtains the hop-by-hop delay; compares it with the value to determine whether the delay is abnormal. If it is not abnormal, directly update the metadata field information of INT, that is, the data packet is Figure 6 As shown in the upper right corner; the exception needs to use a hash table to record the exception information. If there is no hash conflict during recording, the delay exception is recorded normally and the data packet is updated as shown in the upper right corner of the figure. However, if a hash conflict occurs, the exception information of this hop needs to be retained in the data packet header, and the timestamp information is updated to the delay information. At the same time, the timestamp information of the current switch is added for the next hop exception judgment, such as Figure 6As shown below on the right. For each subsequent data packet, repeat the above steps, and periodically obtain the hash table information and reset the hash table value. For the abnormal flow that has been recorded, the current abnormal judgment is not performed, and it is directly recorded. The purpose of this is to fully record the delay information of all data packets of the abnormal flow, including abnormal delay information and normal delay information, so as to avoid wrong judgment. For example, after one cycle, the controller obtains the hash table of the switch and finds that the delay of only one data packet of the flow is abnormal, and the delays of other data packets are normal. Then it is very likely that the data packet is abnormal due to link congestion. In addition, it is worth noting that in the present invention, a special scenario may be encountered in which the data packet received by the switch already contains abnormal information that has not been recorded in the previous hop. In this case, these existing abnormal information are processed first. Specifically, when the hash table is used for recording, if no hash conflict occurs, the record is performed normally; if a conflict occurs, the abnormal information is retained and left for the next hop switch to process. At the same time, consider an extreme case, that is, all the switch hash tables of the data plane cannot record the abnormal situation of a certain hop. In this case, the scheme is designed to send the relevant abnormal information to the INT server for processing. This function is mainly undertaken by the egress node. By properly handling these special scenarios and extreme situations, it can ensure the integrity and accuracy of network anomaly information, providing strong support for subsequent troubleshooting and performance optimization.

[0025] In some embodiments, after the final data packet is forwarded by the egress node, the INT header information and telemetry data of the final data packet are deleted.

[0026] In this embodiment, it is easy to know through the analysis of the abnormality detection process of the intermediate node that if a hash conflict occurs, the recording task will be passed to the next-hop switch for processing. If all intermediate nodes cannot complete the recording task, the final recording task will be handed over to the egress node. However, even at the egress node, the risk of hash collision still exists, which may cause some abnormal information to not be effectively recorded in the data plane. In order to meet this challenge, it is necessary to transmit the abnormal information that cannot be recorded to the INT server for further processing after the egress node. In addition, in order to comprehensively record the normal and abnormal information of the abnormal flow, such as Figure 7 This solution designs a Bloom filter at the egress node. This filter can effectively record the relevant information of the abnormal flow, ensure the integrity and accuracy of the data, and provide strong support for subsequent analysis and processing. The specific process of INT egress node anomaly detection is introduced below through Algorithm 2.

[0027] Algorithm 2 As shown in Algorithm 2, the egress node first judges and processes special situations, that is, whether the flow has been sent to the INT server or recorded in the hash table. Through the Bloom filter detection, if the flow has been sent to the INT server, the current INT information is sent directly; in addition, if the flow has been recorded in the hash table, the current delay information is directly recorded in the hash table, and there will definitely be no hash conflict. If the abnormality of the flow occurs for the first time, that is, the Bloom filter and the hash table have not recorded the flow, then the following steps are performed to determine whether to record it. First, determine whether there is information in the packet header of the data packet that has not been recorded before. If so, and a hash conflict occurs when the egress node attempts to record it, it needs to be sent to the INT server, and the Bloom filter is updated to record the information of the flow; secondly, determine whether an abnormality occurs in the current hop. If an abnormality occurs, it is recorded. If a hash conflict occurs when recording, it also needs to be sent to the INT server and the Bloom filter is updated. If it is determined that no abnormality occurs, the data packet is directly restored to its original state. For each subsequent data packet, the above algorithm is executed, and the controller periodically obtains the hash table information and Bloom filter information and resets them. As described in Algorithm 2, the exit node will generate a new message due to the hash collision problem and inform the INT server of the INT information. Figure 7 As shown in FIG. 1 , the INT notification message carries the five-tuple information of the Ethernet layer information flow and the INT information. In addition, the original message will be restored to the initial state, retaining only the original data packet header information and the payload part.

[0028] In some embodiments, when any of the ingress node, intermediate node, and egress node attempts to record abnormal information and fails, an update data packet is constructed and sent to the INT server. The update data packet has target data flow ID information, switch ID involved in the abnormality, and target abnormal delay information.

