Network monitoring method, device, equipment, medium and program product

Abstract

The invention provides a network monitoring method which can be applied to the field of financial science and technology or other fields. The network monitoring method comprises the steps that first network flow information and second network flow information of a network equipment port are acquired, the first network flow information represents flow data of the port at the current moment, and the second network flow information represents flow data of the port at the historical moment; obtaining a target parameter corresponding to the current moment, wherein the target parameter represents the influence degree of the network traffic data at the historical moment on the traffic data at the current moment; according to the first network traffic information, the second network traffic information and the target parameter, determining a weighted average value corresponding to the traffic data of the port at the current moment; and generating prompt information according to the second network flow information and the weighted average. The invention further provides a network monitoring device, equipment, a storage medium and a program product.

Description

Technical Field

[0001] The present disclosure relates to the field of network management, and more specifically to a network monitoring method, device, equipment, medium and program product. Background Art

[0002] With the development of informatization in the financial industry, the bank's information system, as a representative of the financial industry's information system, has a relatively complex network structure. In the network, a port is a virtual location on a machine that is open to connections from other machines. Each networked computer / server has a standard number of ports, and each port is reserved for certain types of communication. However, the complex network traffic is very difficult to handle during the communication process, resulting in high pressure on later operation and maintenance, and heavy system operation and maintenance work. Summary of the invention

[0003] In view of the above problems, the present disclosure provides a network monitoring method, apparatus, device, medium and program product.

[0004] According to a first aspect of the present disclosure, a network monitoring method is provided, the method comprising: obtaining first network traffic information and second network traffic information of a network device port, the first network traffic information representing the traffic data of the port at a current moment, and the second network traffic information representing the traffic data of the port at a historical moment; obtaining a target parameter corresponding to the current moment, the target parameter representing the degree of influence of the network traffic data at a historical moment on the traffic data at the current moment; determining a weighted average value corresponding to the traffic data of the port at the current moment based on the first network traffic information, the second network traffic information and the target parameter; and generating prompt information based on the second network traffic information and the weighted average value.

[0005] According to an embodiment of the present disclosure, obtaining a target parameter corresponding to the current moment includes: obtaining historical network traffic information of a network device port at multiple historical moments within a historical period; determining a first intermediate value based on the historical network traffic data, the first intermediate value representing the variance of the historical network traffic data; and determining the target parameter based on the first intermediate value.

[0006] According to an embodiment of the present disclosure, prompt information is generated based on the second network traffic information and the weighted average value, including: determining the fluctuation value based on the second network traffic information and the weighted average value; obtaining the target threshold corresponding to the current moment; and generating a warning prompt when the fluctuation value is greater than the target threshold.

[0007] According to an embodiment of the present disclosure, obtaining a target threshold corresponding to the current moment includes: obtaining historical network traffic information of a network device port at multiple historical moments within a historical period; determining a second intermediate value and a third intermediate value based on the historical network traffic data, the second intermediate value representing the standard deviation of the historical network traffic data, and the third intermediate value representing the average value of the historical network traffic data; determining the target threshold based on the second intermediate value and the third intermediate value.

[0008] According to an embodiment of the present disclosure, the method also includes: when the fluctuation value is less than the target threshold, obtaining identification information of multiple running services in the network device; generating priorities corresponding to the multiple running services respectively according to the identification information; and allocating traffic to the multiple running services in order from low to high priority of the multiple running services.

[0009] According to an embodiment of the present disclosure, the method further includes: when the fluctuation value is greater than the target threshold, allocating traffic to the multiple running services in order of priority from high to low.

[0010] According to an embodiment of the present disclosure, when the first service traffic allocated to the first operating service is greater than the second service traffic consumed by the first operating service at the current moment, the remaining traffic is allocated to the second operating service, and the remaining traffic represents the difference between the first service traffic and the second service traffic, and the priority of the first operating service is greater than the priority of the second operating service.

[0011] According to an embodiment of the present disclosure, a weighted average value corresponding to the traffic data of the port at the current moment is determined based on the first network traffic information, the second network traffic information and the target parameter, including: determining a first comprehensive value based on the target parameter and the first network traffic information; determining a second comprehensive value based on the target parameter and the second network traffic information; determining a weighted average value based on the first comprehensive value and the second comprehensive value.

[0012] The second aspect of the present disclosure provides a network monitoring device, which includes: a first acquisition module, used to acquire first network traffic information and second network traffic information of a network device port, the first network traffic information representing the traffic data of the port at a current moment, and the second network traffic information representing the traffic data of the port at a historical moment; a second acquisition module, used to acquire a target parameter corresponding to the current moment, the target parameter representing the degree of influence of the network traffic data at a historical moment on the traffic data at the current moment; a determination module, used to determine a weighted average value corresponding to the traffic data of the port at the current moment based on the first network traffic information, the second network traffic information and the target parameter; and a generation module, used to generate prompt information based on the second network traffic information and the weighted average value.

