A programmable network-based anomaly detection and localization method, system, and medium

Abstract

The application discloses an abnormality detection positioning method and system based on a programmable network and a medium, and belongs to the technical field of data processing. The method comprises the following steps: S1, adding INT header information at an entry node, and passing a first data packet through an INT source switch to obtain a second data packet by adding an INT header label and a metadata field to the first data packet; S2, if an intermediate node is abnormal, adding abnormality information to the second data packet to obtain a third data packet and outputting the third data packet to a next-hop switch; S3, when a final data packet reaches a last-hop switch, using a Bloom filter to determine whether the final data packet needs to be sent to an INT server, and finally updating the Bloom filter; and S4, emptying the Bloom filter and a hash table of the switch after each detection period ends. Abnormality judgment and recording are performed on a data plane, so that the application can directly perform abnormality detection in the transmission process of a data stream, and thus the amount of data sent to the INT server is significantly reduced.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data processing, and in particular to an abnormality detection positioning method and system based on a programmable network and a medium. BACKGROUND

[0002] In a programmable network, the INT technology realizes the transparent transmission of detection information by adding telemetry data in the packet header. These data can completely cover the entire network path and eventually converge into the INT server at the exit, providing a basis for fine-grained performance detection. This technology significantly enhances the visibility of the network, enabling network administrators to gain detailed insights into the transmission path, delay, and packet loss of data packets, thus facilitating more precise abnormality detection. However, the INT technology causes significant additional overhead, including data plane overhead, i.e., the increase in data packet size hop by hop due to the carrying of measurement information; and control plane overhead, i.e., the overhead of sending INT information from programmable switches to the INT server. Therefore, how to reduce the additional overhead caused by the INT technology while maintaining its advantages is an important challenge currently faced by research.

[0003] To reduce telemetry overhead, sampling INT can be used to detect only a portion of the flow. INT sampling is performed at the network entry switch, and the sampling rate can be flexibly adjusted according to detection requirements. The entry switch adds an INT packet header to the sampled packets of a specific flow, and the intermediate nodes write measurement data into the data packets with the INT header, realizing detection only on the flow with the INT packet header. However, the sampling INT method cannot achieve detection of the performance of each data packet, resulting in reduced overall measurement accuracy. Another way to reduce telemetry overhead is to record abnormal information in the data plane and report it to the controller at the end of the receipt period. In the second method, the detection information in the data packet header does not increase hop by hop, reducing the data plane overhead, and the INT information of the data packet does not need to be sent to the INT server, reducing the control plane overhead. Related research uses sketch to record detection information in programmable switches to reduce additional overhead, but due to hash collisions, sketch inevitably produces recording errors, limiting detection accuracy. SUMMARY

[0004] The present application aims to overcome the shortcomings of the prior art and provide an abnormality detection positioning method and system based on a programmable network and a medium.

[0005] The purpose of the present application is achieved by the following technical solutions: The present application provides, in a first aspect, an abnormality detection positioning method based on a programmable network, comprising the following steps:

[0006] S1, adding INT header information at the ingress node, the first data packet passing through the INT source switch, the first data packet being added with an INT header label and a metadata field to obtain a second data packet, the metadata field including an INT source switch id and timestamp information;

[0007] S2, when the second data packet reaches the first switch, performing intermediate node anomaly judgment and recording to obtain a third data packet output to a next-hop switch; if there is an anomaly in the intermediate node, adding anomaly information to the second data packet to obtain the third data packet and outputting the third data packet to the next-hop switch;

[0008] S3, when the final data packet reaches the last-hop switch, using a Bloom filter to judge whether it needs to be sent to an INT server, and if so, sending the final data packet to the INT server; then judging whether there is an egress node anomaly according to timestamp information of the final data packet, and if so, recording; then judging whether telemetry data of the final data packet needs to be sent to the INT server, and if so, sending the telemetry data of the final data packet to the INT server; and finally updating the Bloom filter;

[0009] S4, after each detection period ends, emptying the Bloom filter and the hash table of the switch.

[0010] Preferably, the intermediate node anomaly judgment and recording further includes the following steps:

[0011] S21: the first switch reading last-hop timestamp information recorded in the second data packet;

[0012] S22: the first switch subtracting the last-hop timestamp information recorded in the second data packet from a current timestamp to obtain a current-hop delay; then comparing the current-hop delay with a preset threshold, and if the current-hop delay does not exceed the preset threshold, performing S23, and if the current-hop delay exceeds the preset threshold, performing S24;

[0013] S23: judging that the intermediate node is normal and updating intermediate node information to obtain the third data packet;

[0014] S24: judging that the intermediate node is abnormal, the first switch recording the first switch id and an abnormal delay using a hash table, and if there is a conflict in the hash table, performing S25, and if there is no conflict in the hash table, obtaining the third data packet;

[0015] S25: the first switch adding the switch id of the conflict and delay information of the switch id of the conflict to the second data packet to obtain the third data packet.

[0016] Preferably, when the final data packet passes through the egress node for forwarding processing, the INT header information and the telemetry data of the final data packet are deleted.

[0017] Preferably, when any of the ingress node, intermediate node, egress node fails to record the abnormal information, an update data packet is constructed and sent to the INT server, the update data packet having target data stream id information, switch id related to the abnormality, and target abnormality time delay information.

[0018] Preferably, the INT header label and metadata field are added between the IP layer and the transport layer of the first data packet and the IP layer protocol number is changed, and the original IP layer protocol number is retained to obtain the second data packet.

[0019] Preferably, detection is performed periodically, and in each detection period, the controller obtains hash table information of the programmable data plane and telemetry data received by the INT server; the Bloom filter records all data streams that need to be sent to the INT server; for abnormal data streams that are not recorded by the programmable data plane, the abnormal data streams are directly sent to the INT server; for abnormal data streams that are recorded by the programmable data plane, the abnormal data streams are not sent to the INT server; for data streams whose INT header field length is within a preset length, the data streams are recorded as normal data streams and are not sent to the INT server.

[0020] The second aspect of the application provides an abnormality detection and positioning system based on a programmable network, which is used to implement any of the above abnormality detection and positioning methods based on a programmable network, and comprises a programmable control plane connected to a programmable data plane; the programmable control plane comprises a controller and an INT server, the controller is used to issue routing instructions, and the INT server is used to receive telemetry data uploaded by each node in the programmable data plane and analyze the telemetry data to detect and locate abnormal conditions; each node in the programmable data plane is a programmable switch.

