A cross-region link anomaly detection method

Abstract

The present disclosure provides a cross-area link anomaly detection method, aiming to solve the problem of lag in identifying cross-area link anomalies in the related art. The method comprises: determining a first coverage area and a second coverage area according to the geographical position of a target node; wherein the target node is located in the second coverage area; using a first probe in the first coverage area to detect the target node to obtain a first link score; preliminarily determining whether there is a cross-area link anomaly in the coverage of the target node to the first coverage area according to the first link score; in the case of a first coverage area with a link anomaly, using a second probe in the second coverage area to detect the target node to obtain a second link score; and determining whether there is a cross-area link anomaly according to the second detection score.

Description

Technical Field

[0001] This disclosure relates to the field of CDN (Content Delivery Network) network technology, and in particular to a method for detecting cross-regional link anomalies. Background Technology

[0002] CDN technology requires the deployment of server nodes of different types and functions, which can distribute network traffic to various nodes, thereby improving data transmission speed and performance, and enabling users across the country to have a faster network experience.

[0003] In CDN edge nodes used for cross-provincial coverage scenarios, due to restrictions on out-of-province traffic by operators or poor performance due to long cross-province links, situations may arise where data access within the province is normal, but data requests from out-of-province areas are restricted. However, related technologies cannot directly perceive the quality of different links through data; typically, the quality of coverage is inferred from user access performance after node coverage is implemented, which introduces a certain degree of lag. Summary of the Invention

[0004] To overcome the problems existing in related technologies, this disclosure provides a method for detecting cross-regional link anomalies. The technical solution of this disclosure is as follows:

[0005] According to a first aspect of the present disclosure, a method for detecting cross-regional link anomalies is provided, comprising:

[0006] Based on the geographical location of the target node, a first coverage area and a second coverage area are determined; wherein the target node is located in the second coverage area;

[0007] Using a first probe in the first coverage area, the target node is detected to obtain a first link score;

[0008] Based on the first link score, it is preliminarily determined whether there is a cross-regional link anomaly in the coverage of the first coverage area by the target node;

[0009] In the case of a first coverage area with link anomalies, the target node is detected using a second probe in the second coverage area to obtain a second link score;

[0010] Based on the second detection score, it is determined whether there is a cross-regional link anomaly.

[0011] Optionally, the target node is detected using a first probe in the first coverage area to obtain a first link score, including:

[0012] Based on the service classification of the target node, determine a first number of target probe addresses;

[0013] A first detection task is obtained based on the first probe and the target detection address; the first probe and the target detection address included in the first detection task have a one-to-one relationship.

[0014] The target node is probed according to the first probe task, and the first link score corresponding to the probe task is obtained.

[0015] Optionally, the target node is detected using a second probe in the second coverage area to obtain a second link score, including:

[0016] Based on the service classification of the target node, determine the second number of test addresses;

[0017] A second detection task is obtained based on the second probe and the test address; the second probe and the test address included in the second detection task have a one-to-one relationship.

[0018] The target node is probed according to the second detection task, and the second link score corresponding to the detection task is obtained.

[0019] Optionally, both the first link score and the second link score include: the first indicator score and the second indicator score;

[0020] The process of detecting the target node using a first probe in the first coverage area to obtain a first link score, and detecting the target node using a second probe in the second coverage area to obtain a second link score, is performed according to the following steps:

[0021] Determine the first indicator processing statement and the second indicator processing statement.

[0022] During the process of probing the target node according to the probing task, the first indicator result and the second indicator result corresponding to the probing task are obtained through the first indicator processing statement and the second indicator processing statement.

[0023] According to the scoring measurement standard, the results of the first indicator and the second indicator are converted to obtain the first indicator score and the second indicator score corresponding to the detection task.

[0024] Optionally, the first probe in the first coverage area is determined according to the following steps:

[0025] Determine the node attributes of the target node; the node attributes include the operator to which the target node belongs and the address protocol of the target node;

[0026] The node attributes and the first coverage area are determined as the target filtering conditions;

[0027] Based on the target filtering criteria, a target probe list for the first coverage area relative to the target node is obtained from the probe list;

[0028] Determine the probe node where each probe in the target probe list is located;

[0029] A third number of probes is determined from each probe node, and the determined probes are designated as the first probes.

[0030] Optionally, the first link score includes a first indicator score and a second indicator score; based on the first link score, it is preliminarily determined whether there is a cross-regional link anomaly in the coverage of the first coverage area by the target node, including:

[0031] Determine the first index score and the second index score corresponding to each first detection task;

[0032] The larger of the first indicator score and the second indicator score is determined as the final score corresponding to the first detection task.

[0033] Based on the respective final scores, determine the first median score and the first interquartile range score corresponding to the first coverage area;

[0034] If the first median score is greater than or equal to the first median score, it is determined that the target node has a link anomaly in the coverage of the first coverage area;

[0035] If the first median score is less than the first median score, it is determined that the target node does not have a link anomaly in the coverage of the first coverage area.

[0036] Optionally, the second probe in the second coverage area is determined according to the following steps:

[0037] Determine the node attributes of the target node; the node attributes include the operator to which the target node belongs and the address protocol of the target node;

[0038] The node attributes and the second coverage area are determined as test filtering conditions;

[0039] Based on the test filtering criteria, a list of test probes corresponding to the target node is obtained from the probe list.

[0040] Determine the test node where each probe in the test probe list is located;

[0041] A fourth number of probes are determined from each test node other than the target node, and the determined probes are designated as the second probes.

[0042] Optionally, based on the second detection score, it is determined whether there is a cross-regional link anomaly, including:

[0043] Based on the second detection score, it is determined whether the target node has an anomaly;

[0044] If no abnormality is found at the target node, it is finally determined whether there is a cross-regional link abnormality in the coverage of the first coverage area by the target node.

[0045] Optionally, the second link score includes a first indicator score and a second indicator score; determining whether the target node is abnormal based on the second detection score includes:

[0046] Determine the first and second indicator scores for each of the second detection tasks;

[0047] Based on the scores of each of the first sub-indicators, determine whether the first indicator is abnormal, and based on the scores of each of the second indicators, determine whether the second indicator is abnormal.

[0048] If both the first and second indicators show abnormalities, it is determined that the target node is abnormal;

[0049] If the first indicator is not abnormal, and / or if the second indicator is not abnormal, it is determined that the target node is not abnormal.

