Method and device for adjusting network configuration, equipment and storage medium

Abstract

The embodiment of the invention provides a method and device for adjusting network configuration, equipment and a storage medium. In the method, a first traffic set which does not meet a predetermined condition is determined based on an original configuration for a network. Each traffic in the first set of traffic is associated with a plurality of network events. In the method, a target configuration item to be adjusted is determined from each configuration item in original configuration based on a corresponding relationship between a plurality of network events and each configuration item in the original configuration. In the method, a candidate adjustment scheme corresponding to a target configuration item is obtained. In the method, an updated configuration for the network is also determined by adjusting the target configuration item using the candidate adjustment scheme. In this way, by locating errors in the network configuration and determining the updated configuration of the network, automatic adjustment of the network configuration can be achieved, and therefore the adjustment efficiency of the network configuration is improved.

Description

Technical Field

[0001] Example embodiments of the present disclosure generally relate to the field of computer technology, and more particularly, to a method, apparatus, device, and computer-readable storage medium for adjusting network configuration. Background Art

[0002] With the rapid development of computer technology, the demand for network usage is increasing. If a network accident occurs, it may have a long-term and wide-ranging impact, causing serious economic losses. The causes of network accidents include configuration errors, software vulnerabilities, and hardware failures, among which network configuration errors are an important cause. Therefore, it is necessary to detect and resolve errors in network configuration, thereby improving network reliability. Summary of the invention

[0003] In a first aspect of the present disclosure, a method for adjusting network configuration is provided. The method includes: based on an original configuration for the network, determining a first traffic set that does not meet a predetermined condition, each traffic in the first traffic set being associated with a plurality of network events; based on a correspondence between the plurality of network events and each configuration item in the original configuration, determining a target configuration item to be adjusted from each configuration item in the original configuration; obtaining a candidate adjustment scheme corresponding to the target configuration item; and determining an updated configuration for the network by adjusting the target configuration item using the candidate adjustment scheme.

[0004] In a second aspect of the present disclosure, a device for adjusting network configuration is provided. The device includes: a verification module configured to determine traffic that does not meet a predetermined condition in the original configuration of the network, the traffic being associated with multiple network events; a positioning module configured to determine a target configuration item to be adjusted from each configuration item in the original configuration based on a correspondence between multiple network events and each configuration item in the original configuration; an acquisition module configured to acquire a candidate adjustment scheme corresponding to the target configuration item; and a determination module configured to determine an updated configuration for the network by adjusting the target configuration item using the candidate adjustment scheme.

[0005] In a third aspect of the present disclosure, an electronic device is provided. The device includes: at least one processing unit; and at least one memory, the at least one memory is coupled to the at least one processing unit and stores instructions for execution by the at least one processing unit, and when the instructions are executed by the at least one processing unit, the device executes the method of the first aspect.

[0006] In a fourth aspect of the present disclosure, a computer-readable storage medium is provided, wherein a computer program is stored on the medium, and when the computer program is executed by a processor, the method of the first aspect is implemented.

[0007] It should be understood that the content described in this section is not intended to limit the key features or important features of the embodiments of the present disclosure, nor is it intended to limit the scope of the present disclosure. Other features of the present disclosure will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0008] The above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. In the accompanying drawings, the same or similar reference numerals represent the same or similar elements, wherein:

[0009] Figure 1 A schematic diagram showing an example environment for adjusting network configuration in which embodiments of the present disclosure can be implemented;

[0010] Figure 2 A schematic diagram showing an example network according to some embodiments of the present disclosure is shown;

[0011] Figure 3 A flowchart showing a process for adjusting a network configuration according to some embodiments of the present disclosure is shown;

[0012] Figure 4 A schematic diagram showing a process for adjusting a network configuration according to some embodiments of the present disclosure is shown;

[0013] Figure 5 A schematic diagram showing a provenance information tree of an example network according to some embodiments of the present disclosure;

[0014] Figure 6 A flowchart illustrating an example process for adjusting a network configuration according to some embodiments of the present disclosure;

[0015] Figure 7 A block diagram showing an apparatus for adjusting network configuration according to some embodiments of the present disclosure; and

[0016] Figure 8 A block diagram of an electronic device is shown in which one or more embodiments of the present disclosure may be implemented. DETAILED DESCRIPTION

[0017] Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as being limited to the embodiments set forth herein. On the contrary, these embodiments are provided to provide a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are only for exemplary purposes and are not intended to limit the scope of protection of the present disclosure.

[0018] In the description of the embodiments of the present disclosure, the term "including" and similar terms should be understood as open inclusion, that is, "including but not limited to". The term "based on" should be understood as "based at least in part on". The term "one embodiment" or "the embodiment" should be understood as "at least one embodiment". The term "some embodiments" should be understood as "at least some embodiments". Other explicit and implicit definitions may also be included below.

[0019] Herein, unless explicitly stated, executing a step “in response to A” does not mean executing the step immediately after “A” but may include one or more intermediate steps.

[0020] It is understandable that the data involved in this technical solution (including but not limited to the data itself, the acquisition or use of the data) shall comply with the requirements of relevant laws, regulations and relevant provisions.

[0021] It is understandable that before using the technical solutions disclosed in the embodiments of the present disclosure, the types, scope of use, usage scenarios, etc. of the personal information involved in the present disclosure should be informed to the user and the user's authorization should be obtained in an appropriate manner in accordance with relevant laws and regulations.

[0022] For example, in response to receiving an active request from a user, a prompt message is sent to the user to clearly prompt the user that the operation requested to be performed will require obtaining and using the user's personal information, so that the user can independently choose whether to provide personal information to software or hardware such as electronic devices, applications, servers or storage media that execute operations of the technical solution of the present disclosure based on the prompt message.

[0023] As an optional but non-limiting implementation, in response to receiving an active request from the user, the prompt information is sent to the user in a manner such as a pop-up window, in which the prompt information can be presented in text form. In addition, the pop-up window can also carry a selection control for the user to choose "agree" or "disagree" to provide personal information to the electronic device.

[0024] It is understandable that the above notification and the process of obtaining user authorization are merely illustrative and do not constitute a limitation on the implementation of the present disclosure. Other methods that meet relevant laws and regulations may also be applied to the implementation of the present disclosure.

