Railway service application port monitoring and early warning method and system, server and medium

Abstract

The invention discloses a railway service application port monitoring and early warning method and system, a server and a medium, and relates to the technical field of communication. The method comprises the steps of generating corresponding service port baseline data based on service port original baseline data of each railway service; after the service port baseline data is generated, monitoring first service traffic data of each service application port; in response to the operation of monitoring the first service flow data, judging whether the first service flow data is matched with the corresponding service port baseline data; and if not, sending service abnormity early warning information. According to the method, whether the business is abnormal or not is judged by matching the business flow data of the business application port with all the data transmission rules of the railway business under the normal operation condition, and the rules are not easily influenced by external factors, so that the accuracy of judging the abnormal business is greatly improved. Meanwhile, by sending early warning information, railway operation and maintenance personnel can be effectively reminded to pay attention to abnormal services.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a railway business application port monitoring and early warning method, system, server and medium. Background Art

[0002] The railway data network is one of the core infrastructures of modern railway operations, and undertakes the task of railway inter-station business communication. In the railway data network, business application ports are the key nodes connecting various railway businesses to the network. These ports are responsible for the inbound and outbound transmission of business data. Their normal operation is the prerequisite for the effective information exchange between related businesses and other parts of the network. Any abnormality in the business application port may affect the normal development of railway business.

[0003] At present, when monitoring the abnormality of the business application port, feature recognition is often used to determine whether the business application port is abnormal. For example, by analyzing the traffic of the business, the protocol, packet size and port number of the business are obtained, and these data are compared with the pre-established feature library to determine whether the business is abnormal based on the comparison results.

[0004] However, with the continuous expansion of railway business and the increasing complexity of the network environment, the feature recognition method has gradually exposed serious limitations in this complex environment. Because it is overly dependent on the pre-established feature library, which cannot cover the port features in all cases, when special situations that have not appeared before appear, it is easy to make misjudgments, resulting in low accuracy of judgment results, and may also cause unnecessary maintenance operations and waste of resources. Summary of the invention

[0005] The present application provides a railway business application port monitoring and early warning method, system, server and medium, which can judge whether the business is abnormal by matching the business flow data of the business application port with all data transmission rules of the railway business under normal operation. Since these rules are not easily affected by external factors, the accuracy of judging abnormal business is greatly improved. At the same time, by sending early warning information, railway operation and maintenance personnel can be effectively reminded to pay attention to abnormal business.

[0006] In the first aspect, the present application provides a service application port monitoring and early warning method, the method comprising: based on the original baseline data of the service ports of each railway service, generating corresponding service port baseline data, the service port original baseline data including one or more service port original baselines, the service port original baseline being the standard reference data established for the service traffic of the service application port when the service application port is in a normal operation state, the normal operation state including a normal operation state and an abnormal operation state, the service port baseline data being the standard reference data established for the service traffic of the service application port when the service application port is in a normal operation state, and being divided into service public port baseline data and service private port baseline data, the service public port baseline data including one or more service public port baselines, the service public port baseline being a standard determined for the same railway service when there are service requests on multiple service clients Quasi-reference data is used to determine whether the business application port involved in the baseline is in a normal state. The business private port baseline data includes one or more business private port baselines. The business private port baseline is a standard reference data determined for the same railway business when there is a business request only on one business client. It is used to determine whether the business application port involved in the baseline is in a normal state; after generating the business port baseline data, the first business flow data of each business application port is monitored. The first business flow data is the flow packet data sent by the sender during the railway business interaction process; in response to the operation of monitoring the first business flow data, it is determined whether the first business flow data matches the corresponding business port baseline data; if not, a business abnormality warning information is issued, and the business abnormality warning information includes the first business flow data of the abnormal business, the time when the abnormality occurs, the time when the abnormality ends, and the number of times the abnormality occurs.

[0007] By adopting the above technical solution, the service port baseline data is generated based on the original baseline data of the service port. By matching the service flow data of the monitored service application port with the service port baseline data, it is judged whether the railway business is abnormal. Since the service port baseline data covers all data transmission rules of the railway business under normal operation, and these rules are not easily affected by external factors, it is possible to accurately judge whether the railway business is abnormal through the matching results, which greatly improves the accuracy of judging abnormal business. At the same time, when the railway business is abnormal, the business abnormality warning information can be issued to the railway operation and maintenance personnel to remind the railway operation and maintenance personnel to pay attention to the abnormal business, thus ensuring the normal operation of the railway business.

[0008] In combination with some embodiments of the first aspect, in some embodiments, the original baseline data of the service port based on each railway service generates the corresponding service port baseline data, specifically including: extracting the intersection port data with the same VPN number and S end in the original baseline data of the service port, storing it in the service public port baseline data, and generating the service public port baseline data; extracting the baseline data other than the service public port baseline data in the original baseline data of the service port, storing it in the service private port baseline data, and generating the service private port baseline data to be confirmed; determining whether each baseline to be confirmed in the service private port baseline data to be confirmed is a normal baseline, and the baseline status of the baseline to be confirmed is to be confirmed; if the baseline to be confirmed is the normal baseline, changing the baseline status of the baseline to be confirmed to confirmed; if the baseline to be confirmed is an abnormal baseline, changing the baseline status of the baseline to be confirmed to abnormal.

[0009] By adopting the above technical solution, the baselines in the original baseline data of the service port are divided into the service public port baseline and the service private port baseline according to certain conditions, and the corresponding service public port baseline data and service private port baseline data are generated. Since the generated service private port baseline data may have abnormal baselines, the baseline status of each baseline in the service private port baseline data is confirmed to determine whether the corresponding baseline is an abnormal baseline. And these abnormal baselines will not be compared with the service flow data, eliminating the influence of abnormal baselines on the judgment of abnormal services, and improving the accuracy of judging abnormal services.

[0010] In combination with some embodiments of the first aspect, in some embodiments, the determination of whether each baseline to be confirmed in the business private port baseline data to be confirmed is a normal baseline specifically includes: confirming whether there is a high-risk port in the application port list of each baseline to be confirmed in the business private port baseline data to be confirmed, and the high-risk port is an application port that is not used for normal business; if there is a high-risk port in the application port list of the baseline to be confirmed, it is determined that the baseline does not have the particularity, and the particularity is the basis for judging whether the baseline status is normal; in the case that the baseline to be confirmed has the particularity, the baseline is determined to be the normal baseline; in the case that the baseline to be confirmed does not have the particularity, the baseline is determined to be the abnormal baseline.

[0011] With the above technical solution, whether the baseline is a normal baseline is determined by confirming whether there are high-risk ports in the application port list of the baseline to be confirmed. However, since the reasons for baseline abnormalities are diverse and complex, a baseline without high-risk ports may also be an abnormal baseline. Therefore, after the high-risk port judgment is completed, the railway business experts will further judge the baseline without high-risk ports, and finally obtain an accurate baseline status judgment result. This judgment method uses machine judgment and manual judgment to determine whether the baseline is a normal baseline. Compared with the method of using only manual judgment, it reduces manual operations and improves judgment efficiency. Compared with the method of using only machine judgment, it avoids the problem of inaccurate judgment caused by the machine's inability to accurately identify complex business logic relationships, thereby improving the accuracy of judgment.

[0012] In combination with some embodiments of the first aspect, in some embodiments, before the original baseline data of the service port based on each railway service generates the corresponding service port baseline data, the method also includes: obtaining second service flow data of each service application port, the second service flow data is the flow packet data transmitted during the railway service interaction process; parsing the obtained second service flow data to obtain second service flow parsing data; classifying the second service flow parsing data according to the C-end, VPN number, S-end and port number to obtain classified data, the data structure of the classified data is consistent with the data structure of the original baseline data of the service port, and the C-end, VPN and S-end of any two data will not be completely consistent in the classified data; determining whether the application port list in the classified data will not change within a certain period of time; if so, storing the classified data in the original baseline data of the service port to generate the original baseline data of the service port.