[0050] Optionally, it also includes:

[0051] Divide the detection data acquisition areas into non-overlapping areas;

[0052] Configure corresponding data acquisition components for each of the aforementioned detection data acquisition areas;

[0053] Based on the geographical location of the target node, determine the target detection data collection area where the target node is located;

[0054] Using the data acquisition component corresponding to the target detection data acquisition area, the first link score and the second link score corresponding to the target node are acquired.

[0055] According to a second aspect of the present disclosure, a cross-regional link anomaly detection device is provided, comprising:

[0056] The coverage area determination module is used to determine a first coverage area and a second coverage area based on the geographical location of the target node; wherein the target node is located in the second coverage area;

[0057] The first detection module is used to detect the target node using a first probe in the first coverage area and obtain a first link score;

[0058] The anomaly detection module is used to preliminarily determine, based on the first link score, whether there is a cross-regional link anomaly in the coverage of the target node to the first coverage area;

[0059] The second detection module is used to detect the target node using a second probe in the second coverage area when there is a link anomaly in the first coverage area, and to obtain a second link score.

[0060] The anomaly determination module is used to determine whether there is a cross-regional link anomaly based on the second detection score.

[0061] According to a third aspect of the present disclosure, an electronic device is provided, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the computer program is executed by the processor, it implements the steps of the cross-regional link anomaly detection method as described in the first aspect.

[0062] According to a fourth aspect of the present disclosure, a computer-readable storage medium is provided, on which a computer program is stored, which, when executed by a processor, implements the steps of the cross-regional link anomaly detection method as described in the first aspect.

[0063] According to a fifth aspect of the present disclosure, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps of the cross-regional link anomaly detection method described in the first aspect.

[0064] This disclosure proactively probes target nodes by deploying probes in both the first and second coverage areas, rather than relying solely on user access performance for inference. This allows for early detection of cross-regional link anomalies, avoiding the latency issues of traditional methods. By obtaining the first and second link scores, the specific areas with link anomalies can be accurately located, guiding subsequent troubleshooting and optimization. In CDN networks, node selection and performance directly affect user access speed and experience. This disclosure, by detecting cross-regional link anomalies, allows for more rational selection of CDN nodes, avoiding content distribution to nodes with link problems, thereby improving data transmission speed and performance. Attached Figure Description

[0065] To more clearly illustrate the technical solutions of the embodiments of this disclosure, the accompanying drawings used in the description of the embodiments of this disclosure will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this disclosure. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0066] Figure 1 This is a schematic diagram illustrating the steps of a cross-regional link anomaly detection method according to an embodiment of this disclosure;

[0067] Figure 2 This is a schematic diagram of an overall architecture for detection data acquisition, as shown in an embodiment of this disclosure;

[0068] Figure 3 This is a schematic diagram illustrating the acquisition of data for a probe mission by a data acquisition component according to an embodiment of this disclosure;

[0069] Figure 4 This is a schematic diagram illustrating the steps of cross-regional link anomaly detection according to an embodiment of this disclosure;

[0070] Figure 5 This is a schematic diagram illustrating an embodiment of cross-regional link anomaly identification.

[0071] Figure 6 This is an overall architecture diagram of cross-regional link anomaly detection shown in an embodiment of this disclosure;

[0072] Figure 7 This is a block diagram of a cross-regional link anomaly detection device shown in an embodiment of this disclosure;

[0073] Figure 8 This is a schematic diagram of an electronic device shown in an embodiment of this disclosure. Detailed Implementation

[0074] The technical solutions of the embodiments of this disclosure will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this disclosure. Based on the embodiments of this disclosure, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this disclosure.

[0075] The terms "first," "second," etc., used in this disclosure and in the claims are used to distinguish similar objects and not to describe a specific order or sequence. It should be understood that such use of data can be interchanged where appropriate so that embodiments of this disclosure can be implemented in orders other than those illustrated or described herein, and the objects distinguished by "first," "second," etc., are generally of the same class and the number of objects is not limited; for example, a first object can be one or more. Furthermore, in the specification and claims, "and / or" indicates at least one of the connected objects, and the character " / " generally indicates that the preceding and following objects are in an "or" relationship.

[0076] To facilitate understanding, the technical terms used in this disclosure will be explained first.

[0077] Blackbox_exporter: An exporter provided by Prometheus that can monitor target instances of HTTP (Hypertext Transfer Protocol), HTTPS (Hypertext Transfer Protocol Secure), DNS (Domain Name System), TCP (Transmission Control Protocol), ICMP (Internet Control Message Protocol), etc., thereby enabling monitoring and data collection of the monitored nodes.

[0078] Inter-provincial links: Inter-provincial links refer to links where there is a correspondence between a province and a node. For example, province A has nodes a1, a2, and a3, and there are also provinces B and C. The correspondence between province B and node a1, province B and node a2, province C and node a2, etc., is called inter-provincial links. In this example, there are 6 inter-provincial links.

[0079] CDN Node Coverage: In a CDN network, edge nodes are the nodes closest to the customer. When a customer accesses the domain name xxx.com, after DNS resolution, they are directed to the nearest edge node 'a'. Edge node 'a' has a backup of the content of the xxx.com website, allowing the user to access the relevant data. If a user is directed to node 'a' according to the scheduling strategy, then the user's region is said to be covered by node 'a'. Generally, this region is divided by geographical location; users in the same province or city are usually covered by the same node.

[0080] CDN technology requires the deployment of server nodes of different types and functions to distribute network traffic across these nodes, thereby improving data transmission speed and performance and enabling users nationwide to enjoy a faster network experience. Different business scenarios have different requirements for nodes; some nodes are shared by multiple services, while others serve as backup nodes for traffic smoothing.

[0081] As business volume increases, it becomes necessary to effectively control node coverage costs and effectiveness. Without impacting user experience, cross-provincial node coverage can be adopted to reduce node construction costs. Furthermore, node coverage adjustments can ensure smooth access during peak traffic periods and full node utilization during off-peak hours.

[0082] However, in CDN edge nodes used for cross-provincial coverage scenarios, due to restrictions on out-of-province traffic by operators or poor performance of long cross-province links, there may be situations where data access within the province is normal, but data requests from out-of-province are restricted. In such cases, it is impossible to directly determine the quality of the link through data. Usually, the coverage is first implemented using nodes, and then the quality of the coverage is inferred from the user's access performance, which has a certain lag.