[0029] In some embodiments, the INT header tag and metadata field are added between the IP layer and the transport layer of the first data packet and the IP layer protocol number is changed, and the original IP layer protocol number is retained to obtain the second data packet.

[0030] In some embodiments, detection is performed periodically. In each detection cycle, the controller obtains the hash table information of the programmable data plane and the telemetry data received by the INT server; the Bloom filter records all data streams to be sent to the INT server, and the abnormal data streams not recorded by the programmable data plane are directly sent to the INT server; the abnormal data streams recorded by the programmable data plane are not sent to the INT server; the data streams whose length of the INT header field is within the preset length are recorded as normal data streams and are not sent to the INT server.

[0031] In this embodiment, as shown in Algorithm 3, the present invention implements a periodic detection mechanism. In each detection cycle, the controller can obtain abnormal data from two key components, namely, the hash table information of the data plane and the telemetry data received by the INT server. For the abnormal flow detected by the data plane, we can obtain accurate information including the five-tuple information of the abnormal flow, the location where the abnormality occurred, the number of abnormal data packets, the abnormal total delay, and the number of normal data packets and the normal total delay. Since the data plane judges the abnormality based on accurate delay information and can clearly record the normal delay and abnormal delay of the abnormal flow, the data plane can record accurate abnormal information.

[0032] When the INT server processes the received flows, we use Bloom filters to record all flows that have been sent to the INT server at the last hop. The use of Bloom filters may result in the following three flow recording situations: (1) abnormal flows that are not recorded by the data plane. Such flows need to be correctly sent to the INT server for further processing; (2) abnormal flows that have been recorded by the data plane. Due to the false positive characteristics of the Bloom filter, these flows may be mistakenly sent to the INT server again; (3) normal flows that have not experienced abnormalities may also be mistakenly sent to the INT server due to the false positive characteristics of the Bloom filter. In situations (2) and (3), although the INT server may receive incorrect abnormal flow information, in subsequent in-depth analysis, the packet header information can be used to accurately distinguish between correct and incorrect information. For situation (2), since the data plane has recorded its abnormal information, it is easy to determine whether the flow is abnormal by checking the hash table. In addition, all flows that need to be sent to the INT server, in addition to the necessary information of the INT host, also have the previous abnormal information attached, resulting in the increase in the length of the INT header field of these flows compared to normal flows. Based on this feature, the present invention can effectively identify situation (3). Therefore, the controller can accurately identify all abnormal flows, thereby ensuring the accuracy of abnormal detection and processing.

[0033] Algorithm 3 A specific embodiment is given below to illustrate the method of the present invention. The overall process is as follows: Figure 8As shown. Among them, node 1 is the entry node, node 7 is the exit node, the forwarding path of business flow f1 is nodes 1, 5, 4, 6, 7, and the forwarding path of business flow 2 is nodes 1, 2, 3, 7. Business flow f1 is a normal business flow, and business flow f2 is an abnormal business flow. When it goes from node 1 to node 2, the delay abnormality occurs. Therefore, the detection goal of this embodiment is to be able to record the flow information of business flow f2, the switch where the abnormality occurs, and the abnormal delay information. It includes four steps: (1) The entry node adds INT. The data packet passes through the INT source switch. The switch adds the INT header label and adds the metadata field, namely the switch ID and timestamp information. As shown in the figure, after business flows f1 and f2 pass through node 1, the INT header, the switch ID sl of node 1, and the timestamp time1 are added. (2) The intermediate node abnormality is judged and recorded. When the data packet arrives at the next-hop switch, the switch first reads the previous hop timestamp information recorded on the data packet. Subsequently, the switch subtracts the current timestamp from the timestamp in the data packet to calculate the delay of this hop. Next, the calculated delay is compared with the preset threshold. If the delay exceeds the value, it is judged as abnormal. At this time, the switch will use the hash table to record the ID of the current switch and the corresponding abnormal delay. If the delay does not exceed the threshold, it is judged to be normal, and no abnormal processing is performed. In addition, in the process of recording abnormal flow information, if a conflict occurs in the hash table, the switch will attach the conflicting switch ID and its corresponding delay information to the data packet, and pass the data packet to the next hop switch so that the subsequent switches can continue to record abnormal information. During the normal transmission of business flow f1, when the data packet arrives at node 2, it is confirmed that no abnormality occurs after abnormal detection. Subsequently, node 2 updates the switch ID and timestamp information of the INT header to the ID and current timestamp of node 2 itself. Subsequently, business flow f1 continues to pass through nodes 4 and 6, and also undergoes abnormal detection and no abnormality is found. Nodes 4 and 6 will repeat the above steps of updating the INT header information. For business flow f2, when the data packet arrives at node 2, the detection mechanism finds that its delay exceeds the preset threshold, thereby determining that business flow f2 has an abnormality during the transmission process from node 1 to node 2. Node 2 encounters a hash conflict when trying to record the exception information. At this time, node 2 adds the exception information to the packet header, that is, updates the time1 field to delay1, and appends the switch ID and current timestamp information of node 2. As service flow f2 continues to be transmitted to node 3, node 3 tries to record the exception information again. If no hash conflict occurs at this time, node 3 records the exception information locally. In this way, even in the case of a hash conflict, it can ensure that the exception information is fully transmitted and recorded, providing key data for subsequent analysis and processing.(3) Record the abnormality of the egress node and send it to the INT server. For the last-hop switch, this paper first uses the Bloom filter to determine whether it needs to be sent to the INT server; then uses the timestamp information to determine whether it is abnormal, and records it if it is abnormal; finally, it determines whether the telemetry data of the data packet needs to be sent to the INT server and updates the Bloom filter. After the service flow f1 and f2 are forwarded by node 7, the INT header and its related telemetry data information will be deleted to restore the data packet to the original transmission state. In particular, for service flow f2, if any node among nodes 1, 2, 3, and 7 fails to record the abnormal information, a new data packet needs to be constructed and sent to the INT server. The newly constructed data packet will contain the flow ID information, the switch ID involved in the abnormality, and the specific delay information for subsequent analysis and processing by the INT server. (4) Clear the Bloom filter and hash table. After each measurement cycle, the Bloom filter and hash table of the switch will be cleared to prepare for the measurement of the next cycle.

