Network state monitoring method and device, electronic equipment and storage medium

Abstract

The invention relates to the field of network monitoring, and provides a network state monitoring method and device, electronic equipment and a storage medium. The configuration information, the routing information, the ICMP timeout information and the TCP handshake signal response information of a plurality of nodes forming the network are subjected to data comprehensive analysis to judge whether the current network connection is abnormal or not. Therefore, the state of network connection can be judged comprehensively and accurately, potential abnormity can be identified, and the effectiveness of network monitoring can be effectively improved.

Description

Technical Field

[0001] The present application relates to the field of network monitoring, and more specifically, to a network status monitoring method, device, electronic device and storage medium. Background Art

[0002] Nowadays, in order to improve the convenience of network services, network service providers usually choose to deploy distributed networks. A distributed network is a network architecture consisting of multiple independent nodes that are distributed in different geographical locations and connected to each other through a communication network. It has the characteristics of decentralization, scalability, load balancing, etc., and has been widely used in cloud computing, big data processing, blockchain technology and other fields.

[0003] In a distributed network, the network connection status is affected by multiple factors. Traditional monitoring methods can often only focus on one or two factors separately, and it is difficult to conduct a comprehensive and integrated analysis of these many different types of factors, which makes it impossible to accurately judge the true status of the network connection.

[0004] Therefore, an optimized network status monitoring solution is needed. Summary of the invention

[0005] In view of the shortcomings of the prior art, the present application provides a network status monitoring method, device, electronic device and storage medium.

[0006] According to one aspect of the present application, a network status monitoring method is provided, which includes:

[0007] Obtain configuration information, routing information, ICMP timeout information, and TCP handshake signal response information of multiple nodes constituting the network;

[0008] Performing data preprocessing on the configuration information, routing information, ICMP timeout information and TCP handshake signal response information of the plurality of nodes to obtain a plurality of node status information after preprocessing;

[0009] Performing node state representation processing on the preprocessed multiple node state information to obtain a node state semantic fusion feature matrix;

[0010] Based on the node state semantic fusion feature matrix, the recognition result of the network connection state is obtained.

[0011] In the above-mentioned network status monitoring method, node status representation processing is performed on the multiple node status information after preprocessing to obtain a node status semantic fusion feature matrix, including: performing preliminary feature extraction processing on the multiple node status information after preprocessing to obtain multiple node status semantic feature vectors; arranging the multiple node status semantic feature vectors in two dimensions into a node status semantic feature matrix; performing feature emphasis processing on the node status semantic feature matrix to obtain a node status semantic emphasis feature matrix; and fusing the node status semantic feature matrix and the node status semantic emphasis feature matrix to obtain the node status semantic fusion feature matrix.

[0012] In the above-mentioned network status monitoring method, preliminary feature extraction processing is performed on the multiple node status information after preprocessing to obtain multiple node status semantic feature vectors, including: each node status information in the multiple node status information after preprocessing is segmented and then passed through a node status semantic feature extractor to obtain the multiple node status semantic feature vectors.

[0013] In the above network status monitoring method, the node status semantic feature matrix is ​​subjected to feature emphasis processing to obtain a node status semantic emphasis feature matrix, including: inputting the node status semantic feature matrix into a node status semantic feature emphasizer to obtain the node status semantic emphasis feature matrix.

[0014] In the above-mentioned network status monitoring method, the node status semantic feature matrix and the node status semantic emphasis feature matrix are fused to obtain the node status semantic fusion feature matrix, including: expanding the node status semantic feature matrix and the node status semantic emphasis feature matrix to obtain a node status semantic feature vector and a node status semantic emphasis feature vector; performing feature intrinsic alignment based on vector norming on the node status semantic feature vector and the node status semantic emphasis feature vector to obtain a node status semantic fusion feature vector; and performing dimension reconstruction on the node status semantic fusion feature vector to obtain the node status semantic fusion feature matrix.

[0015] In the above-mentioned network status monitoring method, the node status semantic feature vector and the node status semantic emphasis feature vector are subjected to feature intrinsic alignment based on vector norming to obtain a node status semantic fusion feature vector, including: performing normalization modulation based on vector norming on the node status semantic feature vector and the node status semantic emphasis feature vector to obtain a pre-aligned node status semantic feature vector and a pre-aligned node status semantic emphasis feature vector; performing intrinsic feature extraction on the pre-aligned node status semantic feature vector and the pre-aligned node status semantic emphasis feature vector to obtain a first node status semantic principal component feature vector and a second node status semantic principal component feature vector; performing intrinsic fine-grained alignment and fusion on the first node status semantic principal component feature vector and the second node status semantic principal component feature vector to obtain the node status semantic fusion feature vector.