[0013] A third aspect of the present disclosure provides an electronic device, comprising: one or more processors; and a memory for storing one or more computer programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the above method.

[0014] The fourth aspect of the present disclosure further provides a computer-readable storage medium having a computer program or instructions stored thereon, which implements the steps of the above method when the above computer program or instructions are executed by a processor.

[0015] The fifth aspect of the present disclosure further provides a computer program product, including a computer program or instructions, which implement the steps of the above method when the above computer program or instructions are executed by a processor. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The above contents and other objects, features and advantages of the present disclosure will become more apparent through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, in which:

[0017] Figure 1 The application scenario diagram of the network monitoring method, apparatus, device, medium and program product according to the embodiment of the present disclosure is schematically shown;

[0018] Figure 2 A flowchart of a network monitoring method according to an embodiment of the present disclosure is schematically shown;

[0019] Figure 3 A flowchart of a method for determining target parameters according to an embodiment of the present disclosure is schematically shown;

[0020] Figure 4 A flowchart of judging based on the second network traffic information and the weighted average value according to an embodiment of the present disclosure is schematically shown;

[0021] Figure 5 A flowchart of a method for determining a target threshold according to an embodiment of the present disclosure is schematically shown;

[0022] Figure 6 A flowchart of a network monitoring method according to another embodiment of the present disclosure is schematically shown;

[0023] Figure 7 A flowchart of a method for determining a weighted average value according to an embodiment of the present disclosure is schematically shown;

[0024] Figure 8 A schematic diagram of a network monitoring device according to an embodiment of the present disclosure is shown; and

[0025] Fig. 9 A block diagram of an electronic device suitable for implementing a network monitoring method according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0026] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present disclosure. In the following detailed description, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0027] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. The terms "comprise", "include", etc. used herein indicate the existence of the features, steps, operations and / or components, but do not exclude the existence or addition of one or more other features, steps, operations or components.

[0028] All terms (including technical and scientific terms) used herein have the meanings commonly understood by those skilled in the art unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification and should not be interpreted in an idealized or overly rigid manner.

[0029] When using expressions such as "at least one of A, B, and C, etc.", they should generally be interpreted according to the meaning of the expression commonly understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.).

[0030] It should be noted that the network monitoring determination method and device disclosed herein can be used in the field of financial technology and in the field of network management, and can also be used in any field other than the field of financial technology. The application field of the network monitoring method and device disclosed herein is not limited.

[0031] In the technical solution of the present disclosure, the user information (including but not limited to user personal information, user image information, user device information, such as location information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved are all information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data comply with relevant laws, regulations and standards, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0032] In the scenario of using personal information for automated decision-making, the methods, devices, and systems provided by the embodiments of the present disclosure provide users with corresponding operation portals for users to choose to agree or reject the automated decision-making results; if the user chooses to reject, the expert decision-making process will be entered. The expression "automated decision-making" here refers to the activity of automatically analyzing and evaluating a person's behavioral habits, interests and hobbies, or economic, health, credit status, etc. through computer programs, and making decisions. The expression "expert decision-making" here refers to the activity of making decisions by people who specialize in a certain field, have specialized experience, knowledge and skills, and have reached a certain level of professionalism.

[0033] The embodiments of the present disclosure provide a network monitoring method, apparatus, device, medium and program product. Before introducing the technical solutions provided by the embodiments of the present disclosure, the related technologies involved in the present disclosure are first described.

[0034] In related technologies, with the development of informatization in the financial industry, the bank's information system, as a representative of the financial industry's information system, has a relatively complex network structure. In the network, a port is a virtual location on a machine that is open to connections from other machines. Each networked computer / server has a standard number of ports, and each port is reserved for certain types of communications. The complex network traffic is very difficult to handle during the communication process, resulting in high pressure on later operation and maintenance, and heavy system operation and maintenance work.

[0035] For example, as the scale of enterprise networks continues to expand, the management and optimization of network traffic has become increasingly complex. Real-time monitoring of network traffic, identification of abnormal traffic, and timely response have become core requirements for ensuring network stability and security. Usually, network traffic monitoring methods are mainly based on simple threshold judgments or static rules. These methods are prone to false positives or false negatives when facing a dynamically changing network environment, thus affecting the stable operation of the network.

[0036] Before further describing the embodiments of the present disclosure in detail, the nouns and terms involved in the embodiments of the present disclosure are described. The nouns and terms involved in the embodiments of the present disclosure are subject to the following interpretations.

[0037] The EMA (Exponential Moving Average) algorithm is widely used in the smoothing of time series data. It reflects the trend of data changes over time by assigning different weights to historical data. The EMA value (weighted average) represents the weighted average value based on historical data within a certain time window.