[0025] As used herein, the term "forwarding loop" may refer to a phenomenon in which a data packet is repeatedly forwarded between multiple devices in a network and cannot reach its destination. Forwarding loops are usually caused by incorrect routing configuration or protocol failure, which may cause network congestion, increased latency, and wasted bandwidth. Identification and elimination of forwarding loops are critical to maintaining network stability and performance.

[0026] The term "origin information" may refer to a collection of detailed information related to a specific network event, used to trace the source and propagation path of the event. Origin information may include information about the network device, configuration statements, and data packets where the event occurred. By analyzing such information, the root cause of the network problem and its propagation path can be determined. In some cases, such information can be constructed as a tree structure to indicate the relationship between network events, such as a derivative relationship.

[0027] The term "coverage relationship" may refer to a relationship used to evaluate the scope of influence of a network configuration statement on a specific network event in network management. In an embodiment of the present disclosure, a coverage relationship may refer to a corresponding relationship between a network event and a configuration item. The coverage relationship is used to calculate the number of times a configuration statement is triggered by a network event by tracing the association between the network event and the configuration statement. The coverage relationship can be used to identify and analyze which configuration statements have an actual impact on network behavior, thereby helping to optimize configuration and locate faults.

[0028] The term "Satisfiability Modulo Theories" can be abbreviated as SMT. SMT is an extended Satisfiability Problem (SAT) that not only handles Boolean logic, but also can handle constraints in different mathematical theories (such as integer arithmetic, bit vectors, arrays, functions, etc.). SMT technology is widely used in program verification, model checking, automatic reasoning and other fields to solve decision problems involving complex logic and constraints.

[0029] The term "Border Gateway Protocol (BGP)" may refer to a network routing protocol widely used in data center networks. BGP routing has multiple properties that can provide great flexibility for network operation and maintenance and the design of network routing strategies.

[0030] The term "neighbor" can refer to a directly connected device or node in a network. For example, in BGP, a BGP neighbor refers to a directly connected switch that exchanges routing information through the BGP protocol. Each BGP neighbor maintains a routing table containing configuration policies and regularly exchanges routing information with other BGP neighbors to ensure network connectivity and routing information updates.

[0031] In traditional solutions, due to configuration errors, software vulnerabilities and hardware failures, networks often cause network accidents such as traffic black holes and forwarding loops. These network accidents last for a long time and have a wide impact, even affecting the world, causing serious economic losses. Among these reasons, network configuration errors are a major cause of network accidents.

[0032] In order to deal with the above situation, various network simulation and network verification methods are used to detect network configuration errors and improve network reliability. Network simulation can simulate or predict the behavior of the network under specific configuration and physical environment based on device images or customized models, and network verification can use formal methods to infer whether the network behavior meets the predetermined conditions. The predetermined conditions can be pre-defined or predetermined network conditions, or they can be input by the network administrator, such as conditions set according to the network administrator's intention, such as no forwarding loops, no forwarding black holes, etc. However, these network simulation and network verification methods can only detect errors or reduce the impact, but cannot repair errors. Since it is impossible to find the specific erroneous configuration line and then modify the configuration file to meet the predetermined conditions again, the network administrator needs to manually locate and repair the error.

[0033] This manual repair process is cumbersome and time-consuming, thus delaying the network change plan. In fact, the manual repair process can take tens of minutes to several hours. The reason why it is so time-consuming is the complexity of traditional distributed networks. First, large enterprise networks can run multiple routing protocols, which calculate the best route through multiple rounds of interaction. In addition, the routers in the network can come from different vendors, each of which has specific behaviors when implementing some functions. In addition, the network can have multiple network architectures at the same time, each of which is configured with different routing policies. Therefore, there is no obvious causal relationship between incorrect network configuration and violation of predetermined conditions, and even experienced network administrators find it difficult to locate and repair the cause of network incidents.

[0034] In order to make up for the shortcomings of manual repair methods, some current solutions use provenance and synthesis methods to automatically locate or repair incorrect network configurations. Provenance technology creates a directed acyclic graph to record the derivative relationship between network events, locates the root cause of the error by tracing the source of the abnormal event in the graph, and then repairs it by modifying the parameter values ​​of these sources. However, provenance technology cannot guarantee correctness, because this tracking method can only determine the correlation between events but not the causality between events. Therefore, the located network configuration is not necessarily the direct cause of the network accident. Secondly, the method of modifying the parameter value of the source ignores the derivative relationship between the network configuration and other events, which can generate new network events that violate the predetermined conditions.

[0035] On the other hand, synthesis technology creates a set of SMT constraints modeling network configuration, control plane semantics, and predetermined conditions entered by the administrator. If some predetermined conditions are not met, synthesis technology will establish corresponding free variables for various statements and parameters of network configuration to generate some repair options, and calculate the values ​​of a set of free variables that can satisfy all SMT constraints. This set of values ​​is an implementable repair solution. Since synthesis technology considers all predetermined conditions at the same time, this method can ensure the correctness of the repair solution, but due to the large number of SMT constraints and free variables, the calculation complexity is high, so it cannot be extended to large networks.

[0036] In order to overcome the above-mentioned correctness and scalability problems, on the one hand, the repair solution that needs to be generated should not only eliminate events that do not meet the predetermined conditions, but also not introduce more events that do not meet the predetermined conditions. The difficulty lies in the fact that due to the inherent complexity of traditional distributed networks, it is difficult to infer the impact of a repair solution on all devices before deployment. On the other hand, it is necessary to generate a repair method that supports large networks containing tens of thousands of devices to quickly complete positioning and repair work. The difficulty lies in the fact that considering that each device can contain thousands of lines of configuration, and changing any of the lines can generate a correct repair solution, the search space is very large. Searching for feasible repair solutions in such a space is an NP-complete problem. In addition, a network setting in practice may require modifying multiple lines of configuration, which makes solving the problem even more difficult.

