System health monitoring method and system based on real-time topological graph

Abstract

The invention discloses a system health monitoring method and system based on a real-time topological graph, and relates to the field related to the information network technology, and the method comprises the steps: carrying out the real-time monitoring of a network system, and constructing a real-time network topological graph; performing expectation prediction according to each access node to obtain a network expectation topological graph; deviation detection is carried out, and deviation detection results of all nodes are obtained; performing health risk inspection on each access node according to the health risk inspection channel; based on the health risk node and the risk deviation detection result, carrying out risk wave and abnormal analysis on the real-time network topological graph, and determining a risk wave and abnormal node; and generating a health risk early warning signal according to the health risk node, and generating a risk wave early warning signal based on the risk wave abnormal node. The technical problem that the real-time performance, the comprehensiveness and the accuracy of health monitoring of an existing network system are insufficient is solved, and the technical effect of improving the real-time performance, the comprehensiveness and the accuracy of health state monitoring of the network system is achieved.

Description

Technical Field

[0001] The present application relates to information network technology-related fields, and in particular to a system health monitoring method and system based on a real-time topology map. Background Art

[0002] With the rapid development of information technology, network systems have become an indispensable infrastructure in modern society. Whether it is an internal office network of an enterprise or an Internet service for the public, the stability and security of the network system are directly related to the continuity of business and the security of user data. Therefore, monitoring the health of the network system and timely discovering and handling potential risks are the key to ensuring the stable operation of the network system. In the existing network health monitoring methods, regular scanning, log analysis and other means are usually used to detect anomalies in the network system. These methods cannot capture the real-time changes in the network status in a timely manner, and also lack the grasp of the global status of the entire network system, resulting in insufficient early warning capabilities and inability to effectively prevent the spread of risks.

[0003] Among the current related technologies, network system health monitoring has technical problems such as lack of real-time, comprehensiveness and accuracy. Summary of the invention

[0004] The present application provides a system health monitoring method and system based on a real-time topology map, which monitors the network system in real time and constructs a real-time network topology map. Based on the real-time topology map, an expected prediction is made for each access node to generate an expected network topology map. The real-time topology map is compared with the expected topology map, and the deviation of each node is detected. According to the deviation detection result, the nodes with health risks and the degree of risk deviation are determined through a health risk inspection channel. Based on the health risk nodes and the risk deviation results, the risk impact in the network is analyzed, and abnormal nodes are determined. According to the health risk nodes and the risk impact abnormal nodes, corresponding health risk warning signals and risk impact warning signals are generated respectively. Technical means such as these achieve the technical effect of improving the real-time, comprehensiveness and accuracy of network system health status monitoring.

[0005] The present application provides a system health monitoring method based on a real-time topology map, including: real-time monitoring of a network system to construct a real-time network topology map; performing expected predictions based on each access node in the real-time network topology map to obtain an expected network topology map; performing deviation detection on the real-time network topology map based on the expected network topology map to obtain deviation detection results of each node; based on the deviation detection results of each node, performing health risk inspection on each access node according to a health risk inspection channel to determine health risk nodes and risk deviation detection results corresponding to the health risk nodes; based on the health risk nodes and the risk deviation detection results, performing risk spread and abnormality analysis on the real-time network topology map to determine risk spread abnormal nodes; generating a health risk warning signal based on the health risk nodes, and generating a risk spread warning signal based on the risk spread abnormal nodes.

[0006] In a possible implementation, based on the expected prediction of each access node in the real-time network topology map, the expected network topology map is obtained, and the following processing is performed: the execution task information of each access node is collected to obtain the task of each node; based on the task of each node, the health status sample of each access node is retrieved to obtain the health status sample set of each node; based on the health status sample set of each node, a central trend analysis is performed to obtain the expected status data of each node; based on the expected status data of each node, the expected network topology map is constructed.

[0007] In a possible implementation, based on the deviation detection results of each node, according to the health risk inspection channel, a health risk inspection is performed on each access node to determine the health risk node and the risk deviation detection result corresponding to the health risk node, and the following processing is performed: the health risk inspection channel includes a health risk prediction branch and a risk inspection branch; according to the deviation detection results of each node, the nth node deviation detection result corresponding to the nth access node is extracted, wherein n is a positive integer; the nth node deviation detection result is input into the health risk prediction branch to obtain the nth node health risk coefficient; the nth node health risk coefficient is input into the risk inspection branch, wherein the risk inspection branch includes a health risk threshold; if the nth node health risk coefficient is greater than or equal to the health risk threshold, the nth access node is added to the health risk node, and the nth node deviation detection result is added to the risk deviation detection result.

[0008] In a possible implementation, the construction step of the health risk prediction branch performs the following processing: calling the node deviation detection result record set and the node health risk coefficient record set; using the node deviation detection result record set as input data and the node health risk coefficient record set as output data, performing supervised learning on K base learners to generate K health risk predictors, wherein K is a positive integer greater than 1; merging the K health risk predictors as parallel independent nodes to generate a health risk prediction unit; constructing a risk prediction incentive unit, wherein the risk prediction incentive unit includes K risk prediction incentive coefficients, and the K risk prediction incentive coefficients are obtained by calculating the proportion of K health risk prediction accuracy parameters corresponding to the K health risk predictors; encapsulating the health risk prediction unit and the risk prediction incentive unit into the health risk prediction branch.