[0083] To address the aforementioned technical issues, this disclosure proposes a cross-regional link anomaly detection method. This method can proactively detect cross-regional link anomalies through the detection data of monitoring probes, thereby providing a basis for node coverage optimization and node scheduling.

[0084] Figure 1 [R2] is a schematic diagram illustrating the steps of a cross-regional link anomaly detection method according to an embodiment of this disclosure. Figure 1 As shown, the method may specifically include the following steps:

[0085] Step S11: Determine the first coverage area and the second coverage area based on the geographical location of the target node; wherein the target node is located in the second coverage area.

[0086] Define the coverage area of ​​the target node, ensuring that these coverage areas do not overlap. The coverage area of ​​a target node can be understood as the region within which customers can access the target node using a domain name after DNS resolution.

[0087] Based on the geographical location of the target node, determine which coverage area the target node is located in from various coverage areas, and designate the coverage area containing the target node as the second coverage area. All other coverage areas besides the second coverage area are designated as the first coverage area.

[0088] In practice, the first coverage area can be understood as the outside of the target node, and the second coverage area can be understood as the inside of the target node.

[0089] Step S12: Use the first probe in the first coverage area to detect the target node and obtain the first link score.

[0090] Machines with Blackbox installed can be used as probe nodes, and probes can be selected from these probe nodes for detection.

[0091] The first probe is selected from the first coverage area, that is, from the province outside the target node. The first probe is used to probe the target node. Specifically, the first probe can be used to send probe data packets to the target node, and the timestamps of data packet transmission and reception and other relevant information can be recorded.

[0092] After the first probe detects the target node, the first detection score is obtained.

[0093] Step S13: Based on the first link score, preliminarily determine whether there is a cross-regional link anomaly in the coverage of the first coverage area by the target node.

[0094] The first detection score reflects the coverage effect of the target node on the first coverage area. Based on the first detection score, it can be determined whether there are cross-regional link anomalies in the target node's coverage of the first coverage area, thus enabling the identification of abnormal links.

[0095] In some specific situations, a normal threshold for link score can be set based on historical data or network performance standards. The first probe score can be compared with the normal threshold to determine whether the first probe score is good or bad, thereby determining whether there is an anomaly in the coverage of the target node in the first coverage area.

[0096] Step S14: In the case of a first coverage area with a link anomaly, the target node is detected using a second probe in the second coverage area to obtain a second link score.

[0097] If a link anomaly is confirmed in the first coverage area, a second probe is selected in the second coverage area for further probing. Further probing of the second coverage area can rule out the possibility that the target node itself is faulty.

[0098] Similarly, a second probe can be used to send probe packets to the target node, and the corresponding second link score can be obtained.

[0099] Step S15: Determine whether there is a cross-regional link anomaly based on the second detection score.

[0100] By checking whether the second detection score is abnormal, it can be determined whether the target node is abnormal, and thus ultimately determine whether there is a cross-regional link anomaly in the target node's coverage of the first coverage area.

[0101] By employing the embodiment [R3] of this disclosure, comprehensive monitoring of network link status is achieved by deploying probes in both a first and a second coverage area. Probe detection in both coverage areas allows for differentiation between cross-regional link issues and target node failures. When the first probe detects a link anomaly, the results from the second probe help determine whether the fault lies in the cross-regional link or is due to performance issues or configuration errors on the target node itself. Timely detection and handling of cross-regional link anomalies provide valuable reference information for network administrators to optimize network configuration and performance, thereby improving the speed and smoothness of user access to content and ultimately enhancing user experience and satisfaction.

[0102] In one optional embodiment [R4], the method further includes: dividing non-overlapping detection data acquisition areas; configuring corresponding data acquisition components for each detection data acquisition area; determining the target detection data acquisition area where the target node is located based on the geographical location of the target node; and using the data acquisition components corresponding to the target detection data acquisition area to acquire the first link score and the second link score corresponding to the target node.

[0103] This disclosure allows the use of the data acquisition component Prometheus to collect various probe data generated when probing target nodes.

[0104] In actual cross-regional link anomaly detection, multiple target nodes are detected simultaneously. Due to the large number of target nodes, the selection of most of their addresses as probe targets, the large number of probes in the provinces covered by each target node, and the use of protocols including HTTP and ICMP, the final number of probe tasks for all access nodes across the country is in the tens of millions.

[0105] In this scenario, a single data acquisition unit cannot collect all the detection data within a specified time. Therefore, non-overlapping detection data acquisition areas can be defined according to certain measurements. Each non-overlapping detection data acquisition area is configured with a corresponding data acquisition unit to collect the detection data of each target node within that area.

[0106] Specifically, the system can be divided according to the location of the nodes, resulting in six major administrative regions: Northeast, North China, East China, Central and South China, Northwest, and Southwest. A total of six Prometheus instances are configured to collect data, with different Prometheus instances responsible for different regions. The final data is then aggregated by the data query component Thanos for external querying. When the target node is located in the Northeast region, the Prometheus instance corresponding to that region is used to collect data generated during the detection of that target node.

[0107] Figure 2 This is a schematic diagram illustrating an overall architecture for detection data acquisition according to an embodiment of this disclosure. According to... Figure 2 As shown, each detection task generates detection task data. Based on the geographical location of the target node in the detection task, the detection task data is collected through the corresponding data acquisition component. The detection task data collected by each data acquisition component can be queried by users through a unified data query component. Users can initiate a detection task data query request to the data query component to obtain the detection task data collected by the corresponding data acquisition component.

[0108] Figure 3 This is a schematic diagram illustrating the acquisition of data for a probe mission by a data acquisition component according to an embodiment of this disclosure. According to... Figure 3 As shown, the data acquisition component calls the probe to probe the address of the target node, thereby obtaining the probe task data.

[0109] In one optional embodiment [R5], by dividing the probe data collection areas into non-overlapping areas, data collection resources can be managed more effectively, ensuring timely data collection even with excessive data. Furthermore, using different data collection components for each partition ensures clear data collection responsibility for each area, avoiding resource overlap and waste. Determining the target probe data collection area based on the geographical location of the target node ensures targeted data collection, reduces blind data collection, and improves data accuracy and relevance. It also exhibits good scalability. As the network scales up or data collection demands increase, the system can be easily expanded by adding new probe data collection areas and data collection components.