[0037] According to an embodiment of the present disclosure, a scheme for adjusting network configuration is proposed. In the scheme, first, based on the original configuration and predetermined conditions for the network, a set of traffic that does not meet the predetermined conditions is calculated. Secondly, a target configuration item is selected from each configuration item of the original configuration by calculating the suspiciousness, and a candidate adjustment scheme is obtained according to the target configuration item. Finally, an adjusted updated configuration for the network is determined by the candidate adjustment scheme. The scheme of the present disclosure can realize automatic adjustment of the network configuration by locating errors and determining the updated configuration of the network, thereby improving the efficiency of adjusting the network configuration.

[0038] The following will refer to the attached Figure 1-8 Example embodiments of the present disclosure are described in detail.

[0039] Figure 1 1 is a schematic diagram of an example environment 100 for adjusting network configuration in which embodiments of the present disclosure can be implemented. Figure 1As shown, illustratively, the original configuration 110 of the network may include configuration snippet codes currently used by the network. In some embodiments, these configuration snippet codes are part of the configuration statements of the network device or network protocol, which are generally used to define device behavior, routing policies or other network functions. It should be understood that the original configuration 110 of the network is exemplary and not restrictive, and the original configuration 110 of the network may also include global configuration, interface configuration, routing configuration, etc.

[0040] When a network accident occurs, the process of adjusting the configuration items is executed in the configuration adjustment device 120, and the original configuration 110 of the network can be adjusted to the updated configuration 130 of the network. The adjusted updated configuration 130 of the network can be an implementable network repair solution. The configuration adjustment device 120 can automatically adjust the network configuration by locating the error in the network and determining the updated configuration of the network, thereby improving the efficiency of repairing the network configuration error. It should be understood that the environment 100 is merely exemplary and is not intended to limit the present disclosure in any way.

[0041] Figure 1 The configuration adjustment device 120 shown can be any type of electronic device, such as a terminal device, a server device or other device. Examples of terminal devices include mobile terminals, fixed terminals or portable terminals, including mobile phones, desktop computers, laptop computers, notebook computers, netbook computers, tablet computers, media computers, multimedia tablets, personal communication systems (PCS) devices, personal navigation devices, personal digital assistants (PDAs), audio / video players, digital cameras / camcorders, positioning devices, television receivers, radio broadcast receivers, e-book devices, gaming devices or any combination of the foregoing, including accessories and peripherals of these devices or any combination thereof. In some embodiments, the electronic device can also support any type of interface for the user (such as "wearable" circuits, etc.). Examples of server devices include, but are not limited to, mainframes, edge computing nodes, computing devices in cloud environments, and the like.

[0042] refer to Figure 2 , shows a schematic diagram of an example network 200 according to some embodiments of the present disclosure. Network 200 may have multiple configurations, each of which may include multiple configuration items, sometimes also referred to as "statements". Errors in the configuration of network 200 may be caused by Figure 1 The configuration adjustment device 120 is used to detect and adjust, thereby obtaining an updated configuration of the network 200, for example Figure 1 Update configuration 130 in.

[0043] Figure 2The example network 200 running in has four backbone routers, router 501, router 401, router 301 and router 201. The example network also includes access point 210, access point 230 and data center network 220. The configuration snippet code of router 501 is shown in Table 1 below:

[0044] Table 1

[0045]

[0046] The rewrite policy included in Table 1 replaces all AS-paths received from access point 210 and router 401 with router 501 .

[0047] Figure 2 Similar rewrite policies are also configured for routers 401, 301, and 201. Since routers 401 and 301 are not configured as neighbors, three route announcements are sent in the update requiring data center network 220 to access access point 230. During this process, the first rewrite is performed when the third route propagation corresponding to the third address reaches router 201, and its as-path 240 is rewritten to {201}.

[0048] When the third route propagates to router 301, as-path 242 is {201, 201}. Then when the third route propagates to router 401, as-path 244 is {301, 201, 201}. When the third route propagates to router 501, a second rewrite is performed, and its as-path 246 is rewritten to {501}. Then, when the third route propagates to router 401 again, as-path 248 is {501, 501}, and when the third route propagates to router 301, a third rewrite is performed, and its as-path 250 is rewritten to {301}. Finally, when the third route propagates to router 301 again, as-path 252 is {301, 301}. Figure 2 As shown, the third route propagation generates a loop, resulting in route oscillation of the third address.

[0049] In this regard, the configuration adjustment device 120 according to the embodiment of the present disclosure can first detect the cause of the route oscillation, for example, the cause is that the rewrite policy on the router 301 and the router 501 increases the priority of the route by shortening the AS-path. Next, the configuration adjustment device 120 can generate an adjustment plan for adjusting the configuration item parameters, thereby determining the updated configuration for the network and solving the problem of network loops. Figures 3 to 6 The above process of the present disclosure is further described.

[0050] Figure 3 FIG. 3 is a flowchart of a process 300 for adjusting a network configuration according to some embodiments of the present disclosure. Figure 1 Environment 100 and Figure 2 The process 300 is described with reference to the network 200. For example, the process 300 may be performed by the configuration adjustment device 120 or other suitable devices. In addition, in the process of describing the process 300, for ease of understanding, the process 300 is combined with Figure 4 and Figure 5 The embodiments are further described and discussed.

[0051] The process 300 begins at block 310. Based on the original configuration of the network, the configuration adjustment device 120 determines a first set of flows that do not meet a predetermined condition. Each flow in the first set of flows is associated with a plurality of network events.

[0052] In addition, in some embodiments, the configuration adjustment device 120 can determine the path that each flow in the first flow set passes through in the network, the data packets included in the flow, and / or other appropriate information. In addition, the configuration adjustment device 120 can further determine the association relationship between multiple network events and network events based on the determined results.

[0053] The following will be combined Figure 4 Provide further explanation. Figure 4 A schematic diagram of a process 400 for adjusting a network configuration according to some embodiments of the present disclosure is shown, wherein a verification process 410 further describes in detail the process of determining the first set of traffic that does not meet the predetermined condition in box 310. In some embodiments, the original configuration 110 of the network, such as the configuration snippet code of the example network 200 shown in Table 1, is input into a network verification tool to perform the verification process 410. After the verification process 410, the loop path that the traffic passes through in the network and the data packets included in the traffic are output. Through the verification process 410, the traffic that does not meet the predetermined condition in the file of the original configuration 110 of the network is selected, and the origin information corresponding to the traffic can be searched according to the origin information tree.