[0009] In a possible implementation, based on the health risk nodes and the risk deviation detection results, the real-time network topology map is analyzed for risk spread and abnormality, the risk spread abnormal nodes are determined, and the following processing is performed: based on the real-time network topology map, the risk propagation prediction of the health risk nodes is performed according to the risk deviation detection results to obtain risk propagation prediction results; based on the real-time network topology map, a plurality of candidate spread nodes are obtained; based on the risk propagation prediction results, a spread risk evaluation is performed on the plurality of candidate spread nodes to obtain a plurality of spread risk coefficients; it is determined whether the plurality of spread risk coefficients are greater than or equal to a spread risk threshold; if any one of the plurality of spread risk coefficients is greater than or equal to the spread risk threshold, an abnormal spread risk coefficient is obtained; and the candidate spread node corresponding to the abnormal spread risk coefficient is added to the risk spread abnormal node.

[0010] In a possible implementation, based on the risk propagation prediction result, the multiple candidate affected nodes are evaluated for risk, and multiple affected risk coefficients are obtained, and the following processing is performed: according to the risk propagation prediction result, the multiple candidate affected nodes are evaluated for risk probability, and multiple affected risk probability coefficients are obtained; according to the risk propagation prediction result, the multiple candidate affected nodes are evaluated for risk impact, and multiple affected risk impact coefficients are obtained; according to the risk propagation prediction result, the multiple affected risk probability coefficients and the multiple affected risk impact coefficients are weightedly calculated respectively, to generate the multiple affected risk coefficients.

[0011] In a possible implementation, the network system is monitored in real time, a real-time network topology map is constructed, and the following processing is performed: obtaining network basic topology data of the network system; establishing a network basic topology map based on the network basic topology data; performing real-time monitoring on the network system to obtain network real-time monitoring data; topologically optimizing the network basic topology map based on the network real-time monitoring data to generate the real-time network topology map.

[0012] The present application also provides a system health monitoring system based on a real-time topology map, including: a real-time network topology map construction module, which is used to monitor the network system in real time and construct a real-time network topology map; a network expected topology map acquisition module, which is used to make expected predictions based on each access node in the real-time network topology map to obtain the network expected topology map; a deviation detection module, which is used to perform deviation detection on the real-time network topology map according to the network expected topology map to obtain the deviation detection results of each node; a health risk inspection module, which is used to perform health risk inspection on each access node based on the deviation detection results of each node and according to a health risk inspection channel, determine the health risk node, and the risk deviation detection result corresponding to the health risk node; a risk spread and abnormal analysis module, which is used to perform risk spread and abnormal analysis on the real-time network topology map based on the health risk node and the risk deviation detection result, and determine the risk spread abnormal node; an early warning signal generation module, which is used to generate a health risk early warning signal based on the health risk node, and generate a risk spread early warning signal based on the risk spread abnormal node.

[0013] The system health monitoring method and system based on the real-time topology map proposed in this application first monitor the network system in real time and construct a real-time network topology map. Then, based on the expected prediction of each access node in the real-time network topology map, the expected network topology map is obtained. Then, based on the expected network topology map, the real-time network topology map is subjected to deviation detection to obtain the deviation detection results of each node. Then, based on the deviation detection results of each node, a health risk inspection is performed on each access node according to the health risk inspection channel to determine the health risk nodes and the risk deviation detection results corresponding to the health risk nodes. Based on the health risk nodes and the risk deviation detection results, the real-time network topology map is subjected to risk spread and abnormal analysis to determine the risk spread and abnormal nodes. Finally, based on the health risk nodes, a health risk warning signal is generated. Based on the risk spread and abnormal nodes, a risk spread and warning signal is generated, thereby achieving the technical effect of improving the real-time, comprehensiveness and accuracy of network system health status monitoring. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] In order to more clearly illustrate the technical solution of the embodiment of the present invention, the accompanying drawings of the embodiment of the present invention will be briefly introduced below. A flow chart is used in the present application to illustrate the operations performed by the system according to the embodiment of the present application. It should be understood that the preceding or following operations are not necessarily performed accurately in order. On the contrary, various steps can be processed in reverse order or simultaneously as needed. At the same time, other operations can also be added to these processes, or one or more operations can be removed from these processes.

[0015] Figure 1 A flowchart of a system health monitoring method based on a real-time topology graph provided in an embodiment of the present application.

[0016] Figure 2 A schematic diagram of the structure of a system health monitoring system based on a real-time topology graph provided in an embodiment of the present application.

[0017] Explanation of the accompanying drawings: real-time network topology map construction module 10, network expected topology map acquisition module 20, deviation detection module 30, health risk inspection module 40, risk and anomaly analysis module 50, warning signal generation module 60. DETAILED DESCRIPTION

[0018] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below.

[0019] In order to make the objectives, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings. The described embodiments should not be regarded as limiting the present application. All other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of this application.