[0021] Preferably, the controller generates a routing path by obtaining global network topology information, and then obtains routing instructions and issues the routing instructions to each node in the programmable data plane.

[0022] Preferably, each node in the programmable data plane forwards the first data packet according to the routing instructions, and the programmable switch of each node measures the per-hop time delay of each data packet and judges whether there is abnormal information, and if there is abnormal information in the programmable data plane, the abnormal information is recorded, if a hash collision occurs during recording, the current abnormal information is added to the header of the current data packet and handed over to the next-hop switch for recording, and if the last-hop switch still cannot record the current abnormal information, the current abnormal information is sent to the INT server.

[0023] The third aspect of the present application provides a computer readable storage medium, wherein the computer readable storage medium stores computer executable instructions, and the computer executable instructions are loaded and executed by a processor to implement any of the abnormality detection and positioning methods based on programmable network.

[0024] The present application has the following advantages:

[0025] 1) The abnormality judgment and record are performed in the data plane, so that the present application can directly perform abnormality detection in the transmission process of the data flow, thereby significantly reducing the amount of data sent to the INT server. In addition, the present application fully utilizes the programmable characteristics of the data plane, and can utilize the storage resources downstream to record abnormality information when a conflict occurs. This innovative design not only improves the accuracy of abnormality detection, but also optimizes the utilization of network resources, thereby providing a new idea for constructing an efficient and reliable network abnormality detection system.

[0026] 2) The fat tree topology is built based on the Bmv2 and Mininet platforms, and it is verified through experiments that the present application has a significant advantage in terms of additional overhead compared with the traditional INT measurement technology. In the case of reasonable setting of the storage resources of the data plane, the present application can effectively record the abnormal flow information in the data plane, thereby greatly reducing the burden of network transmission and providing strong support for the improvement of network performance. BRIEF DESCRIPTION OF DRAWINGS

[0027] Figure 1 It is an abnormality detection and positioning method flowchart based on programmable network.

[0028] Figure 2 It is an abnormality judgment flowchart of the intermediate node.

[0029] Figure 3 It is a system block diagram of the abnormality detection and positioning system based on programmable network.

[0030] Figure 4 It is an INT-MD data packet format schematic diagram.

[0031] Figure 5 It is an entry node data processing schematic diagram.

[0032] Figure 6 It is an intermediate node data processing schematic diagram.

[0033] Figure 7 It is an exit node data processing schematic diagram.

[0034] Figure 8 It is an abnormality detection flowchart.

[0035] Figure 9 It is a data packet analysis flowchart.

[0036] Figure 10 Fig. 8 is a flowchart of a data packet reverse parsing process;

[0037] Figure 11 Fig. 9 is a schematic diagram of data packet header changes;

[0038] Figure 12 Fig. 10 is a schematic diagram of a fat-tree topology;

[0039] Figure 13 Fig. 11 is a schematic diagram of flow size distribution in a trace;

[0040] Figure 14 Fig. 12 is a schematic diagram of data plane detection proportion under different storage sizes;

[0041] Figure 15 Fig. 13 is a schematic diagram of FPR result analysis;

[0042] Figure 16 Fig. 14 is a schematic diagram of control plane overhead proportion under different storage sizes;

[0043] Figure 17 Fig. 15 is a schematic diagram of INT overhead analysis;

[0044] Figure 18 Fig. 16 is a comparison diagram of additional overheads. DETAILED DESCRIPTION

[0045] The technical solutions of the present application will be described clearly and completely below in conjunction with embodiments. Obviously, the described embodiments are only some of the embodiments of the present application, but not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0046] INT technology enables accurate measurement of hop-by-hop delay by embedding measurement information in the header of data packets, so that switches can collect and report relevant data of network status while forwarding data packets. However, according to the original design of INT technology, if the measurement information of each hop is attached to the data header and the abnormal information is sent to the INT server at the egress node, it will cause significant additional overhead and heavy burden on the INT server. The present application accurately records abnormal information in the data plane using a hash table, and adds abnormal information to the data packet when a hash collision occurs, which is delivered to the next hop switch for recording. The switches in the data plane record abnormal information to the best of their ability, and only when they cannot record, the information is reported to the INT server at the egress node for further processing. Specifically, for each data packet entering the network, the ingress node adds an INT header and timestamp information; the intermediate node obtains the hop-by-hop delay according to the timestamp information of the previous hop and the timestamp of the data packet arrival; if the delay value is greater than the threshold value, it is considered that an anomaly has occurred, and the intermediate node records the abnormal information; if a hash collision occurs during recording, the abnormal information is added to the packet header, and the recording task is delivered to the next hop; the egress node restores the data packet to the initial state, and delivers the abnormal information that cannot be recorded by the data plane to the INT server, thereby ensuring the recording of all abnormal information.

[0047] Referring to Figures 1-18 The present application provides an abnormality detection and positioning method based on a programmable network, comprising the following steps:

[0048] S1, adding INT header information at the ingress node, the first data packet passes through the INT source switch, the first data packet is labeled with the INT header and a metadata field to obtain a second data packet, the metadata field includes the INT source switch id and timestamp information;

[0049] S2, when the second data packet arrives at the first switch, intermediate node anomaly judgment and recording are performed to obtain a third data packet output to the next hop switch; if there is an anomaly in the intermediate node, the abnormal information is added to the second data packet to obtain the third data packet and output to the next hop switch;

[0050] S3, when the final data packet arrives at the last hop switch, it is judged whether it needs to be sent to the INT server using a Bloom filter, if it needs to be sent to the INT server, the final data packet is sent to the INT server; then it is judged whether there is an egress node anomaly according to the timestamp information of the final data packet, if there is an egress node anomaly, it is recorded; then it is judged whether the telemetry data of the final data packet needs to be sent to the INT server, if it needs to be sent to the INT server, the telemetry data of the final data packet is sent to the INT server; finally, the Bloom filter is updated;

[0051] S4, after each detection cycle, empty the Bloom filter and hash table of the switch.