[0013] The above technical solution is adopted to obtain the business flow data of the public business application port and classify these data to generate the original baseline data of the business port. In order to make the generated business port baseline data cover the data transmission rules of all railway businesses, the data will be stored in the business port baseline data only when it is confirmed that the classified data will not change for a long time, thus ensuring the integrity of the data.

[0014] In combination with some embodiments of the first aspect, in some embodiments, the response to the operation of monitoring the first business flow data is to determine whether the first business flow data matches the corresponding business port baseline data, which specifically includes: parsing the monitored first business flow data to obtain first business flow parsing data; according to the unique identifier of the business public port baseline data, comparing the first business flow parsing data with the business public port baseline data, the unique identifier of the business public port baseline data is VPN number + S end + application port list, and the comparison is to determine whether there is a baseline in the baseline data based on the unique identifier, and the identification content matches the identification content of the first business flow parsing data. If so, it indicates that the comparison is successful, and if not, it indicates that the comparison fails; if the first business flow parsing data matches the business public port baseline number If the comparison fails, the first service flow parsing data is compared with the baseline data with the baseline status of confirmed in the service private port baseline data according to the unique identifier of the service private port baseline data, and the unique identifier of the service private port baseline data is C-end + VPN number + S-end + application port list; if the first service flow parsing data is successfully compared with the service public port baseline data, or is successfully compared with the baseline data with the baseline status of confirmed in the service private port baseline data, it is determined that the first service flow data matches the corresponding service port baseline data; if the first service flow parsing data fails to compare with the service public port baseline data, and also fails to compare with the baseline data with the baseline status of confirmed in the service private port baseline data, it is determined that the first service flow data does not match the corresponding service port baseline data.

[0015] By adopting the above technical solution, the business flow data of the monitored business application port is compared with the business public port baseline and the business private port baseline respectively. If both comparisons fail, it means that the data does not match and the railway business corresponding to the business application port is abnormal. If one of the comparisons succeeds, it means that the data matches and the railway business corresponding to the business application port is normal. By matching the business flow data with all data transmission rules of the railway business under normal operation, the reliability and accuracy of the matching results are improved, thereby improving the accuracy of judging abnormal business.

[0016] In combination with some embodiments of the first aspect, in some embodiments, after the if not, then issue a business abnormality warning message, the method also includes: obtaining the business abnormality problem reported by the user through the abnormal problem feedback table to obtain feedback information, the abnormal problem feedback table is used to record the user's feedback information, the feedback information includes the terminal service device where the abnormality occurs, the time when the abnormality occurs, and the business where the abnormality occurs; searching for the business abnormality warning information corresponding to the feedback information to obtain the business feedback abnormality warning information; uploading the business feedback abnormality warning information to the abnormal problem feedback table.

[0017] By adopting the above technical solution, the abnormal business problems reported by users are obtained through the abnormal problem feedback form, and the relevant abnormal business warning information is searched through the feedback information, and the found information is stored in the abnormal problem feedback form, so that the abnormal problems reported by users correspond to the abnormal business warning information of the problem. When the railway operation and maintenance personnel maintain abnormal business according to the feedback form, they can quickly find the cause of the abnormality according to the corresponding abnormal business warning information in the feedback form, and then maintain the abnormal business, which improves the efficiency of maintaining the business and ensures the normal operation of the railway business.

[0018] In combination with some embodiments of the first aspect, in some embodiments, after generating corresponding service port baseline data based on the original baseline data of the service port of each railway service, the method also includes: searching for a baseline in the service private port baseline data whose baseline status is abnormal; displaying information of the baseline whose baseline status is abnormal, the displayed information including the C-end, VPN number, S-end and port number.

[0019] By adopting the above technical solution, by searching for abnormal baselines detected in the generated business private port baselines and displaying the information of these abnormal baselines, a basis is provided for railway operation and maintenance personnel to solve abnormal problems, which speeds up the resolution of abnormal problems and improves the efficiency of maintenance business.

[0020] In the second aspect, an embodiment of the present application provides a business application port monitoring and early warning system, which includes: a baseline generation module, which is used to generate corresponding business port baseline data based on the original baseline data of the business port of each railway business; a business monitoring module, which is used to monitor the first business flow data of each business application port after generating the business port baseline data; a data matching module, which is used to determine whether the first business flow data matches the corresponding business port baseline data when the operation of the first business flow data is monitored; a business early warning module, which is used to issue a business abnormality early warning message when the first business flow data does not match the business port baseline data.

[0021] In a third aspect, an embodiment of the present application provides a monitoring server, which includes: one or more processors and a memory; the memory is coupled to the one or more processors, the memory is used to store computer program code, the computer program code includes computer instructions, and the one or more processors call the computer instructions to enable the monitoring server to execute the method described in the first aspect and any possible implementation method of the first aspect.

[0022] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, comprising instructions, which, when executed on a monitoring server, enable the monitoring server to execute the method described in the first aspect and any possible implementation of the first aspect.

[0023] It is understandable that the system provided in the second aspect, the monitoring server provided in the third aspect, and the storage medium provided in the fourth aspect are all used to execute the method provided in the present application. Therefore, the beneficial effects that can be achieved can refer to the beneficial effects in the corresponding method, which will not be repeated here.

[0024] One or more technical solutions provided in the embodiments of the present application have at least the following technical effects or advantages: 1. This application determines whether there is any abnormality in the railway business by matching the business flow data of the business application port with the business port baseline data. Since the business port baseline data covers all data transmission rules of the railway business under normal operation, and these data transmission rules are not easily affected by external factors, the matching results can be used to accurately determine whether there is any abnormality in the railway business, greatly improving the accuracy of judging abnormal business.

[0025] 2. This application uses a combination of machine judgment and manual judgment to determine whether each baseline in the generated business private port baseline data is a normal baseline. Compared with the method of using only manual judgment, it reduces manual operations and improves judgment efficiency. Compared with the method of using only machine judgment, it avoids the problem of inaccurate judgment caused by the machine's inability to accurately identify complex business logical relationships, improves the accuracy of the judgment, ensures that there is no abnormal data in the business private port baseline data used for comparison, improves the accuracy of the comparison results, and thereby improves the accuracy of the matching results.

[0026] 3. This application sends business abnormality warning information to remind railway operation and maintenance personnel to pay attention to abnormal business as soon as the abnormality is detected, and maintain the abnormal business. At the same time, the relevant business abnormality warning information is searched through the user feedback information, and the business abnormality warning information found is matched with the abnormal problems reported by the user one by one, so that when handling user feedback, the railway operation and maintenance personnel can directly find the cause of the abnormality according to the business abnormality warning information corresponding to the feedback information, and then maintain the abnormal business, improve the efficiency of maintenance business, and ensure the normal operation of railway business. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] Figure 1 This is a schematic diagram of an application scenario of the service application port monitoring and early warning method in an embodiment of the present application; Figure 2 This is a flow chart of a method for monitoring and early warning of a service application port in an embodiment of the present application; Figure 3 This is another flow chart of the service application port monitoring and early warning method in the embodiment of the present application; Figure 4 This is a module architecture diagram of the business application port monitoring and early warning system in the embodiment of the present application; Figure 5 It is a hardware structure diagram of the monitoring server in the embodiment of the present application. DETAILED DESCRIPTION

[0028] The terms used in the following embodiments of the present application are only for the purpose of describing specific embodiments, and are not intended to be used as limitations to the present application. As used in the specification and appended claims of the present application, the singular expressions "one", "a kind of", "said", "above", "the" and "this" are intended to also include plural expressions, unless there is a clear indication to the contrary in the context. It should also be understood that the term "and / or" used in the present application refers to any or all possible combinations comprising one or more listed items.