[0038] The embodiment of the present disclosure provides a network monitoring method, which includes: obtaining first network traffic information and second network traffic information of a network device port, the first network traffic information represents the traffic data of the port at the current moment, and the second network traffic information represents the traffic data of the port at the historical moment; obtaining a target parameter corresponding to the current moment, the target parameter represents the degree of influence of the network traffic data at the historical moment on the traffic data at the current moment; determining a weighted average value corresponding to the traffic data of the port at the current moment according to the first network traffic information, the second network traffic information and the target parameter; generating prompt information according to the second network traffic information and the weighted average value. By dynamically updating the target parameters in the weighted average algorithm according to the historical traffic data within the historical period, and then analyzing the changes in network traffic in real time according to the dynamic target parameters. Thereby, an adaptive traffic analysis method is realized, providing a more accurate and sensitive network status monitoring and alarm mechanism, and enhancing the stability and security of the network.

[0039] Figure 1 The application scenario diagram of the network monitoring method, apparatus, device, medium and program product according to the embodiments of the present disclosure is schematically shown.

[0040] like Figure 1 As shown, the application scenario 100 according to this embodiment may include a first terminal device 101, a second terminal device 102, a third terminal device 103, a network 104, and a server 105. The network 104 is used to provide a medium for a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. The network 104 may include various connection types, such as wired, wireless communication links, or optical fiber cables, etc.

[0041] The user can use the first terminal device 101, the second terminal device 102, and the third terminal device 103 to interact with the server 105 through the network 104 to receive or send messages, etc. Various communication client applications can be installed on the first terminal device 101, the second terminal device 102, and the third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only for example).

[0042] The first terminal device 101, the second terminal device 102, and the third terminal device 103 may be various electronic devices having display screens and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, and the like.

[0043] The server 105 may be a server that provides various services, such as a background management server (only as an example) that provides support for websites browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103. The background management server may analyze and process the received data such as user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal device.

[0044] It should be noted that the network monitoring method provided in the embodiment of the present disclosure can generally be executed by the server 105. Accordingly, the network monitoring device provided in the embodiment of the present disclosure can generally be set in the server 105. The network monitoring method provided in the embodiment of the present disclosure can also be executed by a server or server cluster that is different from the server 105 and can communicate with the first terminal device 101, the second terminal device 102, the third terminal device 103 and / or the server 105. Accordingly, the network monitoring device provided in the embodiment of the present disclosure can also be set in a server or server cluster that is different from the server 105 and can communicate with the first terminal device 101, the second terminal device 102, the third terminal device 103 and / or the server 105.

[0045] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0046] The following will be based on Figure 1 The scene described by Figure 2~Figure 7 The network monitoring method of the disclosed embodiment is described in detail.

[0047] Figure 2 The flowchart of the network monitoring method according to the embodiment of the present disclosure is schematically shown.

[0048] like Figure 2 As shown, the network monitoring method of this embodiment includes operations S210 to S240.

[0049] In operation S210, first network traffic information and second network traffic information of a port of a network device are obtained, wherein the first network traffic information represents traffic data of the port at a current moment, and the second network traffic information represents traffic data of the port at a historical moment.

[0050] Exemplarily, a real-time monitoring tool in the network system can be used to monitor multiple network devices in the network system in real time. For example, a port traffic monitoring module in the real-time monitoring tool can monitor the inflow and outflow of port traffic in real time.

[0051] Network devices can be hardware devices responsible for data transmission, processing or management in a computer network, for example, routers, network cards, switches, etc.

[0052] A port is a physical or virtual interface that can connect to other devices or systems. The function of a port is to enable data communication between network devices and external devices. For example, Ethernet ports, fiber optic ports, serial ports, etc. For example, a router or switch usually has multiple Ethernet ports.

[0053] The first network traffic information may be the network traffic situation of the network device port at the current moment, that is, at this moment.

[0054] The second network traffic information may be the traffic data of the network device port at a certain historical moment in the past. Different from the "first network traffic information", this part of information is not the traffic at the current moment, but data related to a known past moment.

[0055] In operation S220, a target parameter corresponding to the current moment is obtained, where the target parameter represents the degree of influence of the network traffic data at the historical moment on the traffic data at the current moment.

[0056] For example, when the weighted average value of the traffic data is calculated by the EMA algorithm, the EMA value corresponding to the current moment can be calculated based on the traffic data at the current moment and the network traffic data at the historical moment. The target parameter can be the smoothing factor in the EMA value calculation formula, that is, the weight α of the traffic data at the current moment, and the network traffic data at the historical moment can be represented by 1-α.

[0057] In another embodiment, the target parameter may further include a first target parameter and a second target parameter, wherein the first target parameter represents the weight of the flow data at the current moment, and the second target parameter represents the weight of the flow data at the historical moment.

[0058] In operation S230, a weighted average value corresponding to the traffic data of the port at the current moment is determined according to the first network traffic information, the second network traffic information, and the target parameter.