[0052] In this embodiment, in order to accurately measure the hop-by-hop delay of data packets in the transmission process, the application designs an INT data packet structure as shown in the figure. Figure 4 It is worth noting that as the data packet is transmitted hop by hop in the network, the overhead of the INT metadata field will continue to increase, which undoubtedly puts a heavy burden on network resources. In order to effectively alleviate this problem, the application innovatively designs the INT data field to record the ID of the switch and the key timestamp information. Through this design, the application can significantly reduce the overhead of the INT metadata field while ensuring measurement accuracy, thereby optimizing the utilization efficiency of network resources. According to the protocol standard of the second version of INT, the application defines the format of the INT-MD metadata header and the metadata itself as shown in the figure. Figure 4 In the original INT design, the data packet increases a 4-byte or 8-byte metadata field every hop, but in this application, the length of the INT metadata field will not increase with the number of hops. The original INT technology adds a metadata field every other hop, and the lightweight INT of the application has an exception judgment process. Only when there is an exception, the exception information will be added to the packet header, so it will not cause the length of each INT metadata field to increase with the number of hops. Based on the IP protocol, the INT header is placed after the IP protocol header. The application focuses on the detection of IP flow in the exception detection process to ensure that the insertion of INT does not interfere with the normal processing flow of the IP layer. Strictly follow the existing INT specification to ensure compatibility with existing network architecture. When writing INT data into the data packet for the first time, we fill the PROTOCOL field in the IP header with INT TYPE to identify that the data packet uses INT technology. The first field of the INT header is INT OPTION. It contains two key information: one is the original value of the PROTOCOL field in the IP header, i.e. the OPTION field; the second is the number of INT data items. This design allows the application to restore the original IP packet field at the last hop of the data packet to ensure data integrity and accuracy. After the INT OPTION field, the application allocates a variable-length INT data stack to store specific INT data items in Figure 4 Each INT data item (INT) occupies 4B and contains switch ID and timestamp information. It is used for subsequent fault detection and positioning. The encapsulation and decapsulation of the INT header are performed in the network, so the INT protocol is transparent to the terminal host.

[0053] In order to realize the abnormal measurement based on the lightweight INT, the data packet needs to be processed differently in the telemetry system when entering the entry node, the intermediate node and the exit node. The entry node needs to add the INT header field and the first switch metadata, i.e. the switch id and the timestamp information, to the data packet. The intermediate node needs to make abnormal judgment and record the abnormality and handle the hash conflict. The exit node needs to record the telemetry information transmitted to the INT server by means of the Bloom filter in addition to the abnormal judgment and record. The entry node adds the INT header field and the metadata field to each data packet, as shown in Fig. 3. Figure 5 In addition, the protocol number of the IP layer is changed to the INT TYPE at the entry node. When the subsequent switch parses the INT TYPE, the INT header information is obtained. The original protocol number of the IP layer is reserved in the OPTION field of the INT header.

[0054] In some embodiments, the abnormal judgment and record of the intermediate node further include the following steps:

[0055] S21: The first switch reads the last hop timestamp information recorded in the second data packet;

[0056] S22: The first switch subtracts the current timestamp from the last hop timestamp information recorded in the second data packet to obtain the current hop delay. Then, the current hop delay is compared with the preset threshold. If the current hop delay does not exceed the preset threshold, S23 is performed. If the current hop delay exceeds the preset threshold, S24 is performed.

[0057] S23: The intermediate node is judged to be normal, and the intermediate node information is updated to obtain the third data packet.

[0058] S24: The intermediate node is judged to be abnormal. The first switch records the first switch id and the abnormal delay by using the hash table. If the hash table conflicts, S25 is performed. If the hash table does not conflict, the third data packet is obtained.

[0059] S25: The first switch adds the conflicting switch id and the delay information of the conflicting switch id to the second data packet to obtain the third data packet.

[0060] In this embodiment, at the intermediate node, the data is parsed to obtain the INT layer information, and the last hop timestamp information is used for abnormal judgment and record. When recording, hash conflict may occur. In this case, the abnormal information needs to be carried to the data header, and the recording task is handed over to the next hop switch. The specific process is shown in Algorithm 1.

[0061] Algorithm 1

[0062]

[0063] First, handle special cases by checking the hash table to see if the current flow has been recorded before. If it has, record it directly; otherwise, proceed with the next step. The switch obtains the timestamp of the data packet in the previous hop, subtracts it from the current local timestamp to get the hop-by-hop latency, compares it with this value, and checks if the latency is abnormal. If not, it directly updates the metadata field of the INT, indicating that the data packet is now in normal latency. Figure 6 As shown in the upper right corner; anomalies need to be recorded using a hash table. If no hash collision occurs during recording, the latency anomaly is recorded normally and the data packet is updated, as shown in the upper right corner of the figure. However, if a hash collision occurs, the anomaly information for this hop needs to be retained in the data packet header, and the timestamp information is updated to the latency information. At the same time, the timestamp information of the current switch is added for anomaly detection in the next hop, such as... Figure 6 As shown in the lower right corner. For each subsequent data packet, the above steps are repeated, and the hash table information is periodically retrieved and the hash table value is reset. For abnormal flows that have already been recorded, the current abnormality judgment is not performed, and the flow is directly recorded. The purpose of this is to completely record the latency information of all data packets in the abnormal flow, including abnormal latency information and normal latency information, thereby avoiding misjudgment. For example, after one cycle, the controller retrieves the switch's hash table and finds that only one data packet in the flow has an abnormal latency, while the latency of other data packets is normal. Then, it is very likely that the abnormality of the data packet is caused by link congestion. In addition, it is worth noting that in this invention, there may be a special scenario where the data packets received by the switch already contain abnormal information that was not recorded in the previous hop. In this case, these existing abnormal information are processed first. Specifically, when using the hash table for recording, if no hash collision occurs, the recording is performed normally; if a collision occurs, the abnormal information is retained and left for the next hop switch to process. At the same time, consider an extreme case, that is, all the switch hash tables in the data plane cannot record the abnormality of a certain hop. In this case, the scheme design sends the relevant abnormal information to the INT server for processing. This function is mainly undertaken by the exit node. By properly handling these special scenarios and extreme situations, the integrity and accuracy of network anomaly information can be ensured, providing strong support for subsequent troubleshooting and performance optimization.

[0064] In some embodiments, after the final data packet has been forwarded by the egress node, the INT header information and telemetry data of the final data packet are deleted.

[0065] In this embodiment, through the analysis of the intermediate node anomaly detection process, it is known that if a hash collision occurs, the record task will be passed to the next hop switch for processing. If all intermediate nodes cannot complete the record task, the final record task will be handed over to the egress node. However, even in the egress node, the risk of hash collision still exists, which may cause part of the abnormal information to be unable to be effectively recorded in the data plane. In order to cope with this challenge, it is necessary to transmit the unrecorded abnormal information to the INT server for further processing after the egress node. In addition, in order to comprehensively record the normal and abnormal information of the abnormal flow, such as Figure 7 The present scheme designs a Bloom filter at the egress node. The filter can effectively record the relevant information of the abnormal flow, ensure the integrity and accuracy of the data, and provide strong support for subsequent analysis and processing. The specific process of the INT egress node anomaly detection is introduced below through Algorithm 2.

