Flow analysis method and device for active PCDN users based on Flink

Abstract

The invention discloses a flow analysis method and device for active PCDN users based on Flink, and the method comprises the steps: screening a user list which accords with PCDN features and PCDN platform domain names from aaa call ticket data provided by an operator, and obtaining a PCDN violation user list; the Flink calculation engine loads the PCDN violation user list, matching is carried out on the basis of user access ip and ports and accessed Netflow traffic data, then traffic light summarization is carried out, and Netflow traffic data associated with PCDN violation users is obtained; the method comprises the following steps: selecting Netflow traffic data associated with PCDN violation users in the online and offline time range of the PCDN violation users to perform activity analysis, calculating the activity ratio of Flow in the online and offline time range of the PCDN violation users, obtaining the activity of the PCDN violation users, and finally outputting a PCDN violation user list with inverted activity. According to the method and the device, the suspected PCDN users are found and sorted according to the activeness, so that subsequent operation is facilitated, the burden of flow settlement is reduced, and the revenue of broadband services is increased.

Description

Technical Field

[0001] The present invention relates to the field of PCDN illegal user analysis, and in particular to a Flink-based traffic analysis method and device for active PCDN users. Background Art

[0002] PCDN (Personal Content Delivery Network) users refer to individuals or organizations that participate in the PCDN network, usually by sharing their idle bandwidth, storage space and computing resources to help distribute network content. PCDN is a decentralized content distribution network model. Unlike traditional CDN (Content Delivery Network), PCDN relies on ordinary user devices distributed around the world, rather than dedicated data centers or servers.

[0003] Simply put, PCDN users are those who use the operator's broadband account to provide Internet access services to others, which will lead to errors in the operator's traffic amount settlement and compete with the operator's existing traditional CDN business (broadband business). Since PCDN has the advantages of lower cost and wider coverage, it may affect the operator's CDN business revenue. Although PCDN may reduce some of the operator's content distribution costs, its profit model is still not clear enough. Due to the reliance on user devices for content distribution, it is difficult for operators to directly obtain revenue from each node, thus affecting their commercial interests. In general, it will lead to a decrease in the operator's customers. Customers use PCDN services provided by others instead of the operator's traditional CDN services, which makes it difficult to trace traffic and charge these PCDN users.

[0004] Most of the current technical solutions are to give a qualitative analysis of a PCDN violating user from the perspective of the PCDN domain name platform, the upstream and downstream traffic ratio, or the upstream traffic threshold. However, in the actual investigation process, it was found that simply meeting the above conditions cannot determine that the user is a PCDN violating user. In the actual detection process, many errors were found. Therefore, it is necessary to further compare the activity of a large number of suspected users from the perspective of real-time traffic, and finally judge the suspicion of the account based on the activity, which is more effective and more accurate. Summary of the invention

[0005] In order to solve the above problems existing in the current technical solutions, the present invention provides a traffic analysis method and device for active PCDN users based on Flink, which preliminarily analyzes the call bill users with abnormal traffic through call bill data (the operator has statistical data), and then combines the real-time Netflow data to perform traffic analysis on active PCDN users, and outputs the highest comprehensive activity as the PCDN violating user. The operator performs subsequent operations on the PCDN violating user account according to the PCDN violating user list.

[0006] To achieve the above purpose, the present invention adopts the following technical solutions:

[0007] In one embodiment of the present invention, a traffic analysis method for active PCDN users based on Flink is proposed. The method includes:

[0008] From the AAA call bill data provided by the operator, filter the user list that meets the PCDN characteristics and PCDN platform domain name to obtain the PCDN illegal user list;

[0009] The Flink computing engine loads the PCDN illegal user list, matches the user's access IP and port with the accessed Netflow traffic data, and then performs light traffic aggregation to obtain the Netflow traffic data associated with the PCDN illegal users.

[0010] The Netflow traffic data associated with the PCDN illegal users within the online and offline time range of the PCDN illegal users is selected for activity analysis, and the active proportion of the Flow within the online and offline time range of the PCDN illegal users is calculated to obtain the activity of the PCDN illegal users, and finally a list of PCDN illegal users in reverse order of activity is output.

[0011] Furthermore, the PCDN features are: the upstream traffic is greater than 50GB, and the upstream to downstream traffic ratio is greater than 2.