[0029] In the following, the terms "first" and "second" are used for descriptive purposes only and are not to be understood as suggesting or implying relative importance or implicitly indicating the number of the indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features, and in the description of the embodiments of the present application, unless otherwise specified, "plurality" means two or more.

[0030] First, the relevant concepts involved in the embodiments of the present application are briefly introduced.

[0031] 1. Client (C-end) The client (C-end) refers to a terminal device or software application that initiates a service request and interacts with the server (S-end) to obtain corresponding services or resources. The C-end is the user-oriented end. Users trigger service needs through various operations on the client software running on the C-end device (such as a computer, mobile phone, etc.). These needs will be sent to the corresponding server in the form of a request for processing. In the embodiment of the present application, the C-end refers to the station.

[0032] 2. Server (S) The service end (S end) refers to the server device or software application that receives the business request from the client (C end), processes the request according to the business logic, and then returns the processing result to the corresponding C end. The S end usually has strong computing power, storage capacity and stable network connection to cope with a large number of business requests from many C ends. It runs various service programs, which parse, verify, process and other operations on the received requests according to pre-set business rules and algorithms. In the embodiment of the present application, the S end refers to the business processing center.

[0033] 3. Business monitoring server A business monitoring server is a server specifically used to monitor and analyze network services. It can collect business data in the network in real time or periodically, and process, analyze and store these data. In this application, the business monitoring server is mainly used to obtain business flow data sent by the sender in business interaction, and analyze and compare these data to determine whether there are any abnormalities in various railway services.

[0034] 4.VPN VPN (Virtual Private Network) is a technology for establishing a private network on a public network (such as the Internet). It builds a logically isolated and secure network channel for users in a public network through encryption, tunneling and other technical means, allowing users to perform secure data communications as in a private network. In this application, VPN is divided into different areas, each corresponding to a business. During the business data transmission process, the data sent by the C end (or S end) is connected to the railway data network through VPN, forwarded in the data network, and then flows out of the railway data network through VPN, thereby transmitting the data to the S end (or C end) in different geographical locations, realizing cross-site information communication between the C end and the S end.

[0035] 5. Application Port Application ports refer to the communication endpoint numbers used to distinguish different railway applications or services on the railway data network. Just like in a large railway transportation management system, each application has its own "window" (port) to receive and send information. These ports, together with the IP address, determine the exact flow of data in the network. The IP address can be regarded as the "address" of each site or device in the railway data network, while the port is the "room number" of different applications in these sites or devices. Data accurately finds the corresponding application through this "room number" for interaction.

[0036] 6. Business application port A business application port refers to a communication port specifically allocated for an application or service with a specific business function, and can include one or more application ports. It is a key identifier used to distinguish different railway businesses in network communications, ensuring that data can be accurately transmitted between corresponding railway business systems. Each business application port is associated with a specific railway business process and application, just like an exclusive data channel entrance opened for different railway businesses.

[0037] 7. Business port original baseline The original baseline of the business port is a standard reference data established specifically for the business traffic of the business application port. This data is set based on a series of key indicators when the business application port is in normal operation, where the normal operation state includes normal operation state and abnormal operation state. These key indicators not only cover the sender of the business traffic (clarify the source information of the traffic, such as the specific client, server or network node, etc.), the receiver (determine the target terminal of the traffic, including various servers, application systems, etc.), VPN number (used to distinguish different virtual private networks, reflecting the network architecture and security division), application port number (clarify the specific port used by the railway business, which is related to the function and protocol of the application), but may also include other related elements.

[0038] 8. Business port baseline The service port baseline is divided into a service public port baseline and a service private port baseline. It is generated from the service port original baseline and only contains the standard reference data established when the service application port is in normal operation. This baseline is mainly used to accurately measure whether the service application port is in normal working condition and whether its operation mode is consistent with the railway business expectations, providing a key reference standard for network management and railway business monitoring.

[0039] 9. Business public port baseline The service common port baseline is a standard reference data determined when there are service requests for the same railway service on multiple service C-ends. Its unique identifier is VPN+S-end+application port list, which is used to uniformly measure and judge whether the service application ports involved are in normal working state and whether they meet the expected operation mode of the railway service when different C-ends are connected to the same S-end through the same VPN.

[0040] 10. Business private port baseline The business private port baseline is a standard reference data determined for the business requests unique to individual C-ends. The unique identifier of the baseline is the C-end + VPN + S-end + application port list, which is used to measure and judge whether the business application ports involved in the individual C-end are in normal working condition and whether they meet the expected operation mode of railway business.

[0041] Figure 1 It is a schematic diagram of an application scenario of the business application port monitoring and early warning method in an embodiment of the present application.

[0042] See also Figure 1 ,The figure includes multiple clients, a small number of servers, the in-station information network, VPN and railway data network, showing the ,business data transmission process of business requests and responses during ,the railway cross-station business interaction.

[0043] For the service request process, the client first transmits the service request data to the client's internal information network through the corresponding data link, then accesses the railway data network through VPN and transmits the service request data to the data network. After the data is transmitted to the data network, the data network forwards the data according to the destination port number in the data (that is, the number of the destination service application port). The forwarded data flows out of the data network through VPN, is transmitted to the internal information network of the target server, and finally is transmitted to the target server.

[0044] For the service response process, the server first transmits the service response data to the server's internal information network through the corresponding data link, then accesses the railway data network through VPN and transmits the service response data to the data network. After the data is transmitted to the data network, the data network forwards the data according to the destination port number in the data. The forwarded data flows out of the data network through VPN, is transmitted to the target client's internal information network, and finally is transmitted to the target client.

[0045] Among them, the client can be but is not limited to the ticket client at the station ticket window, the mobile office terminal of the railway staff, the crew operation terminal on the train, etc. The server can be but is not limited to being implemented through an independent server or a server cluster composed of multiple servers, which is not limited here.

[0046] According to the above business request and response process, in the railway business interaction process, data starts from the source address (sender) and is transmitted to the destination address (receiver), where the destination address is determined by the destination port number in the data. If an abnormality occurs in the business application port during this process, it will inevitably affect the normal operation of the railway business. At the same time, in the process of business data transmission, the data transmission path is fixed, and the sender, receiver, VPN and port number used for data transmission (that is, the number of the business application port) are also fixed.

[0047] In the related art, a service application port abnormality monitoring solution based on feature recognition can be used to monitor in real time whether there are any abnormalities in railway services.

[0048] First, obtain the service data flow in the service request and response process, and parse the characteristic data in the service data flow, such as the service protocol, flow size, and port number. After the analysis is completed, compare the obtained characteristic data with the pre-established characteristic library, and judge whether the railway service is abnormal based on the comparison results. Among them, the characteristic library used for comparison contains all the characteristic data of the service under normal circumstances.

[0049] The above-described business application port anomaly monitoring solution relies too much on the pre-established feature library. Since the feature library cannot cover all port features in all situations, when special situations that have not appeared before occur, it is easy to make misjudgments, resulting in low accuracy of judgment results, and may also cause unnecessary maintenance operations and waste of resources.