[0066] Algorithm 2

[0067]

[0068] As shown in Algorithm 2, the egress node first judges and processes special cases, that is, judges whether the flow has been sent to the INT server or has been recorded by the hash table. Through the Bloom filter detection, if the flow has been sent to the INT server, the current INT information is directly sent; in addition, if the flow has been recorded by the hash table, the current time delay information is directly recorded by the hash table, and hash collision will not occur. If the abnormality of the flow occurs for the first time, that is, the Bloom filter and the hash table do not record the flow, the following steps are executed to judge whether to record. First, it is judged whether there is information in the packet header that has not been recorded before. If there is, and hash collision occurs when the egress node tries to record, the INT server needs to be sent, and the Bloom filter needs to be updated to record the information of the flow; secondly, it is judged whether the current hop is abnormal. If abnormal, record, if hash collision occurs when recording, also need to send to the INT server, and update the Bloom filter, if it is judged that no abnormality occurs, the data packet is directly restored to the original state. For each subsequent data packet, the above algorithm is executed, and the controller periodically acquires the hash table information, the Bloom filter information and resets. As described in Algorithm 2, the egress node will generate a new packet due to the hash collision problem, and inform the INT server of the INT information. As shown in Figure 7 The original packet will be restored to the initial state, and only the original packet header information and the payload part are retained.

[0069] In some embodiments, when any of the ingress node, intermediate node, egress node fails to record abnormal information, an update data packet is constructed and sent to the INT server, the update data packet having target data stream id information, switch id related to the abnormality, and target abnormal delay information.

[0070] In some embodiments, the INT header tag and metadata field are added between the IP layer and the transport layer of the first data packet and change the IP layer protocol number, and the original IP layer protocol number is retained to obtain the second data packet.

[0071] In some embodiments, periodic detection is performed, and in each detection period, the controller acquires hash table information of the programmable data plane and telemetry data received by the INT server; a Bloom filter records all data streams that need to be sent to the INT server; for abnormal data streams not recorded by the programmable data plane, the abnormal data streams are directly sent to the INT server; for abnormal data streams recorded by the programmable data plane, the abnormal data streams are not sent to the INT server; and for data streams whose INT header field length is within a preset length, the data streams are recorded as normal data streams and are not sent to the INT server.

[0072] In this embodiment, as shown in Algorithm 3, the present embodiment performs periodic detection mechanism, and in each detection period, the controller can acquire abnormal data from two key components, i.e., hash table information of the data plane and telemetry data received by the INT server. For abnormal streams detected by the data plane, we can acquire accurate information including five-tuple information of the abnormal stream, abnormal occurrence position, abnormal data packet quantity, abnormal total delay, and normal data packet quantity and normal total delay. Since the data plane judges the abnormality based on accurate delay information and can clearly record normal delay and abnormal delay of the abnormal stream, the data plane can record accurate abnormal information.

[0073] In the processing of the received flows in the INT server, we use a Bloom filter to record all the flows that have been sent to the INT server at the last hop. The use of the Bloom filter can result in the following three flow recording cases: (1) abnormal flows that are not recorded by the data plane, such as flows that need to be correctly sent to the INT server for further processing; (2) abnormal flows that are recorded by the data plane, which can be incorrectly sent to the INT server again due to the false positive characteristics of the Bloom filter; (3) normal flows that do not occur abnormally, which can also be incorrectly sent to the INT server due to the false positive of the Bloom filter. In cases (2) and (3), although the INT server can receive incorrect abnormal flow information, in subsequent in-depth analysis, packet header information can be used to accurately distinguish between correct and incorrect information. For case (2), since the data plane has recorded its abnormal information, by checking the hash table, it can be easily determined whether the flow is abnormal. In addition, all flows that need to be sent to the INT server, in addition to containing the necessary information of the INT host, are additionally attached with the previous abnormal information, resulting in the INT header field length of these flows to be increased compared to normal flows. Based on this feature, the present application can effectively identify case (3). Therefore, the controller can accurately identify all abnormal flows, thereby ensuring the accuracy of abnormal detection and processing.

[0074] Algorithm 3

[0075]

[0076] A specific embodiment of the method of the present application is given below, and the overall flow is as follows Figure 8The forwarding path of service flow f1 is node 1, 5, 4, 6, 7, and the forwarding path of service flow f2 is node 1, 2, 3, 7. Service flow f1 is a normal service flow, and service flow f2 is an abnormal service flow, and a delay abnormality occurs when it is transmitted from node 1 to node 2. Therefore, the detection target of the embodiment is to record the flow information of service flow f2, the abnormal switch, and the abnormal delay information. It includes four steps: (1) The entry node adds an INT, and the data packet passes through the INT source switch, the switch adds an INT header label, and adds a metadata field, i.e., the switch ID and the timestamp information. As shown in the figure, after service flows f1 and f2 pass through node 1, the INT header is added, and the switch ID sl and the timestamp time1 of node 1 are added. (2) The intermediate node judges and records the abnormality. When the data packet arrives at the next hop switch, the switch first reads the last hop timestamp information recorded on the data packet. Then, the switch subtracts the current timestamp from the timestamp in the data packet to calculate the delay of the current hop. Next, the calculated delay is compared with the preset threshold value. If the delay exceeds the value, it is determined to be abnormal, and at this time, the switch internally records the ID of the current switch and the corresponding abnormal delay by using a hash table. If the delay does not exceed the threshold value, it is determined to be normal, and no abnormality processing is performed. In addition, in the process of recording the abnormal flow information, if a hash table collision occurs, the switch will add the switch ID and the corresponding delay information of the collision to the data packet, and pass the data packet to the next hop switch, so that the subsequent switch can continue to record the abnormal information. In the normal transmission process of service flow f1, when the data packet arrives at node 2, it is determined that no abnormality occurs after the abnormality detection. Then, node 2 updates the switch ID and timestamp information in the INT header to the ID and current timestamp of node 2 itself. Then, service flow f1 continues to pass through node 4 and node 6, and also passes through the abnormality detection and no abnormality is found, and node 4 and node 6 will repeat the above step of updating the INT header information. For service flow f2, when the data packet arrives at node 2, the detection mechanism finds that the delay exceeds the preset threshold value, so it is determined that service flow f2 has an abnormality in the transmission process from node 1 to node 2. Node 2 encounters a hash collision when trying to record the abnormal information, at this time, node 2 adds the abnormal information to the packet header of the data packet, i.e., updates the time1 field to delay1, and adds the switch ID and current timestamp information of node 2. As service flow f2 continues to be transmitted to node 3, node 3 again tries to record the abnormal information. If no hash collision occurs at this time, node 3 records the abnormal information locally. In this way, even in the case of hash collision, the abnormal information can be ensured to be completely transmitted and recorded, which provides key data for subsequent analysis and processing.(3) The export node records and sends the abnormal information to the INT server. For the last hop switch, this paper first uses the Bloom filter to determine whether it needs to be sent to the INT server. Then, the time stamp information is used to determine whether it is abnormal. If it is abnormal, it is recorded. Finally, it is determined whether the telemetry data of the data packet needs to be sent to the INT server, and the Bloom filter is updated. After the forwarding processing of the node 7, the service streams f1 and f2 will delete the INT header and the related telemetry data information, so as to restore the data packet to the original transmission state. In particular, for the service stream f2, if any one of the nodes 1, 2, 3 and 7 encounters a record failure when attempting to record abnormal information, a new data packet needs to be constructed and sent to the INT server. The newly constructed data packet will contain the stream ID information, the switch ID related to the abnormality and the specific delay information, so as to provide the INT server for subsequent analysis and processing.