[0110] In one optional embodiment [R6], both the first link score and the second link score include: a first indicator score and a second indicator score; the process of probing the target node using a first probe in the first coverage area to obtain the first link score, and probing the target node using a second probe in the second coverage area to obtain the second link score, is performed according to the following steps: determining a first indicator processing statement and a second indicator processing statement; during the process of probing the target node according to the probing task, obtaining the first indicator result and the second indicator result corresponding to the probing task through the first indicator processing statement and the second indicator processing statement; and converting the first indicator result and the second indicator result according to the scoring measurement standard to obtain the first indicator score and the second indicator score corresponding to the probing task.

[0111] Probes are used to probe various addresses on the target node, generating corresponding probe tasks. A probe task represents the probe of an address on a target node by a probe.

[0112] The first metric can be the response time data from an HTTP probe, and the second metric can be the packet loss rate data from a ping probe. The scores for both metrics can be collected using processing statements. There are no special requirements for HTTP and ping probes; different metrics can be used to detect network limitations in different business scenarios.

[0113] The first indicator processing statement and the second indicator processing statement can be configured in the data acquisition component. After the data acquisition component acquires the first indicator data and the second indicator data, it uses the corresponding statements to convert the first indicator data and the second indicator data into the corresponding first indicator score and second indicator score.

[0114] Specifically, when the first metric score is the response time of the HTTP probe, the HTTP response time data processing statement can be as shown in Table 1. The meaning of the HTTP response time data processing statement in Table 1 is as follows: if the probe result status code is 200, it indicates that the HTTP probe data is normal, and its response time can be directly used as the result; if the probe result status code is not 200, it indicates that the probe failed, and a timeout of 3 seconds is uniformly taken as the response time data for this HTTP probe.

[0115]

[0116] Table 1

[0117] When the second metric is the packet loss rate data from ping probes, the ping packet loss rate data processing statement can be as shown in Table 2. The meaning of the ping packet loss rate data processing statement in Table 2 is as follows: when the average processing time of the target node for ping packet loss rate data is greater than 100ms, it indicates a potential problem with the link or node, and the packet loss rate is directly marked as 100; conversely, if the average processing time of the target node for ping packet loss rate data is no greater than 100ms, the packet loss rate data from the ping probes is taken as the result.

[0118]

[0119] Table 2

[0120] During the process of probing the target node using the first probe or the second probe based on the detection task, first indicator data and second indicator data are obtained. The first indicator data is processed using the first indicator processing statement to obtain the first indicator result. The second indicator data is processed using the second indicator processing statement to obtain the second indicator data.

[0121] According to the scoring criteria, the results of the first and second indicators are converted to obtain the first indicator score and the second indicator score corresponding to the detection task. Converting the first and second indicator results ensures they are on a unified scoring standard, allowing for comparison. For example, both the first and second indicator results can be uniformly processed into scores from 0 to 100.

[0122] If the first metric result corresponds to the HTTP probe result, the first metric score can be obtained by dividing the response time by 3 if the HTTP probe response time is less than 3; otherwise, 100 can be used as the first metric score. Specifically, it can be determined using the following methods:

[0123] ·probe_http_seconds<3, score = probe_http_seconds / 3

[0124] ·probe_http_seconds>3, score = 100ping

[0125] Here, probe_http_seconds represents the response time of the HTTP probe, and score represents the score of the first metric.

[0126] If the second metric is the result of the ping probe, the packet loss rate can be used directly as the result.

[0127] By adopting the embodiment of this disclosure [R7], the technical solution introduces a first indicator score and a second indicator score, making the calculation of link scores more refined and comprehensive. By determining the first and second indicator processing statements and applying these statements during the probing process to obtain indicator results, the objectivity and consistency of the evaluation process can be ensured. It allows for the flexible definition and adjustment of indicator processing statements according to different probing tasks and requirements, and can be expanded and optimized according to actual conditions to adapt to different application scenarios and changing needs.

[0128] Figure 4 This is a schematic diagram illustrating the steps of cross-regional link anomaly detection according to an embodiment of this disclosure. Figure 4 As shown, firstly, target nodes are selected from the candidate node list. Target nodes are nodes that need to be detected for cross-regional link anomalies. Probes are then filtered from the candidate probe list. The carrier and address protocol of each probe in the filtered probe set must be consistent with the target node. Probes that are inconsistent are discarded and not added to the probe set. After obtaining the probe set, the region and probe node of each probe in the probe set are determined. Target probes are then identified from the probe nodes. Target probes are probes used to probe the target node.

[0129] The identification of abnormal links can be performed through the following steps.

[0130] In one optional embodiment [R8], the target node is probed using a first probe in the first coverage area to obtain a first link score, including: determining a first number of target probe addresses based on the service classification of the target node; obtaining a first probe task based on the first probe and the target probe address; the first probe and the target probe address included in the first probe task have a one-to-one relationship; and probing the target node based on the first probe task to obtain the first link score corresponding to the probe task.

[0131] First, it is necessary to determine the target probe addresses to be used for probing within the target node. This can be done by determining the service categories on the target node and selecting a first number of target probe addresses from each service category.

[0132] Table 3 contains information about a target node. The target node is named Fuzhou 1, located in Fujian Province, uses IPv4 as its IP protocol, and is operated by China Unicom. The target node includes three sub-nodes: 1.1.1.1, 2.2.2.2, and 3.3.3.3. The target probe address can be selected from these three sub-nodes according to the target node's service type.

[0133]

[0134] Table 3

[0135] The first probe task establishes the target probe address. Each first probe needs to probe all target probe addresses, generating a corresponding probe task. The target probe address of the first probe means that each probe task involves one first probe probing one target probe address, establishing a one-to-one relationship. This ensures that each target probe address uniquely corresponds to one first probe, thereby guaranteeing the accuracy and traceability of the probe results.

[0136] For example, if there are 2 first probes and 4 target detection addresses, combining the first probes and target detection addresses will generate 8 different detection tasks.

[0137] The target node is probed through probe missions, and each probe mission has a corresponding first link score.