[0016] In the above-mentioned network status monitoring method, based on the node status semantic fusion feature matrix, an identification result of the network connection status is obtained, including: passing the node status semantic fusion feature matrix through a classifier-based connection status anomaly identifier to obtain the identification result, and the identification result is used to indicate whether there is an abnormality in the network connection.

[0017] According to another aspect of the present application, there is provided a network status monitoring device, comprising:

[0018] The network node information collection module is used to obtain the configuration information, routing information, ICMP timeout information and TCP handshake signal response information of multiple nodes constituting the network;

[0019] A network node information preprocessing module, used for performing data preprocessing on the configuration information, routing information, ICMP timeout information and TCP handshake signal response information of the plurality of nodes to obtain a plurality of node status information after preprocessing;

[0020] A network node state feature extraction module is used to perform node state representation processing on the preprocessed multiple node state information to obtain a node state semantic fusion feature matrix;

[0021] The network connection status recognition result generation module is used to obtain the recognition result of the network connection status based on the node status semantic fusion feature matrix.

[0022] According to another aspect of the present application, an electronic device is provided, comprising a memory and a processor coupled to the memory, wherein the processor is configured to execute the network status monitoring method as described in any one of the above items based on instructions stored in the memory.

[0023] According to another aspect of the present application, a readable storage medium is provided, on which computer program instructions are stored, wherein the computer program instructions, when executed by a processor, implement the network status monitoring method as described in any one of the above items.

[0024] This application has significant technical effects due to the adoption of the above technical solutions:

[0025] The network status monitoring method, device, electronic device and storage medium provided by the present application adopt data analysis and processing technology based on artificial intelligence, and judge whether there is an abnormality in the current network connection by performing data comprehensive analysis on the configuration information, routing information, ICMP timeout information and TCP handshake signal response information of multiple nodes constituting the network. In this way, the status of the network connection can be comprehensively and accurately judged, potential anomalies can be identified, and the effectiveness of network monitoring can be effectively improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] By describing the embodiments of the present application in more detail in conjunction with the accompanying drawings, the above and other purposes, features and advantages of the present application will become more apparent. The accompanying drawings are used to provide a further understanding of the embodiments of the present application and constitute a part of the specification. Together with the embodiments of the present application, they are used to explain the present application and do not constitute a limitation of the present application. In the accompanying drawings, the same reference numerals generally represent the same components or steps.

[0027] Figure 1 Flowchart of a network status monitoring method according to an embodiment of the present application.

[0028] Figure 2 The present invention is a flowchart of performing node state representation processing on the pre-processed multiple node state information to obtain a node state semantic fusion feature matrix in a network state monitoring method according to an embodiment of the present application.

[0029] Figure 3 is a block diagram of a network status monitoring device according to an embodiment of the present application.

[0030] Figure 4 is a block diagram of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0031] Below, the exemplary embodiments according to the present application will be described in detail with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments of the present application, and it should be understood that the present application is not limited to the exemplary embodiments described here.

[0032] In today's era of rapid digital development, the Internet has penetrated into every aspect of people's lives and work, and people's requirements for the convenience of network services are also increasing. Whether it is daily online office, online shopping, smooth playback of high-definition videos, or real-time battles in large-scale online games, they all rely on stable and efficient network services. In this context, network service providers usually choose to deploy distributed networks to meet the needs of the public.

[0033] Distributed networks achieve decentralization, scalability and load balancing by deploying multiple independent nodes in different geographical locations and interconnecting them through communication networks. In particular, the application of distributed networks has become an important force in promoting industry development in the fields of cloud computing, big data processing and blockchain technology. The decentralized nature of distributed networks means that network services no longer rely on a single central node, thereby enhancing the network's anti-attack capability and fault tolerance. In terms of scalability, distributed networks can easily expand network capacity by adding nodes to meet growing business needs. Load balancing technology optimizes resource usage, improves throughput, reduces response time and avoids single-point overload problems by intelligently allocating network traffic. For example, on mission-critical servers such as Web servers and FTP servers, the application of load balancing technology has significantly improved the availability and scalability of Internet server programs. In terms of security, distributed networks can effectively defend against network attacks such as SYN Flood attacks and protect backend servers from attacks by setting policies on load balancing devices.