[0059] Exemplarily, the weighted average value corresponding to the flow data of the port at the current moment may be calculated according to the following calculation formula.

[0060]

[0061] Among them, EMA t is the EMA value at the current time t, EMA t-1 is the EMA value at the historical time t-1, X tis the traffic data at the current time t (i.e., the first network traffic information), α is the smoothing factor (i.e., the target parameter), and α takes a value between 0 and 1.

[0062] The larger the value of the target parameter α, the greater the weight of the new data.

[0063] In operation S240, prompt information is generated according to the second network traffic information and the weighted average value.

[0064] For example, the change of EMA value can be used to judge the quality of network status. When the EMA value of traffic data increases or decreases rapidly, it may indicate that the network is abnormal and needs to be handled in time. For example, if the EMA value at the current moment suddenly increases or decreases compared to the EMA value at the previous moment, it may indicate that the network is abnormal (for example: attack, large amount of data influx, network failure, etc.). According to the fluctuation of EMA value, the system can generate early warning in time and notify the administrator to handle it.

[0065] For example, traffic anomalies can also be determined by comparing the deviation between the current EMA value and the current traffic value. If the deviation exceeds the set threshold, it is an anomaly (for example: attack, large amount of data influx, network failure, etc.). The system can generate an early warning in time and notify the administrator to handle it.

[0066] It can be understood that by dynamically updating the target parameters in the weighted average algorithm based on the historical traffic data in the historical period, and then analyzing the changes in network traffic in real time based on the dynamic target parameters, an adaptive traffic analysis method is implemented, providing a more accurate and sensitive network status monitoring and alarm mechanism, and enhancing the stability and security of the network.

[0067] Figure 3 The flowchart of the method for determining target parameters according to an embodiment of the present disclosure is schematically shown.

[0068] As described above, in operation S220, the target parameter corresponding to the current moment is obtained. In one possible implementation, Figure 3 As shown, the operation may further include operation S221 to operation S223.

[0069] In operation S221, historical network traffic information of a network device port at multiple historical moments in a historical period is obtained.

[0070] In operation S222 , a first intermediate value is determined according to the historical network traffic data, where the first intermediate value represents a variance of the historical network traffic data.

[0071] In operation S223, a target parameter is determined according to the first intermediate value.

[0072] Exemplarily, the target parameter (smoothing factor) can be calculated based on the network traffic information (historical network traffic information) at multiple historical moments. For example, the historical period can be set to the traffic data per minute within 10 minutes before the current moment. When the current moment is 10:00, the historical period can be the traffic data per minute from 9:50 to 10:00. For example, the traffic data at 9:50, the traffic data at 9:51, the traffic data at 9:52… The traffic data at ten historical moments are obtained as the historical network traffic information. Whenever the current moment changes, multiple historical moments can change according to the change of the current moment. For example, when the current moment is 10:10, the historical period can be the traffic data per minute from 10:00 to 10:10, for example, the traffic data at 10:00, the traffic data at 10:01, the traffic data at 10:02….

[0073] According to the port flow data at multiple historical moments obtained in the historical period, the variance of the historical network flow information in the historical period is calculated to obtain a first intermediate value.

[0074] The target parameters are calculated according to the following formula:

[0075]

[0076] Among them, α t is the target parameter at the current time t, μ is the first adjustment coefficient, They represent the traffic data of multiple historical moments with a time interval of k before the current moment t, and Var represents the variance.

[0077] The first adjustment coefficient μ can be adjusted according to the actual working conditions of the network system. For example, the first adjustment coefficient μ can be 3 or 2.

[0078] It should be noted that the embodiments of the present disclosure do not impose specific limitations on the historical cycle, the number and interval of historical moments (for example, historical moments are taken at intervals of 1 minute), and the setting of the first adjustment coefficient, which can be set according to the actual application scenario of the network system.

[0079] It is understandable that as the current moment changes, the target parameters also change. Real-time analysis of changes in network traffic dynamically updates the target parameters. This enables an adaptive traffic analysis method, provides a more accurate and sensitive network status monitoring and alarm mechanism, and enhances network stability and security.

[0080] Figure 4 A flowchart of determination based on the second network traffic information and the weighted average according to an embodiment of the present disclosure is schematically shown.

[0081] As described above, in operation S240, prompt information is generated based on the second network traffic information and the weighted average. Figure 4 As shown, the operation may further include operation S241 to operation S245.

[0082] In operation S241, a fluctuation value is determined according to the second network traffic information and the weighted average value.

[0083] In operation S242, a target threshold corresponding to the current moment is acquired.

[0084] In operation S243, it is determined whether the fluctuation value is greater than a target threshold.

[0085] In operation S244, when the fluctuation value is greater than the target threshold, a warning prompt is generated.