[0034] The second aspect of the present invention provides: a programmable network-based anomaly detection and positioning system, used to implement any of the above-mentioned programmable network-based anomaly detection and positioning methods, including: a programmable control plane, the programmable control plane is connected to the programmable data plane; the programmable control plane includes a controller and an INT server, the controller is used to issue routing instructions, and the INT server is used to receive telemetry data uploaded by each node in the programmable data plane and parse the telemetry data to detect and locate abnormal situations; each node in the programmable data plane is a programmable switch.

[0035] In some embodiments, the controller generates a routing path by acquiring global network topology information, and then obtains routing instructions and sends them to each node in the programmable data plane.

[0036] In some embodiments, each node in the programmable data plane forwards the first data packet according to the routing instructions, and at the same time, the programmable switch of each node measures the hop-by-hop delay of the data packet of each hop and determines whether there is abnormal information. If there is a programmable data plane, the abnormal information is recorded. If a hash conflict is sent during recording, the current abnormal information is added to the header of the current data packet and handed over to the next hop switch for recording. If the current abnormal information cannot be recorded until the last hop switch, it is sent to the INT server.

[0037] In this embodiment, the system framework is composed of two core components: the programmable control plane and the data plane. Figure 3As shown in the figure, the control plane mainly includes two modules: the controller and the INT server. The main responsibility of the controller is to issue routing instructions to ensure that the data packets in the network can be transmitted along the predetermined path. The INT server is responsible for collecting the measurement data uploaded by each node in the data plane and conducting in-depth analysis of the data to detect and locate abnormal conditions in the network. In the data plane, each node is designed as a programmable switch that supports the INT function and has the ability to measure data. In particular, Figure 3 The last hop switch of each data flow shown is responsible for uploading the collected telemetry data to the INT server. Specifically, the workflow of this system can be divided into the following steps: During the initialization phase of the system, the controller first obtains the global network topology information and generates corresponding routing paths based on it. Subsequently, the controller sends these routing paths to each programmable switch in the form of flow tables to ensure the correct forwarding of data flows.

[0038] Next, in the data plane, the switch is responsible for forwarding the service flow normally according to the flow table. At the same time, the switch measures the hop-by-hop latency of each data packet and determines whether there is an abnormality based on these measurement data. Once an abnormality is detected, the data plane will record the corresponding service flow abnormality information. If a hash conflict occurs during recording, the abnormal information is added to the packet header and recorded by the next hop switch. For abnormal information that the data plane cannot record, the last hop switch will send it to the INT server.