[0034] However, the connection status of a distributed network is affected by many factors. Traditional monitoring methods can only focus on one or two factors, making it difficult to conduct a comprehensive analysis, resulting in an inability to accurately determine the true status of the network connection. Therefore, an optimized network status monitoring solution is desired.

[0035] In recent years, deep learning and neural networks have been widely used in computer vision, natural language processing, text signal processing and other fields. In addition, deep learning and neural networks have also demonstrated a level close to or even beyond that of humans in image classification, object detection, semantic segmentation, text translation and other fields. The development of deep learning and neural networks provides new solutions and solutions for network status monitoring.

[0036] Figure 1 FIG. 1 is a flow chart of a network status monitoring method according to an embodiment of the present application. Figure 1As shown, according to the network status monitoring method of the embodiment of the present application, it includes: S110, obtaining configuration information, routing information, ICMP timeout information and TCP handshake signal response information of multiple nodes constituting the network; S120, performing data preprocessing on the configuration information, routing information, ICMP timeout information and TCP handshake signal response information of the multiple nodes to obtain multiple node status information after preprocessing; S130, performing node status representation processing on the multiple node status information after preprocessing to obtain a node status semantic fusion feature matrix; S140, obtaining an identification result of the network connection status based on the node status semantic fusion feature matrix.

[0037] In step S110, the configuration information, routing information, ICMP timeout information and TCP handshake signal response information of multiple nodes constituting the network are obtained. It should be understood that in a distributed network, "multiple nodes" specifically refer to each independent device or entity constituting the network. These nodes can be network devices such as computers, servers, routers, switches, etc. The configuration information of the node in this application includes the network settings and parameter information of the node, specifically including IP address, DNS settings, subnet mask, etc. The configuration information helps to understand the network environment and potential configuration errors of the node, which may cause connection problems. The routing information of the node specifically refers to the routing table and routing selection information of the node. ICMP timeout information refers to the result of using ICMP information (such as ping command) to test network connectivity. TCP handshake response information refers to information in the process of establishing a TCP connection, which can reflect the connection status between nodes. By acquiring and analyzing the configuration information, routing information, ICMP timeout information and TCP handshake signal response information of multiple nodes, the present application can comprehensively and accurately determine the status of the network connection and identify potential anomalies. This method not only improves the effectiveness of network monitoring, but also provides an important basis for troubleshooting and performance optimization.

[0038] In step S120, data preprocessing is performed on the configuration information, routing information, ICMP timeout information and TCP handshake signal response information of the multiple nodes to obtain multiple node status information after preprocessing. Accordingly, considering that the various information of the nodes comes from different data sources, the data may have inconsistent formats, and the original collected node information may contain invalid, repeated and some erroneous information. In order to clean these noise data and convert the format of the data, in the technical solution of the present application, it is necessary to perform data preprocessing on the configuration information, routing information, ICMP timeout information and TCP handshake signal response information of the multiple nodes. Through the preprocessing step, the original node data can be converted into a unified and planned form to facilitate subsequent processing and analysis, while removing noise and outliers in the data, which helps to ensure the accuracy of subsequent analysis results.

[0039] In step S130, node state representation processing is performed on the preprocessed plurality of node state information to obtain a node state semantic fusion feature matrix. Specifically, Figure 2 The flowchart of the network status monitoring method according to the embodiment of the present application is to perform node status representation processing on the pre-processed multiple node status information to obtain the node status semantic fusion feature matrix. Figure 2 As shown, node state representation processing is performed on the multiple node state information after preprocessing to obtain a node state semantic fusion feature matrix, including: S131, preliminary feature extraction processing is performed on the multiple node state information after preprocessing to obtain multiple node state semantic feature vectors; S132, the multiple node state semantic feature vectors are arranged in two dimensions into a node state semantic feature matrix; S133, feature emphasis processing is performed on the node state semantic feature matrix to obtain a node state semantic emphasis feature matrix; S134, the node state semantic feature matrix and the node state semantic emphasis feature matrix are fused to obtain the node state semantic fusion feature matrix.