[0086] In operation S245 , when the fluctuation value is less than the target threshold, traffic is allocated to the multiple running services in sequence according to the priorities of the multiple running services.

[0087] Exemplarily, the difference between the network traffic information (second network traffic information) at the current moment and the EMA value (weighted average) is calculated to obtain the fluctuation value. The target threshold corresponding to the current moment is obtained. The target threshold is continuously updated with the change of time, and the target threshold at different moments may be different. The calculated fluctuation values ​​of each port are compared with the target threshold. When the fluctuation value of the first port is greater than the target threshold, it can be considered that the traffic of the first port at the current moment is abnormal, and an early warning can be formed to notify the management personnel to deal with it in time. . When the fluctuation value of the first port is continuously less than the target threshold for multiple moments, it means that the traffic of the first port is gradually decreasing, and traffic can be allocated to multiple running services in turn according to the priorities of the multiple running services currently running on the network device. The allocation of traffic to multiple running services in turn according to priority can be specifically described as follows. Figure 6 The description will not be repeated here.

[0088] Figure 5 The flowchart of the method for determining a target threshold according to an embodiment of the present disclosure is schematically shown.

[0089] As described above, in operation S242, prompt information is generated based on the second network traffic information and the weighted average value. Figure 5 As shown, the operation may further include operation S2421 to operation S2423.

[0090] In operation S2421, historical network traffic information of a network device port at multiple historical moments in a historical period is obtained.

[0091] In operation S2422, a second intermediate value and a third intermediate value are determined based on the historical network traffic data, wherein the second intermediate value represents a standard deviation of the historical network traffic data, and the third intermediate value represents an average value of the historical network traffic data.

[0092] In operation S2423, a target threshold is determined based on the second intermediate value and the third intermediate value.

[0093] Exemplarily, the target threshold value may be calculated based on network traffic information at multiple historical moments (historical network traffic information). For example, the historical period may be the same as the historical period set by the target parameter.

[0094] According to the port traffic data at multiple historical moments obtained in the historical period, the average value of the historical network traffic information in the historical period is calculated to obtain the second intermediate value (X0).

[0095] According to the port traffic data at multiple historical moments obtained in the historical period, the standard deviation of the historical network traffic information in the historical period is calculated to obtain the third median value (σ).

[0096] The target parameters are calculated according to the following formula:

[0097]

[0098] Among them, T is the target threshold at the current time t, X0 represents the average value of the flow data of multiple historical moments with a time interval of k before the current time t, β represents the second adjustment coefficient, and σ represents the standard deviation of the flow data of multiple historical moments with a time interval of k before the current time t.

[0099] The first adjustment coefficient β can be adjusted according to the actual working conditions of the network system. For example, the first adjustment coefficient β can be 5 or 2. A larger β makes the target threshold more relaxed and allows for larger fluctuations; a smaller β makes the threshold more stringent and sensitive to smaller fluctuations. By adjusting β, the detection sensitivity of traffic anomalies can be controlled.

[0100] It is understandable that the target threshold changes with the change of the current moment. The target threshold is dynamically updated by analyzing the changes of network traffic in real time. This realizes an adaptive traffic analysis method, provides a more accurate and sensitive network status monitoring and alarm mechanism, and enhances the stability and security of the network.

[0101] Figure 6 The flowchart of a network monitoring method according to another embodiment of the present disclosure is schematically shown.

[0102] As mentioned above, the network monitoring method, such as Figure 6 As shown, the method may further include operations S310 to S350.

[0103] In operation S310, it is determined whether the fluctuation value is greater than a target threshold.

[0104] In operation S320, when the fluctuation value is less than the target threshold, identification information of multiple running services in the network device is obtained.

[0105] In operation S330, priorities respectively corresponding to the plurality of running services are generated according to the identification information.

[0106] In operation S340, traffic is allocated to the multiple running services in order from low to high priority of the multiple running services.

[0107] In operation S350, when the fluctuation value is greater than the target threshold, traffic is allocated to the multiple running services in order from high to low priority of the multiple running services.

[0108] Exemplarily, for example, the protocol information of each running service can be obtained as identification information, and when the identification information of the running service is a voice protocol, it is set to the first priority; when the identification information of the running service is a video protocol, it is set to the second priority; when the identification information of the running service is a data protocol (for example, file download, web browsing, etc.), it is set to the third priority. The first priority is greater than the second priority, which is greater than the third priority. In other embodiments, the priority can also be set according to the size of the traffic consumed by the running service. When the traffic consumed by the running service is greater than 2G, it is set to the first priority. When the traffic consumed by the running service is less than 2G, it is set to the second priority. The first priority is greater than the second priority. The embodiment of the present disclosure does not specifically limit the setting of the priority, and it can be set according to the actual application situation.