[0012] Furthermore, the activity of the PCDN illegal user is calculated as follows:

[0013] Summarize the Netflow traffic data associated with PCDN illegal users at different time points;

[0014] The online and offline time of the PCDN illegal user is selected and associated with the Netflow traffic data associated with the PCDN illegal user, and the Netflow traffic data associated with the PCDN illegal user within the online and offline time range of the PCDN illegal user is retained;

[0015] Calculate the average uplink rate of aaa users, the average uplink rate of flows at each time point, and the total number of time points between online and offline times;

[0016] Compare the average uplink rate of the flow at each time point with the average uplink rate of the aaa user. If the average uplink rate of the flow at a certain time point is greater than the average uplink rate of the aaa user, the status at that time point is recorded as active. Divide the total number of time points between the online and offline time by the number of active time points to obtain the activity level of the PCDN violating user.

[0017] In one embodiment of the present invention, a Flink-based traffic analysis device for active PCDN users is also proposed, and the device includes:

[0018] The call bill data preliminary screening module is used to screen the user list that meets the PCDN characteristics and PCDN platform domain name from the aaa call bill data provided by the operator, and obtain the PCDN illegal user list;

[0019] Flink access Netflow module is used for Flink computing engine to access Netflow traffic data. It matches the user access IP and port with the loaded PCDN violation user list, and then performs light traffic aggregation to obtain the Netflow traffic data associated with the PCDN violation user.

[0020] The Flink activity calculation module is used to select the Netflow traffic data associated with the PCDN illegal users within the online and offline time range of the PCDN illegal users to analyze the activity, calculate the active proportion of the flow within the online and offline time range of the PCDN illegal users, obtain the activity of the PCDN illegal users, and finally output the PCDN illegal users list in reverse order of activity.

[0021] Furthermore, the PCDN features are: the upstream traffic is greater than 50GB, and the upstream to downstream traffic ratio is greater than 2.

[0022] Furthermore, the activity of the PCDN illegal user is calculated as follows:

[0023] Summarize the Netflow traffic data associated with PCDN illegal users at different time points;

[0024] The online and offline time of the PCDN illegal user is selected and associated with the Netflow traffic data associated with the PCDN illegal user, and the Netflow traffic data associated with the PCDN illegal user within the online and offline time range of the PCDN illegal user is retained;

[0025] Calculate the average uplink rate of aaa users, the average uplink rate of flows at each time point, and the total number of time points between online and offline times;

[0026] Compare the average uplink rate of the flow at each time point with the average uplink rate of the aaa user. If the average uplink rate of the flow at a certain time point is greater than the average uplink rate of the aaa user, the status at that time point is recorded as active. Divide the total number of time points between the online and offline time by the number of active time points to obtain the activity level of the PCDN violating user.

[0027] In one embodiment of the present invention, a computer device is also proposed, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the aforementioned Flink-based traffic analysis method for active PCDN users is designed.

[0028] In one embodiment of the present invention, a computer-readable storage medium is further provided, wherein the computer-readable storage medium stores a computer program for executing a traffic analysis method for active PCDN users based on Flink.

[0029] Beneficial effects:

[0030] 1. The present invention mainly combines the Flink computing engine with the traditional method of judging PCDN users, analyzes the activity of the original call list data in combination with the network traffic, screens PCDN users from multiple dimensions, removes the data that meets the PCDN characteristics but is not actually PCDN users, and improves the accuracy of PCDN user judgment.

[0031] 2. The present invention provides a new solution. Previously, users could only check the list of suspected PCDN illegal users of hundreds of thousands every day. However, with these different dimensional analyses, users can arbitrarily filter out PCDN users with high scores in a certain dimension, or PCDN users with high scores in several dimensions for screening, which provides a certain degree of freedom on the basis of accuracy.

[0032] 3. The present invention uses the Flink computing engine for dimensional analysis, which has good scalability. If there are more dimensional analyses in the future, only the configuration needs to be changed, and the scalability is good. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 It is a flow chart of a method for analyzing traffic of active PCDN users based on Flink according to an embodiment of the present invention;

[0034] Figure 2 The Flow average flow change trend graph of the selected PCDN user with an online time of 20:00 and an offline time of 22:15 according to an embodiment of the present invention;

[0035] Figure 3This is a list diagram of time points at which the average uplink rate of Flow is greater than the average uplink rate of aaa users after 20:00, the online time of a PCDN user in an embodiment of the present invention;

[0036] Figure 4 It is a structural diagram of a traffic analysis device for active PCDN users based on Flink of the present invention;

[0037] Figure 5 It is a schematic diagram of the computer device structure of the present invention. DETAILED DESCRIPTION

[0038] The principles and spirit of the present invention will be described below with reference to several exemplary embodiments. It should be understood that these embodiments are provided only to enable those skilled in the art to better understand and design the present invention, and are not intended to limit the scope of the present invention in any way. On the contrary, these embodiments are provided to make the present disclosure more thorough and complete, and to fully convey the scope of the present disclosure to those skilled in the art.