[0040] In step S131, the multiple node state information after preprocessing is subjected to preliminary feature extraction processing to obtain multiple node state semantic feature vectors. Specifically, in an embodiment of the present application, the multiple node state information after preprocessing is subjected to preliminary feature extraction processing to obtain multiple node state semantic feature vectors, including: each node state information in the multiple node state information after preprocessing is segmented and then passed through a node state semantic feature extractor to obtain the multiple node state semantic feature vectors. It should be understood that each node state information after preprocessing contains a large amount of text data. These text data representing the node state are often composed of multiple words or phrases. In order to divide the long text data into smaller vocabulary units with clear meanings, so as to more accurately capture the state information of each node, the technical solution of the present application needs to perform word segmentation processing on each node state information. Through word segmentation, the node state information can be analyzed more carefully. Next, in order to effectively extract the context-aware features in the text data after word segmentation, thereby improving the accuracy and efficiency of network state analysis, it is necessary to input each node state information after word segmentation into a node state semantic feature extractor. The node state semantic feature extractor in this application specifically refers to a converter-based semantic encoder that includes a word embedding layer. The encoder uses deep learning technology to map the word-segmented vocabulary units into a continuous vector space, thereby capturing the semantic relationship and contextual information between words, and then effectively understanding the state information of each node, thereby providing strong support for subsequent monitoring and diagnosis.

[0041] In step S132, the multiple node state semantic feature vectors are arranged two-dimensionally into a node state semantic feature matrix. It should be understood that in network status monitoring, we need to comprehensively analyze and monitor the status of multiple nodes. Each node has its unique status information, which is converted into a feature vector by a semantic feature extractor. In order to organize the status features of multiple nodes together, in the technical solution of the present application, multiple node state semantic feature vectors can be arranged two-dimensionally into a node state semantic feature matrix. Each row in the matrix can represent the state feature of a node, and the columns correspond to different dimensions of the feature. Through the two-dimensional arrangement, the data structure is clearer, and this structured form facilitates subsequent calculations and analysis.

[0042] In step S133, the node state semantic feature matrix is ​​subjected to feature emphasis processing to obtain a node state semantic emphasized feature matrix. Specifically, in an embodiment of the present application, the node state semantic feature matrix is ​​subjected to feature emphasis processing to obtain a node state semantic emphasized feature matrix, including: inputting the node state semantic feature matrix into a node state semantic feature emphasizer to obtain the node state semantic emphasized feature matrix. It should be understood that the original node state semantic feature matrix contains a large amount of comprehensive state information of multiple nodes. In order to extract the most important features from this information and remove redundant information to achieve compression and abstraction of node state information, the node state semantic feature matrix can be input into a node state semantic feature emphasizer in the technical solution of the present application to obtain the node state semantic emphasized feature matrix. In the present application, the node state semantic feature emphasizer is a convolutional neural network model using a spatial attention mechanism. Those of ordinary skill in the art should know that convolutional neural network models are good at extracting features from local areas. For the node state semantic feature matrix, the convolutional neural network model can capture local patterns, which helps to identify the relationship between node states. And the spatial attention mechanism allows the model to automatically focus on important feature areas when processing the input matrix. This means that the model can dynamically adjust its focus and enhance its sensitivity to the status of key nodes, which can better capture subtle changes and abnormal patterns in network status, thereby improving the accuracy and reliability of anomaly detection.

[0043] In step S134, the node state semantic feature matrix and the node state semantic emphasis feature matrix are fused to obtain the node state semantic fusion feature matrix. It should be understood that the node state semantic feature matrix is ​​composed of semantically representative feature vectors extracted from the original data, which reflects the more basic and comprehensive semantic features of various aspects of network connection; and the node state semantic emphasis feature matrix is ​​obtained by further processing by the node state semantic feature emphasizer. This matrix highlights some key semantic features that may have a greater impact on the judgment of network connection status, which is a deepening and focusing of the original extracted features. Relying solely on the node state semantic feature matrix, although it can present more comprehensive feature information, it may be difficult to make efficient and accurate judgments based on key features when judging network connection abnormalities in the subsequent judgment due to too much information and insufficient emphasis; and relying solely on the node state semantic emphasis feature matrix, it will lose other useful information for auxiliary judgment due to excessive focus on some key features, resulting in the judgment may not be comprehensive enough. Therefore, in the technical solution of the present application, it is necessary to fuse the node state semantic feature matrix and the node state semantic emphasis feature matrix to combine the advantages of these two feature matrices to achieve more accurate network connection status judgment.