[0050] The business application port monitoring and early warning method in the embodiment of the present application uses the law of data transmission in railway business interaction to determine whether the railway business is abnormal. Among them, the law of data transmission means that in each railway business interaction process, the key elements involved in business data transmission are fixed, such as the sender, the receiver, the VPN and the port number, etc., and are not affected by natural factors. By summarizing the law of data transmission in each railway business interaction, the law of data transmission for all railway businesses can be obtained. Based on these laws, it is possible to accurately determine whether the railway business is abnormal, which greatly improves the accuracy of abnormal judgment of railway business.

[0051] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the business application port monitoring and early warning method in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments.

[0052] See also Figure 2 , which is a flow chart of the business application port monitoring and early warning method in an embodiment of the present application.

[0053] S201. Generate corresponding business port baseline data based on the original business port baseline data of each railway business.

[0054] Based on the original baseline data of the business ports of various railway businesses, the data is processed according to certain conditions to generate corresponding business port baseline data.

[0055] The original baseline data of the service port covers all data transmission rules of railway business under normal operation, including one or more original baselines of the service port, each of which corresponds to a data transmission rule. The data structure of the original baseline data of the service port includes C-end, VPN, S-end and application port list. The C-end mainly stores the IP address of the station, which can be one or more. According to the IP address, the specific station location can be accurately located. The VPN mainly stores the VPN number, and different numbers represent different railway businesses. The S-end mainly stores the IP address of the business center, and according to the IP address, the specific business center can be accurately located. The application port list mainly stores one or more port numbers. In the process of business interaction, a total of two port numbers are required, namely the source port number and the destination port number. The port number stored in the application port list is the destination port number.

[0056] The service port baseline data covers all data transmission rules of the service under normal operation. It is divided into service public port baseline data and service private port baseline data, which is obtained by further processing the original service port baseline data. The service public port baseline data contains one or more service public port baselines. The data structure of the service public port baseline data includes VPN, S end, and application port list. The service private port baseline data contains one or more service private port baselines. The data structure of the service private port baseline data includes C end, VPN, S end, application port list, and baseline status.

[0057] Among them, the data structure of the service port original baseline data, service public port baseline data and service private port baseline data includes but is not limited to the contents described above, and may also include traffic size, service data transmission protocol, etc., which are not limited here.

[0058] Optionally, in general, the generation of the corresponding service port baseline data can be achieved in the following manner: first, extract the key information such as the C-end (station IP address), VPN (VPN number), S-end (service center IP address) and application port list (destination port number) contained in the original service port baseline data of each railway service. Then, determine whether to generate service public port baseline data or service private port baseline data based on the railway service attributes.

[0059] If the application scenario corresponding to the data transmission rules involved in the baseline is common to multiple stations (or entities with multiple different IP addresses) and is not dependent on specific individual stations, and its data transmission characteristics can be fully described only by the VPN number, the S-end business center IP address and the application port list, it means that the baseline belongs to the business public port baseline data, and the baseline is stored in the business public port baseline data.

[0060] If the data transmission rules involved in the baseline are closely related to a specific station (distinguished by the specific IP address stored on the C-end), it is necessary to clarify which specific station is involved. In addition to the VPN number, the S-end business center IP address, and the application port list, additional information such as its related status (i.e., baseline status) under the specific station application is required to fully characterize its data transmission characteristics. This indicates that the baseline belongs to the business private port baseline data, and the baseline is stored in the business private port baseline data.

[0061] After classifying the baselines in the original baseline data of the business ports of various railway businesses according to the railway business attributes, the business public port baseline data and the business private port data can be obtained, and then the business port baseline data can be generated.

[0062] S202: Monitor first service flow data of each service application port.

[0063] Real-time monitoring of first service flow data sent by a sender during railway service interaction, wherein the sender may be a C-end or an S-end. The first service flow data includes a C-end, a VPN number, an S-end, and a port number.

[0064] Optionally, in general, the monitoring of the first service flow data of each service application port can be achieved in the following manner: The NetFlow protocol is used to collect data packets sent by the sender during the railway business interaction in real time, and then the collected data packets are analyzed and counted to extract key information, such as source IP address, destination IP address, source port, destination port, protocol type, number of data packets and number of bytes. The extracted key information is combined into a NetFlow record and sent to the designated collector (business port monitoring server) for storage and analysis. Among them, the NetFlow protocol is a network protocol that is mainly used to collect and record traffic information in IP networks. It runs on network devices (such as routers and switches) and can analyze and count data packets passing through these devices.

[0065] Optionally, in some special cases, the monitoring of the first service flow data of each service application port may be implemented in more different specific ways: In some embodiments, deep packet inspection (DPI) technology can be used to capture data packets sent by the sender during railway business interaction in real time. DPI equipment is deployed at key network nodes (such as firewalls, gateways, etc.) to perform in-depth analysis of passing data packets. During the analysis process, in addition to obtaining basic information such as source IP address, destination IP address, source port, destination port, protocol type, etc., it can also identify the specific content of the application layer protocol in the data packet, user behavior characteristics and other deep-level information, such as the instruction content and data format of specific business applications. Integrate this rich key information into a record in a specific format and send it to the designated collector (business port monitoring server) for storage and analysis.

[0066] In some embodiments, a method of combining port mirroring (SPAN) with a custom script can also be used. First, configure the SPAN function on the network switch, and copy a copy of the data packet of the service application port to be monitored to the specified mirror port. Then, on the server or analysis device connected to the mirror port, use a pre-written custom script (which can be implemented based on programming languages ​​such as Python) to capture the data packets flowing through this mirror port. The custom script analyzes and counts the collected data packets according to the set logic, and extracts key information such as source IP address, destination IP address, source port, destination port, protocol type, priority tag of the data packet, and VLAN (virtual local area network) information. Then, organize the extracted key information into data records in a specific format and send them to the specified collector (service port monitoring server) for storage and subsequent analysis operations.

[0067] S203: Determine whether the first service flow data matches the corresponding service port baseline data.

[0068] According to the unique identifiers of the service public port baseline data and the service private port baseline data, the first service flow data of each service application port is compared with the corresponding service public port baseline data and the service private port data, and the comparison result is used to determine whether the first service flow data matches the corresponding service port baseline data. If the comparison is successful, it means a match, and the step S202 is executed to continue monitoring the service flow data; if the comparison fails, it means a mismatch, and the step S204 is executed to issue a service abnormality warning message. Comparison refers to judging whether there is a baseline identification content in the baseline data that matches the identification content of the flow data according to the unique identifier. If so, it means the comparison is successful, and if not, it means the comparison fails.

[0069] Among them, the unique identifier of the service public port baseline data is VPN number + S end + application port list, and the unique identifier of the service private port baseline data is C end + VPN number + S end + application port list.

[0070] The unique identifiers of the service public port baseline data and the service private port baseline data include but are not limited to only the one mentioned above, which is not limited here.

[0071] Optionally, in general, the determination of whether the first service flow data matches the corresponding service port baseline data can be implemented in the following manner: First, obtain the specific content (including VPN number, S end and port number, etc.) involved in the unique identification (VPN number + S end + application port list) of the corresponding service public port baseline data in the first service flow data, and then use the obtained unique identification content as the search and matching condition to perform a search and matching operation in the corresponding service public port baseline data set. Through a suitable search algorithm, determine whether there is a baseline data, whose unique identification content matches the corresponding identification content parsed from the current first service flow data (that is, the VPN number and S end of the baseline are the same as the VPN number and S end in the first service flow data, and the application port list of the baseline contains the port number in the first service flow data). If matching baseline data can be found, the comparison between the first service flow data and the service public port baseline data is successful. If no match is found after traversing the entire service public port baseline data set, the comparison fails.