[0138] By employing the embodiments of this disclosure [R9], through service classification, the probe addresses associated with the target node can be identified more accurately, ensuring the targeting and effectiveness of the probes. The first link score obtained through the probe task can quantitatively evaluate the link performance from the target node to the first coverage area, providing data support for network optimization. The first link score can also serve as an indicator of network health status; when the first link score is abnormal, it may indicate that there is a network bottleneck or fault in the target node's connection to the first coverage area, requiring timely measures for investigation and optimization.

[0139] In one optional embodiment [R10], the first probe in the first coverage area is determined according to the following steps: determining the node attributes of the target node; the node attributes include the operator to which the target node belongs and the address protocol of the target node; determining the node attributes and the first coverage area as target filtering conditions; according to the target filtering conditions, filtering from the probe list to obtain a target probe list for the first coverage area to the target node; determining the probe node where each probe in the target probe list is located; determining a third number of probes from each probe node respectively, and determining the determined probes as the first probe.

[0140] The operator and IP protocol of the first probe need to be consistent with those of the target node. Therefore, the operator and IP protocol of the target node need to be used as a filtering condition for the probes. Furthermore, this disclosure aims to determine the coverage effect of the target node on each coverage area. Therefore, the probe node where the first probe is located needs to be located within the first coverage area corresponding to the target node. Thus, the coverage area of ​​the target node also needs to be used as a filtering condition for the probes.

[0141] The target node's carrier, IP protocol, and primary coverage area are used as target filtering criteria to filter pre-configured probes, resulting in a target probe list. After obtaining the target probe list, the probes are grouped according to the granularity of the probe node to determine which probe node each probe is located on. A third probe is selected from each probe node, and this selected probe is designated as the first probe, thus avoiding unreliable detection results due to the failure of a single probe node.

[0142] Table 4 illustrates the target node and the first probe. The target node is named Ganzhou1, its operator is China Unicom, its IP protocol is IPv6, and the target probe addresses on the target node are 1.1.1.1, 2.2.2.2, and 3.3.3.3. The data in probes represents the first probe obtained after filtering and selection.

[0143]

[0144] Table 4

[0145] By employing the embodiment [R11] of this disclosure, using node attributes and a first coverage area as filtering conditions, probes located within a specified coverage area and matching the target node attributes can be quickly filtered from a large list of probes, improving filtering efficiency and accuracy. By determining the target probe list and further selecting a certain number of probes from each probe node, the rational use of resources can be ensured, and the unreliability of detection results due to the failure of a single probe node can be avoided. The filtering conditions and the number of selected probes can be flexibly adjusted according to different attributes of the target node and changes in the coverage area, adapting to different monitoring needs and network environments.

[0146] In one optional embodiment [R12], the first link score includes a first indicator score and a second indicator score; based on the first link score, it is preliminarily determined whether there is a cross-regional link anomaly in the coverage of the first coverage area by the target node, including: determining the first indicator score and the second indicator score corresponding to each first detection task; determining the larger of the first indicator score and the second indicator score as the final score corresponding to the first detection task; determining the first median score and the first interquartile range score corresponding to the first coverage area based on each of the final scores; if the first median score is greater than or equal to the first interquartile range score, it is determined that there is a link anomaly in the coverage of the first coverage area by the target node; if the first median score is less than the first interquartile range score, it is determined that there is no link anomaly in the coverage of the first coverage area by the target node.

[0147] The first probe is used to probe the target address on the target node, generating a corresponding probe task. The first link score corresponding to each first probe task is determined. Each first link score includes a first indicator score and a second indicator score.

[0148] Table 5 shows the detection results for a specific first probe task. The target node is Ganzhou 1, located in Jiangxi Province, with a target probe address of 1.1.1.1. The first probe is located in Fujian Province, specifically at probe node Xiamen 1, with an address of 4.4.4.1. Therefore, the first probe task shown in Table 5 represents the probe from address 4.4.4.1 to the target probe address 1.1.1.1. This first probe task had a packet loss rate of 50% and a response time of 0.25 seconds.

[0149]

[0150] Table 5

[0151] For any first link score, the final score of the first detection task is determined by its corresponding first indicator score and second indicator score. Specifically, the score with the larger value between the first indicator score and the second indicator score can be determined as the final score for the first detection task, with a larger value indicating a worse detection result.

[0152] Identify the final scores included in the first coverage area. Based on each of the final scores, determine the first median score and the first interquartile range score corresponding to the first coverage area; the interquartile range score is obtained by subtracting the 1 / 4 quartile from the 3 / 4 quartile of each final score.

[0153] If the first median score is less than the first interquartile range score, it indicates that the final score in the first coverage area is concentrated in the area with larger values, indicating that the detection effect is poor. Therefore, it is determined that the target node has a link anomaly in the coverage of the first coverage area. If the first median score is greater than or equal to the first interquartile range score, it indicates that the final score in the first coverage area is concentrated in the area with smaller values, indicating that the detection effect is good. Therefore, it is determined that the target node does not have a link anomaly in the coverage of the first coverage area.

[0154] When simultaneously performing anomaly detection on links in various first coverage areas corresponding to multiple target nodes, the data acquisition component can collect the detection data of the first detection tasks corresponding to each target node, and then group the first detection tasks corresponding to each target node after aggregation. Each first detection task in each group comes from the first probe in the same first coverage area, and the first detection tasks in this group are detecting the same target node.

[0155] Table 6 shows the first link scores corresponding to the first detection tasks in the first coverage area a-node b group. Probes a, b, and c are located in the same first coverage area, and 1.1.1. and 1.1.1.2 are located in the same target node. Each row in Table 6 represents a first detection task, and each first detection task corresponds to a first index score and a second index score.

[0156]

[0157] Table 6

[0158] Using the embodiments of this disclosure [R13], by selecting the larger of the first indicator score and the second indicator score as the final score, weights can be dynamically assigned to the two indicators. When one indicator shows a significant link problem, it will play a more important role in the final evaluation. Using the median and interquartile range for score analysis can improve the robustness of the evaluation. The median is insensitive to extreme values ​​of the data, while the interquartile range provides information about the data distribution, reducing misjudgments caused by individual outliers. Timely detection and handling of cross-regional link anomalies helps improve the overall network service quality and user experience. Reducing link failures and anomalies ensures smooth data transmission and reduces network latency and packet loss rate.

[0159] The verification of abnormal links can be performed through the following steps.