[0020] In the following description, reference is made to "some embodiments", which describe a subset of all possible embodiments, but it is understood that "some embodiments" may be the same subset or different subsets of all possible embodiments, and may be combined with each other without conflict. The terms "including" and "having" and any variations are intended to cover non-exclusive inclusions. For example, a process, method, system, product, or server that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or modules that are not clearly listed or inherent to these processes, methods, products, or devices. Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by technicians in the technical field to which this application belongs. The terms used herein are for the purpose of describing the embodiments of the present application only.

[0021] The present application embodiment provides a system health monitoring method based on a real-time topology map, such as Figure 1 As shown, the method includes:

[0022] Step S100, monitor the network system in real time and construct a real-time network topology map.

[0023] Specifically, by deploying sensors or agents at key locations in the network system, network traffic, device status, connection relationships and other information are collected in real time. Using the collected information, graph theory and visualization technology are used to dynamically build a real-time topology diagram of the network system. The diagram shows the connection relationship and status between various nodes (such as servers, routers, switches, etc.).

[0024] In a possible implementation, the network system is monitored in real time to construct a real-time network topology map, and step S100 further includes step S110 to obtain basic network topology data of the network system. Specifically, basic information of the network system is collected through configuration management tools (such as configuration management database CMDB, configuration database, etc.) or network discovery tools, including device type, IP address, port information, connection relationship between devices, etc. The collected data is stored in a database for subsequent use, and the database can be a relational database or a non-relational database.

[0025] Step S120, based on the network basic topology data, establish a network basic topology map. Specifically, using the knowledge of graph theory, the network basic topology data is converted into a graphical representation. Nodes represent network devices, and edges represent the connection relationship between devices. Use graphical tools (such as Graphviz, D3.js, etc.) to represent the graph to form a network basic topology map for displaying the basic structure of the network system.

[0026] Step S130, real-time monitoring is performed according to the network system to obtain real-time network monitoring data. Specifically, the Simple Network Management Protocol (SNMP) is used to collect real-time status information from network devices, such as interface status, flow, error count, etc.; NetFlow or sFlow technology is used to collect network flow data and analyze the data flow in the network; log files of network devices, applications and systems are collected and analyzed to obtain real-time events and status information. Through real-time monitoring, real-time network monitoring data is obtained.

[0027] Step S140, topology optimization is performed on the basic network topology map according to the real-time network monitoring data to generate the real-time network topology map. Specifically, the states of nodes and edges in the basic network topology map are dynamically updated according to the real-time network monitoring data. For example, if an interface fails, the interface is marked as a faulty state in the topology map. The topology map is optimized using a topology optimization algorithm (such as a shortest path algorithm, a traffic balancing algorithm, etc.) to better reflect the actual state of the network. Graphics rendering technology is used to present the updated topology map in a visual manner. This implementation method generates a real-time network topology map based on real-time network monitoring data and basic network topology data, accurately reflects the actual structure and state of the network system, and improves the real-time, accuracy and visualization of network system health monitoring.

[0028] Step S200, performing expected prediction based on each access node in the real-time network topology map to obtain an expected network topology map.

[0029] Specifically, based on historical data, network strategies, business needs and other factors, machine learning or statistical models are used to predict the expected topology of the network under normal conditions. That is, the expected network topology map is the predicted topology map of the network under normal conditions, which is used for comparison with the real-time topology map.

[0030] In a possible implementation, an expected prediction is made based on each access node in the real-time network topology map to obtain an expected network topology map, and step S200 further includes step S210, collecting the execution task information of each access node to obtain the task of each node. Specifically, the access node refers to a device or node in the network system, such as a server, router, switch, etc., which are responsible for data access, forwarding and processing. The task information currently being executed by each access node is collected through configuration management tools, log analysis tools or directly obtained from the device interface. This task information may include data processing tasks, network communication tasks, resource allocation tasks, etc. The collected task information is stored in a database for subsequent analysis and processing. The database can be a relational database for storing structured task information.

[0031] Step S220, retrieve the health status samples of each access node according to the tasks of each node to obtain the health status sample set of each node. Specifically, establish a database containing various health status samples (sample data describing the health status of access nodes under specific tasks), and these samples can be historical data, simulation data or expert-annotated data. According to the task information of each node, retrieve similar health status samples in the health status sample library to form the health status sample set of each node.

[0032] Step S230, performing a central tendency analysis on the sample set of health status of each node to obtain the expected state data of each node. Specifically, using statistical methods (such as mean, median, mode, etc.) to analyze the sample set of health status of each node, find out the expected state data of each node (the health status data that the access node expects to achieve under a specific task). Smoothing the analyzed data to reduce the impact of noise and outliers. The central tendency analysis is used to find the center position or typical value of the data.

[0033] Step S240, construct the network expected topology graph according to the expected state data of each node. Specifically, using graph theory and visualization technology, the network expected topology graph is constructed according to the expected state data of each node, which is used to represent the expected health state of the network system under a specific task. In the graph, the node represents the access device, the edge represents the connection relationship between the devices, and the state of the node is represented by the expected state data. This implementation method uses a health state sample library and central trend analysis to derive the expected state data of the node based on a large amount of data, thereby improving the accuracy and reliability of the prediction.