[0039] Finally, the INT server is responsible for collecting INT measurement data from the data plane and periodically obtaining anomaly information from the data plane. By analyzing these data, the INT server can detect and locate anomalies in the network, thereby providing powerful decision support for network administrators.

[0040] The INT field consists of the INT OPTION part and the INT DATA part. Specifically, the INT OPTION part contains the option field and the INT num field, while the INT DATA part contains the switchID field and timestamp information. As shown in Table 1, these fields have unique structures and functions. The following will explain the origin and function of each field in detail.

[0041] Table 1 The option field records the PROTOCAL information of the original IP datagram header. When the switch receives a data packet, it will use the PROTOCAL field of the IP datagram header to determine whether it is the INT protocol, which means that the original protocol information will be overwritten, so the option field is needed to retain the original information and restore the original field information at the last hop of the data packet transmission process to ensure the integrity and accuracy of the data. Therefore, the length of the option field is the same as the length of the PROTOCAL field of the IP datagram header.

[0042] The INT_num field records the number of INT DATA information retained. When an exception occurs in a data packet and a hash conflict occurs during recording, the current exception will be retained until the next hop for recording. At this time, the value of INT_num is increased by 1 based on the original value. When no hash conflict occurs, the value of INT_num is 1. During the parsing phase of the data packet, the value of INT_num is used to determine whether the parsing of the INT DATA part is completed. In experimental simulation, due to the limited number of switches, 8 bits are allocated. In actual applications, this allocation can be customized according to the actual network scale to meet the needs of different scenarios.

[0043] The Switch ID field indicates the switch ID, which is sent by the controller to the switch through the flow table. The switch then performs related actions through flow table matching and writes them into the data packet. Similarly, allocating 8 bits can meet the detection requirements during the experiment. In actual applications, it can be customized according to the actual network scale.

[0044] Timestamp is the timestamp information, which is important information for packet anomaly judgment. In the v1model structure of P4, standard_metadata_t provides key information for packet processing, including two important information about timestamps, ingress_global_timestamp and egress_global_timestamp. These two fields are counted at the microsecond level, respectively identifying the time points when the packet enters the ingress stage and the egress stage, and are represented in 48-bit form. In implementation, the scheme uses ingress_global_timestamp to indicate the time when the packet arrives at the switch. In addition, since data anomaly judgment can meet the requirements at the millisecond level, in actual applications, only the last 24 bits of the value are extracted, thereby ensuring sufficient accuracy while also achieving effective data compression and efficient processing.

[0045] In the P4 vlmodel architecture, the clone_preserving_field_list function can be used to clone the original data packet. For the cloned data packet, its Ethernet layer header information is retained, and the flow ID information and INT information are attached after the Ethernet layer header.

[0046] When the data packet arrives at the P4 target machine, it passes through the parser, ingress matching action pipeline, egress matching action pipeline and reverse parser in sequence. Next, the detailed processing process of the data packet in the parser, ingress matching action pipeline, egress matching action pipeline and reverse parser will be explained in detail. (1) Parsing stage. In P4, after the data packet enters the switch, it needs to go through the process of parsing, matching processing and reverse parsing. The parsing field obtains the data packet header information, and the reverse parsing field reassembles the packet header. In this solution, it is necessary to implement INT in-band telemetry on the data plane of P4. Therefore, during the parsing and reverse parsing process, the INT field needs to be additionally processed. The parsing process is as follows: Fig. 9 As shown in the figure, for the received data packet, the Ethernet header field is first parsed to obtain the field information of the Ethernet header; according to the type of the Ethernet data packet, the IPv4 header is further parsed to determine the type of the IPv4 data packet. If type=INT_TYPE, it is considered to be a TNT message; according to the option field of INT, TCP or UDP is parsed. Among them, when parsing the INT message, since INT may carry switch information, it is necessary to parse the DATA part of INT multiple times according to the INT_num field.

[0047] (2) Ingress action matching pipeline processing. The ingress action matching pipeline is mainly responsible for forwarding normal business flows and detecting and recording abnormal flows. The core matching tables and action details involved are shown in Table 2. ipv4_lpm_table is used for routing selection of normal business flows. Specifically, the matching key value in the table is hdr.ipv4.dstAddr (i.e., the destination IP address of IPv4 in the packet header). Once the corresponding rule is matched, the system will execute the set_nhop (select next hop) action, which assigns a value to the standard_metadata.egress_spec field, thereby controlling the data packet to be forwarded from the specified port. In addition, this action will also make necessary modifications to the MAC address, TTL (time to live) and other information in the IPv4 packet header to ensure that the data packet can reach the destination address correctly and efficiently.