[0054] In some embodiments, the original configuration file 110 is input into a network verification tool to obtain logs output by analysis, and a provenance information tree is constructed based on the logs. Figure 5 FIG. 5 is a schematic diagram of a provenance information tree 500 of an example network according to some embodiments of the present disclosure, which corresponds to the example network 200. Figure 5As shown, the nodes in the provenance information tree represent network events, such as network event 510, network event 520, and network event 530, and the edges in the provenance information tree represent the association between network events in the log. Through the provenance information tree, the path that the traffic passes through in the network can be determined.

[0055] Back to Figure 3 In block 320 , based on the correspondence between the plurality of network events and the configuration items in the original configuration, the configuration adjustment device 120 determines the target configuration item to be adjusted from the configuration items in the original configuration.

[0056] In some embodiments, if the first node corresponding to the first network event among the multiple network events matches the second node corresponding to a configuration item in the original configuration, the configuration adjustment device 120 can determine that the first network event has a corresponding relationship with the configuration item. As an example, the configuration adjustment device 120 locates the origin information tree node corresponding to the target network event, and reversely searches for the node connected to the origin information tree node. If the connected node corresponds to a configuration item in the original configuration, the configuration item has a corresponding relationship with the network event, that is, the configuration item is covered by the network event. It should be understood that using the origin information tree to determine whether a configuration item is covered by a network event is only an example and not a limitation, and other tools can also be used to determine whether a configuration item is covered by the network.

[0057] In some embodiments, the configuration adjustment device 120 may determine the correspondence between the plurality of network events and each configuration item in the original configuration based on the second traffic set that meets the predetermined condition.

[0058] In some embodiments, for each configuration item in the original configuration, the configuration adjustment device 120 can count the number of test flows that do not meet the predetermined conditions in the test flows that have a corresponding relationship with the configuration item, recorded as a first number, and the number of test flows that meet the predetermined conditions, recorded as a second number. Based on the first number and the second number, the configuration adjustment device 120 can calculate the suspicion of the configuration item. In this way, the scheme of the present disclosure can effectively identify erroneous configuration items. As an example, the configuration adjustment device 120 calculates the configuration items covered by the network event, and further counts the number of test flows that do not meet the predetermined conditions in the test flows that have a corresponding relationship with the configuration item as a first number, that is, the number of failed test cases of the configuration item, and the number of test flows that meet the predetermined conditions as a second number, that is, the number of passed test cases of the configuration item, and calculates the suspicion of the configuration item using the Taratula algorithm formula of the following formula (1):

[0059]

[0060] Wherein susp(s) represents the suspicion of the configuration item, failed(s) represents the number of failed test cases of the configuration item, and passed(s) represents the number of successful test cases of the configuration item. The higher the suspicion, the greater the correlation between the configuration item and the network error, and therefore the configuration item needs to be checked and repaired first. Alternatively, the suspicion of the configuration item can be calculated using the Ochiai algorithm. In some embodiments, the suspicion of the configuration item can be calculated using the GenProg algorithm. In other embodiments, the suspicion of the configuration item can be calculated using the Jaccard algorithm. It should be understood that the various algorithms for calculating the suspicion of the configuration item above are merely exemplary and should not limit the scope of protection of the present disclosure. Various algorithms that can be thought of by those skilled in the art should be included in the scope of the present disclosure.

[0061] In some embodiments, based on the suspiciousness of each configuration item in the original configuration, the configuration adjustment device 120 can select at least one configuration item to be adjusted from each configuration item. The at least one configuration item to be adjusted includes a target configuration item. In some embodiments, the at least one configuration item to be adjusted includes a predetermined number of configuration items.

[0062] Continue to refer Figure 4 , wherein the error location process 420 further describes in detail the process of determining the target configuration item to be adjusted in block 320. The provenance information output by the verification process 110 is used as an input to the error location process 420. In addition, the iteration threshold is also input into the error location process 420 as part of the original configuration, and is used in the subsequent evaluation solution process 440, which will be further described below.

[0063] In addition, if Figure 4 As shown, the predetermined number of configuration items are input into the generating solution process 430 as the output of the locating error process 420. For example, the predetermined number of configuration items are the first predetermined number of configuration items after being sorted from high to low in terms of suspicion, such as the 100 configuration items with the highest suspicion. Alternatively, one of the configuration items with the highest suspicion can also be randomly selected.

[0064] As an example and not a limitation, the error location process 420 will be described in detail below in the form of a specific embodiment. Figure 2 The suspiciousness of the configuration snippet code corresponding to the running instance network, that is, the suspiciousness of the configuration item is shown in the following Table 2:

[0065] Table 2

[0066] Configuration snippet code number First route Second route Third route Suspicion 1 · · · 0.5 2 · · · 0.5 3 · · · 0.5 5 · · · 0.5 6 · · · 0.5 7 · · · 0 8 · · · 0.5 9 · · · 0.67 11 · · · 0.5 13 · · · 0.5 14 · · · 0.5 15 · · · 0.5

[0067] The column corresponding to the first route in Table 2 indicates that the configuration snippet code is covered by the test case corresponding to the first route propagation. For example, there is a black dot at the intersection of the row with the configuration snippet code number 1 and the column corresponding to the first route, which indicates that the configuration item is covered by the test case; there is no black dot at the intersection of the row with the configuration snippet code number 9 and the column corresponding to the first route, which indicates that the configuration item is not covered by the test case.

[0068] In addition, the last column in Table 2 represents the suspiciousness of each configuration item calculated according to the coverage by applying equation (1). It can be seen that the configuration item with the highest suspiciousness in this specific embodiment is the configuration item with the configuration fragment code number 9, and its suspiciousness is 0.67. Therefore, the configuration item with the configuration fragment code number 9 is input as the target configuration item into the generation solution process 430.