[0034] Step S300: performing deviation detection on the real-time network topology map according to the expected network topology map to obtain deviation detection results of each node.

[0035] Specifically, by comparing the real-time network topology map with the expected network topology map, the difference between the two, i.e., the deviation, is identified, and the deviation of each node in the real-time topology map relative to the expected topology map is recorded.

[0036] Step S400, based on the deviation detection results of each node, according to the health risk inspection channel, health risk inspection is performed on each access node to determine the health risk node and the risk deviation detection result corresponding to the health risk node.

[0037] Specifically, the health risk inspection channel is a set of preset rules or models for evaluating the health risk of a node. According to the deviation detection results of each node, the health risk of each node is evaluated through the health risk inspection channel. The health risk node is a node that is assessed to have a health risk. For the health risk node, its deviation and its risk are recorded in detail.

[0038] In a possible implementation, based on the deviation detection results of each node, according to the health risk inspection channel, a health risk inspection is performed on each access node to determine the health risk node and the risk deviation detection result corresponding to the health risk node. Step S400 further includes step S410, and the health risk inspection channel includes a health risk prediction branch and a risk inspection branch. Specifically, the health risk inspection channel is a comprehensive evaluation system, which contains two main branches: a health risk prediction branch and a risk inspection branch. The health risk prediction branch uses machine learning or statistical models to predict the health risk coefficient of the access node. This coefficient is a quantitative indicator used to indicate the degree to which the node deviates from the normal state or the probability of a possible failure. The risk inspection branch is responsible for determining whether the access node actually has a health risk based on a preset health risk threshold. If the health risk coefficient of the node exceeds this threshold, the node is considered to have a health risk.

[0039] Step S420, extracting the nth node deviation detection result corresponding to the nth access node according to the node deviation detection results, where n is a positive integer. Specifically, according to the obtained node deviation detection results, extract the deviation detection result of a specific access node (nth access node). This detection result contains the difference information between the current state of the node and the expected state.

[0040] Step S430, input the nth node deviation detection result into the health risk prediction branch to obtain the nth node health risk coefficient. Specifically, the nth node deviation detection result is input into the health risk prediction branch. This branch uses a pre-trained model or algorithm to analyze the deviation detection result and outputs a health risk coefficient, which reflects the health of the current state of the node or the risk of potential failure.

[0041] Step S440, input the health risk coefficient of the nth node into the risk inspection branch, wherein the risk inspection branch includes a health risk threshold, and if the health risk coefficient of the nth node is greater than or equal to the health risk threshold, add the nth access node to the health risk node, and add the nth node deviation detection result to the risk deviation detection result. Specifically, the health risk coefficient of the nth node is input into the risk inspection branch. In this branch, the system checks whether the health risk coefficient has reached the preset health risk threshold. If the health risk coefficient of the nth node is greater than or equal to this threshold, the system will consider that there is a health risk in the nth access node and add it to the health risk node list. At the same time, the deviation detection result of the nth node will also be added to the risk deviation detection result for subsequent more detailed analysis and processing. This implementation method enables the system to comprehensively evaluate the health status of the access node from multiple angles through the combined use of the health risk prediction branch and the risk inspection branch, thereby improving the accuracy and reliability of the evaluation.

[0042] In one possible implementation, a health risk prediction branch is constructed, and step S410 further includes step S411, which retrieves a node deviation detection result record set and a node health risk coefficient record set. Specifically, using database query technology, historical data, including a node deviation detection result record set and a node health risk coefficient record set, are retrieved from the storage system through SQL query or NoSQL query statements. Among them, the node deviation detection result record set contains the deviation detection results of all access nodes in the past period of time, and these results record the difference between the node state and the expected state. The node health risk coefficient record set contains health risk coefficients corresponding to the above-mentioned deviation detection results. These coefficients were determined in the past through expert evaluation, historical fault analysis, etc., and are used to quantify the health risks of nodes.

[0043] Step S412, using the node deviation detection result record set as input data, and the node health risk coefficient record set as output data, supervised learning is performed on K base learners to generate K health risk predictors, where K is a positive integer greater than 1. Specifically, a machine learning framework (such as TensorFlow, PyTorch, etc.) is used to implement the supervised learning algorithm. The base learner can be any machine learning model such as a decision tree, support vector machine, neural network, etc. The node deviation detection result record set is used as the input feature, and the node health risk coefficient record set is used as the output label. K different base learners are trained, and each learner uses a different algorithm or parameter configuration.

[0044] Step S413, the K health risk predictors are merged as parallel independent nodes to generate a health risk prediction unit. Specifically, the K health risk predictors are deployed as independent nodes on a parallel computing framework (such as Apache Spark, Dask, etc.). For each new deviation detection result, it is simultaneously input into all health risk predictors and their prediction results are collected.