[0039] Those skilled in the art will appreciate that the embodiments of the present invention may be designed as a device, apparatus, equipment, method or computer program product. Therefore, the present disclosure may be specifically designed in the following forms, namely: complete hardware, complete software (including firmware, resident software, microcode, etc.), or a combination of hardware and software.

[0040] According to an implementation of the present invention, a traffic analysis method for active PCDN users based on Flink is proposed. Since the scale of PCDN user data after initial screening is too large, at least 80% of PCDN users are not real PCDN illegal users. Therefore, the call bill users with abnormal traffic are firstly analyzed through aaa call bill data (operators have statistical data), and then the traffic analysis of active PCDN users is performed in combination with real-time Netflow traffic data. The highest comprehensive activity is output as the PCDN illegal user, and the operator performs subsequent operations on the user account according to the PCDN illegal user list.

[0041] The principle and spirit of the present invention are explained in detail below with reference to several representative embodiments of the present invention.

[0042] The traffic analysis method of active PCDN users based on Flink of the present invention includes:

[0043] 1. From the AAA call data provided by the operator, filter out the user list that meets the PCDN characteristics and PCDN platform domain name, i.e., the PCDN illegal user list, as well as specific user IP, port range, online and offline time, etc. PCDN platform domain names are some common websites that provide P2P services.

[0044] 2. The Flink computing engine loads the PCDN illegal user list, matches the accessed Netflow traffic data based on the user's access IP and port, and then performs light traffic aggregation to obtain the Netflow traffic data associated with the PCDN illegal users and store it. Light aggregation: Aggregate the Netflow traffic data with the same characteristics once, generally in a rolling window of 15 seconds, to reduce the data size and enhance performance.

[0045] 3. Select the Netflow traffic data associated with the PCDN illegal user within the online and offline time range of the PCDN illegal user to analyze the activity, calculate the active proportion of the Flow within the online and offline time range of the PCDN illegal user, and obtain the activity of the PCDN illegal user. Finally, output the PCDN illegal user list in reverse order of activity. The higher the activity, the closer it is to the PCDN illegal user.

[0046] It should be noted that, although the operations of the method of the present invention are described in a specific order in the above embodiments and the accompanying drawings, this does not require or imply that the operations must be performed in the specific order, or that all the operations shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps.

[0047] In order to explain the above-mentioned Flink-based traffic analysis method for active PCDN users more clearly, a specific embodiment is used for description below. However, it should be noted that this embodiment is only for better illustrating the present invention and does not constitute an improper limitation to the present invention.

[0048] Example:

[0049] like Figure 1 As shown in the figure, the activity of PCDN user traffic is summarized and cross-analyzed from the results of Flink access to Netflow traffic data and the collected AAA call bill data. The specific implementation steps are as follows:

[0050] 1. Analyze the accessed AAA call record data and store the user list that initially meets the PCDN characteristics.

[0051] The following is a sample of aaa call record data:

[0052] user1272635|61.178.255.117|ads-J092182278010096a8d95158669|10800|2024-07-17 21:00:02|2024-07-1800:00:02|125.75.49.181|54272|58367|100.118.41.51| 39402|0|21560|0|240e:0334:0018:069a:0000:0000:0000:0000 / 64|0|0|0|0|up date

[0053] user1828104|61.178.255.120|ads-X0821922700102274ebbf153320|10752|2024-07-17 21:00:50|2024-07-1800:00:02|118.181.161.87|25600|29695|100.71.5.105|3171262291|0|761733420|1||0|0|0|0|stop

[0054] Valid information is extracted from AAA bill data for analysis. The valid information includes user, IP, start port, end port, event time (field carried by AAA bill data), session ID, number of uplink bytes, number of downlink bytes, user status, and uplink rate. PCDN features are as follows: entries with uplink traffic greater than 50GB and uplink and downlink traffic ratio greater than 2 are marked as suspected PCDN violation users. The screened out suspected PCDN violation users are stored.