[0048] Table 2 add_int_table is responsible for adding the current switchID and abnormal delay information to the packet header when a hash conflict occurs. This table adopts a design without matching key values. When no match is found in the table, the add_int action will be executed. In this action, the parameter switchID is passed in by the control plane, and the abnormal delay information is obtained by calculating the difference between the current timestamp of ingress_global_timestamp and the timestamp of the previous hop in the packet header. This mechanism ensures that the data packet can carry abnormal information in the header when a hash conflict occurs to support subsequent processing and abnormal analysis.

[0049] The function of update_int_tablee is to update the INT field information in the packet header. Whenever a data sentence passes through a switch, this table is responsible for updating the switchID and timestamp information in the header INT. Similar to the add_int_table matching table, the switchID parameter is provided by the control plane, and the timestamp uses the ingress_global_timestamp field value of standard_metadata in the current switch. The updated information will be passed along with the data packet to the next hop switch for subsequent anomaly detection and judgment.

[0050] The ingress action matching pipeline contains three main actions: hash_collision_flag, hash_normal, and hash_abnormal. The hash_collision_flag action is responsible for detecting whether a hash collision occurs. Once a hash collision is detected, the system will execute the add_int_table matching table to add the necessary switchID and abnormal delay information to the packet header. If no hash collision occurs, the system will further perform an abnormality judgment. If a delay abnormality is detected, the hash_abnormal action is executed, which will record the delay and number information of the abnormal data packets of the abnormal flow in the hash table. Conversely, if no abnormality is detected, the hash_normal action is executed to record the delay and number information of the normal data packets of the abnormal flow in the hash table. This series of actions ensures efficient processing and accurate monitoring of data packets in the network.

[0051] (3) Egress action matching pipeline processing. During the implementation process, the functions of anomaly detection and anomaly recording are all realized in the ingress action matching pipeline. Therefore, the egress action matching pipelines of the ingress node and the intermediate node do not need to add additional functions to support this mechanism. However, for the egress node, since it is responsible for feeding back the abnormal information that cannot be recorded to the controller, it is necessary to add additional processing steps in the egress action matching pipeline to ensure the effective transmission and proper processing of the abnormal information. In the egress action matching pipeline of the egress node, according to the value of standard_metadata.instance_type, if it is judged to be 1, it means that the current message is a clone message, and the five-tuple information of the flow and the INT information are retained and sent to the INT server, as shown in Table 3. In the implementation, in the egress matching stage, the Ethernet layer, IP layer and UDP layer information are all set to illegal through the method setlnvalid(), so the illegal header information will not be added in the reverse parsing stage.

[0052] Table 3 (4) Inverse analysis stage: the inverse analysis process is as follows: Fig.10 As shown in the figure, in the reverse parsing process, it is also necessary to add the processing logic of the INT field. Add the transport layer, INT, IP layer and Ethernet header to the payload in turn. After the data packet passes the reverse parsing, it leaves the current switch. It should be noted that in the overall implementation of INT, the header field of the data packet will change after passing through the source node, intermediate node and exit node. Specifically, the source node needs to add the INT header and metadata information to the data packet, such as Fig.11 As shown in (a), INT data is at the Ethernet layer and IP layer; for intermediate nodes, INT metadata information needs to be updated, such as Fig.11 As shown in (b), for the egress node, the data packet is restored to the original data and does not contain any INT information.

[0053] The third aspect of the present invention provides: a computer-readable storage medium, wherein the computer-readable storage medium stores computer-executable instructions, and when the computer-executable instructions are loaded and executed by a processor, any of the above-mentioned programmable network-based anomaly detection and positioning methods is implemented.

[0054] The advantages of the present invention compared with the prior art are verified by simulation experiments. First, a Fig.12In the fat tree topology shown, the pod of the topology is set to 4. The I of the hosts h1-h16 in the topology is 10.13.1.2-10.13.1.17. Each access layer switch connects two hosts, and the hosts act as servers in the network. In addition, it is worth noting that all switches in the access layer may act as egress nodes in the INT architecture. Therefore, in order to support this function, all access layer switches are connected to a dedicated server to act as INT servers. The experiment determines whether an abnormality occurs based on the hop-by-hop delay of the data packet in the network. In order to realize the abnormal data packet, a flag bit in the header field is used to indicate the abnormality of the current data packet when constructing the data packet. The switch obtains and records the abnormal delay through the flag bit. In addition, in actual applications, engineers can obtain the threshold of abnormal delay based on empirical values. Before constructing the abnormal scenario, this experiment obtains the normal delay of each hop through the normal flow in the network, and sets the experimental value on this basis.