[0045] Step S414, construct a risk prediction incentive unit, wherein the risk prediction incentive unit includes K risk prediction incentive coefficients, and the K risk prediction incentive coefficients are obtained by performing a percentage calculation on the K health risk prediction accuracy parameters corresponding to the K health risk predictors. Specifically, for each health risk predictor, calculate its prediction accuracy parameter on historical data. Based on these parameters, a risk prediction incentive coefficient is assigned to each predictor using a percentage calculation method. These incentive coefficients are used to adjust the weight of each predictor when merging the prediction results to calculate the final health risk coefficient.

[0046] Step S415, encapsulate the health risk prediction unit and the risk prediction incentive unit into the health risk prediction branch. Specifically, the health risk prediction unit and the risk prediction incentive unit are encapsulated into a module or class. A clear interface is designed so that an external system can easily call the module for health risk prediction. This implementation reduces the bias and variance of a single model by training multiple different base learners and merging their prediction results, thereby improving the accuracy of the overall prediction.

[0047] Step S500: Based on the health risk nodes and the risk deviation detection results, the real-time network topology diagram is analyzed for risk and abnormality, and risk and abnormal nodes are determined.

[0048] Specifically, by analyzing the health risk nodes and risk deviation detection results, other nodes that may be affected by the risk are identified through risk propagation prediction in the real-time network topology diagram, that is, risk-spreading abnormal nodes (nodes that are affected by health risk nodes in the network and may become abnormal).

[0049] In a possible implementation, based on the health risk node and the risk deviation detection result, the real-time network topology map is subjected to risk spread and abnormal analysis to determine the risk spread and abnormal nodes, and step S500 further includes step S510, based on the real-time network topology map, performing risk propagation prediction of the health risk node according to the risk deviation detection result to obtain a risk propagation prediction result. Specifically, the connection information of the health risk node and its adjacent nodes is extracted from the real-time network topology map, and a risk propagation model is constructed based on the connection information and historical propagation data. The risk propagation model is used to predict the degree of risk that the health risk node may spread to its adjacent nodes.

[0050] Step S520: obtaining a plurality of candidate affected nodes according to the real-time network topology map. Specifically, traversing the real-time network topology map, taking nodes other than health risk nodes as candidate affected nodes.

[0051] Step S530, based on the risk propagation prediction result, the multiple candidate affected nodes are evaluated for risk, and multiple affected risk coefficients are obtained. Specifically, for each candidate affected node, its affected risk coefficient is calculated using a risk assessment model. The risk assessment model is constructed based on factors such as node attributes, historical risk data, and risk propagation prediction results.

[0052] Step S540, determining whether the multiple contagion risk coefficients are greater than or equal to the contagion risk threshold. Specifically, a fixed threshold is set to determine whether the risk of the candidate contagion node has reached a level that requires attention. The threshold can be set based on factors such as the system's security requirements and historical risk data. The contagion risk coefficient of each candidate contagion node is compared with the contagion risk threshold. If the contagion risk coefficient of a node is greater than or equal to the threshold, it is considered that the node has an abnormal contagion risk.

[0053] Step S550: if any one of the plurality of contagion risk coefficients is greater than or equal to the contagion risk threshold, obtain an abnormal contagion risk coefficient. Specifically, select the contagion risk coefficient greater than or equal to the threshold from step S550 and use it as the abnormal contagion risk coefficient.

[0054] Step S560, adding the candidate affected nodes corresponding to the abnormal spread risk coefficient to the risk spread abnormal nodes. Specifically, for each spread risk coefficient greater than or equal to the threshold, find the corresponding candidate affected nodes and add these nodes to the risk spread abnormal node list. This implementation method accurately identifies which nodes have abnormal spread risks through risk propagation prediction and spread risk assessment, thereby improving the accuracy of risk management.

[0055] In a possible implementation, based on the risk propagation prediction result, the multiple candidate affected nodes are evaluated for risk of spread, and multiple risk coefficients of spread are obtained. Step S530 further includes step S531, which evaluates the probability of spread of risk for the multiple candidate affected nodes according to the risk propagation prediction result to obtain multiple risk probability coefficients of spread. Specifically, the connection information related to the health risk node in the real-time network topology diagram is collected, including connection type, bandwidth, delay, etc. Graph theory and probability theory methods are used to analyze the possible paths and probabilities of risk propagation from the health risk node to each candidate affected node. According to the analysis results, a risk probability coefficient is calculated for each candidate affected node, which reflects the possibility of risk propagation to the node.

[0056] Step S532, based on the risk propagation prediction result, the multiple candidate affected nodes are evaluated for the risk impact, and multiple risk impact coefficients are obtained. Specifically, the number and type of nodes that may be affected after the risk propagation, as well as the functions and importance of these nodes in the network are analyzed. Based on the analysis of the impact range, the potential impact of the risk propagation on each candidate affected node and its connected network is evaluated, such as service interruption, data loss, etc. According to the evaluation results, a risk impact coefficient is calculated for each candidate affected node, which reflects the impact that may be caused after the risk propagates to the node.