[0072] If the comparison between the first business flow data and the business public port baseline data fails, obtain the specific content (including C-end, VPN number, S-end and port number, etc.) involved in the unique identifier of the corresponding business private port baseline data (C-end + VPN number + S-end + application port list) in the first business flow data, and perform search and matching operations in the business private port baseline data set based on the parsed identifier content. Use appropriate search logic and algorithms to determine whether there is an identifier content of the baseline data that matches the corresponding identifier content of the current first business flow data (that is, the C-end, VPN number, and S-end of the baseline are the same as the C-end, VPN number, and S-end in the first business flow data, and the application port list of the baseline contains the port number in the first business flow data). If matching baseline data is found, it means that the comparison between the first business flow data and the business private port baseline data is successful. Otherwise, if the search is fruitless, it is determined that the comparison has failed.

[0073] If the first service flow data fails to be compared with both the service public port baseline data and the service private port baseline data, the first service flow data does not match the corresponding service port baseline data; if the first service flow data successfully compares with the service public port baseline data or the service private port baseline data, the first service flow data matches the corresponding service port baseline data.

[0074] S204: Issue a business abnormality warning message.

[0075] If the first service flow data does not match the corresponding service port baseline data, it means that the railway service is abnormal, and a service abnormality warning message is issued to remind users to pay attention to abnormal services. Among them, the service abnormality warning information includes but is not limited to the first service flow data of the abnormal service, the time when the abnormality occurs, the time when the abnormality ends, the number of times the abnormality occurs, etc., and the warning information will be stored in the service monitoring server to provide a basis for subsequent equipment operation and maintenance or troubleshooting of abnormal problems.

[0076] Optionally, in general, the issuance of business abnormality warning information can be achieved in the following ways: The first business flow data of the abnormal business, the time when the abnormality occurred, the time when the abnormality ended, the number of abnormality occurrences and other information are summarized into a business abnormality warning information. Then, the analysis report is pushed to the railway operation and maintenance personnel through various channels. If there is a special business management system within the enterprise, the message push function of the system can be used to directly pop up a striking alarm prompt and abnormal warning information on the operation interface of the railway operation and maintenance personnel; the abnormal warning information can also be sent as an attachment to the work mailbox of the railway operation and maintenance personnel via email. After the push, the railway operation and maintenance personnel are confirmed to receive the message receipt or read receipt to ensure that the railway operation and maintenance personnel can receive the business abnormality warning information and handle the abnormal business.

[0077] In the embodiment of the present application, the first service flow data of the service application port is matched with the service port baseline data to determine whether the railway service is abnormal. Since the service port baseline data covers all data transmission rules of the railway service under normal operation, it is possible to accurately determine whether the railway service is abnormal through the matching result, which greatly improves the accuracy of determining abnormal services. When the railway service is abnormal, a service abnormality warning message can be issued to the railway operation and maintenance personnel to remind them to pay attention to the abnormal service, thereby ensuring the normal operation of the railway service.

[0078] Combine the following Figure 3 Another flow chart of the service application port monitoring and early warning method shown in FIG. 1 is a specific description of the service application port monitoring and early warning method in an embodiment of the present application: S301. Acquire second service flow data of each service application port.

[0079] In a certain period of time, the second service flow data of each service application port is collected in real time, and the collected data is transmitted to the service port monitoring server.

[0080] Optionally, in general, the acquisition of the second service flow data of each service application port may be implemented in the following manner: In a certain period of time, the data packets in the railway business interaction process are collected in real time through the NetFlow protocol, and then the collected data packets are analyzed and counted to extract key information, such as source IP address, destination IP address, source port, destination port, protocol type, number of data packets and number of bytes, etc. The extracted key information is combined into a NetFlow record and sent to the designated collector (business port monitoring server) for storage and analysis.

[0081] Optionally, in some special cases, the second service flow data of each service application port may be obtained in more different specific implementations: In some embodiments, the IPFIX protocol can be used to capture data packets in the railway business interaction process in real time. The IPFIX protocol is also a standard protocol for network traffic monitoring, which can be run on relevant devices in the network (such as routers, firewalls, and other devices that support the protocol function). During the operation, the data packets passing through these devices are first captured, and then a comprehensive analysis and statistics are carried out on the collected data packets to extract key information, such as source IP address, destination IP address, source port, destination port, protocol type, timestamp of data packet transmission, service type, etc. Subsequently, the extracted key information is integrated into IPFIX records, and finally these records are sent to the pre-set receiving end (that is, the business port monitoring server) for subsequent storage and more in-depth analysis.

[0082] In some embodiments, within a specific cycle time range, the sFlow protocol can be used to collect data packets generated during railway business interactions in real time. The sFlow protocol is a sampling-based network traffic monitoring protocol, which is deployed on network infrastructure devices such as switches and routers in the network. By extracting the massive data packets passing through these devices according to certain sampling rules, the corresponding data packet samples are obtained. Afterwards, detailed analysis and statistics are carried out on the collected data packet samples to extract key information such as source IP address, destination IP address, source port, destination port, protocol type, data packet sampling ratio, and related identification of application layer protocols. Then, these extracted key information are summarized into sFlow records, and then sent to the designated collector (service port monitoring server) so that effective storage and in-depth analysis can be carried out later.

[0083] S302: Analyze the second service flow data of each service application port.

[0084] The second business flow data of each business application port is analyzed to obtain data such as the C-end, S-end, VPN number, and port number in each railway business interaction process.

[0085] Optionally, in general, the parsing of the second service flow data of each service application port can be implemented in the following manner: First, read the source IP address information from the received second service flow data record (such as NetFlow record, IPFIX record or sFlow record). According to the pre-set database of correspondence between IP address segments and C-end and S-end identifiers, determine the type of the source IP address to which it belongs, thereby determining the corresponding C-end or S-end identifier. For the VPN number, check the specific VPN tag field in the data packet or determine it based on the association rules between VPN and service ports configured on the network device. Then, directly extract the source port and destination port number information from the record. During the parsing process, if some special format or encrypted data is encountered, the corresponding decryption algorithm or data conversion tool is used to restore it to a recognizable format before parsing. Through this step-by-step analysis and processing method, the C-end, S-end, VPN number, port number and other data in each railway business interaction process are accurately parsed, providing a basis for subsequent comparison with the service port baseline data and abnormal judgment.

[0086] S303: Classify the parsed second service flow data of each service application port to obtain classified data.

[0087] The parsed data is classified according to the C-end, VPN, S-end and port number, and the data structure of the classified data is consistent with the data structure of the original baseline data of the service port. Among them, the C-end, VPN and S-end are uniquely corresponding, that is, the C-end, VPN and S-end of any two data will not be completely consistent in the classified data, and the port number in the application port list of each data is also unique.

[0088] Optionally, in general, the classification of the parsed second service flow data of each service application port can be achieved in the following manner: First, initialize an empty data set (which can be a data structure such as a dictionary that is easy to search and store by specific key values) to store the classified data. The key value of each item in this data set is set with a unique identifier composed of the C-end, VPN, and S-end, and the corresponding value is an initially empty application port list.

[0089] Next, all the parsed second service flow data are traversed, and the corresponding C-end identifier, VPN number and S-end identifier are extracted from each parsed data, and they are concatenated in a specific order to form a unique string as an index for subsequent operations.

[0090] Then, use this spliced ​​index to search for the previously initialized data set. If the corresponding item can be found in the data set through the index, it means that similar data already exists. At this time, obtain the application port list corresponding to the item, and then extract the application port number in the data currently being processed to check whether the port number already exists in this application port list. If not, add this port number to the application port list to achieve the integration of application ports; if it already exists, it will be processed accordingly according to the established railway business rules (such as whether to update other attributes related to the port, etc.) or ignore the duplicate port number.

