Traffic-based video transmission anomaly analysis method and system, and electronic equipment

Abstract

The invention provides a video transmission abnormity analysis method and system based on flow and electronic equipment, and relates to the technical field of video transmission, and the method comprises the steps: firstly, analyzing switch mirror image flow collected from an upstream access switch in advance, generating video signaling data, and transmitting the video signaling data to an upstream access switch; the video signaling data comprises structure data, target task data and communication parameters; and then performing anomaly analysis on the video signaling data, determining a video transmission anomaly result, and generating alarm information based on the video transmission anomaly result. According to the method, the video signaling is analyzed from the flow, centralized monitoring and analysis of the video transmission abnormity are realized through signaling auditing, the technical problems of high difficulty and poor compatibility of video transmission abnormity analysis in the prior art are solved, and the technical effects of improving the efficiency of video transmission abnormity analysis and guaranteeing the stability of video transmission are realized.

Description

Technical Field

[0001] The present invention relates to the technical field of video transmission, and in particular to a flow-based video transmission anomaly analysis method, system and electronic equipment. Background Art

[0002] In recent years, video networking protocols and security technical requirements have become more standardized, and some technical standards for cross-network and cascading video data (such as GB / T 28181 "Technical Requirements for Information Transmission, Exchange, and Control of Network Video Surveillance Systems" and GB 35114 "Technical Requirements and Test Methods for Video Surveillance Systems") have been proposed one after another. With the continuous development and improvement of the current public security video transmission network, network cameras and other video acquisition and monitoring equipment have been widely deployed in every corner of major cities, forming a comprehensive coverage of important places for social security. A large number of video application systems have been built and put into use, improving the ability and level of public security organs to maintain social security and respond to emergencies; at the same time, with the continuous enrichment of video application scenarios, a large amount of video data needs to be shared and transmitted, which also puts forward higher requirements for the stability and security of video transmission.

[0003] In order to ensure the stability and security of video transmission, video transmission anomaly analysis is a common and effective means. At present, the commonly used video transmission anomaly analysis methods mainly rely on video platforms, video switching boundaries, video access gateways and other products to capture anomalies, but each manufacturer and each product is independent of each other. Once an anomaly occurs, the operation and maintenance personnel need to log in to each system to check one by one, which makes it very difficult to locate the problem. In other words, the existing technology for video transmission anomaly analysis has technical problems such as high difficulty and poor compatibility. Summary of the invention

[0004] The purpose of the present invention is to provide a flow-based video transmission anomaly analysis method, system and electronic device to alleviate the technical problems of great difficulty and poor compatibility in the prior art of video transmission anomaly analysis.

[0005] In the first aspect, an embodiment of the present invention provides a flow-based video transmission anomaly analysis method, which is applied to a flow-based video transmission anomaly analysis system, wherein the anomaly analysis system is connected to an upstream access switch in the video transmission system; the method comprises: parsing the switch mirror traffic collected in advance from the upstream access switch to generate video signaling data; the video signaling data comprises: structure data, target task data, and communication parameters; performing an anomaly analysis on the video signaling data to determine an abnormal result of video transmission; and generating an alarm message based on the abnormal result of video transmission.

[0006] In some optional implementations, the switch mirror traffic collected in advance from the above-mentioned upstream access switch is parsed to generate video signaling data, including: collecting switch mirror traffic from the above-mentioned upstream access switch; filtering and cleaning the above-mentioned switch mirror traffic to retain video transmission related traffic; and structuring the above-mentioned video transmission related traffic to generate video signaling data.

[0007] In some optional implementations, the above-mentioned video transmission related traffic is structured and processed to generate video signaling data, including: extracting corresponding data from the above-mentioned video transmission related traffic according to a structured processing template to generate video signaling data; wherein the above-mentioned structured processing template includes: structural data, target task data, and communication parameters.

[0008] In some optional implementations, the video signaling data is analyzed for abnormalities, including: performing an integrity check on the structural data in the video signaling data to determine whether the header content of the video signaling data is missing; performing an authenticity check on the structural data in the video signaling data to determine whether the video signaling is an illegal signaling.

[0009] In some optional implementations, the video signaling data is analyzed for abnormalities, including: performing content verification on the target task data in the video signaling data to determine whether the video signaling contains sensitive information; the sensitive information includes: personal privacy information and platform restriction information.