[0057] Step S533, according to the risk probability weight and the risk impact weight, the multiple risk probability coefficients and the multiple risk impact coefficients are weighted and calculated to generate the multiple risk coefficients. Specifically, according to the network characteristics, different weights (i.e., risk probability weight and risk impact weight) are assigned to the risk probability and risk impact. Using the assigned weights, the risk probability coefficient and the risk impact coefficient are weighted and calculated to generate the risk coefficient of each candidate node. The generated risk coefficient is compared with the preset risk threshold to determine whether each candidate node faces an abnormally high risk. This implementation method accurately reflects the real risk situation faced by each candidate node by comprehensively considering the probability and impact of risk propagation, so that nodes that may be affected by risks and have abnormal situations can be effectively identified.

[0058] Step S600, generating a health risk warning signal according to the health risk node, and generating a risk impact warning signal based on the risk impact abnormal node.

[0059] Specifically, the health risk warning signal is a warning signal generated for the health risk node, which is used to remind the administrator to pay attention to and deal with the health risks of these nodes. The risk spread warning signal is a warning signal generated for the risk spread abnormal node, which is used to remind the administrator to pay attention to the abnormal impact that these nodes may be affected. The generated warning signal is sent to the administrator through the system interface, email, text message, etc. The embodiment of the present application adopts real-time monitoring of the network system, and constructs a real-time network topology map. Based on the real-time topology map, each access node is expected to be predicted, and the network expected topology map is generated. The real-time topology map is compared with the expected topology map, and the deviation of each node is detected. According to the deviation detection result, the nodes with health risks and their risk deviation degree are determined through the health risk inspection channel. Based on the health risk nodes and the risk deviation results, the risk spread in the network is analyzed, and the abnormal nodes are determined. According to the health risk nodes and the risk spread abnormal nodes, the corresponding health risk warning signals and risk spread warning signals are generated respectively. Technical means such as technical effects have been achieved to improve the real-time, comprehensive and accurate monitoring of the health status of the network system.

[0060] In the above, refer to Figure 1 The system health monitoring method based on the real-time topology diagram according to the embodiment of the present invention is described in detail. Figure 2 A system health monitoring system based on a real-time topology graph according to an embodiment of the present invention is described.

[0061] The system health monitoring system based on the real-time topology map according to the embodiment of the present invention is used to solve the technical problems of insufficient real-time, comprehensiveness and accuracy of the existing network system health monitoring, and achieve the technical effect of improving the real-time, comprehensiveness and accuracy of the network system health status monitoring. The system health monitoring system based on the real-time topology map includes: a real-time network topology map construction module 10, a network expected topology map acquisition module 20, a deviation detection module 30, a health risk inspection module 40, a risk and abnormality analysis module 50, and an early warning signal generation module 60.

[0062] A real-time network topology construction module 10 is used to monitor the network system in real time and construct a real-time network topology; a network expected topology acquisition module 20 is used to make expected predictions based on each access node in the real-time network topology to obtain the expected network topology; a deviation detection module 30 is used to perform deviation detection on the real-time network topology according to the expected network topology to obtain the deviation detection results of each node; a health risk inspection module 40 is used to perform health risk inspection on each access node based on the deviation detection results of each node and according to the health risk inspection channel to determine the health risk node and the risk deviation detection result corresponding to the health risk node; a risk spread and abnormality analysis module 50 is used to perform risk spread and abnormality analysis on the real-time network topology based on the health risk node and the risk deviation detection result to determine the risk spread abnormal node; an early warning signal generation module 60 is used to generate a health risk early warning signal based on the health risk node, and generate a risk spread early warning signal based on the risk spread abnormal node.

[0063] The specific configuration of the network expected topology map acquisition module 20 will be described in detail below. As described above, the network expected topology map is obtained by performing expected predictions based on each access node in the real-time network topology map. The network expected topology map acquisition module 20 may further include: an execution task information acquisition unit for collecting the execution task information of each access node to obtain the tasks of each node; a health status sample retrieval unit for performing health status sample retrieval on each access node according to the tasks of each node to obtain a health status sample set of each node; a central trend analysis unit for performing central trend analysis based on the health status sample set of each node to obtain the expected state data of each node; and a network expected topology map construction unit for constructing the network expected topology map based on the expected state data of each node.

[0064] Below, the specific configuration of the health risk inspection module 40 will be described in detail. As described above, based on the deviation detection results of each node, according to the health risk inspection channel, the health risk inspection of each access node is performed to determine the health risk node and the risk deviation detection result corresponding to the health risk node. The health risk inspection module 40 may further include: a health risk inspection channel construction unit is used to construct a health risk inspection channel, and the health risk inspection channel includes a health risk prediction branch and a risk inspection branch; a deviation detection result extraction unit is used to extract the nth node deviation detection result corresponding to the nth access node according to the deviation detection results of each node, wherein n is a positive integer; a health risk prediction unit is used to input the nth node deviation detection result into the health risk prediction branch to obtain the nth node health risk coefficient; a risk inspection unit is used to input the nth node health risk coefficient into the risk inspection branch, wherein the risk inspection branch includes a health risk threshold, if the nth node health risk coefficient is greater than or equal to the health risk threshold, the nth access node is added to the health risk node, and the nth node deviation detection result is added to the risk deviation detection result.