[0077] The second aspect of the present application provides: an abnormality detection and positioning system based on a programmable network, which is used to implement any one of the above-mentioned abnormality detection and positioning methods based on a programmable network, comprising: a programmable control plane connected to a programmable data plane; the programmable control plane comprises a controller and an INT server, the controller is used to issue routing instructions, and the INT server is used to receive the telemetry data uploaded by each node in the programmable data plane and analyze the telemetry data to detect and locate abnormal conditions; each node in the programmable data plane is a programmable switch.

[0078] In some embodiments, the controller generates a routing path by obtaining global network topology information, thereby obtaining routing instructions and issuing them to each node in the programmable data plane.

[0079] In some embodiments, each node in the programmable data plane forwards the first data packet according to the routing instructions, while the programmable switch of each node measures the per-hop delay of each hop of the data packet and judges whether there is abnormal information. If there is abnormal information in the programmable data plane, the abnormal information is recorded. If a hash collision occurs during recording, the current abnormal information is added to the header of the current data packet and handed over to the next hop switch for recording. If the last hop switch still cannot record the current abnormal information, it is sent to the INT server.

[0080] In this embodiment, the framework of the system is composed of two core components of the programmable control plane and the data plane, as shown in Figure 3As shown in the control plane, it mainly includes two modules, the controller and the INT server. The main responsibility of the controller is to issue routing instructions to ensure that the data packets in the network can be transmitted according to the predetermined path. The INT server is responsible for collecting the measurement data uploaded from each node in the data plane, and conducting in-depth analysis on these data to detect and locate the abnormal situation in the network. In the data plane, each node is designed as a programmable switch, which supports the INT function and has the ability of data measurement. In particular, as shown in the figure, the last hop switch of each data flow is responsible for uploading the collected telemetry data to the INT server. Specifically, the workflow of the system can be divided into the following steps: Figure 3

[0081] In the initialization phase of the system, the controller first obtains the global network topology information, and generates the corresponding routing path accordingly. Subsequently, the controller issues these routing paths to the programmable switches in the form of flow tables to ensure the correct forwarding of data flow.

[0082] Next, in the data plane, the switch is responsible for normal forwarding of service flow according to the flow table. At the same time, the switch measures the per-hop delay of each hop of the data packet, and judges whether there is an abnormality based on these measurement data. Once an abnormality is detected, the data plane will record the corresponding service flow abnormal information. If a hash conflict occurs when recording, the abnormal information will be added to the data packet header for the next hop switch to record. For the abnormal information that the data plane cannot record, the last hop switch will send it to the INT server.

[0083] Finally, the INT server is responsible for collecting the INT measurement data from the data plane, and periodically obtaining the abnormal information from the data plane. Through the analysis of these data, the INT server can detect and locate the abnormal situation in the network, thereby providing strong decision support for network administrators.

[0084] The INT field is composed of the INT OPTION part and the INT DATA part. Specifically, the INT OPTION part contains the option field and the INT num field, while the INT DATA part covers the switchID field and the timestamp information. As shown in Table 1, these fields have specific structure and function, and the source and function of each field will be described in detail below.

[0085] Table 1

[0086]

[0087] ​The option field records the PROTOCAL information of the original IP data header. When the switch receives the data packet, it will determine whether it is the INT protocol through the PROTOCAL field of the IP data header, that is, the original protocol information will be covered, so the option field is needed to retain the original information, and the original field information is restored at the last hop in the data packet transmission process to ensure the integrity and accuracy of the data. Therefore, the length of the option field is the same as the length of the PROTOCAL field of the IP data header.

[0088] The INT_num field records the number of reserved INT DATA information. When the data packet is abnormal and the record occurs hash conflict, the current exception is reserved to the next hop for recording, and the value of INT_num is increased by 1 based on the original value. When there is no hash conflict, the value of INT_num is 1. In the analysis stage of the data packet, the value of INT_num is used to determine whether the INT DATA part is parsed. In experimental simulation, 8 bits are allocated, which can meet the detection requirements in experiments. In actual application, this allocation can be customized according to the actual network size to meet the needs of different scenarios.

[0089] The Switch ID field represents the switch ID, which is informed to the switch by the controller through the form of flow table downlink, and is written into the data packet by matching and executing related actions through the flow table. Similarly, 8 bits can meet the detection requirements in experiments, and in actual application, it can be customized according to the actual network size.

[0090] The timestamp, i.e. time stamp information, is important information for data packet exception judgment. In the v1model structure of P4, standard_metadata_t provides key information for data packet processing, including two important information about timestamp, ingress_global_timestamp and egress_global_timestamp. These two fields are counted in microseconds and represent the time points when the data packet enters the ingress stage and egress stage, respectively, and are represented in 48 bits. In implementation, the scheme uses ingress_global_timestamp to represent the time when the data packet arrives at the switch. In addition, since the data exception judgment can meet the demand in millisecond level, only the last 24 bits of the value are extracted in actual application, so as to realize effective compression and efficient processing of data while ensuring sufficient accuracy.

[0091] In the P4 vlmodel architecture, the clone_preserving_field_list function can be used to clone the original data packet. For the cloned data packet, the Ethernet layer header information is retained, and the flow ID information and the INT information are appended after the Ethernet layer header.