[0010] In some optional implementations, the video signaling data is analyzed for abnormalities, including: verifying the communication parameters in the video signaling data to determine whether a handshake timeout occurs in the video signaling; verifying the communication parameters in the video signaling data to determine whether the video signaling successfully executes the target task.

[0011] In some optional implementations, the video signaling data is analyzed for abnormalities, including: determining a handshake failure rate based on the video signaling data; judging whether the handshake failure rate is abnormal based on historical data, and if so, sending the abnormal result of the handshake failure rate to an alarm module.

[0012] In the second aspect, an embodiment of the present invention provides a flow-based video transmission anomaly analysis system, which is connected to an upstream access switch in a video transmission system; the system includes: a flow parsing module, used to parse the switch mirror traffic collected in advance from the upstream access switch to generate video signaling data; the video signaling data includes: structure data, target task data, communication parameters; an anomaly analysis module, used to perform an anomaly analysis on the video signaling data to determine the video transmission anomaly result; an alarm module, used to generate alarm information based on the video transmission anomaly result.

[0013] In a third aspect, an embodiment of the present invention provides an electronic device, comprising a memory and a processor, wherein the memory stores a computer program executable on the processor, and when the processor executes the computer program, the steps of any one of the methods described in the first aspect are implemented.

[0014] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer-executable instructions. When the computer-executable instructions are called and executed by a processor, the computer-executable instructions prompt the processor to execute any method described in the first aspect above.

[0015] The present invention provides a method, system and electronic device for analyzing video transmission anomalies based on traffic flow, the method comprising: firstly parsing the switch mirror traffic collected in advance from the upstream access switch to generate video signaling data, the video signaling data comprising: structure data, target task data, communication parameters; then performing an anomaly analysis on the video signaling data to determine the video transmission anomaly result, and then generating an alarm message based on the video transmission anomaly result. The method parses the video signaling from the traffic flow, realizes the centralized monitoring and analysis of video transmission anomalies through signaling audit, solves the technical problems of difficulty and poor compatibility of video transmission anomaly analysis in the prior art, and realizes the technical effect of improving the efficiency of video transmission anomaly analysis and ensuring the stability of video transmission. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0017] Figure 1 A flow chart of a method for analyzing abnormalities in video transmission based on flow provided by an embodiment of the present invention;

[0018] Figure 2 A schematic diagram of the connection structure between a flow-based video transmission anomaly analysis system and a video transmission system provided by an embodiment of the present invention;

[0019] Figure 3 A schematic diagram of the structure of a flow-based video transmission anomaly analysis system provided by an embodiment of the present invention;

[0020] Figure 4 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0021] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Generally, the components of the embodiments of the present invention described and shown in the drawings here can be arranged and designed in various different configurations.

[0022] Therefore, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the invention claimed for protection, but merely represents selected embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0023] It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in the subsequent drawings. Some embodiments of the present invention are described in detail below in conjunction with the drawings. The following embodiments and features in the embodiments can be combined with each other without conflict.

[0024] In recent years, video networking protocols and security technical requirements have become more standardized, and a series of technical standards for cross-network and cascading video data have been proposed, such as GB / T 28181 and GB 35114. With the continuous development and improvement of the current public security video transmission network, network cameras and other video acquisition and monitoring equipment have been widely deployed in every corner of major cities, forming a comprehensive coverage of important places for social security. A large number of video application systems have been built and put into use, improving the ability and level of public security organs to maintain social order and respond to emergencies; at the same time, with the continuous enrichment of video application scenarios, a large amount of video data needs to be shared and transmitted, which also puts forward higher requirements for the stability and security of video transmission.

[0025] In order to ensure the stability and security of video transmission, video transmission anomaly analysis is a common and effective means. At present, the commonly used video transmission anomaly analysis methods mainly rely on video platforms, video switching boundaries, video access gateways and other products to capture anomalies. However, each manufacturer and each product is independent of each other. Once an anomaly occurs, the operation and maintenance personnel need to log in to each system to check one by one, which makes it very difficult to locate the problem. Therefore, there is an urgent need for an effective technical means to centrally monitor and analyze video transmission anomalies.