[0065] Among them, the health risk inspection channel construction unit may further include: a health risk prediction branch construction subunit for constructing a health risk prediction branch, and the health risk prediction branch construction subunit may further include: a record set retrieval microunit for retrieving a node deviation detection result record set and a node health risk coefficient record set; a supervised learning microunit for using the node deviation detection result record set as input data and the node health risk coefficient record set as output data to perform supervised learning on K base learners to generate K health risk predictors, wherein K is a positive integer greater than 1; a node merging microunit for merging the K health risk predictors as parallel independent nodes to generate a health risk prediction unit; a risk prediction incentive construction microunit for constructing a risk prediction incentive unit, wherein the risk prediction incentive unit includes K risk prediction incentive coefficients, and the K risk prediction incentive coefficients are obtained by calculating the proportion of K health risk prediction accuracy parameters corresponding to the K health risk predictors; an encapsulation microunit is used to encapsulate the health risk prediction unit and the risk prediction incentive unit into the health risk prediction branch.

[0066] The specific configuration of the risk spread and abnormal analysis module 50 will be described in detail below. As described above, based on the health risk node and the risk deviation detection result, the risk spread and abnormal analysis is performed on the real-time network topology map to determine the risk spread abnormal node. The risk spread and abnormal analysis module 50 may further include: a risk propagation prediction unit is used to perform risk propagation prediction of the health risk node based on the real-time network topology map according to the risk deviation detection result to obtain a risk propagation prediction result; a candidate spread node acquisition unit is used to obtain multiple candidate spread nodes according to the real-time network topology map; a spread risk evaluation unit is used to perform spread risk evaluation on the multiple candidate spread nodes based on the risk propagation prediction result to obtain multiple spread risk coefficients; a judgment unit is used to judge whether the multiple spread risk coefficients are greater than or equal to the spread risk threshold; an abnormal spread risk coefficient acquisition unit is used to obtain an abnormal spread risk coefficient if any one of the multiple spread risk coefficients is greater than or equal to the spread risk threshold; a risk spread abnormal node generation unit is used to add the candidate spread node corresponding to the abnormal spread risk coefficient to the risk spread abnormal node.

[0067] Among them, based on the risk propagation prediction result, the multiple candidate affected nodes are evaluated for impact risk to obtain multiple impact risk coefficients. The impact risk evaluation unit may further include: a impact risk probability evaluation subunit is used to perform impact risk probability evaluation on the multiple candidate affected nodes according to the risk propagation prediction result to obtain multiple impact risk probability coefficients; a impact risk impact evaluation subunit is used to perform impact risk impact evaluation on the multiple candidate affected nodes according to the risk propagation prediction result to obtain multiple impact risk coefficients; a weighted calculation subunit is used to perform weighted calculation on the multiple impact risk probability coefficients and the multiple impact risk coefficients according to the impact risk probability weights and the impact risk impact weights, respectively, to generate the multiple impact risk coefficients.

[0068] The specific configuration of the real-time network topology map construction module 10 will be described in detail below. As described above, the network system is monitored in real time and a real-time network topology map is constructed. The real-time network topology map construction module 10 may further include: a network basic topology data acquisition unit for obtaining the basic network topology data of the network system; a network basic topology map establishment unit for establishing a network basic topology map based on the basic network topology data; a real-time monitoring unit for performing real-time monitoring according to the network system and obtaining network real-time monitoring data; and a topology optimization unit for topologically optimizing the basic network topology map based on the real-time network monitoring data to generate the real-time network topology map.

[0069] The system health monitoring system based on real-time topology map provided by the embodiment of the present invention can execute the system health monitoring method based on real-time topology map provided by any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0070] Although the present application makes various references to certain modules in the system according to the embodiments of the present application, any number of different modules may be used and run on the user terminal and / or server, and the various units and modules included are only divided according to functional logic, but are not limited to the above division, as long as the corresponding functions can be achieved; in addition, the specific names of the functional units are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of the present invention.

[0071] The above specific implementation manner does not constitute a limitation to the protection scope of the present application. It should be understood by those skilled in the art that various modifications, combinations and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present application should be included in the protection scope of the present application. In some cases, the actions or steps recorded in the present application can be performed in an order different from that in the embodiment and can still achieve the desired results. In addition, the process depicted in the accompanying drawings does not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

Claims

1. A system health monitoring method based on a real-time topology graph, characterized in that: The method comprises: Monitor the network system in real time and build a real-time network topology map; Performing expected predictions based on each access node in the real-time network topology map to obtain an expected network topology map; Perform deviation detection on the real-time network topology map according to the expected network topology map to obtain deviation detection results of each node; Based on the deviation detection results of each node, and according to the health risk inspection channel, a health risk inspection is performed on each access node to determine a health risk node and a risk deviation detection result corresponding to the health risk node; Based on the health risk nodes and the risk deviation detection results, the real-time network topology diagram is analyzed for risk and abnormality to determine the risk and abnormal nodes; A health risk warning signal is generated according to the health risk node, and a risk impact warning signal is generated based on the risk impact abnormal node.