[0160] In one optional embodiment [R14], the target node is probed using a second probe in the second coverage area to obtain a second link score, including: determining a second number of test addresses based on the service classification of the target node; obtaining a second probe task based on the second probe and the test addresses; the second probe and the test addresses included in the second probe task have a one-to-one relationship; and probing the target node based on the second probe task to obtain the second link score corresponding to the probe task.

[0161] Based on the service classification of the target node, a second number of test addresses are determined. The test addresses determined during abnormal link verification can be the same as the target probe addresses determined during abnormal link identification; this can be understood as the first and second numbers being consistent, and the test addresses and target probe addresses being consistent.

[0162] Based on the second probe and the test address, the second probing task is obtained. The method for determining the second probing task is similar to that for the first probing task. Each second probe needs to probe all the test addresses determined on the target node, generating a corresponding second probing task. The second probing task represents the task corresponding to a second probe probing a test address, and there is a one-to-one relationship between the second probe and the test address in the second probing task.

[0163] When probing the target node through the second probing task, each second probing task will obtain a corresponding second link score.

[0164] By employing the embodiments of this disclosure [R15], and using a second probe to detect within a second coverage area, the source of cross-regional link anomalies can be located more accurately. By accurately identifying the source of cross-regional link anomalies, network problems can be quickly located and resolved, thereby optimizing network performance.

[0165] In one optional embodiment [R16], the second probe in the second coverage area is determined according to the following steps: determining the node attributes of the target node; the node attributes include the operator to which the target node belongs and the address protocol of the target node; determining the node attributes and the second coverage area as test filtering conditions; according to the test filtering conditions, filtering from the probe list to obtain a test probe list corresponding to the target node; determining the test node where each probe in the test probe list is located; determining a fourth number of probes from each test node other than the target node, and determining the determined probes as the second probes.

[0166] Determine the node attributes of the target node; the node attributes include the operator to which the target node belongs and the address protocol of the target node; determine the node attributes and the second coverage area as test filtering conditions; a list of test probes that are in the second coverage area and have the same node attributes as the target node can be obtained from the probe list.

[0167] Identify the nodes where each probe in the probe list is located, exclude the target node from these nodes, and designate the remaining nodes as test nodes. Select a fourth probe from the test nodes and designate it as the second probe. Verify the availability of the selected second probe by checking its network connectivity and whether its probing function is working properly.

[0168] Using the embodiment [R17] of this disclosure, since the target node is a node experiencing link anomalies, a fourth number of probes are determined from each test node other than the target node as second probes for detection, which can more accurately reflect the link status. By selecting probes from multiple test nodes for detection, the detection results of multiple probes can be mutually verified, reducing misjudgments caused by single probe failure or error.

[0169] In one optional embodiment [R18], determining whether there is a cross-regional link anomaly based on the second detection score includes: determining whether the target node is abnormal based on the second detection score; and if the target node is not abnormal, finally determining whether there is a cross-regional link anomaly in the coverage of the first coverage area by the target node.

[0170] The second probe is located in the same coverage area as the target node, with relatively low network latency and transmission delay, which more accurately reflects the actual status of the node and reduces misjudgments caused by network fluctuations.

[0171] It can analyze the scores of each second link, or set one or more anomaly thresholds, and determine whether the target node is abnormal by using the second link scores.

[0172] If the target node itself is not abnormal, but the first link score reflects that there is a link abnormality between the target node and the first coverage area, then after excluding factors that may be caused by the target node itself, it can be determined that the target node has a cross-regional link abnormality with the first coverage area.

[0173] Using the embodiment [R19] of this disclosure, detection is performed using a second probe in the second coverage area, and the target node is determined to be abnormal based on the second detection score. This step can accurately locate the source of the problem. If the target node is determined to be normal, then it is finally determined whether there is a cross-regional link anomaly in the target node's coverage of the first coverage area, improving the accuracy of detection. Accurately identifying cross-regional link anomalies and eliminating interference from node faults helps to quickly locate and resolve network problems.

[0174] In one optional embodiment [R20], the second link score includes a first indicator score and a second indicator score; determining whether the target node is abnormal based on the second detection score includes: determining the first indicator score and the second indicator score corresponding to each second detection task; determining whether the first indicator is abnormal based on each first indicator score, and determining whether the second indicator is abnormal based on each second indicator score; determining that the target node is abnormal if both the first indicator and the second indicator are abnormal; and determining that the target node is not abnormal if the first indicator is not abnormal, and / or if the second indicator is not abnormal.

[0175] Determine the first and second indicator scores for each of the second detection tasks. Consider the first and second indicator scores separately, and determine whether any anomalies have occurred in either indicator.

[0176] The second median and second interquartile range scores corresponding to each first indicator can be determined by the scores of each first indicator. If the second median score is less than the second interquartile range score, the first indicator is considered normal; otherwise, it is considered abnormal.

[0177] The third median and third interquartile range scores corresponding to the second indicators can be determined by the scores of each second indicator; if the third median score is less than the third interquartile range score, the first indicator is determined to be normal, otherwise it is abnormal.

[0178] If both the first and second indicators show abnormalities, it is determined that the target node is abnormal;

[0179] If the first indicator is not abnormal, and / or if the second indicator is not abnormal, it is determined that the target node is not abnormal.

[0180] This is because an anomaly in a single data source can have multiple causes, potentially leading to a misjudgment that a node is malfunctioning. By using two sets of data—the first indicator score and the second indicator score—cross-validation can be employed to reduce the risk of misjudgment.

[0181] Using the embodiment [R21] of this disclosure, the target node is judged to be abnormal only when both the first indicator score and the second indicator score are abnormal. The dual confirmation mechanism improves the accuracy of anomaly detection and reduces the possibility of false alarms and false negatives.

[0182] Figure 5 This is a schematic diagram illustrating an embodiment of the present disclosure of cross-regional link anomaly identification. According to... Figure 5As shown, a node in Province A can cover Provinces A, B, and C. Since the node is located within Province A, Province A is the second coverage area of ​​the node, while Provinces B and C are the first coverage areas. Using a probe in Province B to probe the node in Province A can determine if there are any anomalies in the cross-regional link between the node in Province A and Province B. Using a probe in Province C to probe the node in Province A can determine if there are any anomalies in the cross-regional link between the node in Province A and Province C. If anomalies are found in the cross-regional link between the node in Province A and Province B, and / or anomalies are found in the cross-regional link between the node in Province A and Province C, then a probe in Province A can be used to probe the node in Province A to determine if the node in Province A itself has malfunctioned.