[0026] At present, the common video transmission anomaly analysis methods mainly rely on video platforms, video exchange boundaries, video access gateways and other products to capture anomalies separately, which has problems such as low efficiency in anomaly positioning and unclear responsibility. In other words, the existing technology for video transmission anomaly analysis has technical problems such as high difficulty and poor compatibility.

[0027] Based on this, the embodiments of the present invention provide a flow-based video transmission anomaly analysis method, system and electronic device to solve the technical problems of high difficulty and poor compatibility in video transmission anomaly analysis in the prior art.

[0028] To facilitate understanding of this embodiment, firstly, a method for analyzing abnormality of video transmission based on flow rate disclosed in an embodiment of the present invention is described in detail. Figure 1 The flowchart of a flow-based video transmission anomaly analysis method is shown. The method is applied to a flow-based video transmission anomaly analysis system, and the anomaly analysis system is connected to an upstream access switch in the video transmission system. Figure 2 A schematic diagram of the connection structure between a flow-based video transmission anomaly analysis system and a video transmission system is shown.

[0029] As a specific example, the video transmission system includes: a lower-level video platform, a downstream access switch (connected to the lower-level video platform), an edge device, an upstream access switch (connected to the upper-level video platform), and an upper-level video platform; and the traffic-based video transmission anomaly analysis system is directly connected to the video transmission system through the upstream access switch, and analyzes the video transmission anomalies by collecting and analyzing the switch bypass mirror traffic to ensure that normal business transmission is not affected.

[0030] The method can be performed by an electronic device, and mainly includes the following steps S110 to S130:

[0031] S110: parsing the switch mirror traffic collected in advance from the upstream access switch to generate video signaling data; the video signaling data includes: structure data, target task data, and communication parameters;

[0032] In one embodiment, parsing switch mirror traffic collected in advance from an upstream access switch to generate video signaling data includes:

[0033] (S11) collecting switch mirror traffic from an upstream access switch;

[0034] (S12) filtering and cleaning the switch mirror traffic, and retaining the video transmission related traffic;

[0035] That is, the collected switch mirror traffic is parsed, cleaned, and filtered, and only the video transmission related traffic is retained. As a specific example, the retained video transmission related traffic may include: Session Initiation Protocol (SIP) signaling, Real-time Transport Protocol (RTP) video stream, etc.

[0036] SIP is an application layer control protocol used to create, modify and terminate multimedia sessions (such as video calls). SIP signaling can be used in communication scenarios such as initiating telephone calls and video conferencing over the Internet, as well as in scenarios such as video on demand and video playback.

[0037] (S13) Structuring the video transmission related traffic to generate video signaling data.

[0038] Specifically, the above (S13) may include: extracting corresponding data from video transmission related traffic according to a structured processing template to generate video signaling data. The structured processing template includes: structure data, target task data, and communication parameters.

[0039] As a specific example, structural data is characteristic data of SIP signaling, which may be part or all of the fields in the message header of SIP signaling, such as: common header fields (Via, Max-Forwards, etc.), request header fields (From, To, Call-ID, CSeq, Contact, etc.), response header fields, entity header fields (Content-Type, Content-Length, etc.).

[0040] The target task of video transmission can be video on demand, video playback, camera rotation, etc. The target task data can include data of specific tasks, data of requested tasks, data of task feedback, etc.

[0041] Communication parameters can be parameters for communication during video transmission, such as signaling timeout detection (receiving a timed-out response packet after a signaling request, or not receiving a response packet for a long time), RTP protocol detection, etc. There are generally two ways to determine signaling timeout: 1. Receiving a timed-out response packet after a signaling request, such as 408 Request Timeout: the server cannot generate a response within an appropriate period of time; 504 Server Timeout: the server times out and cannot process the request within the specified time. 2. No response packet is received for a long time after a signaling request, such as a preset timeout of 30 seconds for the signaling server, and no response packet is received for more than 30 seconds after the signaling request packet is found.