[0055] 2. The Netflow traffic within the access metropolitan area network boundary is sent to the Flink UDP data receiving port. The Flink computing engine loads the above-mentioned list of suspected PCDN violation users into the cache. The Flink computing engine filters the source IP, destination IP and port that meet the PCDN violation users, establishes a 60-second rolling window, and lightly summarizes the Netflow traffic data that meets the conditions (the Flow source IP is equal to the IP in the aaa call bill data, and the Flow source IP port is within the IP port range of the aaa call bill data) and stores it in the doris database. The stored Flow information includes: source IP, destination IP, source port, destination port, protocol, number of bytes, number of packets, start time, end time and associated PCDN user name.

[0056] 3. Remove the PCDN violating users who are not associated with Netflow traffic data from the list, and then associate the lightly summarized Netflow traffic data with the PCDN violating user information after being removed, and group and summarize them according to the source port, destination port, protocol and time interval, and save the summary information into the doris database.

[0057] 4. Query the doris database and analyze and filter the PCDN platforms of suspected PCDN violators. Common PCDN platforms include Net Heart Cloud, JD Wireless Bao, Super Point Cloud, Fengdong CDN, Xingyu CDN, etc. According to the DNS domain name information accessed, find out whether it belongs to the subdomain of the following domain name (combined with the DNS domain name information, the DNS domain name information must have the domain name field, use the PCDN user's IP as the PCDN source IP to match the DNS record, and then obtain the domain name of the DNS record. Through the domain name conversion mechanism, determine whether it belongs to the PCDN platform domain name), subdomain: for example, the domain name of the PCDN platform is onethingcloud.com (Net Heart Cloud), then onethingcloud.com.cn, www.onethingcloud.com.cn, xxx.onethingcloud.com.cn are all subdomains. When comparing domain names, they will be converted into top-level domain names for matching. The conversion method is to only retain keywords for comparison, such as removing characters such as http: / / , com, cn, and www. No further explanation is given here, which is not the main content discussed in the present invention.

[0058] 5. Use the Flink computing engine and the PCDN illegal user list to calculate the Flow activity.

[0059] (1) First, obtain the lightly summarized Netflow traffic data (step 3), match the PCDN illegal user list (after filtering in step 4), output all the Netflow traffic data of the PCDN illegal users, and summarize the Netflow traffic data point by point, one point every five minutes.

[0060] (2) The online and offline time of the PCDN illegal users is correlated with the Netflow traffic data, and only the Netflow traffic data within the online and offline time range of the PCDN illegal users is retained.

[0061] The specific database logic is as follows:

[0062] pcdn_aaa_ip_min AS(

[0063] SELECT

[0064] src_aaa_user_name,

[0065] src_address,

[0066] SECOND_CEIL(time,300)time,

[0067] SUM(IFNULL(octets,0))octets

[0068] FROM dws_analyzer_pcdn_5_min

[0069] WHERE

[0070] src_aaa_user_name is not null

[0071]

[0072] (3) Calculate the uplink rate of AAA call data. Divide the total uplink bytes of AAA data by the total session duration to obtain the average uplink rate of AAA users.

[0073] (4) Calculate the upstream rate of the flow. Use the summary information of the Netflow traffic in (1) and divide the total traffic of five minutes by the duration (300 seconds) to obtain the average upstream rate of the flow at each five-minute point.

[0074] (5) Calculate the duration. Take the online and offline time of the PCDN violating user, obtain the number of minutes between the online and offline time, divide the number of minutes by 5 and take the integer part to obtain the total number of time points of the continuous activity.

[0075] The specific sql logic is as follows:

[0076]

[0077]

[0078] (6) Finally, compare the average uplink rate of Flow with the average uplink rate of aaa users. If the average uplink rate of Flow is greater than the average uplink rate of aaa users (with an allowable error of 10%), the state at that time point is recorded as 1, i.e., active. The number of active time points is divided by the total number of time points to obtain the activity level of the PCDN violating user.

[0079] The specific SQL processing logic is as follows:

[0080] )

[0082] (7) Select the online time of the PCDN illegal user as 20:00 and the offline time as 22:15. For example, Figure 2 and 3 As shown:

[0083] Figure 2 The middle dashed line represents the average uplink rate of AAA users, which is Figure 2 It can be seen that the traffic of the PCDN illegal user is active between 20:00 and 22:00, which shows that it is very likely that the PCDN illegal user provides PCDN services to others.