[0044] In particular, considering that the node state semantic feature matrix focuses on capturing the general state information of the node, while the node state semantic emphasis feature matrix focuses more on emphasizing those features that are more critical to the identification of abnormal network connection status. This difference in emphasis leads to the scale difference between the two matrices in feature expression. In machine learning, if the scale range of features is too different, it may cause the model to attach different importance to different features during the training process, thereby affecting the performance of the model. In particular, in gradient-based optimization algorithms, features with larger scales may dominate the direction of the gradient, making the model overly sensitive to these features and ignoring other important features. In other words, the different scale ranges of the node state semantic feature matrix and the node state semantic emphasis feature matrix will lead to the misestimation of the importance of features in subsequent processing. Specifically, when the two matrices are simply merged directly, due to their different scale ranges, the features corresponding to the matrix elements with larger scales may numerically "mask" the features corresponding to the matrix elements with smaller scales, making it difficult for the latter to effectively reflect some relatively weak but perhaps equally important node state semantic information in the merged results, resulting in information loss, which will affect the accuracy of the identification and judgment of abnormal network connection status. In order to solve this problem, a feature intrinsic alignment method based on vector norming is used, which can effectively solve the alignment problem between features of different scales. This method ensures that in the fusion process, not only the original node semantic information is retained, but also the high-level semantic information is accurately transmitted by analyzing and adjusting the intrinsic features in the feature matrix. The node state semantic fusion feature matrix obtained in this way can more accurately reflect the actual situation of the network connection state and provide more reliable data support for subsequent anomaly identification.

[0045] Specifically, in an embodiment of the present application, the node state semantic feature matrix and the node state semantic emphasis feature matrix are fused to obtain the node state semantic fusion feature matrix, including: expanding the node state semantic feature matrix and the node state semantic emphasis feature matrix to obtain a node state semantic feature vector and a node state semantic emphasis feature vector; performing feature intrinsic alignment based on vector norming on the node state semantic feature vector and the node state semantic emphasis feature vector to obtain a node state semantic fusion feature vector; and performing dimensional reconstruction on the node state semantic fusion feature vector to obtain the node state semantic fusion feature matrix.

[0046] More specifically, in an embodiment of the present application, the node state semantic feature vector and the node state semantic emphasis feature vector are subjected to feature intrinsic alignment based on vector norming to obtain a node state semantic fusion feature vector, including: performing normalization modulation based on vector norming on the node state semantic feature vector and the node state semantic emphasis feature vector to obtain a pre-aligned node state semantic feature vector and a pre-aligned node state semantic emphasis feature vector; performing intrinsic feature extraction on the pre-aligned node state semantic feature vector and the pre-aligned node state semantic emphasis feature vector to obtain a first node state semantic principal component feature vector and a second node state semantic principal component feature vector; performing intrinsic fine-grained alignment and fusion on the first node state semantic principal component feature vector and the second node state semantic principal component feature vector to obtain the node state semantic fusion feature vector.

[0047] In an embodiment of the present application, another implementation expression of performing feature intrinsic alignment based on vector norming on the node state semantic feature vector and the node state semantic emphasis feature vector to obtain a node state semantic fusion feature vector can be: processing the node state semantic feature vector and the node state semantic emphasis feature vector according to the following formula to obtain a node state semantic fusion feature vector; wherein the formula is.

[0048]

[0049]

[0050]

[0051]

[0052]

[0053] in, Represents the node state semantic feature vector, Indicates the node state semantics emphasized feature vector, The first node state semantic feature vector The eigenvalues ​​at the positions, The semantics of the node state emphasizes the first The eigenvalues ​​at the positions, represents the natural exponential function, represents the square of the vector's two-norm, represents the pre-aligned node state semantic feature vector, Represents the semantically emphasized feature vector of the pre-aligned node state, represents intrinsic feature extraction, represents the sequence of first eigendecomposition vectors, represents the first diagonal matrix, and Represent the first position and the first diagonal matrix respectively. The eigenvalues ​​at the positions, represents the transpose of a vector, represents vector concatenation, , , The first, second and third sequences of the semantic principal component feature vectors of the first node state are represented respectively. feature vectors, represents the semantic principal component feature vector of the first node state, represents the sequence of the second eigendecomposition vectors, represents the second diagonal matrix, and Represent the first and second positions of the second diagonal matrix respectively. The eigenvalues ​​at the positions, , , The first, second and third sequences of the semantic principal component feature vectors of the second node state are represented respectively. feature vectors, represents the semantic principal component feature vector of the second node state, It means subtracting by position. It means point multiplication by position. It means adding by position. represents point convolution, Represents the semantic fusion feature vector of node status.