[0042] Usually, when transmitting a video, the signaling protocol is first used for handshake interaction. During the handshake process, the specific IP and port for video stream transmission are negotiated, and the real video stream data is transmitted through the negotiated IP and port. For example, in SIP communication, the signaling handshake refers to the process of exchanging a series of messages between two communication endpoints through the SIP protocol to establish a session. These messages include invitations (INVITE), responses (such as 200OK) and confirmations (ACK). After the SIP signaling handshake is completed, the two parties will negotiate the IP address, port number and other key information of the subsequent RTP push stream through the SDP protocol (Session Description Protocol). This information is the basis for real-time data transmission between the two parties.

[0043] RTP (Real-time Transport Protocol) is a protocol used to transmit real-time data (such as audio and video) on the Internet. It provides mechanisms such as timestamps and sequence numbers for data packets to ensure the real-time and integrity of data. In video communication, push streaming refers to sending local video data to a remote endpoint via the RTP protocol; while pull streaming refers to receiving video data transmitted via the RTP protocol from a remote endpoint.

[0044] S120: Performing abnormal analysis on the video signaling data to determine abnormal video transmission results;

[0045] In one embodiment, performing abnormal analysis on video signaling data may include: (1) performing integrity verification on structural data in the video signaling data to determine whether the header content of the video signaling data is missing; (2) performing authenticity verification on structural data in the video signaling data to determine whether the video signaling is illegal signaling.

[0046] For example, the standard SIP protocol has protocol specifications. For example, the header field content of the INVITE signaling generally contains From, To, Call-ID, CSeq, Contact and other information. If the data parsed from the traffic is structured to obtain video signaling data, and the header field content of the video signaling data has missing fields (the information of the structured data is incomplete), or the fields of the structured data are not the content of the real signaling, it can be determined as illegal signaling.

[0047] In one embodiment, performing abnormal analysis on video signaling data may also include: (3) performing content verification on target task data in the video signaling data to determine whether the video signaling contains sensitive information; sensitive information includes: personal privacy information and platform restriction information.

[0048] Among them, personal privacy information can be ID card number, bank card number, etc.; platform restricted information can be information that violates platform regulations, banned words, etc.

[0049] As a specific example, the standard SIP protocol has protocol specifications. If the SIP protocol parsed from the traffic contains other information, such as sensitive information such as identity card number, bank card number, etc., it can be determined that the signaling illegally contains sensitive data.

[0050] In one embodiment, performing abnormal analysis on video signaling data may also include: (4) verifying communication parameters in the video signaling data to determine whether a handshake timeout occurs in the video signaling; and (5) verifying communication parameters in the video signaling data to determine whether the video signaling successfully executes the target task.

[0051] For example, after the SIP signaling handshake is completed, the IP, port and other information of the subsequent RTP streaming will be negotiated in the SDP. However, if it is found that the corresponding RTP protocol has not been detected after the signaling handshake of the video on demand is completed, it can be determined that the video on demand handshake is successful but the streaming fails.

[0052] In one embodiment, performing abnormal analysis on video signaling data may also include: (6) determining a handshake failure rate based on the video signaling data; judging whether the handshake failure rate is abnormal based on historical data, and if so, sending the abnormal result of the handshake failure rate to an alarm module.

[0053] In the above embodiment, the specific steps of performing abnormal analysis on the video signaling data can be performed by an abnormal analysis model, which can be generated based on a machine learning algorithm or a deep learning algorithm, and is used to predict the video signaling data to be tested and generate an analysis result of the video transmission abnormality. The abnormal analysis model can also be a predefined rule condition, which is used to match the video signaling data to be tested, and the rule condition in the match is used as the analysis result of the video transmission abnormality.

[0054] S130: Generate alarm information based on the abnormal result of video transmission.

[0055] The alarm information may be generated by an alarm module in the flow-based video transmission anomaly analysis system, that is, the alarm module generates an alarm event immediately after receiving the video transmission anomaly result.

[0056] The embodiment of the present application provides a method for analyzing video transmission anomalies based on traffic, which ensures that normal business transmission is not affected by collecting and analyzing the switch bypass mirror traffic; the video signaling is parsed and restored from the traffic to implement signaling audit, and multiple dimensions such as the integrity of the video signaling content, the signaling connection failure rate, and irrelevant information included in the signaling content can be analyzed; the embodiment of the present application also supports correlation analysis of video signaling and video streams, discovers anomalies such as video streaming timeout, video signaling on-demand success but streaming failure, and generates alarms in a timely manner.