2. The system health monitoring method based on real-time topology map according to claim 1, characterized in that: Performing expected prediction according to each access node in the real-time network topology map to obtain an expected network topology map includes: Collecting the execution task information of each access node to obtain the task of each node; Performing health status sample retrieval on each access node according to each node task to obtain a health status sample set of each node; Performing a central tendency analysis based on the health status sample set of each node to obtain the expected status data of each node; The network expected topology graph is constructed according to the expected state data of each node.

3. The system health monitoring method based on real-time topology map according to claim 1, characterized in that: Based on the deviation detection results of each node, a health risk inspection is performed on each access node according to a health risk inspection channel to determine a health risk node and a risk deviation detection result corresponding to the health risk node, including: The health risk inspection channel includes a health risk prediction branch and a risk inspection branch; Extracting the nth node deviation detection result corresponding to the nth access node according to the node deviation detection results, where n is a positive integer; Inputting the n-th node deviation detection result into the health risk prediction branch to obtain the n-th node health risk coefficient; Inputting the nth node health risk coefficient into the risk verification branch, wherein the risk verification branch includes a health risk threshold; If the health risk coefficient of the nth node is greater than or equal to the health risk threshold, the nth access node is added to the health risk node, and the nth node deviation detection result is added to the risk deviation detection result.

4. The system health monitoring method based on real-time topology map according to claim 3, characterized in that: The steps of constructing the health risk prediction branch include: Retrieve the node deviation detection result record set and the node health risk coefficient record set; Taking the node deviation detection result record set as input data and the node health risk coefficient record set as output data, supervised learning is performed on K base learners to generate K health risk predictors, where K is a positive integer greater than 1; Merging the K health risk predictors as parallel independent nodes to generate a health risk prediction unit; Constructing a risk prediction incentive unit, wherein the risk prediction incentive unit includes K risk prediction incentive coefficients, and the K risk prediction incentive coefficients are obtained by calculating the proportion of K health risk prediction accuracy parameters corresponding to the K health risk predictors; The health risk prediction unit and the risk prediction incentive unit are encapsulated as the health risk prediction branch.

5. The system health monitoring method based on real-time topology map according to claim 1, characterized in that: Based on the health risk nodes and the risk deviation detection results, the real-time network topology diagram is analyzed for risk and abnormality, and risk and abnormal nodes are determined, including: Based on the real-time network topology graph, performing risk propagation prediction of the health risk node according to the risk deviation detection result to obtain a risk propagation prediction result; According to the real-time network topology diagram, a plurality of candidate affected nodes are obtained; Based on the risk propagation prediction result, a risk assessment is performed on the multiple candidate affected nodes to obtain multiple risk coefficients; Determining whether the multiple contagion risk coefficients are greater than or equal to a contagion risk threshold; If any one of the multiple contagion risk coefficients is greater than or equal to the contagion risk threshold, obtaining an abnormal contagion risk coefficient; The candidate affected nodes corresponding to the abnormal affected risk coefficient are added to the risk affected abnormal nodes.

6. The system health monitoring method based on real-time topology map according to claim 5, characterized in that: Based on the risk propagation prediction result, the multiple candidate affected nodes are evaluated for risk, and multiple affected risk coefficients are obtained, including: According to the risk propagation prediction result, a risk probability evaluation is performed on the multiple candidate affected nodes to obtain multiple risk probability coefficients; Performing risk impact assessment on the multiple candidate affected nodes according to the risk propagation prediction result to obtain multiple risk impact coefficients; According to the contagion risk probability weight and the contagion risk impact weight, weighted calculations are performed on the multiple contagion risk probability coefficients and the multiple contagion risk impact coefficients respectively to generate the multiple contagion risk coefficients.

7. The system health monitoring method based on real-time topology map according to claim 1, characterized in that: Monitor the network system in real time and build a real-time network topology diagram, including: Obtaining basic network topology data of the network system; Establishing a network basic topology map according to the network basic topology data; Perform real-time monitoring according to the network system to obtain real-time network monitoring data; The network basic topology map is topologically optimized according to the network real-time monitoring data to generate the real-time network topology map.

8. A system health monitoring system based on a real-time topology map, characterized in that: The system is used to implement the system health monitoring method based on the real-time topology map according to any one of claims 1 to 7, and the system includes: A real-time network topology construction module is used to monitor the network system in real time and construct a real-time network topology; A network expected topology map acquisition module is used to make an expected prediction based on each access node in the real-time network topology map to obtain the network expected topology map; A deviation detection module, used to perform deviation detection on the real-time network topology map according to the expected network topology map, and obtain the deviation detection result of each node; A health risk inspection module, configured to perform health risk inspection on each access node based on the deviation detection result of each node and according to a health risk inspection channel, to determine a health risk node and a risk deviation detection result corresponding to the health risk node; A risk and abnormality analysis module, used to perform risk and abnormality analysis on the real-time network topology diagram based on the health risk nodes and the risk deviation detection results, and determine the risk and abnormal nodes; The warning signal generation module is used to generate a health risk warning signal based on the health risk node, and generate a risk impact warning signal based on the risk impact abnormal node.

Images