[0183] In a specific embodiment, taking Ganzhou 1 node in Jiangxi Province as an example, we can illustrate how to select probes to generate probe tasks, then obtain HTTP and ping probe data, calculate the cross-provincial link score, that is, the first link score, and finally conduct intra-provincial probes to verify whether there are any problems with the link.

[0184] The first step is the allocation process for the detection tasks. The attributes of the Ganzhou 1 node are shown in Table 7. The province is Jiangxi Province, the operator is China Mobile, the IP protocol is IPv4, and the machine IPs on the node are 127.1.1.x (4 machines). The covered provinces include Fujian Province, Zhejiang Province, etc.

[0185]

[0186] Table 7

[0187] Subsequently, monitoring probes are filtered based on node information. First, they are filtered by coverage province, carrier, and IP protocol to generate a probe set. Then, they are categorized according to the node where the probe is located to obtain a target probe list for each node, as detailed in Table 8.

[0188]

[0189] Table 8

[0190] This includes two probe nodes, Fuzhou 1 and Guangzhou 1, both of which are filtered and can be used to probe the Ganzhou 1 node. Two probes are selected from each node, and the first probe is obtained as ["1.1.1.1", "1.1.1.2", "11.1.1.2", "11.1.1.3"], with the target probe address as ["127.1.1.2", "127.1.1.3"]. In this example, a total of eight probe paths will be obtained.

[0191] The Ganzhou 1 node is located in South China. Prometheus machines in South China were used to collect data from these eight probe paths. The probe results for one of these paths are shown in Table 9. The packet loss rate was 3%, the HTTP probe time was 0.15 seconds, and the HTTP score, calculated using the formula algorithm, was 5%. Taking the larger of the two values, the final score for the first probe task shown in Table 9 was 5.

[0192]

[0193] Table 9

[0194] The final scores for each of the eight detection paths were analyzed. Grouping these final scores by province and node, the median score and interquartile range (ICM) score for each group were determined. For example, assuming there are 100 probes from Fuzhou 1, Quanzhou 1, and Xiamen 1 in Fujian Province to Ganzhou 1, and the calculated IQR score is 50, which is greater than the median of 10, this indicates that most links from Fujian Province to Ganzhou 1 have a high number of high-scoring link probes and significant link discrepancies. Therefore, the Fujian-Ganzhou 1 link is marked as a suspected link anomaly.

[0195] After receiving a suspected anomaly from Fujian Province-Ganzhou 1, other monitoring probes in Jiangxi Province besides Ganzhou 1, such as Xinyu 1, Jiujiang 1, and Nanchang 1, were selected. Ganzhou 1 was detected. Based on the collected results, the overall link score was found to be less than the median, indicating that most probes in the province had low scores and the detection effect within the province was good. There was no node problem in Ganzhou 1. Finally, it was determined that the cross-provincial link between Fujian Province and Ganzhou 1 was abnormal.

[0196] This disclosure identifies suspected anomalies using data from outside the province, and then verifies them by comparing with data from within the province, thus obtaining a definitive and reliable result. The cross-regional link anomaly detection method proposed in this disclosure can be applied to data center node detection. Assuming multiple probes to node a show suspected abnormal data, while multiple probes to node b show normal data, and since nodes a and b belong to the same data center, they can be ruled out as link anomalies.

[0197] This disclosure describes the detection of link anomalies using a combination of data from outside the province and data from within the province. The anomaly outside the province triggered the detection within the province. In some cases, data from outside the province and data from within the province can be determined simultaneously, but this consumes and wastes a lot of resources.

[0198] The cross-regional link anomaly detection method provided in this disclosure can not only identify anomalies in cross-provincial links of nodes, but also improve the effectiveness of planned node coverage across provinces. For example, when a target node has a fast-area link anomaly in the first coverage area 1, the target node can be adjusted not to cover the first coverage area 1, while other nodes can be adjusted to cover the first coverage area 1, resulting in better communication quality in the first coverage area 1. This not only reduces costs but also ensures that each area can communicate with high quality.

[0199] Figure 6 This is an overall architecture diagram of cross-regional link anomaly detection shown in an embodiment of this disclosure. According to... Figure 6 As shown, firstly, the first detection task generation module generates a first detection task using the target detection address corresponding to the target node and the first probe. Data corresponding to the first detection task is collected by the data acquisition component. The anomaly identification module retrieves the data corresponding to the first detection task from the data acquisition component using the data query component and analyzes the first link score corresponding to each retrieved first detection task to determine if there are any target nodes suspected of having cross-regional link anomalies. If there are target nodes suspected of having cross-regional link anomalies, the anomaly verification module generates a second detection task using the test address and the second probe corresponding to the target node. Data corresponding to the first detection task is collected by the data acquisition component. The anomaly verification module retrieves the data corresponding to the second detection task from the data acquisition component using the data query component and analyzes the second link score corresponding to each retrieved second detection task to determine whether a cross-regional link anomaly exists.

[0200] Figure 7 This is a block diagram illustrating a cross-regional link anomaly detection device according to an embodiment of this disclosure. Figure 7 As shown, the device includes:

[0201] The coverage area determination module 710 is used to determine a first coverage area and a second coverage area based on the geographical location of the target node; wherein the target node is located in the second coverage area;

[0202] The first detection module 720 is used to detect the target node using a first probe in the first coverage area and obtain a first link score;

[0203] The anomaly detection module 730 is used to preliminarily determine, based on the first link score, whether there is a cross-regional link anomaly in the coverage of the target node to the first coverage area;

[0204] The second detection module 740 is used to detect the target node using a second probe in the second coverage area when there is a link anomaly in the first coverage area, and obtain a second link score.

[0205] The anomaly determination module 750 is used to determine whether there is a cross-regional link anomaly based on the second detection score.

[0206] This disclosure also provides an electronic device, with reference to... Figure 8 , Figure 8 This is a schematic diagram of an electronic device according to an embodiment of this disclosure. For example... Figure 8 As shown, the electronic device 800 includes a memory 810 and a processor 820. The memory 810 and the processor 820 are connected via a bus for communication. The memory 810 stores a computer program that can run on the processor 820 to implement the steps in the cross-regional link anomaly detection method disclosed in this embodiment.