[0084] Based on the same inventive concept, the present invention also proposes a traffic analysis device for active PCDN users based on Flink. The implementation of the device can refer to the implementation of the above method, and the repeated parts will not be repeated. The term "module" used below can be a combination of software and / or hardware designed for a predetermined function. Although the device described in the following embodiments is preferably designed with software, the design of hardware, or a combination of software and hardware is also possible and conceivable.

[0085] Figure 4 Schematic diagram of the structure of the traffic analysis device for active PCDN users based on Flink of the present invention. Figure 4 As shown, the device comprises:

[0086] The call bill data preliminary screening module 101 is used to screen the user list that meets the PCDN characteristics and PCDN platform domain name from the aaa call bill data provided by the operator, and obtain the PCDN illegal user list; the PCDN characteristics are: the uplink traffic is greater than 50GB, and the uplink and downlink traffic ratio is greater than 2.

[0087] The Flink access Netflow module 102 is used for the Flink computing engine to access the Netflow traffic data, match the user access IP and port with the loaded PCDN illegal user list, and then perform light traffic aggregation to obtain the Netflow traffic data associated with the PCDN illegal users.

[0088] The Flink activity calculation module 103 is used to select the Netflow traffic data associated with the PCDN illegal user within the online and offline time range of the PCDN illegal user to perform activity analysis, calculate the active proportion of the flow within the online and offline time range of the PCDN illegal user, obtain the activity of the PCDN illegal user, and finally output a list of PCDN illegal users in reverse order of activity; the activity of the PCDN illegal user is calculated as follows:

[0089] Summarize the Netflow traffic data associated with PCDN illegal users at different time points;

[0090] The online and offline time of the PCDN illegal user is selected and associated with the Netflow traffic data associated with the PCDN illegal user, and the Netflow traffic data associated with the PCDN illegal user within the online and offline time range of the PCDN illegal user is retained;

[0091] Calculate the average uplink rate of aaa users, the average uplink rate of flows at each time point, and the total number of time points between online and offline times;

[0092] Compare the average uplink rate of the flow at each time point with the average uplink rate of the aaa user. If the average uplink rate of the flow at a certain time point is greater than the average uplink rate of the aaa user, the status at that time point is recorded as active. Divide the total number of time points between the online and offline time by the number of active time points to obtain the activity level of the PCDN violating user.

[0093] It should be noted that although several modules of the traffic analysis device for active PCDN users based on Flink are mentioned in the above detailed description, this division is only exemplary and not mandatory. In fact, according to an embodiment of the present invention, the features and functions of two or more modules described above can be concretized in one module. Conversely, the features and functions of one module described above can be further divided into multiple modules for concretization.

[0094] Based on the above invention concept, Figure 5 As shown, the present invention also proposes a computer device 200, including a memory 210, a processor 220, and a computer program 230 stored in the memory 210 and executable on the processor 220. When the processor 220 executes the computer program 230, the aforementioned Flink-based traffic analysis method for active PCDN users is designed.

[0095] Based on the aforementioned inventive concept, the present invention further proposes a computer-readable storage medium, which stores a computer program for executing the aforementioned Flink-based traffic analysis method for active PCDN users.

[0096] The traffic analysis method and device for active PCDN users based on Flink proposed in the present invention have the following highlights:

[0097] 1. The new technical solution of the present invention is mainly based on the traditional judgment of PCDN users and combined with the Flink computing engine, the analysis results of the original call list data are combined with the network traffic to analyze the activity, and PCDN users are screened from multiple dimensions, and the part of data that meets the PCDN characteristics but is not actually PCDN users is removed, thereby improving the accuracy of PCDN user judgment.

[0098] 2. The present invention provides a new solution. Previously, users could only check the list of suspected PCDN illegal users of hundreds of thousands every day. However, with these different dimensional analyses, users can arbitrarily filter out PCDN users with high scores in a certain dimension, or PCDN users with high scores in several dimensions for screening, which provides a certain degree of freedom on the basis of accuracy.

[0099] 3. The present invention uses the Flink computing engine for dimensional analysis, which has good scalability. If there are more dimensional analyses in the future, only the configuration needs to be changed, and the scalability is good.