[0054] That is, in the technical solution of the present application, the node state semantic feature vector and the node state semantic emphasis feature vector are subjected to feature intrinsic alignment based on vector norming to obtain the node state semantic fusion feature vector, which first performs normalization modulation based on vector norming on the node state semantic feature vector and the node state semantic emphasis feature vector to obtain the pre-aligned node state semantic feature vector and the pre-aligned node state semantic emphasis feature vector. This process is not just for simply adjusting the scale, but an important technology in feature engineering, which aims to solve the problem of inconsistent scales between features in the data set. By calculating the modulus of the feature vector and dividing each vector by its own modulus, it can be ensured that all feature vectors have the same length, thereby eliminating the impact of scale differences between different feature vectors. Normalization processing not only contributes to numerical stability in subsequent processing, but also makes the comparison between feature vectors more fair and reasonable, laying the foundation for subsequent feature alignment. In machine learning models, especially algorithms such as neural networks, the scale of the input features directly affects the speed and direction of weight updates, so normalization can be regarded as a regularization method, which helps to prevent overfitting, and also helps to avoid the problem of gradient disappearance or explosion.

[0055] Next, the pre-aligned node state semantic feature vector and the pre-aligned node state semantic emphasis feature vector are subjected to intrinsic feature extraction to obtain a first node state semantic principal component feature vector and a second node state semantic principal component feature vector. That is, after the normalization modulation is completed, the pre-aligned node state semantic feature vector and the node state semantic emphasis feature vector are subjected to intrinsic feature extraction. As an unsupervised linear dimensionality reduction method, intrinsic feature extraction is widely used in data compression and feature extraction. This process determines the principal components by finding the direction of the maximum variance of the data. These principal components are new coordinate axes in the original feature space and can capture the structure of the data with minimal information loss. It is worth mentioning that by selecting the eigenvectors corresponding to the first few largest eigenvalues, the dimension of the feature space can be effectively reduced while maintaining the key information of the data. This dimensionality reduction can not only accelerate the model training process, but also help the model to generalize better and reduce the impact of noise, thereby improving the performance of the model.

[0056] Finally, the first node state semantic principal component feature vector and the second node state semantic principal component feature vector are intrinsically aligned and fused to obtain the node state semantic fusion feature vector. The goal of this step is to find the best matching point or area between the principal component feature vectors of the two target analysis raw data to achieve alignment between the two. Fine-grained alignment goes beyond the traditional rough fusion methods such as simple weighted average or splicing, and needs to consider the time series characteristics or spatial distribution characteristics of the feature vector. The fusion after alignment is not a simple numerical operation, but requires the design of a specific mechanism to determine how to combine the information of the two feature vectors. This content-based intelligent fusion method can more effectively utilize multi-source information and improve the representation ability and decision-making quality of the model.

[0057] In step S140, based on the node state semantic fusion feature matrix, the recognition result of the network connection state is obtained. Specifically, in an embodiment of the present application, based on the node state semantic fusion feature matrix, the recognition result of the network connection state is obtained, including: passing the node state semantic fusion feature matrix through a connection state abnormality identifier based on a classifier to obtain the recognition result, and the recognition result is used to indicate whether the network connection is abnormal. It should be understood that the node state semantic fusion feature matrix contains the most critical information in the network connection state judgment. In order to automatically judge the network connection state according to the information in the node state semantic fusion feature matrix, the node state semantic fusion feature matrix can be passed through a connection state abnormality identifier based on a classifier. A classifier is a trained machine learning model that can identify potential relationships and patterns in a feature matrix, and then distinguish between normal and abnormal network states. The recognition result obtained by the classifier can be directly used to determine whether the network connection is abnormal. If the recognition result is abnormal, it indicates that there may be a problem with the network connection. Here, the recognition result can also be combined with an early warning mechanism. When the recognition result is abnormal, the early warning mechanism can be automatically triggered to send an alarm message to relevant personnel so that measures can be taken in time to deal with abnormal situations.

[0058] In summary, the network status monitoring method based on the embodiment of the present application is explained, which adopts artificial intelligence-based data analysis and processing technology to perform data comprehensive analysis on the configuration information, routing information, ICMP timeout information and TCP handshake signal response information of multiple nodes constituting the network to determine whether there is an abnormality in the current network connection. In this way, the status of the network connection can be comprehensively and accurately determined, potential anomalies can be identified, and the effectiveness of network monitoring can be effectively improved.