[0109] Calculate the difference between the network traffic information (second network traffic information) of the first port at the current moment and the EMA value (weighted average) to obtain the fluctuation value. When the fluctuation value of the first port is continuously less than the target threshold, it indicates that the traffic of the first port is gradually decreasing and showing a downward trend. This indicates that the current traffic is low and there may be idle resources in the system. At this time, obtain the identification information of multiple running services currently running in the network device. Determine the priority of each running service. When the fluctuation value of the first port is continuously less than the target threshold, check whether there is a backlog of low-priority requests and try to process some low-priority tasks when the traffic is reduced. This ensures that the system can efficiently process the backlog of low-priority requests when the traffic is low, ensuring the efficient operation of the system.

[0110] When the fluctuation value of the first port is continuously greater than the target threshold, it indicates that the traffic of the first port is gradually increasing and showing an upward trend. This indicates that the current traffic is high and the system may be overloaded. At this time, the identification information of multiple running services currently running in the network device is obtained. The priority of each running service is determined.

[0111] Traffic is allocated in order of priority from high to low, that is, high-priority running services are given priority to obtain more or better network resources (such as traffic). When network resources are limited or fluctuating, the system will allocate network bandwidth according to the predetermined priority order. First, more bandwidth is allocated to high-priority running services, and then the remaining resources are allocated to low-priority services. Prioritize critical tasks or high-priority requests, and postpone or delay low-priority requests to avoid system crashes.

[0112] In some embodiments, when the first service traffic allocated to the first operating service is greater than the second service traffic consumed by the first operating service at the current moment, the remaining traffic is allocated to the second operating service, and the remaining traffic represents the difference between the first service traffic and the second service traffic, and the priority of the first operating service is greater than the priority of the second operating service.

[0113] Exemplarily, the first service flow may refer to the flow allocated to the first running service. It can be understood as the flow allocated by the system to the first service. The second service flow may refer to the flow consumed during the actual operation of the first running service at the current moment. The remaining flow may be the difference between the first service flow and the second service flow at the current moment, that is, the allocated part of the flow that is not consumed by the first running service.

[0114] The excess traffic of the first service will be reallocated to the traffic of the second service to help the second service fill its insufficient traffic demand. The first service has a higher priority in resource allocation. If a conflict or insufficient resources occur, the system will give priority to meeting the needs of the first service. In this case, even if the remaining traffic is allocated to the second service, if there is any traffic contention, the first service will get priority to resources to ensure that its business will not be affected.

[0115] It is understandable that by performing multi-level distribution of the remaining traffic, the system can ensure that the traffic needs of important businesses are met first under multi-tasking or multi-business loads to avoid traffic waste, and it can also reasonably allocate resources to optimize the performance of the overall network or system.

[0116] Figure 7 The flowchart of the method for determining the weighted average value according to the embodiment of the present disclosure is schematically shown.

[0117] As described above, in operation S230, a weighted average value corresponding to the flow data of the port at the current moment is determined based on the first network flow information, the second network flow information and the target parameter. Figure 7 As shown, the operation may further include operation S231 to operation S233.

[0118] In operation S231, a first comprehensive value is determined according to the target parameter and the first network traffic information.

[0119] In operation S232, a second comprehensive value is determined according to the target parameter and the second network traffic information.

[0120] In operation S233, a weighted average value is determined based on the first integrated value and the second integrated value.

[0121] For example, the weighted average is calculated as follows:

[0122]

[0123] Among them, EMA t is the EMA value at the current time t, EMA t-1 is the EMA value at the historical time t-1, X t is the traffic data at the current time t (i.e., the first network traffic information), α is the smoothing factor (i.e., the target parameter), and α takes a value between 0 and 1.

[0124] According to the product of the target parameter α and the first network traffic information at the current moment, the first comprehensive value α*X is obtained. t According to the target parameter α and the weighted average of historical moments (EMA t-1 ) to obtain the first comprehensive value, namely (1-α)*X t , add the first comprehensive value and the second comprehensive value to get the EMA value at the current time t, that is, EMA t .

[0125] Based on the above network monitoring method, the present disclosure also provides a network monitoring device. Figure 8 The device is described in detail.

[0126] Figure 8 The structural block diagram of the network monitoring device according to the embodiment of the present disclosure is schematically shown.

[0127] like Figure 8 As shown, the network monitoring device 400 of this embodiment includes a first acquisition module 410 , a second acquisition module 420 , a determination module 430 and a generation module 440 .

[0128] The first acquisition module 410 is used to acquire first network traffic information and second network traffic information of a network device port, wherein the first network traffic information represents traffic data of the port at the current moment, and the second network traffic information represents traffic data of the port at a historical moment. In one embodiment, the first acquisition module 410 can be used to perform the operation S210 described above, which will not be described in detail here.

[0129] The second acquisition module 420 is used to acquire a target parameter corresponding to the current moment, and the target parameter represents the degree of influence of the network traffic data at the historical moment on the traffic data at the current moment. In one embodiment, the second acquisition module 420 can be used to perform the operation S220 described above, which will not be repeated here.