[0092] When the data packet arrives at the P4 target machine, it successively passes through the parser, the ingress matching action pipeline, the egress matching action pipeline and the reverse parser. Next, the detailed processing process of the data packet in the parser, the ingress matching action pipeline, the egress action matching pipeline and the reverse parser will be described in detail.(1) Parsing stage, after the data packet enters the switch, it needs to go through the processes of parsing, matching processing and reverse parsing. Among them, the parsing field obtains the packet header information, and the reverse parsing field recombines the packet header. In the present scheme, the INT in-band telemetry needs to be implemented in the data plane of P4, so in the parsing and reverse parsing processes, the INT field needs to be processed additionally. The parsing process is as shown in Figure 9 Fig. 1. For the received data packet, the Ethernet packet header field is parsed first, that is, the field information of the Ethernet packet header can be obtained; according to the type of the Ethermet data packet, the IPv4 header is further parsed, the type of the IPv4 data packet is judged, if the type = INT_TYPE, it is considered to be the TNT message; according to the option field of the INT, the TCP or UDP is parsed. Among them, when parsing the INT message, since the INT may carry the switch information, the INT DATA part needs to be parsed multiple times according to the INT_num field.

[0093] (2) Ingress action matching pipeline processing, the ingress action matching pipeline mainly undertakes the tasks of forwarding the normal service flow and detecting and recording the abnormal flow. The core matching table and action details involved are as shown in Table 2. The ipv4_lpm_table is used for the routing selection of the normal service flow. Specifically, the matching key value in the table is hdr.ipv4.dstAddr (i.e. the destination IP address of the IPv4 in the packet header), once the corresponding rule is matched, the system will execute the set_nhop (select next hop) action, which is the standard_metadata.egress_spec field assignment, and then control the data packet to be transmitted out from the specified port. In addition, the action also makes necessary modifications to the MAC address, TTL (time to live) and other information in the IPv4 packet header, so as to ensure that the data packet can correctly and efficiently reach the destination address.

[0094] Table 2

[0095]

[0096] The add_int_table is responsible for adding the current switchID and abnormal delay information in the packet header when a hash collision occurs. This table uses a design without matching key values, and when a matching item is not found in the table, the add_int action will be executed. In this action, the parameter switchID is passed in by the control plane, and the abnormal delay information is obtained by calculating the difference between the current timestamp ingress_global_timestamp and the last hop timestamp in the packet header. This mechanism ensures that the packet can carry abnormal information in the header when a hash collision occurs, to support subsequent processing and abnormal analysis.

[0097] The update_int_tablee is responsible for updating the INT field information in the packet header. Whenever a data packet passes through a switch, this table is responsible for updating the switchID and timestamp information in the header INT. Similar to the add_int_table matching table, the switchID parameter is provided by the control plane, and the timestamp uses the ingress_global_timestamp field value of the standard_metadata in the current switch. The updated information will be passed to the next hop switch with the data packet, for subsequent abnormal detection and judgment.

[0098] The entry action matching pipeline contains three main actions: hash_collision_flag, hash_normal, and hash_abnormal. The hash_collision_flag action is responsible for detecting whether a hash collision has occurred. Once a hash collision is detected, the system will execute the add_int_table matching table to add the necessary switchID and abnormal delay information in the packet header. If no hash collision occurs, the system will further perform abnormal judgment. If a delay anomaly is detected, the hash_abnormal action will be executed, which will record the delay and number information of the abnormal data packets of the abnormal flow in the hash table. Conversely, if no anomaly is detected, the hash_normal action will be executed to record the delay and number information of the normal data packets of the abnormal flow in the hash table. This series of actions ensures efficient processing and accurate monitoring of data packets in the network.

[0099] (3) The processing of the exit action matching pipeline. In the implementation process, the functions of anomaly detection and anomaly record are realized in the entry action matching pipeline. Therefore, the exit action matching pipeline of the entry node and the intermediate node does not need to be additionally provided with functions to support this mechanism. However, for the exit node, since it undertakes the responsibility of feeding back the unrecorded anomaly information to the controller, additional processing steps need to be added in the exit action matching pipeline to ensure the effective transmission and proper processing of the anomaly information. In the exit action matching pipeline of the exit node, according to the value of standard_metadata.instance_type, if it is judged to be 1, it indicates that the current packet is a cloned packet, and the five-tuple information and the INT information of the reserved flow are sent to the INT server, as shown in Table 3. In the implementation, in the exit matching stage, the Ethernet layer, IP layer and UDP layer information are all set to be illegal by the method setlnvalid(). Therefore, in the reverse analysis stage, the illegal header information will not be added.

[0100] Table 3

[0101]

[0102] (4) The reverse analysis stage. The reverse analysis process is shown in Figure 10 . In the reverse analysis process, the processing logic of the INT field also needs to be added. The transport layer, INT, IP layer and Ethernet header are added on the payload in sequence. After the packet is analyzed by the reverse analysis, it leaves the current switch. It needs to be noted that in the overall implementation of the INT, the header field of the packet will change after it passes through the source node, the intermediate node and the exit node. Specifically, the source node needs to add the INT header and the metadata information to the packet, as shown in Figure 11 (a). The data of the INT is behind the Ethernet layer and the IP layer. For the intermediate node, the metadata information of the INT needs to be updated, as shown in Figure 11 (b). For the exit node, the packet is restored to the original data and does not contain any INT information.

[0103] The third aspect of the present application provides a computer readable storage medium, wherein the computer readable storage medium stores computer executable instructions, and when the computer executable instructions are loaded and executed by a processor, the above-mentioned any one of the anomaly detection and positioning methods based on a programmable network is realized.

[0104] The advantages of the present application compared with the prior art are verified by the simulation test. First, a simulation test platform is built as Figure 12The fat tree topology shown, set the topology pod for 4, the I of host h1-h16 in the topology is 10.13.1.2-10.13.1.17, each access layer switch is connected with two hosts, and the hosts act as servers in the network. In addition, it is worth noting that all the switches of the access layer can act as the egress node in the INT architecture, therefore, in order to support this function, all the access layer switches are connected with a special server together to act as the role of the INT server. The experiment judges whether the abnormality occurs according to the hop-by-hop delay of the data packet in the network, in order to realize the abnormal data packet, a certain flag bit in the header field is used to indicate the current data packet is abnormal, and the switch obtains and records the abnormal delay through the flag bit. In addition, in practical application, the threshold value of delay abnormality can be obtained according to the experience value, before constructing the abnormal scene, the normal delay of each hop is obtained through the normal flow in the network, and on this basis, the experimental value is set.