[0069] Back to Figure 3 , in box 330, the configuration adjustment device 120 obtains a candidate adjustment scheme corresponding to the target configuration item. In some embodiments, the candidate adjustment scheme may be determined based on a configuration template input into the scheme generation process 430. It should be understood that determining the candidate adjustment scheme based on the configuration template is merely one implementation method for obtaining the candidate adjustment scheme and should not limit the scope of the present disclosure. Alternatively, the candidate adjustment scheme may be obtained by calculation of a cloud model. In other embodiments, if it is determined through the process of generating the scheme 430 that a candidate adjustment scheme cannot be generated, the adjustment device 120 may end the process of adjusting the network configuration.

[0070] In some embodiments, the configuration adjustment device 120 may determine the configuration type of the target configuration item based on the routing function corresponding to the target configuration item. In some embodiments, the configuration adjustment device 120 may determine the configuration type of the target configuration item by the routing function controlled by the configuration item. For example, the routing function may include routing announcement, policy routing, peer neighbor, and routing policy, etc.

[0071] In some embodiments, according to the configuration type of the target configuration item, the configuration adjustment device 120 may determine a group of configuration templates associated with the configuration type, and select a configuration template from the group of configuration templates. In some embodiments, a group of configuration templates is predefined, and the group of configuration templates may be determined according to the configuration type by using a heuristic search globally. In some embodiments, a group of configuration templates may be manually organized. In other embodiments, a group of configuration templates may be obtained using an automated tool.

[0072] After obtaining a set of configuration templates, a configuration template to be used can be selected from the set of configuration templates by random sampling. As an example, the selected configuration template may include a set of parameterized configuration statements (i.e., a set of configuration items). Each configuration item can be abstractly represented by a regular expression, for example:

[0073] Type[Command[parameters]*]+,

[0074] Type indicates a configuration type command, command indicates an optional subcommand, and parameters indicates optional parameters under a subcommand.

[0075] In some embodiments, the configuration adjustment device 120 can determine candidate adjustment schemes by replacing a parameter value in the target configuration item with a variable, such as a symbolic variable, based on the selected configuration template. In some embodiments, a parameter value in the target configuration item can be randomly selected. As an example, the content corresponding to the parameter value in the configuration item is replaced with a symbolic variable, and then a symbolic search method is used locally to determine the candidate adjustment scheme. By narrowing the search space in this way, the scheme of the present disclosure also improves the efficiency of the search. It should be understood that the symbolic variable is only an example of a variable in the embodiment of the present disclosure. In other embodiments, the variable can also be implemented in other forms, and the scope of the present disclosure is not limited to this. For ease of discussion, the variables are described below using symbolic variables as an example.

[0076] In some embodiments, the configuration adjustment device 120 can determine the parameter value in the target configuration item. In other embodiments, based on the variable (e.g., symbolic variable) constraint associated with the target configuration item, the configuration adjustment device 120 can determine the range of the variable (e.g., symbolic variable) used to replace the parameter value. As an example, the parameter value in the configuration item can be replaced with the symbolic variable, and then the configuration item with the symbolic variable is executed along the path of the origin information tree to determine the precondition of the derivation relationship on the execution path. The precondition is determined as the constraint of the symbolic variable. The constraint on the origin information tree corresponding to the traffic that meets the predetermined condition is recorded as P, and the constraint on the origin information tree corresponding to the traffic that does not meet the predetermined condition is recorded as F, where P and The intersection of is determined as a constraint on the symbolic variables, where represents a non-set of F. In addition, in some embodiments, the constraint is solved using an SMT solver to obtain a range of symbolic variables that meets a predetermined condition, and the range is substituted for the symbolic variable in the configuration item to generate a candidate adjustment solution.

[0077] Continue to refer Figure 4, wherein the generating solution process 430 further describes in detail the process of obtaining the candidate adjustment solution in block 330. Figure 4 As shown, a predetermined number of configuration items are input into the solution generation process 430 , and the configuration adjustment device 120 generates candidate adjustment solutions as outputs of the solution generation process 430 based on the configuration template.

[0078] As an example but not a limitation, the solution generation process 430 will be described in detail below in the form of a specific embodiment. As described above with respect to Table 2, the configuration item with the configuration snippet code number "9" is input into the solution generation process 430 as a target configuration item. The specific content corresponding to the configuration snippet code can be found in Table 1. Associated with the configuration snippet code numbered "9" is the 11th row in Table 1, i.e., ip prefix-list default_all index 5 permit0.0.0.00. The configuration type of the 11th row is ip prefix-list, and one of the selectable templates in a set of templates corresponding to the configuration type is ip prefix-list name index n action prefix, and then the prefix parameter is randomly selected to be replaced by a parameter of a symbolic variable. In other words, ip prefix-list default_all index5 permit 0.0.0.00 is replaced by ip prefix-list default_all index 5 permit var, where var represents the symbolic variable to be replaced.

[0079] Next, the configuration item with the symbol variable is in Figure 5 The provenance information tree shown is executed to obtain the constraint P that satisfies the predetermined conditions: And the constraint F that does not satisfy the predetermined condition: in, represents a "belongs to" relationship, and "∧" represents an "and" relationship. Therefore, the constraints on symbolic variables The solution can be {10.70 / 16}∪{20.0 / 16}, where “∪” represents the union.

[0080] After the solution generation process 430 is processed, the following candidate adjustment solution can be obtained, that is, adjusting line 11 to ip prefix-list default_all index 5 permit 10.70 / 16 and ip prefix-list default_all index 5 permit 20.0 / 16. Figure 2As shown, after being processed by this candidate adjustment solution, only the routes from access point 210, access point 230 and data center network 220 are rewritten.

[0081] Back to Figure 3 At block 340, the configuration adjustment device 120 determines an updated configuration for the network by adjusting the target configuration item using the candidate adjustment scheme. In some embodiments, the target configuration item is adjusted using the candidate adjustment scheme, and the number of flows that do not meet the predetermined condition is determined based on the adjusted target configuration item.

[0082] In some embodiments, if the number of flows that do not meet the predetermined condition is less than or equal to a first threshold, the candidate adjustment solution is determined as an updated configuration for the network. For example, the first threshold may be 0. In this case, if the number of flows that do not meet the predetermined condition is equal to 0, then the candidate adjustment solution is determined as an updated configuration for the network.