[0055] The solution involves two data structures, Bloom filter and hash table, which need to be designed according to the requirements. First, we consider the memory size m of the Bloom filter and the number k of hash functions. When the error rate is given, it can be determined by the following formula: Where n represents the number of service flows in the network. The experimental error rate p is set to 0.01, and the parameter values ​​are shown in Table 4.

[0056] Table 4 In the experiment, the detection of abnormal flows is set up in the context of 100,000 business flows. Using the real data set downloaded by CAIDA, the trace contains 100,000 business flows, including about 800,000 data packets. The specific flow size distribution of the trace is as follows: Fig.13 shown.

[0057] The present invention is dedicated to realizing the recording of all abnormal flows by the data plane. When the data plane cannot record specific abnormal flow information due to storage resource limitations or hash conflicts, this information will be transferred to the INT server for processing. In view of the limited storage resources of the data plane and the possible conflicts caused by hash table settings, different sizes of hash table storage resources are configured for the switch during the experiment. The specific configuration method is as follows: Fig.14 To further explore the impact of different configurations on the performance of abnormal flow detection, we set different numbers of abnormal flows and conducted a series of experiments, such as Fig.14. The experimental results show that when the number of abnormal flows remains unchanged, as the hash table resources allocated to the data plane gradually increase, the number of abnormal flows recorded by the data plane shows a significant growth trend. Especially when the hash table resources are sufficient, for example, under the 90KB memory size configuration in the figure, when the number of abnormal flows is small, almost all abnormal flows can be recorded by the data plane; even when the number of abnormal flows gradually increases, more than 90% of the abnormal flows are still successfully recorded by the data plane. This result fully demonstrates that for abnormal flows in the network, the data plane will do its best to record them, thereby effectively reducing the processing pressure of the INT server and improving the abnormal flow detection and processing efficiency of the entire system.

[0058] In addition, since the Bloom filter is introduced in the last hop egress node, this inevitably leads to a certain false detection rate, that is, the normal flow is misjudged as an abnormal flow. Although the abnormal flow can be accurately identified in the data analysis phase of the INT server, this false detection phenomenon still causes unnecessary waste of INT resources. Therefore, this section conducts an experimental analysis. The false detection rate is defined as: n_int / N, where n_int represents the flow that the INT server incorrectly receives, and N represents the total number of abnormal flows. It should be noted that the false detection rate indicator here is not FPR, but an indicator specifically used to measure false detection situations. For example Fig.15 As shown in (a), the value of the data plane detection FPR is 0 in most cases, and its maximum value reaches 0.001. The data plane is responsible for recording the five-tuple information and delay data of the abnormal flow. When the network status changes, the delay of the normal flow will also be adjusted accordingly. However, when a packet in the normal flow has a sudden change in delay, it may be mistakenly recorded as an abnormal flow due to misjudgment. Nevertheless, since the switch can record the number of normal packets in the abnormal flow, the number of abnormal packets with normal total delay, and the abnormal total delay, the control end can further analyze the abnormal information when obtaining it to improve the accuracy of anomaly detection. Fig.15 (b), the false detection rate of the INT server is 0 in most cases, but false detection occurs when processing 4000 and 5000 abnormal flows. As the number of abnormal packets increases, more abnormal information is sent to the INT server for processing. At the same time, the flow information recorded by the egress node using the Bloom filter also gradually increases, which increases the possibility of erroneous recording. It should be noted that although the INT server will receive erroneous abnormal flows, it can accurately judge the abnormal flows by combining the data plane abnormal information and packet information.

[0059] When the data plane records the abnormal information of the abnormal flow, the number of abnormal flows received by the INT server will be greatly reduced. Especially when such flows belong to the category of large flows, that is, when the number of data packets is large and the duration is long, it will significantly reduce the processing pressure of the INT server, thereby improving the performance and stability of the entire system. Therefore, the role of this solution in reducing the pressure on the INT server is analyzed next. For the INT server, each time a data packet is received, the corresponding storage and computing resources are consumed to process the data packet. Therefore, when analyzing, the ratio of the number of abnormal data packets received by the INT server to the total number of abnormal data packets is used as a measurement indicator. During the experiment, the number of different abnormal flows and the impact of different memory sizes on the pressure of the INT server were also recorded, such as Fig.16 It can be seen that as the memory size increases, the number of packets received by the INT server gradually decreases. When the memory size is 90KB, the INT server receives less than 10% of the abnormal packets, which effectively reduces the collection pressure of the INT server. In addition, as the number of abnormal flows increases, under the same memory size, due to the limited storage resources of the data plane, more abnormal flows will not be recorded, resulting in an increase in the number of abnormal packets received by the INT server. This result is consistent with Fig.14 Consistent.