[0105] The scheme involves two data structures of Bloom filter and hash table, and needs to be designed according to the demand. First, the memory size m and the number of hash functions k of the Bloom filter are considered to be set, when the error rate is given, it can be determined by the following formula:

[0106]

[0107] Wherein, n represents the number of service flows in the network. The parameter values are obtained as shown in Table 4 when the experimental error rate p=0.01 is set.

[0108] Table 4

[0109]

[0110] In the experiment, the detection of abnormal flow is set in the background of 100000 service flows. The real data set downloaded by CAIDA is adopted, the trace contains 100000 service flows, including about 800000 data packets, and the specific flow size distribution of the trace is shown as Figure 13

[0111] The application is dedicated to realizing the recording of all abnormal flows by the data plane. When the data plane cannot record specific abnormal flow information due to storage resource limitation or hash conflict, the information is transferred to the INT server for processing. In view of the limited storage resources of the data plane and the possible conflict caused by the hash table setting, different sizes of hash table storage resources are configured for the switch in the experiment, and the specific configuration mode is shown as Figure 14 In order to further explore the influence of different configurations on the abnormal flow detection performance, a series of experiments are carried out by setting different numbers of abnormal flows, as shown in Figure 14 ​The experimental results show that, with the number of abnormal flows remaining unchanged, the number of abnormal flows recorded by the data plane shows a significant growth trend as the hash table resources allocated to the data plane gradually increase. In particular, in the case of sufficient hash table resources, such as the 90KB memory size configuration in the figure, when the number of abnormal flows is small, almost all abnormal flows can be recorded by the data plane; even in the case of gradually increasing number of abnormal flows, more than 90% of the abnormal flows are successfully recorded by the data plane. This result fully shows that for abnormal flows in the network, the data plane will do its best to record, thereby effectively reducing the processing pressure of the INT server and improving the efficiency of the entire system for detecting and processing abnormal flows.

[0112] In addition, since the Bloom filter is introduced by the egress node of the last hop, it inevitably leads to a certain false detection rate, i.e., misjudging normal flows as abnormal flows. Although the INT server can accurately identify abnormal flows in the data analysis stage, this false detection phenomenon still causes unnecessary waste of INT resources. Therefore, this subsection conducts experimental analysis. The false detection rate is defined as: n_int / N, where n_int represents the abnormal flows incorrectly received by the INT server, and N represents the total number of abnormal flows. It should be noted that the false detection rate index here is not FPR, but a special index for measuring false detection. For example, Figure 15 As shown in (a), the data plane detection FPR value is 0 in most cases, and the maximum value reaches 0.001. The data plane is responsible for recording the five-tuple information and delay data of abnormal flows, and when the network state changes, the delay of normal flows will also be adjusted accordingly. However, when the delay of a normal flow data packet suddenly changes, it may be misjudged and incorrectly recorded as an abnormal flow. However, since the switch can record the number of normal data packets in abnormal flows, the number of normal total delay abnormal data packets, and the number of abnormal total delay, the control end can further analyze when obtaining these abnormal information to improve the accuracy of abnormal detection. As shown in Figure 15 (b), the false detection rate of the INT server is 0 in most cases, but false detection occurs when processing 4000 and 5000 abnormal flows. With the increase in the number of abnormal data packets, more abnormal information is sent to the INT server for processing, and at the same time, the flow information recorded by the egress node using the Bloom filter also gradually increases, which increases the possibility of incorrect recording. It should be noted that although the INT server will receive incorrect abnormal flows, in combination with the data plane abnormal information and data packet information, the abnormal flow can be accurately judged.

[0113] When the data plane records the exception information of the exception flow, the number of exception flows received by the INT server will be greatly reduced. Especially when such flows belong to the category of large flows, i.e. the number of data packets is large and the duration is long, the processing pressure of the INT server will be significantly reduced, thereby improving the performance and stability of the entire system. Therefore, the effect of the present scheme on reducing the pressure of the INT server is analyzed next. For the INT server, each received data packet needs to consume corresponding storage and computing resources to process the data packet, so the proportion of the number of exception data packets received by the INT server to the total number of exception data packets is taken as a measurement index in the analysis. In the experiment, the influence of different numbers of exception flows and different memory sizes on the pressure of the INT server is also recorded, as shown in the following table: Figure 16 It can be seen that as the memory size increases, the number of data packets received by the INT server gradually decreases. When the allocated memory size is 90KB, the INT server receives less than 10% of the exception data packets, effectively reducing the collection pressure of the INT server. In addition, as the number of exception flows increases, under the same memory size, due to the limited storage resources of the data plane, more exception flows cannot be recorded, resulting in an increase in the number of exception data packets received by the INT server, which is consistent with the result of Figure 14 .

[0114] The original INT technology adds a metadata field every hop, and the lightweight INT of the present application has an exception judgment process compared with the original INT. Only the information of the existing exception is added in the packet header. First, define the additional overhead O as follows: Wherein, L represents the number of links passed by the data packet in the network, and represents the number of additional bytes carried by the data packet on the ith link due to network measurement. In the traditional INT measurement, Wherein, p represents the fixed INT header overhead, and the present application is designed as p=2, q represents the length of the metadata field that needs to be added every hop in the traditional network, which is generally a multiple of 4 bytes or 8 bytes, and is set as q=4. Therefore, the overhead of the traditional INT network is:

[0115] .

[0116] Next, we consider different scenarios to analyze the additional overhead of our scheme respectively. As shown in Figure 17 , the data packet passes through the switches s1→s2→s3→s4 in turn, i.e. s is the entry node, s2, s3 is the intermediate node, and s4 is the exit node. Figure 17In case one and two, the data packet passes through s1→s2→s3→s4 in turn, and no time delay anomaly occurs at each hop or the anomaly is recorded without collision. Therefore, the data packet carries the timestamp of s1 when it is transmitted from s1, and the timestamp of s2 is directly overwritten. Similarly, the data packet carries the timestamp of s3 when it is transmitted from s3. In this case, the data packet at each hop only needs to carry the INT header and the metadata information of one hop, i.e., 6 bytes of data are additionally carried at each hop, which is the most ideal anomaly overhead. Case three indicates that the data packet has an anomaly when it is transmitted from s1→s2, and a hash collision occurs when the anomaly is recorded. Therefore, s2 needs to additionally add the anomaly information of the previous hop, and the anomaly information is normally recorded by s3 when it arrives at s3. Case four considers the worst case, i.e., the data packet has an anomaly at each hop during transmission, and a hash collision occurs when the anomaly is recorded. In this case, the additional overhead is: It should be noted that in the worst case, the present application considers that the data packet encounters an anomaly at each hop during transmission, and a hash collision occurs when the anomaly is recorded. Although this extreme case is theoretically possible for a single data stream, considering the overall situation of all streams in the entire network environment, since the corresponding storage resources have been allocated for recording anomaly information, it is impossible for all streams to encounter the worst case at the same time. Further, under the premise of reasonable resource allocation, by implementing effective optimization measures, the additional overhead of the scheme proposed by the present application can be minimized, thereby ensuring the reliability of data transmission while minimizing the consumption of system resources.