[0083] In some embodiments, if the number of flows that do not meet the predetermined condition is greater than a first threshold value, and the number of iterations is greater than a maximum number of iterations, a timeout message is reported, and the process of adjusting the network configuration is terminated. In other embodiments, if the number of flows that do not meet the predetermined condition is greater than a first threshold value, and the number of iterations is less than or equal to the maximum number of iterations, the number of flows that do not meet the predetermined condition of multiple candidate adjustment schemes is compared with the maximum number of flows that do not meet the predetermined condition of the candidate adjustment schemes obtained after the last iteration, wherein the candidate adjustment schemes that are greater than the maximum number of flows that do not meet the predetermined condition of the last iteration are removed, and the remaining candidate adjustment schemes are retained to perform the next iteration. In this way, the scheme of the present disclosure avoids introducing more flows that do not meet the predetermined condition in the new updated configuration, and improves the correctness of the solved updated configuration.

[0084] Continue to refer Figure 4 , wherein the evaluation solution process 440 further details the process of determining an updated configuration for the network in block 340. Figure 4 As shown, the candidate adjustment scheme output by the generating scheme 430 process is input into the evaluating scheme process 440. Based on the predetermined conditions input into the evaluating scheme, if there is an implementable candidate adjustment scheme, the candidate adjustment scheme is determined as the updated configuration for the network and the process of adjusting the network configuration is terminated. The updated configuration thus obtained is the implementable scheme of the network. If there is no implementable candidate adjustment scheme, but the number of iterations is less than or equal to the iteration threshold, some candidate schemes are selected and input into the locating error process 420 to perform the next iteration. If there is no implementable candidate adjustment scheme and the number of iterations is greater than the iteration threshold, the process of adjusting the network configuration is terminated.

[0085] In some embodiments, calculating the number of flows that do not meet the predetermined condition may be implemented by applying a candidate adjustment solution.Similar to the verification process 410, the number of flows that do not meet the predetermined condition may be calculated by constructing an origin information tree.

[0086] As an example but not a limitation, the evaluation scheme process 440 will be described in detail below in a specific embodiment. As described above, according to one of the candidate adjustment schemes, line 11 can be adjusted to ip prefix-list default_allindex 5 permit 10.70 / 16 and ip prefix-list default_all index 5 permit 20.0 / 16.

[0087] By executing this candidate adjustment scheme similar to the verification process 410, it can be determined that the number of flows that do not meet the predetermined condition after applying the candidate adjustment scheme is 1. Specifically, Figure 2 In the example network in , there is a forwarding loop of the third route propagation between router 301 and router 401, and there is no other failed test traffic. The reason why there is a forwarding loop of the third route propagation between router 301 and router 401 is that the rewrite policy of router 301 rewrites the route from router 401, causing router 301 to select router 401 as the next hop of the third route propagation, and router 301 is the next hop of the third route propagation in router 401.

[0088] In this case, the number of flows that do not meet the predetermined condition is 1, and the number of failed tests is not increased, so the candidate adjustment scheme is retained in the next iteration. In the next iteration, similar to the previous steps, one of the candidate adjustment schemes may be to adjust the 11th line ip prefix-list default_all index 5 permit20.0 / 16. For this candidate adjustment scheme, the number of flows that do not meet the predetermined condition is 0, so the candidate adjustment scheme is determined as the updated configuration for the network. Through this iterative approach, the scheme of the present disclosure can avoid introducing more flows that do not meet the predetermined condition in the new updated configuration.

[0089] like Figure 6 , a flow chart of an example process 600 for adjusting a network configuration according to some embodiments of the present disclosure is shown. Figure 6 Shows Figure 3 A specific implementation method for adjusting the network configuration process in Figure 1 In the following, for the purpose of explanation, reference may be made to the environment 100 shown in FIG. Figure 1 Environment 100 and Figure 2 The process 600 is described with reference to the network 200. For example, the process 600 can be performed by the configuration adjustment device 120 or other suitable devices.

[0090] It should be understood that Figure 6 The process shown is only one implementation of the present disclosure and should not constitute a limitation on the scope of the present disclosure. Specifically, in box 610, the configuration adjustment device 120 determines a first set of traffic that does not meet the conditions. Subsequently, the process proceeds to box 620, and the configuration adjustment device 120 determines the configuration items to be adjusted. Next, the process proceeds to box 630, and the configuration adjustment device 120 obtains a candidate configuration scheme. In box 640, if the fitness of the candidate configuration scheme, that is, the number of traffic that does not meet the predetermined conditions is less than or equal to a predetermined value, then the candidate configuration scheme is an implementable scheme, and the process proceeds to 670, and the configuration adjustment device 120 determines that the candidate configuration scheme is an updated configuration. If the fitness of the candidate configuration scheme is greater than the predetermined value, the process proceeds to 650. In this case, if the number of iterations is greater than the threshold, the configuration adjustment device 120 reports a timeout information and stops adjusting the network configuration. If the number of iterations is less than or equal to the threshold, the process proceeds to 660, and the configuration adjustment device 120 compares the fitness with the maximum fitness among the candidate configurations retained in the previous iteration, so as to select and use the candidate configuration scheme corresponding to the fitness less than the maximum fitness for the next iteration, and the process proceeds to block 665, the number of iterations is incremented once, and returns to block 620 for the next iteration. In this way, the solution of the present disclosure can effectively identify incorrect configuration items and does not introduce more traffic that does not meet the predetermined conditions in the updated configuration.

[0091] Figure 7 FIG. 7 is a block diagram of an apparatus 700 for adjusting a network configuration according to some embodiments of the present disclosure. The apparatus 700 may be implemented as or included in Figure 1 The configuration adjustment device 120. Each module / component in the apparatus 700 may be implemented by hardware, software, firmware or any combination thereof.

[0092] As shown in the figure, the device 700 includes a verification module 710, which is configured to determine a first flow set that does not meet a predetermined condition based on the original configuration for the network, and each flow in the first flow set is associated with multiple network events. The device 700 also includes a positioning module 720, which is configured to determine a target configuration item to be adjusted from each configuration item in the original configuration based on the correspondence between multiple network events and each configuration item in the original configuration. The device 700 also includes an acquisition module 730, which is configured to obtain a candidate adjustment scheme corresponding to the target configuration item. The device 700 also includes a determination module 740, which is configured to adjust the target configuration item by using the candidate adjustment scheme to determine the updated configuration for the network.