[0060] The original INT technology adds metadata fields every hop. Compared with the original INT, the lightweight INT of the present invention has an abnormality judgment process. Only abnormal information will be added to the packet header. First, the additional overhead O is defined as follows: Among them, L represents the number of links that the data packet passes through in the network, which means the number of bytes that the data packet needs to carry additionally on the i-th link for network measurement. In the traditional INT measurement Wherein, p represents the fixed INT header overhead, and the present invention is designed as p=2, and q represents the length of the metadata field that needs to be added for each hop in the traditional network, which is generally a multiple of 4 bytes or 8 bytes, and q=4. Therefore, the overhead of the traditional INT network is: .

[0061] Next, we consider different scenarios to analyze the additional overhead of our solution. Fig.17 As shown, the data packets pass through switches s in sequence. 1 →s 2 →s 3 →s 4 , that is, s is the entry node, s 2 ,s 3 is the intermediate node, s 4 Is the exit node. Fig.17 Cases 1 and 2 show that the data packets pass through s1 →s 2 →s 3 →s 4 , each hop has no delay anomaly or anomaly occurs and no conflict occurs when the anomaly is recorded, then the data packet is from s 1 Outgoing with s 1 The timestamp of arrival s 2 , and then directly use s 2 , the timestamp coverage; similarly, from s 3 Outgoing with s 3 timestamp. In this case, each hop data packet only needs to carry an additional INT header and metadata information of one hop, that is, each hop carries an additional 6 bytes of data, which is the most ideal abnormal overhead. Case 3 means that the data is sent from s 1 →s 2 , an exception occurs and a hash collision occurs when recording, then s 2 It is necessary to add the abnormal information of the previous hop before reaching s 3 After the abnormal information is s 3 Normal recording. Case 4 considers the worst case, that is, an exception occurs at each hop of the data packet during transmission and a hash conflict occurs during recording. The additional overhead at this time is: . It should be emphasized that, in the worst case, the present invention considers that the data packet encounters anomalies at each hop of the transmission, and a hash conflict occurs for each abnormal record. Although this extreme situation is theoretically possible for a single data stream, considering the overall situation of all streams in the entire network environment, since corresponding storage resources have been allocated for recording abnormal information, it is impossible for all streams to encounter the worst case at the same time. Furthermore, under the premise of reasonable resource allocation, by implementing effective optimization measures, it can be ensured that the additional overhead of the solution proposed by the present invention is minimized, thereby minimizing the consumption of system resources while ensuring the reliability of data transmission.

[0062] In the present invention, the data plane records the abnormal flow information in detail. Once a hash conflict occurs, the information will be passed to the next switch for further processing. During the whole process, the data plane continues to record as much as possible. If it is really impossible to record, the information will be forwarded to the INT server. To verify the performance of this solution in terms of data plane overhead, we set the data plane to allocate different sizes of hash table memory and conduct experiments under different numbers of abnormal flows, such as Fig.18As shown. When there are relatively few entries in the switch hash table but a large number of abnormal flows, for example, when the number of abnormal flows is 2000, 3000, and 4000, respectively, and the memory size is 3KB6KB, and 15KB, the data plane can only record a small amount of abnormal flow information, and the additional overhead of the present invention is similar to that of the existing INT algorithm. However, when the memory size increases to 30KB, 60KB, and 90KB, most of the abnormal flow information can be effectively recorded by the data plane, and the additional overhead of the present invention is significantly less than that of the existing INT algorithm.

[0063] The above is only a preferred embodiment of the present invention. It should be understood that the present invention is not limited to the form disclosed herein, and should not be regarded as excluding other embodiments, but can be used in various other combinations, modifications and environments, and can be modified within the scope of the concept described herein through the above teachings or the technology or knowledge of the relevant field. The changes and modifications made by those skilled in the art shall not deviate from the spirit and scope of the present invention, and shall be within the scope of protection of the claims attached to the present invention.