[0117] In the present application, the data plane records anomaly flow information in detail, and the information is passed to the next switch for further processing in case of a hash collision. During the entire process, the data plane continues to record as much as possible, and if it is indeed impossible to record, the information is transferred to the INT server. To verify the performance of the data plane overhead of the present scheme, different sizes of hash table memories are allocated to the data plane, and experiments are performed under different sizes of anomaly flow numbers, as shown in Figure 18 When the number of entries in the hash table of the switch is relatively small but the number of anomaly flows is large, for example, in the case of 2000, 3000, and 4000 anomaly flows, and the memory sizes are 3KB, 6KB, and 15KB, since the data plane can only record a small amount of anomaly flow information, the additional overhead of the present application is similar to that of the existing INT algorithm. However, when the memory size increases to 30KB, 60KB, and 90KB, most of the anomaly flow information can be effectively recorded by the data plane, and the additional overhead of the present application is significantly smaller than that of the existing INT algorithm.

[0118] The foregoing is considered as illustrative only of the principles of the application. Further, since numerous modifications and changes will readily occur to those skilled in the art, it is not desired to limit the application to the exact construction and operation described. Accordingly, all such variations are intended to be included within the scope of the present application as defined in the claims below and their equivalents.

Claims

1. A programmable network based anomaly detection localization method, characterized in that: The method comprises the following steps: S1, adding INT header information at an entry node, the first data packet passing through an INT source switch, the first data packet being added with an INT header label and a metadata field to obtain a second data packet, the metadata field comprising an INT source switch id and timestamp information; S2, when the second data packet reaches a first switch, performing intermediate node anomaly judgment and recording to obtain a third data packet output to a next-hop switch; if there is an anomaly in the intermediate node, adding anomaly information to the second data packet to obtain the third data packet and outputting the third data packet to the next-hop switch; the intermediate node anomaly judgment and recording further comprises the following steps: S21, the first switch reading last-hop timestamp information recorded in the second data packet; S22, the first switch subtracting a current timestamp from the last-hop timestamp information recorded in the second data packet to obtain a current-hop delay; then comparing the current-hop delay with a preset threshold, if the current-hop delay does not exceed the preset threshold, performing S23, if the current-hop delay exceeds the preset threshold, performing S24; S23, judging that the intermediate node is normal and updating intermediate node information to obtain the third data packet; S24, judging that the intermediate node is abnormal, the first switch recording the first switch id and an abnormal delay using a hash table, if there is a conflict in the hash table, performing S25, if there is no conflict in the hash table, obtaining the third data packet; S25, the first switch adding the switch id in conflict and the time delay information of the switch id in conflict to the second data packet to obtain the third data packet; S3, when the final data packet reaches a last-hop switch, using a Bloom filter to judge whether it needs to be sent to an INT server, if it needs to be sent to the INT server, sending the final data packet to the INT server; then judging whether there is an egress node anomaly according to timestamp information of the final data packet, if there is an egress node anomaly, recording; then judging whether telemetry data of the final data packet needs to be sent to the INT server, if it needs to be sent to the INT server, sending the telemetry data of the final data packet to the INT server; finally updating the Bloom filter; when any of the entry node, the intermediate node and the egress node fails to record anomaly information, an update data packet is constructed and sent to the INT server, the update data packet having target data stream id information, switch id involved in anomaly and target anomaly time delay information S4, after each detection period ends, clearing the Bloom filter and the hash table of the switch; Periodically detecting, in each detection period, the controller acquiring hash table information of a programmable data plane and telemetry data received by the INT server; the Bloom filter recording all data streams that need to be sent to the INT server, for an abnormal data stream not recorded by the programmable data plane, directly sending the abnormal data stream to the INT server; for an abnormal data stream recorded by the programmable data plane, not sending the abnormal data stream to the INT server; for a data stream with a length of the INT header field within a preset length, recording the data stream as a normal data stream and not sending the normal data stream to the INT server.

2. The programmable network based anomaly detection localization method of claim 1, wherein: After the final data packet passes through the forwarding processing of the egress node, deleting INT header information and telemetry data of the final data packet.

3. The programmable network based anomaly detection localization method of claim 1, wherein: The INT header label and the metadata field are added between the IP layer and the transport layer of the first data packet and change the IP layer protocol number, and the original IP layer protocol number is reserved to obtain a second data packet.

4. A programmable network based anomaly detection positioning system, characterized by: The programmable network-based anomaly detection and positioning method according to any one of claims 1-3 comprises a programmable control plane connected to a programmable data plane; the programmable control plane comprises a controller configured to issue routing instructions and an INT server configured to receive telemetry data uploaded by each node in the programmable data plane and analyze the telemetry data to detect and locate anomalies; each node in the programmable data plane is a programmable switch.

5. The programmable network-based anomaly detection and localization system of claim 4, wherein: The controller generates routing paths by obtaining global network topology information, thereby obtaining routing instructions and issuing the routing instructions to each node in the programmable data plane.

6. The programmable network-based anomaly detection and localization system of claim 4, wherein: Each node in the programmable data plane forwards the first data packet according to the routing instructions, and the programmable switch of each node measures the hop-by-hop delay of each hop of the data packet and determines whether there is abnormal information; if there is abnormal information in the programmable data plane, the abnormal information is recorded; if a hash collision occurs when recording, the current abnormal information is added to the header of the current data packet and handed over to the next hop switch for recording; if the last hop switch still cannot record the current abnormal information, the current abnormal information is sent to the INT server.

7. A computer-readable storage medium, characterized in that: The computer readable storage medium stores computer executable instructions, and when the computer executable instructions are loaded and executed by the processor, the programmable network-based anomaly detection and positioning method according to any one of claims 1-3 is implemented.

Images