[0093] In some embodiments, the verification module 710 is further configured to: determine at least one of the path that the traffic passes through in the network and the data packets included in the traffic; and based on at least one of the path and the data packets, determine the association relationship between multiple network events and network events.

[0094] In some embodiments, the positioning module 720 is further configured to: in response to a first node corresponding to a first network event in the plurality of network events matching a second node corresponding to a configuration item in the original configuration, determine that the first network event has a corresponding relationship with the configuration item.

[0095] In some embodiments, the positioning module 720 is further configured to: determine the correspondence between the plurality of network events and each configuration item in the original configuration based on a second traffic set that meets a predetermined condition.

[0096] In some embodiments, the positioning module 720 is further configured to: for each configuration item in the original configuration, calculate the suspicion of the configuration item based on a first number of test traffic that does not satisfy a predetermined condition and a second number of test traffic that satisfies the predetermined condition in the test traffic corresponding to the configuration item; and based on the suspicion of each configuration item in the original configuration, select at least one configuration item to be adjusted from each configuration item, and the at least one configuration item to be adjusted includes a target configuration item.

[0097] In some embodiments, the at least one configuration item to be adjusted includes a predetermined number of configuration items.

[0098] In some embodiments, the acquisition module 730 is further configured to: determine the configuration type of the target configuration item based on the routing function corresponding to the target configuration item; select a configuration template from a set of configuration templates associated with the configuration type; and determine a candidate adjustment scheme by replacing a parameter value in the target configuration item with a variable based on the selected configuration template.

[0099] In some embodiments, the acquisition module 730 is further configured to: determine a parameter value in the target configuration item; and determine a range of variables for replacing the parameter value based on variable constraints associated with the target configuration item.

[0100] In some embodiments, the determination module 740 is also configured to: use the candidate adjustment scheme to adjust the target configuration item to obtain an adjustment configuration for the network configuration; based on the adjustment configuration, determine a third traffic set that does not meet the predetermined conditions; and determine the update configuration based at least on the number of traffic in the third traffic set.

[0101] In some embodiments, the determination module 740 is also configured to, in response to the number of flows in the third flow set being greater than a first threshold, adjust the corresponding configuration item using a candidate adjustment scheme corresponding to the configuration item to be adjusted in the adjustment configuration, and in response to the number of flows in the third flow set being less than or equal to the first threshold, determine the adjustment configuration as an updated configuration for the network.

[0102] In some embodiments, the determination module 740 is further configured to compare the number of flows in the first flow set with the number of flows in the third flow set, and determine a candidate adjustment scheme corresponding to the configuration item to be adjusted in the adjustment configuration.

[0103] Figure 8 8 is a block diagram of an electronic device 800 in which one or more embodiments of the present disclosure may be implemented. It should be understood that Figure 8 The electronic device 800 shown is merely exemplary and should not constitute any limitation on the functionality and scope of the embodiments described herein. Figure 8 The electronic device 800 shown can be used to implement Figure 1 The configuration adjustment device 120 and Figure 7 Device 700, etc.

[0104] like Figure 8 As shown, the electronic device 800 is in the form of a general-purpose computing device. The components of the electronic device 800 may include, but are not limited to, one or more processors or processing units 810, a memory 820, a storage device 830, one or more communication units 840, one or more input devices 850, and one or more output devices 860. The processing unit 810 may be an actual or virtual processor and is capable of performing various processes according to a program stored in the memory 820. In a multi-processor system, multiple processing units execute computer executable instructions in parallel to improve the parallel processing capabilities of the electronic device 800.

[0105] The electronic device 800 typically includes a plurality of computer storage media. Such media can be any available media accessible to the electronic device 800, including but not limited to volatile and non-volatile media, removable and non-removable media. The memory 820 can be a volatile memory (e.g., register, cache, random access memory (RAM)), a non-volatile memory (e.g., a read-only memory (ROM), an electrically erasable programmable read-only memory (EEPROM), flash memory) or some combination thereof. The storage device 830 can be a removable or non-removable medium, and can include a machine-readable medium, such as a flash drive, a disk, or any other medium, which can be used to store information and / or data and can be accessed within the electronic device 800.

[0106] The electronic device 800 may further include additional removable / non-removable, volatile / non-volatile storage media. Figure 8 As shown in , a disk drive for reading or writing from a removable, non-volatile disk (e.g., a "floppy disk") and an optical drive for reading or writing from a removable, non-volatile optical disk may be provided. In these cases, each drive may be connected to the bus (not shown) by one or more data media interfaces. The memory 820 may include a computer program product 825 having one or more program modules that are configured to perform various methods or actions of various embodiments of the present disclosure.

[0107] The communication unit 840 implements communication with other electronic devices through a communication medium. Additionally, the functions of the components of the electronic device 800 can be implemented with a single computing cluster or multiple computing machines that can communicate through a communication connection. Therefore, the electronic device 800 can operate in a networked environment using a logical connection with one or more other servers, a network personal computer (PC), or another network node.

[0108] The input device 850 may be one or more input devices, such as a mouse, a keyboard, a tracking ball, etc. The output device 860 may be one or more output devices, such as a display, a speaker, a printer, etc. The electronic device 800 may also communicate with one or more external devices (not shown) through the communication unit 840 as needed, such as a storage device, a display device, etc., communicate with one or more devices that allow a user to interact with the electronic device 800, or communicate with any device that allows the electronic device 800 to communicate with one or more other electronic devices (e.g., a network card, a modem, etc.). Such communication may be performed via an input / output (I / O) interface (not shown).

[0109] According to an exemplary implementation of the present disclosure, a computer-readable storage medium is provided, on which computer-executable instructions are stored, wherein the computer-executable instructions are executed by a processor to implement the method described above. According to an exemplary implementation of the present disclosure, a computer program product is also provided, which is tangibly stored on a non-transitory computer-readable medium and includes computer-executable instructions, and the computer-executable instructions are executed by a processor to implement the method described above.