[0091] If the index search finds that there is no corresponding item in the data collection, then create a new item with the concatenated index as the key, and create a new application port list containing only the application port numbers in the current data as the value of the item, and add this new item to the data collection to complete the classification operation of this data.

[0092] During the entire traversal and classification process, the rule that each piece of classified data has a unique correspondence between the C-end, VPN and S-end is always followed. That is, each time new data is added to the data set, the existing data must be checked again to ensure that the C-end, VPN and S-end are not completely consistent.

[0093] S304: Determine whether the application port list corresponding to each piece of data in the classified data does not change within a certain period of time.

[0094] Determine whether the application port list corresponding to each piece of data in the classified data does not change within a certain period of time. If the application port list does not change within a certain period of time, it means that the original baseline data of the service port has been fully collected, and step S305 is executed to generate the original baseline data of the service port; if the application port list is still changing within a certain period of time, it means that the original baseline data of the service port has not been fully collected, and steps S301, S302, and S303 are executed to continue to obtain data and parse and classify the data. Among them, the certain period of time can be but not limited to 8 hours, 16 hours, 24 hours, etc., which is not limited here.

[0095] Optionally, in general, whether the application port list corresponding to each piece of data in the classified data satisfies the requirement of no change within a certain period of time can be achieved by the following methods: First, a timestamp recorder is set for each piece of classified data to record the time when the application port list changes each time.

[0096] After the classification operation of the parsed data is completed (step S303), a timer is started, and the duration of the timer is set to the previously specified "certain time" (for example, 8 hours, 16 hours or 24 hours, etc.).

[0097] During the timer operation, the application port list corresponding to each piece of data is continuously monitored. Whenever new data is added or the port number in the application port list changes (such as adding a new port number, deleting a port number, or changing the port number attribute, etc.), the timestamp recorder corresponding to the data is immediately updated to the current time.

[0098] At the same time, a regular inspection mechanism is set up (it can be checked at certain intervals, such as 1 hour, 2 hours, etc., according to actual railway business needs). During each inspection, the timestamp recorders of all classified data are traversed. For each piece of data, the current time is compared with the last updated time in the timestamp recorder. If the current time minus the last updated time is greater than or equal to the "certain time" set by the timer, it is considered that the application port list corresponding to the data will not change within a certain period of time; if it is less than the "certain time", it is determined that the application port list is still changing within a certain period of time.

[0099] In addition, in order to deal with possible special situations (such as time recording errors or data loss caused by system failures, etc.), some additional safeguards can be set. For example, the number of changes in the application port list is recorded at the same time. If the number of changes in the application port list has been at an extremely low level (such as less than a preset threshold) during the operation of the timer, and there is no new change when the timer ends, even if the time difference does not reach "a certain time", it can be considered that the application port list is stable to a certain extent. Therefore, combined with the actual situation of the railway business, it can be carefully judged whether it can be regarded as meeting the condition of no longer changing within a certain period of time. In this way, it can be more flexibly and accurately determined whether the application port list corresponding to each piece of data in the classified data meets the requirement of no longer changing within a certain period of time.

[0100] S305: Store the classified data into the service port original baseline data to generate the service port original baseline data.

[0101] When the application port list corresponding to each piece of data in the classified data does not change within a certain period of time, all the classified data are stored in the service port original baseline data to generate the service port original baseline data. The service port original baseline data contains one or more service port original baselines, and the data structure includes C-end, VPN, S-end and application port list.

[0102] In this embodiment, the original baseline data of the service port is shown in Table 1.

[0103] Table 1 Original baseline data of business ports C-end VPN S-side Application port list 1 Stop 1 102 Business Center 1 8080，8081，8082，8083 2 Station 2 102 Business Center 1 8080，8081，8082，8084 3 Stop 1 103 Business Center 2 9090，9091 4 Station 2 104 Business Center 2 9092 5 Stop 1 105 Business Center 2 10010 6 Station 2 105 Business Center 3 10011，10012 ... ... ... ... ... As can be seen from Table 1, the service port original baseline data stores multiple service port original baselines. The data stored in each baseline is unique. The C-end + VPN + S-end of any two baselines are different, and the port number in the application port list corresponding to each baseline is also unique.

[0104] S306: extract the intersection port data with the same VPN number and S end from the original baseline data of the service port and store it into the service public port baseline data to generate the service public port baseline data.

[0105] Extract the intersection port data with the same VPN number and S end in the original baseline data of the service port, store it in the service public port baseline data, and generate the corresponding service public port baseline data. The service public port baseline data contains one or more service public port baselines, and the data structure includes VPN, S end and application port list.

[0106] In this embodiment, the service common port baseline data is shown in Table 2.

[0107] Table 2 Business public port baseline data VPN S-side Application port list 1 102 Business Center 1 8080，8081，8082 ... ... ... ... It can be seen from Table 2 that compared with the original baseline data of the service port, the C end is reduced in the data structure of the service common port baseline data.

[0108] Comparing Table 1 and Table 2, we can see that only the intersection port data that is the same for both VPN and S ends is extracted and stored in the business common port data. There are a total of 6 business port original baselines in Table 1, with baseline numbers 1 to 6. By comparing the VPN and S end data between any two baselines, we can find that only the VPN and S end data stored in the baseline with number 1 and the baseline with number 2 are the same, and the application port lists of the two data have an intersection, and the intersection port data is 8080, 8081, and 8082. Extracting these data and storing them in the business common port data, we get the business common port baseline data shown in Table 2.

[0109] S307 , extracting baseline data except the service public port baseline data and storing it into the service private port baseline data, and generating the service private port baseline data to be confirmed.

[0110] Extract the data except the service public port baseline data from the service port original baseline data, store it in the service private port baseline data, and generate the corresponding service private port baseline data to be confirmed. The service private port baseline data contains one or more service private port baselines. The data structure of the service private port baseline data includes C-end, VPN, S-end, application port list and baseline status. Among them, there are three baseline statuses, namely, to be confirmed, confirmed and abnormal. The baseline status of each baseline in the service private port baseline data to be confirmed is to be confirmed.

[0111] In this embodiment, the service private port baseline data to be confirmed is shown in Table 3.

[0112] Table 3 Baseline data of private service ports to be confirmed C-end VPN S-side Application port list Baseline status 1 Stop 1 102 Business Center 1 8083 To be confirmed 2 Station 2 102 Business Center 1 8084 To be confirmed 3 Stop 1 103 Business Center 2 9090，9091 To be confirmed 4 Station 2 104 Business Center 2 9092 To be confirmed 5 Stop 1 105 Business Center 2 10010 To be confirmed 6 Station 2 105 Business Center 3 10011，10012 To be confirmed ... ... ... ... ... ... As can be seen from Table 3, compared with the original baseline data of the service port, the baseline state is added to the data structure of the service private port baseline data. In the service private port baseline data to be confirmed, the baseline state is all to be confirmed.

[0113] By comparing Table 1, Table 2 and Table 3, it can be seen that the data in Table 1 can be obtained by adding the data in Table 2 to Table 3. Therefore, Table 3 stores all the data in Table 1 except Table 2, that is, the service private port baseline data to be confirmed stores all the data in the service port original baseline data except the service public port baseline data.

[0114] S308: Determine whether each service private port baseline in each service private port baseline data to be confirmed has any particularity.