[0059] Figure 3 FIG. 1 is a block diagram of a network status monitoring device according to an embodiment of the present application. Figure 3As shown, according to the network status monitoring device 100 of the embodiment of the present application, it includes: a network node information acquisition module 110, which is used to obtain the configuration information, routing information, ICMP timeout information and TCP handshake signal response information of multiple nodes constituting the network; a network node information preprocessing module 120, which is used to perform data preprocessing on the configuration information, routing information, ICMP timeout information and TCP handshake signal response information of the multiple nodes to obtain multiple node status information after preprocessing; a network node status feature extraction module 130, which is used to perform node status representation processing on the multiple node status information after preprocessing to obtain a node status semantic fusion feature matrix; a network connection status recognition result generation module 140, which is used to obtain a network connection status recognition result based on the node status semantic fusion feature matrix.

[0060] Here, those skilled in the art can understand that the specific functions and operations of the various units and modules in the above-mentioned network status monitoring device 100 have been described in detail above. Figure 1 to Figure 2 The network status monitoring method has been described in detail in the description of the network status monitoring method, and therefore, its repeated description will be omitted.

[0061] In summary, the network status monitoring device 100 based on the embodiment of the present application is explained, which adopts data analysis and processing technology based on artificial intelligence, and performs data comprehensive analysis on the configuration information, routing information, ICMP timeout information and TCP handshake signal response information of multiple nodes constituting the network to determine whether there is an abnormality in the current network connection. In this way, the status of the network connection can be comprehensively and accurately determined, potential abnormalities can be identified, and the effectiveness of network monitoring can be effectively improved.

[0062] Below, reference Figure 4 To describe an electronic device according to an embodiment of the present application. Figure 4 FIG. 1 is a block diagram of an electronic device according to an embodiment of the present application. Figure 4 As shown, the electronic device 10 includes one or more processors 11 and a memory 12 .

[0063] The processor 11 may be a central processing unit (CPU) or other forms of processing units having data processing capabilities and / or instruction execution capabilities, and may control other components in the electronic device 10 to perform desired functions.

[0064] The memory 12 may include one or more computer program products, and the computer program product may include various forms of computer-readable storage media, such as volatile memory and / or non-volatile memory. The volatile memory may include, for example, a random access memory (RAM) and / or a cache memory (cache), etc. The non-volatile memory may include, for example, a read-only memory (ROM), a hard disk, a flash memory, etc. One or more computer program instructions may be stored on the computer-readable storage medium, and the processor 11 may run the program instructions to implement the network status monitoring and / or other desired functions of the various embodiments of the present application described above. Various contents such as configuration information of multiple nodes, routing information, ICMP timeout information, and TCP handshake signal response information may also be stored in the computer-readable storage medium.

[0065] In one example, the electronic device 10 may further include: an input device 13 and an output device 14 , and these components are interconnected via a bus system and / or other forms of connection mechanisms (not shown).

[0066] The input device 13 may include, for example, a keyboard, a mouse, etc.

[0067] The output device 14 can output various information to the outside, including the result of the recognition result of the network connection status, etc. The output device 14 can include, for example, a display, a speaker, a printer, a communication network and a remote output device connected thereto, etc.

[0068] Of course, to simplify, Figure 4 Only some of the components related to the present application in the electronic device 10 are shown, and components such as a bus, an input / output interface, etc. are omitted. In addition, according to specific application situations, the electronic device 10 may also include any other appropriate components.

[0069] In addition to the above-mentioned methods and devices, an embodiment of the present application may also be a computer program product, which includes computer program instructions, which, when executed by a processor, enable the processor to execute the steps of the network status monitoring method according to various embodiments of the present application described in this specification.

[0070] The computer program product may be written in any combination of one or more programming languages ​​to write program codes for performing the operations of the embodiments of the present application, including object-oriented programming languages, such as Java, C++, etc., and conventional procedural programming languages, such as "C" language or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as an independent software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server.

[0071] In addition, an embodiment of the present application may also be a computer-readable storage medium on which computer program instructions are stored. When the computer program instructions are executed by a processor, the processor executes the steps of the network status monitoring method according to various embodiments of the present application described in this specification.