[0100] Although the spirit and principle of the present invention have been described with reference to several specific embodiments, it should be understood that the present invention is not limited to the disclosed specific embodiments, and the division of various aspects does not mean that the features in these aspects cannot be combined to benefit, and such division is only for the convenience of expression. The present invention is intended to cover various modifications and equivalent arrangements contained in the spirit and scope of the attached claims.

[0101] Regarding the limitation of the protection scope of the present invention, those skilled in the art should understand that, based on the technical solution of the present invention, various modifications or variations that can be made by those skilled in the art without creative work are still within the protection scope of the present invention.

Claims

1. A traffic analysis method for active PCDN users based on Flink, characterized in that: The method includes: From the AAA call bill data provided by the operator, filter the user list that meets the PCDN characteristics and PCDN platform domain name to obtain the PCDN illegal user list; The Flink computing engine loads the PCDN illegal user list, matches the user's access IP and port with the accessed Netflow traffic data, and then performs light traffic aggregation to obtain the Netflow traffic data associated with the PCDN illegal users. The Netflow traffic data associated with the PCDN illegal users within the online and offline time range of the PCDN illegal users is selected for activity analysis, and the active proportion of the Flow within the online and offline time range of the PCDN illegal users is calculated to obtain the activity of the PCDN illegal users, and finally a list of PCDN illegal users in reverse order of activity is output.

2. The method for analyzing traffic of active PCDN users based on Flink according to claim 1, characterized in that: The PCDN features are: the uplink traffic is greater than 50GB, and the uplink and downlink traffic ratio is greater than 2.

3. The method for analyzing traffic of active PCDN users based on Flink according to claim 1, characterized in that: The activity of the PCDN illegal user is calculated as follows: Summarize the Netflow traffic data associated with PCDN illegal users at different time points; The online and offline time of the PCDN illegal user is selected and associated with the Netflow traffic data associated with the PCDN illegal user, and the Netflow traffic data associated with the PCDN illegal user within the online and offline time range of the PCDN illegal user is retained; Calculate the average uplink rate of aaa users, the average uplink rate of flows at each time point, and the total number of time points between online and offline times; Compare the average uplink rate of the flow at each time point with the average uplink rate of the aaa user. If the average uplink rate of the flow at a certain time point is greater than the average uplink rate of the aaa user, the status at that time point is recorded as active. Divide the total number of time points between the online and offline time by the number of active time points to obtain the activity level of the PCDN violating user.

4. A traffic analysis device for active PCDN users based on Flink, characterized in that: The device includes: The call bill data preliminary screening module is used to screen the user list that meets the PCDN characteristics and PCDN platform domain name from the aaa call bill data provided by the operator, and obtain the PCDN illegal user list; Flink access Netflow module is used for Flink computing engine to access Netflow traffic data. It matches the user access IP and port with the loaded PCDN violation user list, and then performs light traffic aggregation to obtain the Netflow traffic data associated with the PCDN violation user. The Flink activity calculation module is used to select the Netflow traffic data associated with the PCDN illegal users within the online and offline time range of the PCDN illegal users to analyze the activity, calculate the active proportion of the flow within the online and offline time range of the PCDN illegal users, obtain the activity of the PCDN illegal users, and finally output the PCDN illegal users list in reverse order of activity.

5. The traffic analysis device for active PCDN users based on Flink according to claim 4, characterized in that: The PCDN features are: the uplink traffic is greater than 50GB, and the uplink and downlink traffic ratio is greater than 2.

6. The traffic analysis device for active PCDN users based on Flink according to claim 4, characterized in that: The activity of the PCDN illegal user is calculated as follows: Summarize the Netflow traffic data associated with PCDN illegal users at different time points; The online and offline time of the PCDN illegal user is selected and associated with the Netflow traffic data associated with the PCDN illegal user, and the Netflow traffic data associated with the PCDN illegal user within the online and offline time range of the PCDN illegal user is retained; Calculate the average uplink rate of aaa users, the average uplink rate of flows at each time point, and the total number of time points between online and offline times; Compare the average uplink rate of the flow at each time point with the average uplink rate of the aaa user. If the average uplink rate of the flow at a certain time point is greater than the average uplink rate of the aaa user, the status at that time point is recorded as active. Divide the total number of time points between the online and offline time by the number of active time points to obtain the activity level of the PCDN violating user.

7. A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 3 is implemented.

8. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program for executing the method according to any one of claims 1 to 3.

Images