[0130] The determination module 430 is used to determine the weighted average value corresponding to the flow data of the port at the current moment according to the first network flow information, the second network flow information and the target parameter. In one embodiment, the determination module 430 can be used to perform the operation S230 described above, which will not be repeated here.

[0131] The generating module 440 is used to generate prompt information according to the second network flow information and the weighted average value. In one embodiment, the generating module 440 can be used to perform the operation S240 described above, which will not be described in detail here.

[0132] According to an embodiment of the present disclosure, any multiple modules of the first acquisition module 410, the second acquisition module 420, the determination module 430, and the generation module 440 can be combined into one module for implementation, or any one of the modules can be split into multiple modules. Alternatively, at least part of the functions of one or more of these modules can be combined with at least part of the functions of other modules and implemented in one module. According to an embodiment of the present disclosure, at least one of the first acquisition module 410, the second acquisition module 420, the determination module 430, and the generation module 440 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application specific integrated circuit (ASIC), or can be implemented by hardware or firmware such as any other reasonable way of integrating or packaging the circuit, or implemented in any one of the three implementation methods of software, hardware, and firmware, or in a suitable combination of any of them. Alternatively, at least one of the first acquisition module 410 , the second acquisition module 420 , the determination module 430 , and the generation module 440 may be at least partially implemented as a computer program module, and when the computer program module is executed, a corresponding function may be performed.

[0133] Fig. 9 A block diagram of an electronic device suitable for implementing a network monitoring method according to an embodiment of the present disclosure is schematically shown.

[0134] like Fig. 9 As shown, the electronic device 500 according to an embodiment of the present disclosure includes a processor 501, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 502 or a program loaded from a storage part 508 to a random access memory (RAM) 503. The processor 501 may include, for example, a general-purpose microprocessor (such as a CPU), an instruction set processor and / or a related chipset and / or a special-purpose microprocessor (for example, an application-specific integrated circuit (ASIC)), etc. The processor 501 may also include an onboard memory for caching purposes. The processor 501 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0135] In RAM 503, various programs and data required for the operation of electronic device 500 are stored. Processor 501, ROM 502 and RAM 503 are connected to each other via bus 504. Processor 501 performs various operations of the method flow according to the embodiment of the present disclosure by executing the program in ROM 502 and / or RAM 503. It should be noted that the program can also be stored in one or more memories other than ROM 502 and RAM 503. Processor 501 can also perform various operations of the method flow according to the embodiment of the present disclosure by executing the program stored in one or more memories.

[0136] According to an embodiment of the present disclosure, the electronic device 500 may further include an input / output (I / O) interface 505, which is also connected to the bus 504. The electronic device 500 may further include one or more of the following components connected to the input / output (I / O) interface 505: an input portion 506 including a keyboard, a mouse, etc.; an output portion 507 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage portion 508 including a hard disk, etc.; and a communication portion 509 including a network interface card such as a LAN card, a modem, etc. The communication portion 509 performs communication processing via a network such as the Internet. A drive 510 is also connected to the input / output (I / O) interface 505 as needed. A removable medium 511, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 510 as needed, so that a computer program read therefrom is installed into the storage portion 508 as needed.

[0137] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or may exist independently without being assembled into the device / apparatus / system. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed, the method according to the embodiment of the present disclosure is implemented.

[0138] According to an embodiment of the present disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium, for example, it may include but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, an apparatus or a device. For example, according to an embodiment of the present disclosure, the computer-readable storage medium may include the ROM 502 and / or RAM 503 described above and / or one or more memories other than ROM 502 and RAM 503.

[0139] The embodiment of the present disclosure also includes a computer program product, which includes a computer program, and the computer program contains program code for executing the method shown in the flowchart. When the computer program product is run in a computer system, the program code is used to enable the computer system to implement the network monitoring method provided by the embodiment of the present disclosure.

[0140] The above functions defined in the system / device of the embodiment of the present disclosure are performed when the computer program is executed by the processor 501. According to the embodiment of the present disclosure, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0141] In one embodiment, the computer program may rely on tangible storage media such as optical storage devices, magnetic storage devices, etc. In another embodiment, the computer program may also be transmitted and distributed in the form of signals on a network medium, and downloaded and installed through the communication part 509, and / or installed from the removable medium 511. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0142] In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 509, and / or installed from the removable medium 511. When the computer program is executed by the processor 501, the above functions defined in the system of the embodiment of the present disclosure are performed. According to the embodiment of the present disclosure, the system, device, means, module, unit, etc. described above can be implemented by a computer program module.

[0143] According to an embodiment of the present disclosure, the program code for executing the computer program provided by the embodiment of the present disclosure can be written in any combination of one or more programming languages. Specifically, these computing programs can be implemented using high-level process and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, Java, C++, python, "C" language or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on the remote computing device, or entirely on the remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using an Internet service provider to connect through the Internet).