[0057] The embodiment of the present application provides a detection method for video transmission anomalies, which can timely and effectively discover abnormal risks such as video connection timeout, failure, and information entrained in video transmission content, and generate alarm events in a timely manner. Without the need for third-party docking, video transmission anomalies of heterogeneous manufacturers can be centrally monitored and analyzed in a timely and effective manner, thereby ensuring the stability and security of video transmission.

[0058] In addition, the embodiment of the present invention also provides a flow-based video transmission anomaly analysis system, see Figure 3 As shown, the abnormality analysis system is connected to an upstream access switch in a video transmission system; the system includes:

[0059] The traffic analysis module 310 is used to analyze the switch mirror traffic collected in advance from the upstream access switch to generate video signaling data; the video signaling data includes: structure data, target task data, and communication parameters;

[0060] The abnormality analysis module 320 is used to perform abnormality analysis on the video signaling data and determine abnormal results of video transmission;

[0061] The alarm module 330 is used to generate alarm information based on abnormal video transmission results.

[0062] In one embodiment, the above-mentioned traffic analysis module can also be used to: collect switch mirror traffic from the upstream access switch; filter and clean the switch mirror traffic to retain video transmission related traffic; and perform structured processing on the video transmission related traffic to generate video signaling data.

[0063] Among them, the video transmission related traffic is structured and processed to generate video signaling data, including: extracting corresponding data from the video transmission related traffic according to a structured processing template to generate video signaling data; wherein the structured processing template includes: structural data, target task data, and communication parameters.

[0064] In one embodiment, the above-mentioned abnormality analysis module may further include: an abnormality analysis model module. The abnormality analysis model module is used to generate an abnormality analysis model based on a machine learning algorithm or a deep learning algorithm, and is used to predict the video signaling data to be tested and generate an analysis result of video transmission abnormality.

[0065] In one embodiment, the above-mentioned abnormality analysis module may further include: a rule definition module. The rule definition module is used to predefine rule conditions, match them with the video signaling data to be tested, and use the matching rule conditions as the analysis results of the video transmission abnormality.

[0066] The flow-based video transmission anomaly analysis system provided in the embodiment of the present application can be specific hardware on the device or software or firmware installed on the device, etc. The implementation principle and technical effects of the device provided in the embodiment of the present application are the same as those of the aforementioned method embodiment. For the sake of brief description, for matters not mentioned in the device embodiment, reference can be made to the corresponding contents in the aforementioned method embodiment. Technical personnel in the relevant field can clearly understand that for the convenience and conciseness of description, the specific working processes of the systems, devices and units described above can all refer to the corresponding processes in the aforementioned method embodiment, and will not be repeated here. The flow-based video transmission anomaly analysis system provided in the embodiment of the present application has the same technical features as the flow-based video transmission anomaly analysis method provided in the above embodiment, so it can also solve the same technical problems and achieve the same technical effects.

[0067] An embodiment of the present application further provides an electronic device. Specifically, the electronic device includes a processor and a storage device. The storage device stores a computer program, and when the computer program is executed by the processor, it executes the method described in any one of the above-mentioned embodiments.

[0068] Figure 4 A structural schematic diagram of an electronic device provided in an embodiment of the present application, the electronic device 400 includes: a processor 40, a memory 41, a bus 42 and a communication interface 43, wherein the processor 40, the communication interface 43 and the memory 41 are connected via the bus 42; the processor 40 is used to execute an executable module stored in the memory 41, such as a computer program.

[0069] The memory 41 may include a high-speed random access memory (RAM), and may also include a non-volatile memory, such as at least one disk memory. The communication connection between the system network element and at least one other network element is realized through at least one communication interface 43 (which may be wired or wireless), and the Internet, wide area network, local area network, metropolitan area network, etc. may be used.

[0070] The bus 42 may be an ISA bus, a PCI bus, or an EISA bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 4 Only one bidirectional arrow is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0071] Among them, the memory 41 is used to store programs, and the processor 40 executes the program after receiving the execution instruction. The method executed by the process definition device disclosed in any embodiment of the above-mentioned embodiment of the present invention can be applied to the processor 40 or implemented by the processor 40.