Claims

1. A method for detecting and locating anomalies based on a programmable network, characterized in that: The following steps are involved: S1, adding INT header information at the ingress node, the first data packet passes through the INT source switch, the first data packet is added with an INT header tag and a metadata field is added to obtain a second data packet, the metadata field includes the INT source switch ID and timestamp information; S2, when the second data packet arrives at the first switch, the intermediate node abnormality is judged and recorded to obtain a third data packet, which is output to the next hop switch; if the intermediate node is abnormal, the abnormal information is added to the second data packet to obtain the third data packet and output to the next hop switch; S3, when the final data packet reaches the last hop switch, use the Bloom filter to determine whether it needs to be sent to the INT server. If necessary, send the final data packet to the INT server; then determine whether there is an exit node abnormality based on the timestamp information of the final data packet, and record it if there is an exit node abnormality; then determine whether the telemetry data of the final data packet needs to be sent to the INT server. If necessary, send the telemetry data of the final data packet to the INT server; finally update the Bloom filter; S4, after each detection cycle, clear the Bloom filter and hash table of the switch.

2. The method for abnormality detection and positioning based on a programmable network according to claim 1, characterized in that: The intermediate node abnormality judgment and recording also includes the following steps: S21: The first switch reads the previous hop timestamp information recorded in the second data packet; S22: The first switch subtracts the current timestamp from the previous hop timestamp information recorded in the second data packet to obtain the current hop delay; then compares the current hop delay with the preset threshold, and executes S23 if the current hop delay does not exceed the preset threshold; if the current hop delay exceeds the preset threshold, executes S24; S23: Determine that the intermediate node is normal and update the intermediate node information to obtain a third data packet; S24: Determine that the intermediate node is abnormal, and the first switch uses a hash table to record the first switch ID and the abnormal delay. If a conflict occurs in the hash table, S25 is executed. If no conflict occurs in the hash table, a third data packet is obtained. S25: The first switch adds the ID of the conflicting switch and the delay information of the conflicting switch ID to the second data packet to obtain a third data packet.

3. The method for abnormality detection and positioning based on a programmable network according to claim 1, characterized in that: When the final data packet is forwarded by the egress node, the INT header information and telemetry data of the final data packet are deleted.

4. The method for abnormality detection and positioning based on a programmable network according to claim 1, characterized in that: When any of the ingress node, intermediate node, and egress node attempts to record abnormal information but fails, an update data packet is constructed and sent to the INT server. The update data packet has target data flow ID information, switch ID involved in the abnormality, and target abnormal delay information.

5. The method for abnormality detection and positioning based on a programmable network according to claim 1, characterized in that: The INT header tag and metadata field are added between the IP layer and the transport layer of the first data packet and the IP layer protocol number is changed, and the original IP layer protocol number is retained to obtain the second data packet.

6. The method for abnormality detection and positioning based on a programmable network according to any one of claims 1 to 5, characterized in that: Periodic detection is performed. In each detection cycle, the controller obtains the hash table information of the programmable data plane and the telemetry data received by the INT server. The Bloom filter records all data flows that need to be sent to the INT server. For abnormal data flows not recorded by the programmable data plane, they are directly sent to the INT server. For abnormal data flows recorded by the programmable data plane, they are not sent to the INT server. For data flows whose length of the INT header field is within the preset length, they are recorded as normal data flows and are not sent to the INT server.

7. An abnormality detection and positioning system based on a programmable network, characterized in that: Used to implement the programmable network-based anomaly detection and positioning method as described in any one of claims 1 to 6, comprising: a programmable control plane, the programmable control plane is connected to a programmable data plane; the programmable control plane includes a controller and an INT server, the controller is used to issue routing instructions, and the INT server is used to receive telemetry data uploaded by each node in the programmable data plane and parse the telemetry data to detect and locate abnormal situations; each node in the programmable data plane is a programmable switch.

8. The programmable network-based anomaly detection and positioning system according to claim 7, characterized in that: The controller generates a routing path by acquiring global network topology information, and then obtains routing instructions and sends them to each node in the programmable data plane.

9. The programmable network-based anomaly detection and positioning system according to claim 7, characterized in that: Each node in the programmable data plane forwards the first data packet according to the routing instructions. At the same time, the programmable switch of each node measures the hop-by-hop delay of the data packet of each hop and determines whether there is abnormal information. If there is, the programmable data plane records the abnormal information. If a hash conflict is sent during recording, the current abnormal information is added to the header of the current data packet and handed over to the next hop switch for recording. If the current abnormal information cannot be recorded until the last hop switch, it is sent to the INT server.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, and when the computer-executable instructions are loaded and executed by the processor, the programmable network-based anomaly detection and positioning method as described in any one of claims 1-6 is implemented.

Images