[0110] Various aspects of the present disclosure are described herein with reference to the flowcharts and / or block diagrams of the methods, devices, equipment, and computer program products implemented according to the present disclosure. It should be understood that each box in the flowchart and / or block diagram and the combination of each box in the flowchart and / or block diagram can be implemented by computer-readable program instructions.

[0111] These computer-readable program instructions can be provided to a processing unit of a general-purpose computer, a special-purpose computer, or other programmable data processing device, thereby producing a machine, so that when these instructions are executed by the processing unit of the computer or other programmable data processing device, a device that implements the functions / actions specified in one or more boxes in the flowchart and / or block diagram is generated. These computer-readable program instructions can also be stored in a computer-readable storage medium, and these instructions cause the computer, programmable data processing device, and / or other equipment to work in a specific manner, so that the computer-readable medium storing the instructions includes a manufactured product, which includes instructions for implementing various aspects of the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0112] Computer-readable program instructions can be loaded onto a computer, other programmable data processing apparatus, or other device so that a series of operational steps are performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, so that the instructions executed on the computer, other programmable data processing apparatus, or other device implement the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0113] The flow chart and block diagram in the accompanying drawings show the possible architecture, function and operation of the system, method and computer program product according to multiple implementations of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a part of a module, program segment or instruction, and a part of a module, program segment or instruction includes one or more executable instructions for realizing the logical function of the specification. In some implementations as replacements, the function marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two continuous square boxes can actually be executed substantially in parallel, and they can sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be realized by a special hardware-based system that performs the function or action of the specification, or can be realized by a combination of special hardware and computer instructions.

[0114] The above descriptions of various implementations of the present disclosure are exemplary, non-exhaustive, and not limited to the disclosed implementations. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described implementations. The selection of terms used herein is intended to best explain the principles of the implementations, practical applications, or improvements to the technology in the market, or to enable other persons of ordinary skill in the art to understand the various implementations disclosed herein.

Claims

1. A method for adjusting a network configuration, comprising: Based on an original configuration for the network, determining a first set of flows that do not satisfy a predetermined condition, each flow in the first set of flows being associated with a plurality of network events; Based on the correspondence between the multiple network events and the configuration items in the original configuration, determining a target configuration item to be adjusted from the configuration items in the original configuration; Obtaining a candidate adjustment solution corresponding to the target configuration item; as well as An updated configuration for the network is determined by adjusting the target configuration item using the candidate adjustment solution.

2. The method according to claim 1, wherein obtaining the candidate adjustment scheme comprises: Determining a configuration type of the target configuration item based on a routing function corresponding to the target configuration item; selecting a configuration template from a set of configuration templates associated with the configuration type; as well as The candidate adjustment solution is determined by replacing a parameter value in the target configuration item with a variable based on the selected configuration template.

3. The method according to claim 2, wherein determining the candidate adjustment solution comprises: Determining the parameter value in the target configuration item; as well as A range of the variable for replacing the parameter value is determined based on a variable constraint associated with the target configuration item.

4. The method according to claim 1, further comprising: Determine at least one of a path through which the traffic passes in the network and a data packet included in the traffic; as well as Based on at least one of the path and the data packet, the association relationship between the multiple network events and the network events is determined.

5. The method according to claim 1, further comprising: In response to a match between a first node corresponding to a first network event in the plurality of network events and a second node corresponding to a configuration item in the original configuration, it is determined that the first network event has a corresponding relationship with the configuration item.

6. The method according to claim 1, further comprising: Based on the second traffic set that meets the predetermined condition, a corresponding relationship between the multiple network events and each configuration item in the original configuration is determined.

7. The method according to claim 1, wherein determining the target configuration item to be adjusted comprises: For each configuration item in the original configuration, based on a first number of test flows that do not satisfy the predetermined condition and a second number of test flows that satisfy the predetermined condition in the test flows corresponding to the configuration item, calculating the suspiciousness of the configuration item; as well as Based on the suspiciousness of each configuration item in the original configuration, at least one configuration item to be adjusted is selected from the configuration items, and the at least one configuration item to be adjusted includes the target configuration item. The method according to claim 7 , wherein the at least one configuration item to be adjusted comprises a predetermined number of configuration items.

9. The method of claim 1 , wherein determining the updated configuration for the network comprises: Using the candidate adjustment scheme to adjust the target configuration item to obtain an adjustment configuration for the network configuration; Based on the adjustment configuration, determining a third flow set that does not satisfy a predetermined condition; and The update configuration is determined based at least on the number of flows in the third flow set.

10. The method according to claim 9, wherein determining the update configuration based on the number of flows in the third flow set comprises: In response to the number of flows in the third flow set being greater than a first threshold, adjusting the corresponding configuration item using a candidate adjustment scheme corresponding to the configuration item to be adjusted in the adjustment configuration, and In response to the number of flows in the third flow set being less than or equal to a first threshold, determining the adjustment configuration as an updated configuration for the network.

11. The method according to claim 9 or claim 10, further comprising: The number of flows in the first flow set and the number of flows in the third flow set are compared to determine a candidate adjustment scheme corresponding to the configuration item to be adjusted in the adjustment configuration.

12. A device for adjusting network configuration, comprising: A verification module is configured to determine, based on an original configuration for the network, a first set of flows that do not satisfy a predetermined condition, each flow in the first set of flows being associated with a plurality of network events; a positioning module configured to determine a target configuration item to be adjusted from each configuration item in the original configuration based on a correspondence between the plurality of network events and each configuration item in the original configuration; An acquisition module is configured to acquire a candidate adjustment solution corresponding to the target configuration item; as well as The determination module is configured to determine an updated configuration for the network by adjusting the target configuration item using the candidate adjustment solution.

13. An electronic device comprising: at least one processing unit; as well as At least one memory, the at least one memory being coupled to the at least one processing unit and storing instructions for execution by the at least one processing unit, the instructions causing the device to perform the method according to any one of claims 1 to 11 when executed by the at least one processing unit.

14. A computer-readable storage medium having a computer program stored thereon, wherein the computer program implements the method according to any one of claims 1 to 11 when executed by a processor.

Images