[0072] The processor 40 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the hardware integrated logic circuit or software instructions in the processor 40. The above processor 40 can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present invention can be implemented or executed. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor. The steps of the method disclosed in the embodiments of the present invention can be directly embodied as a hardware decoding processor to execute, or can be executed by a combination of hardware and software modules in the decoding processor. The software module can be located in a mature storage medium in the field such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory 41, and the processor 40 reads the information in the memory 41 and completes the steps of the above method in combination with its hardware.

[0073] Corresponding to the above method, an embodiment of the present application also provides a computer-readable storage medium, which stores computer-executable instructions. When the computer-executable instructions are called and executed by a processor, the computer-executable instructions prompt the processor to execute the steps of the above method.

[0074] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, and the indirect coupling or communication connection of the devices or units can be electrical, mechanical or other forms.

[0075] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0076] In addition, each functional unit in the embodiments provided in the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0077] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, electronic device, or network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0078] It should be noted that similar numbers and letters represent similar items in the accompanying drawings. Therefore, once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings. In addition, the terms "first", "second", "third", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance.

[0079] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for analyzing abnormalities in video transmission based on traffic, characterized in that: Applied to a traffic-based video transmission anomaly analysis system, the anomaly analysis system is connected to an upstream access switch in the video transmission system; the method comprises: Parsing the switch mirror traffic collected in advance from the upstream access switch to generate video signaling data; the video signaling data includes: structure data, target task data, and communication parameters; Performing an abnormality analysis on the video signaling data to determine an abnormal result of video transmission; Generate alarm information based on the abnormal result of video transmission.

2. The method for analyzing abnormality of video transmission based on flow according to claim 1, characterized in that: Parsing the switch mirror traffic collected in advance from the upstream access switch to generate video signaling data includes: Collecting switch mirror traffic from the upstream access switch; Filtering and cleaning the switch mirror traffic, retaining the video transmission related traffic; The video transmission related traffic is structured to generate video signaling data.

3. The method for analyzing abnormality of video transmission based on flow according to claim 2, characterized in that: The video transmission related traffic is structured to generate video signaling data, including: Corresponding data is extracted from the video transmission related traffic according to a structured processing template to generate video signaling data; wherein the structured processing template includes: structural data, target task data, and communication parameters.

4. The method for analyzing abnormality of video transmission based on flow according to claim 1, characterized in that: Performing abnormality analysis on the video signaling data, including: Performing integrity check on the structure data in the video signaling data to determine whether header field content of the video signaling data is missing; Performing authenticity check on the structural data in the video signaling data to determine whether the video signaling is illegal signaling.

5. The method for analyzing abnormality of video transmission based on flow according to claim 1, characterized in that: Performing abnormality analysis on the video signaling data, including: Perform content verification on the target task data in the video signaling data to determine whether the video signaling carries sensitive information; the sensitive information includes: personal privacy information and platform restriction information.

6. The method for analyzing abnormality of video transmission based on flow according to claim 1, characterized in that: Performing abnormality analysis on the video signaling data, including: Verifying the communication parameters in the video signaling data to determine whether a handshake timeout exists in the video signaling; The communication parameters in the video signaling data are verified to determine whether the video signaling successfully performs the target task.

7. The method for analyzing abnormality of video transmission based on flow rate according to claim 1, characterized in that: Performing abnormality analysis on the video signaling data, including: determining a handshake failure rate based on the video signaling data; It is determined whether the handshake failure rate is abnormal based on historical data, and if so, the abnormal result of the handshake failure rate is sent to an alarm module.

8. A flow-based video transmission anomaly analysis system, characterized in that: The abnormality analysis system is connected to an upstream access switch in the video transmission system; the system comprises: A traffic analysis module, used to analyze the switch mirror traffic collected in advance from the upstream access switch to generate video signaling data; the video signaling data includes: structure data, target task data, and communication parameters; An abnormality analysis module, used to perform abnormality analysis on the video signaling data to determine abnormal results of video transmission; An alarm module is used to generate alarm information based on the abnormal result of the video transmission.

9. An electronic device comprising a memory and a processor, wherein the memory stores a computer program that can be run on the processor, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions. When the computer-executable instructions are called and executed by a processor, the computer-executable instructions prompt the processor to execute the method according to any one of claims 1 to 7.

Images