[0207] This disclosure also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the cross-regional link anomaly detection method disclosed in this disclosure.

[0208] This disclosure also provides a computer program product, including a computer program that, when executed by a processor, implements the steps in the cross-regional link anomaly detection method disclosed in this disclosure.

[0209] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other.

[0210] Those skilled in the art will understand that the embodiments disclosed herein can be provided as methods, apparatus, or computer program products. Therefore, the embodiments disclosed herein can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the embodiments disclosed herein can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0211] This disclosure describes embodiments of methods, apparatus, electronic devices, and computer program products according to embodiments of this disclosure with reference to flowchart illustrations and / or block diagrams. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing terminal device to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing terminal device, generate instructions for implementing the flowchart illustrations. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0212] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing terminal device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0213] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal equipment, causing a series of operational steps to be performed on the computer or other programmable terminal equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable terminal equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0214] Although some embodiments of the present disclosure have been described, those skilled in the art, upon learning the basic inventive concept, can make further changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of the present disclosure.

[0215] The above provides a detailed description of a cross-regional link anomaly detection method provided by this disclosure. Specific examples have been used to illustrate the principles and implementation methods of this disclosure. The descriptions of the above embodiments are only for the purpose of helping to understand the method and its core ideas. At the same time, those skilled in the art will recognize that there will be changes in the specific implementation methods and application scope based on the ideas of this disclosure. Therefore, the content of this specification should not be construed as a limitation of this disclosure.

Claims

1. A method for detecting cross-regional link anomalies, characterized in that, include: Based on the geographical location of the target node, a first coverage area and a second coverage area are determined; wherein the target node is located in the second coverage area; Using a first probe in the first coverage area, the target node is detected to obtain a first link score; Based on the first link score, it is preliminarily determined whether there is a cross-regional link anomaly in the coverage of the first coverage area by the target node; In the case of a first coverage area with link anomalies, the target node is detected using a second probe in the second coverage area to obtain a second link score; Based on the second link score, determine whether there is a cross-regional link anomaly; The first probe in the first coverage area is determined according to the following steps: Determine the node attributes of the target node; the node attributes include the operator to which the target node belongs and the address protocol of the target node; The node attributes and the first coverage area are determined as the target filtering conditions; Based on the target filtering criteria, a target probe list for the first coverage area relative to the target node is obtained from the probe list; Determine the probe node where each probe in the target probe list is located; A third number of probes is determined from each probe node, and the determined probes are designated as the first probes.

2. The method according to claim 1, characterized in that, Using a first probe in the first coverage area, the target node is detected to obtain a first link score, including: Based on the service classification of the target node, determine a first number of target probe addresses; A first detection task is obtained based on the first probe and the target detection address; the first probe and the target detection address included in the first detection task have a one-to-one relationship; The target node is probed according to the first probe task, and the first link score corresponding to the probe task is obtained.

3. The method according to claim 1, characterized in that, Using a second probe in the second coverage area, the target node is detected to obtain a second link score, including: Based on the service classification of the target node, determine the second number of test addresses; A second detection task is obtained based on the second probe and the test address; the second probe and the test address included in the second detection task have a one-to-one relationship. The target node is probed according to the second detection task, and the second link score corresponding to the detection task is obtained.

4. The method according to claim 2 or 3, characterized in that, Both the first link score and the second link score include: the first indicator score and the second indicator score; The process of detecting the target node using a first probe in the first coverage area to obtain a first link score, and detecting the target node using a second probe in the second coverage area to obtain a second link score, is performed according to the following steps: Determine the first indicator processing statement and the second indicator processing statement. During the process of probing the target node according to the probing task, the first indicator result and the second indicator result corresponding to the probing task are obtained through the first indicator processing statement and the second indicator processing statement. According to the scoring measurement standard, the results of the first indicator and the second indicator are converted to obtain the first indicator score and the second indicator score corresponding to the detection task.

5. The method according to claim 2, characterized in that, The first link score includes a first indicator score and a second indicator score; based on the first link score, it is preliminarily determined whether the target node's coverage of the first coverage area has cross-regional link anomalies, including: Determine the first index score and the second index score corresponding to each first detection task; The larger of the first indicator score and the second indicator score is determined as the final score corresponding to the first detection task. Based on the respective final scores, determine the first median score and the first interquartile range score corresponding to the first coverage area; If the first median score is greater than or equal to the first interquartile range score, it is determined that the target node has a link anomaly in the coverage of the first coverage area; If the first median score is less than the first interquartile range score, it is determined that the target node does not have a link anomaly in the coverage of the first coverage area.

6. The method according to claim 1, characterized in that, The second probe in the second coverage area is determined according to the following steps: Determine the node attributes of the target node; the node attributes include the operator to which the target node belongs and the address protocol of the target node; The node attributes and the second coverage area are determined as test filtering conditions; Based on the test filtering criteria, a list of test probes corresponding to the target node is obtained from the probe list. Determine the test node where each probe in the test probe list is located; A fourth number of probes are determined from each test node other than the target node, and the determined probes are designated as the second probes.

7. The method according to claim 3, characterized in that, Based on the second link score, determine whether there are any cross-regional link anomalies, including: Based on the second link score, determine whether the target node is abnormal; If no abnormality is found at the target node, it is finally determined whether there is a cross-regional link abnormality in the coverage of the first coverage area by the target node.

8. The method according to claim 7, characterized in that, The second link score includes a first indicator score and a second indicator score; based on the second link score, determining whether the target node is abnormal includes: Determine the first and second indicator scores for each of the second detection tasks; Based on the scores of each of the first indicators, determine whether the first indicator is abnormal, and based on the scores of each of the second indicators, determine whether the second indicator is abnormal. If both the first and second indicators show abnormalities, it is determined that the target node is abnormal; If the first indicator does not show any abnormalities, and / or if the second indicator does not show any abnormalities, it is determined that the target node does not show any abnormalities.

9. The method according to any one of claims 1-8, characterized in that, Also includes: Divide the detection data acquisition areas into non-overlapping areas; Configure corresponding data acquisition components for each of the aforementioned detection data acquisition areas; Based on the geographical location of the target node, determine the target detection data collection area where the target node is located; Using the data acquisition component corresponding to the target detection data acquisition area, the first link score and the second link score corresponding to the target node are acquired.

Images