[0144] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0145] It will be appreciated by those skilled in the art that the features described in the various embodiments of the present disclosure may be combined and / or combined in a variety of ways, even if such combinations or combinations are not explicitly described in the present disclosure. In particular, without departing from the spirit and teachings of the present disclosure, the features described in the various embodiments of the present disclosure may be combined and / or combined in a variety of ways. All of these combinations and / or combinations fall within the scope of the present disclosure.

[0146] The embodiments of the present disclosure are described above. However, these embodiments are only for illustrative purposes and are not intended to limit the scope of the present disclosure. Although the embodiments are described above, this does not mean that the measures in the various embodiments cannot be used in combination to advantage. Without departing from the scope of the present disclosure, those skilled in the art may make a variety of substitutions and modifications, which should all fall within the scope of the present disclosure.

Claims

1. A network monitoring method, characterized in that: The method comprises: Acquire first network traffic information and second network traffic information of a network device port, wherein the first network traffic information represents traffic data of the port at a current moment, and the second network traffic information represents traffic data of the port at a historical moment; Acquire a target parameter corresponding to the current moment, wherein the target parameter represents the degree of influence of network traffic data at a historical moment on traffic data at the current moment; Determine a weighted average value corresponding to the flow data of the port at the current moment according to the first network flow information, the second network flow information and the target parameter; Prompt information is generated according to the second network traffic information and the weighted average value.

2. The method according to claim 1, characterized in that The acquiring of the target parameter corresponding to the current moment includes: Obtain historical network traffic information of network device ports at multiple historical moments within a historical period; Determine a first intermediate value according to the historical network traffic data, wherein the first intermediate value represents a variance of the historical network traffic data; The target parameter is determined according to the first intermediate value.

3. The method according to claim 1, characterized in that The generating prompt information according to the second network traffic information and the weighted average value includes: Determining a fluctuation value according to the second network traffic information and the weighted average value; Obtaining a target threshold corresponding to the current moment; When the fluctuation value is greater than the target threshold, an early warning prompt is generated.

4. The method according to claim 1, characterized in that The obtaining of the target threshold corresponding to the current moment includes: Obtain historical network traffic information of network device ports at multiple historical moments within a historical period; Determine a second intermediate value and a third intermediate value according to the historical network traffic data, wherein the second intermediate value represents a standard deviation of the historical network traffic data, and the third intermediate value represents an average value of the historical network traffic data; The target threshold is determined according to the second intermediate value and the third intermediate value.

5. The method according to claim 3, characterized in that: The method further comprises: When the fluctuation value is less than the target threshold, obtaining identification information of multiple running services in the network device; Generating priorities corresponding to the multiple running services respectively according to the identification information; Allocate traffic to the multiple running services in order according to the priority of the multiple running services from low to high.

6. The method according to claim 5, characterized in that The method further comprises: When the fluctuation value is greater than the target threshold, traffic is allocated to the multiple running services in order from high to low priority of the multiple running services.

7. The method according to claim 6, characterized in that When the first service flow allocated to the first operating service is greater than the second service flow consumed by the first operating service at the current moment, the remaining flow is allocated to the second operating service, and the remaining flow represents the difference between the first service flow and the second service flow. The priority of the first operating service is greater than the priority of the second operating service.

8. The method according to claim 1, characterized in that The step of determining a weighted average value corresponding to the flow data of the port at the current moment according to the first network flow information, the second network flow information and the target parameter includes: Determining a first comprehensive value according to the target parameter and the first network traffic information; Determining a second comprehensive value according to the target parameter and the second network traffic information; The weighted average value is determined according to the first comprehensive value and the second comprehensive value.

9. A network monitoring device, characterized in that: The device comprises: A first acquisition module, used to acquire first network flow information and second network flow information of a port of a network device, wherein the first network flow information represents flow data of the port at a current moment, and the second network flow information represents flow data of the port at a historical moment; A second acquisition module is used to acquire a target parameter corresponding to the current moment, wherein the target parameter represents the degree of influence of the network traffic data at the historical moment on the traffic data at the current moment; a determination module, configured to determine a weighted average value corresponding to the flow data of the port at a current moment according to the first network flow information, the second network flow information and the target parameter; and A generating module is used to generate prompt information according to the second network traffic information and the weighted average value.

10. An electronic device, comprising: one or more processors; a memory for storing one or more computer programs, It is characterized in that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 8.

11. A computer-readable storage medium having a computer program or instruction stored thereon, characterized in that: When the computer program or instruction is executed by a processor, the steps of the method according to any one of claims 1 to 8 are implemented.

12. A computer program product comprising a computer program or instructions, characterized in that When the computer program or instruction is executed by a processor, the steps of the method according to any one of claims 1 to 8 are implemented.

Images