[0115] Determine whether each business private port baseline in each business private port baseline data to be confirmed has any special features. If the business private port baseline has special features, it means that the baseline is normal, and step S310 is executed to change the baseline status of the baseline to confirmed; if the business private port baseline does not have special features, it means that the baseline is abnormal, and step S309 is executed to change the baseline status of the baseline to abnormal.

[0116] Optionally, in general, determining whether each service private port baseline has particularity can be achieved by: Confirm whether there are high-risk ports in the application port list of each baseline in the business private port baseline data to be confirmed. If there are high-risk ports, the baseline is not special and the baseline status is abnormal; if there are no high-risk ports, the baseline may be special, and the railway business experts will further confirm whether the baseline is special. Among them, high-risk ports are application ports that are not used for normal railway business. The port numbers can include but are not limited to 135, 137, 138, 139, 445, etc., which are not limited here.

[0117] Optionally, in some special cases, there are more different specific implementation methods for determining whether each service private port baseline is special: In some embodiments, a railway business expert may directly make a manual judgment to determine whether each business private port baseline is special, or the business port monitoring server may directly make an automatic judgment, which is not limited here.

[0118] S309: Change the baseline status of the corresponding service private port baseline to abnormal.

[0119] If the service private port baseline does not have any particularity, the baseline state of the baseline stored in the service private port baseline data is changed to abnormal.

[0120] S310: Change the baseline status of the corresponding service private port baseline to confirmed.

[0121] If the service private port baseline has particularity, the baseline state of the baseline stored in the service private port baseline data is changed to confirmed.

[0122] In this embodiment, after executing the steps of confirming the baseline status in S308, S309, and S310, the baseline data of the service private port is as shown in Table 4.

[0123] Table 4 Business private port baseline data C-end VPN S-side Application port list Baseline status 1 Stop 1 102 Business Center 1 8083 confirm 2 Station 2 102 Business Center 1 8084 abnormal 3 Stop 1 103 Business Center 2 9090，9091 confirm 4 Station 2 104 Business Center 2 9092 confirm 5 Stop 1 105 Business Center 2 10010 abnormal 6 Station 2 105 Business Center 3 10011，10012 confirm ... ... ... ... ... ... It can be seen from Table 4 that after executing the steps of confirming the baseline status in S308, S309, and S310, there are only two baseline statuses of the service common port baseline data, namely, confirmed and abnormal.

[0124] By comparing Table 3 and Table 4, it can be seen that the business common port baseline data to be confirmed and the business common port baseline data after the baseline status is confirmed only differ in the baseline status. There are only two baseline statuses after confirmation. The baseline with a confirmed baseline status is a normal baseline, indicating that the railway business corresponding to the baseline is normal business. The baseline with an abnormal baseline status is an abnormal baseline, indicating that the railway business corresponding to the baseline is abnormal business.

[0125] S311. Find a baseline whose baseline status is abnormal in the service private port baseline data.

[0126] After executing the steps of confirming the baseline status in S308, S309, and S310, a baseline whose baseline status is abnormal is searched among the service private port baselines.

[0127] S312: Display the abnormal information of the service private port baseline whose baseline status is abnormal.

[0128] Displays the abnormal information of the service private port baseline whose baseline status is abnormal. The abnormal information includes C-end, VPN, S-end, port number, and time when the abnormality occurs.

[0129] In some embodiments, the railway operation and maintenance personnel can directly find the service terminal device with the abnormality according to the displayed abnormal information, and conduct targeted investigation on the operating program of the device to find the cause of the abnormality and then solve the abnormality. For example, the railway operation and maintenance personnel can accurately locate the station with the abnormality through the C-end in the abnormal information, and then determine the railway business information with the abnormality through VPN. Since the service terminal device corresponding to each railway business is fixed and the number of devices is limited, some service terminal devices that may have abnormalities can be determined according to the railway business information, and then the abnormal terminal device can be accurately located according to the time when the abnormality occurs. After locating the terminal device, the railway operation and maintenance personnel can find the corresponding abnormal operating program according to the port number, and then investigate the program to get the cause of the abnormality. At this time, the railway operation and maintenance personnel can take corresponding measures such as fixing code vulnerabilities, adjusting operating parameters, updating related configurations or restarting services according to the abnormal causes found, so as to solve the abnormality and ensure the normal operation of the railway business.

[0130] The service terminal device may be, but is not limited to, a computer, a server, a mobile terminal device, etc., and is not limited here.

[0131] S313: Monitor the first service flow data of each service application port.

[0132] Real-time monitoring of the business traffic data sent by the sender during business interaction.

[0133] S314: Analyze the monitored first service flow data of each service application port.

[0134] Analyze the first business flow data of each business application port monitored, and extract key information for comparison, including C-end, VPN, S-end, application port number, etc.

[0135] S315: Compare the parsed first service flow data with the service common port baseline data.

[0136] According to the unique identifier of the business public port baseline data (VPN+S end+application port list), the VPN, S end, and application port numbers in the parsed data are compared one by one with the port numbers in the VPN, S end, and application port list stored in each baseline in the business public port baseline data.

[0137] S316: Confirm whether the comparison between the parsed first service flow data and the service common port baseline data is successful.

[0138] Confirm whether the comparison between the first service flow data and the service public port baseline data is successful. If a baseline that is consistent with the VPN, S-end, and application port number of the parsed data is found in the service public port baseline data, the comparison is successful, indicating that the railway business is operating normally. Execute step S313 to continue monitoring the service application port; if not found, the comparison fails, execute step S317 to compare the parsed data with the service private port baseline data.

[0139] S317: Compare the parsed first service flow data with the service private port baseline data whose baseline status is confirmed.

[0140] After the comparison of the service public port baseline data fails, according to the unique identifier of the service private port baseline data (C-end + VPN + S-end + application port list), the C-end, VPN, S-end, and application port numbers in the parsed data are compared one by one with the port numbers in the C-end, VPN, S-end, and application port list stored in the service private port baseline data with the baseline status of confirmed.

[0141] S318: Confirm whether the comparison between the parsed first service flow data and the service private port baseline data with the baseline status being confirmed is successful.

[0142] Confirm whether the comparison between the first business flow data and the business private port baseline data with a baseline status of confirmed is successful. If a baseline that is consistent with the C-end, VPN, S-end, and application port number of the parsed data is found in the business private port baseline data with a baseline status of confirmed, the comparison is successful, indicating that the railway business is operating normally, and step S313 is executed to continue monitoring the business application port; if not found, the comparison fails, and step S319 is executed to issue a business abnormality warning message.

[0143] S319. Issue business abnormality warning information.

[0144] If the comparison of the baseline of the business private port fails, it means that the railway business is abnormal, and a business abnormality warning message is issued to remind railway operation and maintenance personnel to pay attention to abnormal business.

[0145] S320. Obtain the abnormal business problems reported by the user through the abnormal problem feedback form.

[0146] The abnormal problem feedback form is used to obtain detailed information about the abnormal business problems reported by users. The abnormal problem feedback form is used to record the detailed information about the abnormal business problems reported by users. The detailed information about the abnormal business problems includes the abnormal terminal service device, the abnormal time, and the abnormal business.

[0147] Generally, when users encounter abnormal business problems, they usually provide feedback through online customer service or customer service hotline. At this time, after receiving the user's feedback information, the customer service staff will record the information and upload it to the abnormal problem feedback table in the special business abnormal problem management system. Therefore, the business monitoring server can obtain detailed information about the abnormal business problems reported by users through the abnormal problem feedback table.

[0148] S321. Search for warning information related to abnormal business issues reported by users.

[0149] Based on the abnormal business problems reported by users, the abnormal business warning information stored in the business monitoring server is searched for warning information related to the abnormal business problems reported by users.