[0072] The computer readable storage medium can adopt any combination of one or more readable media. The readable medium can be a readable signal medium or a readable storage medium. The readable storage medium can include, for example, but is not limited to, a system, device or device of electricity, magnetism, light, electromagnetic, infrared, or semiconductor, or any combination of the above. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

Claims

1. A network status monitoring method, characterized in that: include: Obtain configuration information, routing information, ICMP timeout information, and TCP handshake signal response information of multiple nodes constituting the network; Performing data preprocessing on the configuration information, routing information, ICMP timeout information and TCP handshake signal response information of the plurality of nodes to obtain a plurality of node status information after preprocessing; Performing node state representation processing on the preprocessed multiple node state information to obtain a node state semantic fusion feature matrix; Based on the node state semantic fusion feature matrix, the recognition result of the network connection state is obtained.

2. The network status monitoring method according to claim 1, characterized in that: Performing node state representation processing on the preprocessed multiple node state information to obtain a node state semantic fusion feature matrix, including: Performing preliminary feature extraction processing on the preprocessed plurality of node state information to obtain a plurality of node state semantic feature vectors; Arranging the plurality of node state semantic feature vectors in two dimensions into a node state semantic feature matrix; Performing feature emphasis processing on the node state semantic feature matrix to obtain a node state semantic emphasis feature matrix; The node state semantic feature matrix and the node state semantic emphasis feature matrix are fused to obtain the node state semantic fusion feature matrix.

3. The network status monitoring method according to claim 2, characterized in that: The plurality of preprocessed node state information are subjected to preliminary feature extraction processing to obtain a plurality of node state semantic feature vectors, including: each node state information in the plurality of preprocessed node state information is segmented and then passed through a node state semantic feature extractor to obtain the plurality of node state semantic feature vectors.

4. The network status monitoring method according to claim 3, characterized in that: Performing feature emphasis processing on the node state semantic feature matrix to obtain a node state semantic emphasis feature matrix includes: inputting the node state semantic feature matrix into a node state semantic feature emphasizer to obtain the node state semantic emphasis feature matrix.

5. The network status monitoring method according to claim 4, characterized in that: Fusion of the node state semantic feature matrix and the node state semantic emphasis feature matrix to obtain the node state semantic fusion feature matrix includes: Expanding the node state semantic feature matrix and the node state semantic emphasis feature matrix to obtain a node state semantic feature vector and a node state semantic emphasis feature vector; Performing feature intrinsic alignment based on vector norming on the node state semantic feature vector and the node state semantic emphasis feature vector to obtain a node state semantic fusion feature vector; The node state semantic fusion feature vector is dimensionally reconstructed to obtain the node state semantic fusion feature matrix.

6. The network status monitoring method according to claim 5, characterized in that: Performing feature intrinsic alignment based on vector norming on the node state semantic feature vector and the node state semantic emphasis feature vector to obtain a node state semantic fusion feature vector, including: Performing normalization modulation based on vector norming on the node state semantic feature vector and the node state semantic emphasis feature vector to obtain a pre-aligned node state semantic feature vector and a pre-aligned node state semantic emphasis feature vector; Performing intrinsic feature extraction on the pre-aligned node state semantic feature vector and the pre-aligned node state semantic emphasis feature vector to obtain a first node state semantic principal component feature vector and a second node state semantic principal component feature vector; The first node state semantic principal component feature vector and the second node state semantic principal component feature vector are intrinsically aligned and fused to obtain the node state semantic fusion feature vector.

7. The network status monitoring method according to claim 6, characterized in that: Based on the node state semantic fusion feature matrix, an identification result of the network connection state is obtained, including: the node state semantic fusion feature matrix is ​​passed through a classifier-based connection state anomaly identifier to obtain the identification result, and the identification result is used to indicate whether there is an abnormality in the network connection.

8. A network status monitoring device, characterized in that: include: The network node information collection module is used to obtain the configuration information, routing information, ICMP timeout information and TCP handshake signal response information of multiple nodes constituting the network; A network node information preprocessing module, used for performing data preprocessing on the configuration information, routing information, ICMP timeout information and TCP handshake signal response information of the plurality of nodes to obtain a plurality of node status information after preprocessing; A network node state feature extraction module is used to perform node state representation processing on the preprocessed multiple node state information to obtain a node state semantic fusion feature matrix; The network connection status recognition result generation module is used to obtain the recognition result of the network connection status based on the node status semantic fusion feature matrix.

9. An electronic device comprising a memory and a processor coupled to the memory, characterized in that: The processor is configured to execute the network status monitoring method according to any one of claims 1 to 7 based on the instructions stored in the memory.

10. A readable storage medium having computer program instructions stored thereon, characterized in that: When the computer program instructions are executed by a processor, the network status monitoring method according to any one of claims 1 to 7 is implemented.

Images