[0150] Optionally, in general, the search for the warning information of the corresponding business abnormality problem can be achieved in the following ways: First, extract the time-related details of the abnormality from the abnormal business problem information reported by the user, and clarify the specific time range of the abnormality. After that, filter out the warning information recorded within the time range in the warning information stored in the business monitoring server. On the basis of obtaining the warning information after time screening, further check the abnormal service terminal where the abnormality occurred as reported by the user to clarify which C-end has the abnormal problem. Next, check the warning information related to the C-end in the warning information. Finally, extract the abnormal business from the abnormal business problem information reported by the user, and then check the warning information related to the VPN of the business in the warning information to obtain the warning information related to the business abnormality problem reported by the user.

[0151] S322. Upload the found warning information to the abnormal problem feedback form.

[0152] The found warning information is uploaded to the abnormal problem feedback table, so that the business abnormal problems reported by users correspond one by one with the warning information of related abnormal problems found, which makes it convenient for railway operation and maintenance personnel to solve the abnormal problems reported by users through the warning information.

[0153] Optionally, in general, uploading the found warning information to the abnormal problem feedback table can be achieved in the following ways: First, after obtaining the warning information related to the abnormal business problems reported by users, these warning information are sorted and classified. According to the key elements involved in the warning information, such as the specific business module corresponding to the warning information (distinguishing different business types, such as ticketing business, dispatching business, etc.) and the scope of the associated specific terminal equipment (clearly one or more service terminal devices on a specific C-end), etc., the classification can make the subsequent upload operation more orderly and facilitate the railway operation and maintenance personnel to quickly locate the required warning information when they check it later.

[0154] Next, create a corresponding area in the abnormal problem feedback table specifically for recording warning information. This area can be designed in a table format, and the table headers can be set to fields such as "warning time", "related business", "involving C-end", and "warning details description" to clearly and comprehensively present the key content of each warning information.

[0155] Then, for each piece of warning information that has been sorted out, extract its key information in turn and fill it into the corresponding field position in the abnormal problem feedback table. For example, accurately record the time when the warning information is generated in the "warning time" field, extract the VPN data from the warning content, fill in the specific railway business corresponding to the VPN in the "related business" field, and clearly fill in the specific C-end information related to it in the "involved C-end" field, and finally put the detailed text description of the warning information in the "warning details description" field.

[0156] During the upload process, it is necessary to ensure that an accurate association is established between each warning information and the corresponding business abnormality problem reported by the user. The business abnormality problem reported by the user and the corresponding warning information can be bound by setting an association identification field in the abnormal problem feedback table, such as using the same problem number or a specific association symbol, so that when the railway operation and maintenance personnel view the abnormal problem reported by a specific user, they can easily find all the warning information that matches it, and can deeply analyze the possible causes of the abnormality based on these warning information, and then formulate effective solutions to quickly solve the abnormal problems reported by users, improve the user experience and the stability and reliability of the entire railway business system.

[0157] At the same time, in order to ensure the accuracy and completeness of the data, a data verification is required after the upload operation is completed. Compare the data volume of the warning information before and after the upload to see if it is consistent, check whether there are format errors or missing key information in the content of each field, and correct any problems in a timely manner to ensure that the warning information in the abnormal problem feedback table is accurate.

[0158] In the embodiment of the present application, by acquiring the first business flow data and classifying the data, generating the original baseline of the business port, all data transmission rules of the railway business under normal operation are obtained, and then the original baseline of the business port is further screened to generate the business port baseline, and all data transmission rules of the railway business under normal operation are obtained, and then by comparing these rules, it is judged whether the railway business is abnormal, which greatly improves the accuracy of judging abnormal business. At the same time, the embodiment of the present application can not only send abnormal warning information to the railway operation and maintenance personnel when abnormal business is found, but also automatically match the business abnormal warning information corresponding to the business abnormality problem reported by the user, which provides a basis for the railway operation and maintenance personnel to solve abnormal problems, speeds up the speed of solving abnormal problems, and improves the efficiency of solving business abnormal problems.

[0159] The above describes the service application port monitoring and early warning method in the embodiment of the present application. The following describes in detail the service application port monitoring and early warning system in the embodiment of the present application in combination with the above service application port monitoring and early warning method.

[0160] See also Figure 4 , which is a module architecture diagram of the business application port monitoring and early warning system in the embodiment of the present application.

[0161] In some embodiments, the business application port monitoring and early warning system includes: a baseline generation module 406, which is used to generate corresponding business port baseline data based on the original baseline data of the business port of each railway business; a business monitoring module 407, which is used to monitor the first business flow data of each business application port after generating the business port baseline data; a data matching module 408, which is used to determine whether the first business flow data matches the corresponding business port baseline data when the operation of the first business flow data is monitored; a business early warning module 409, which is used to issue a business abnormality early warning message when the first business flow data does not match the business port baseline data.

[0162] In some embodiments, the baseline generation module 406 specifically includes: a service public port baseline generation submodule 4061, which is used to extract the intersection port data with the same VPN number and S end in the original baseline data of the service port, and store it in the service public port baseline data to generate the service public port baseline data; a service private port baseline generation submodule 4062, which is used to extract the baseline data other than the service public port baseline data in the original baseline data of the service port, and store it in the service private port baseline data to generate the service private port baseline data to be confirmed; a baseline status determination submodule 4063, which is used to determine whether each baseline to be confirmed in the service private port baseline data to be confirmed is a normal baseline; a baseline status change submodule 4064 of a normal baseline, which is used to change the baseline status of the baseline to be confirmed to confirmed when the baseline to be confirmed is a normal baseline; a baseline status change submodule 4065 of an abnormal baseline, which is used to change the baseline status of the baseline to be confirmed to abnormal when the baseline to be confirmed is an abnormal baseline.

[0163] In some embodiments, the baseline status determination submodule 4063 specifically includes: a high-risk port determination unit 40631, used to confirm whether there is a high-risk port in the application port list of each baseline to be confirmed in the business private port baseline data to be confirmed; a specialness determination unit 40632, used to determine that the baseline does not have specialness when there is a high-risk port in the application port list of the baseline to be confirmed; a normal baseline determination unit 40633, used to determine that the baseline is the normal baseline when the baseline to be confirmed has specialness; an abnormal baseline determination unit 40634, used to determine that the baseline is the abnormal baseline when the baseline to be confirmed does not have specialness.

[0164] In some embodiments, the business application port monitoring and early warning system also includes: a second business traffic data acquisition module 401, which is used to acquire the second business traffic data of each business application port; a second business traffic data analysis module 402, which is used to parse the acquired second business traffic data to obtain second business traffic analysis data; a second business traffic data classification module 403, which is used to classify the second business traffic analysis data according to the C-end, VPN number, S-end and port number to obtain classification data; a classification data determination module 404, which is used to determine whether the application port list in the classification data will not change within a certain period of time; a business port original baseline generation module 405, which is used to store the classification data into the business port original baseline data when the application port list in the classification data will not change within a certain period of time, and generate the business port original baseline data.

[0165] In some embodiments, the data matching module 408 specifically includes: a first business flow data parsing submodule 4081, which is used to parse the monitored first business flow data to obtain first business flow parsing data; a business public port baseline comparison submodule 4082, which is used to compare the first business flow parsing data with the business public port baseline data according to the unique identifier of the business public port baseline data; a business private port baseline comparison submodule 4083, which is used to compare the first business flow parsing data with the baseline data in the business private port baseline data whose baseline status is confirmed according to the unique identifier of the business private port baseline data when the comparison between the first business flow parsing data and the business public port baseline data fails; a data matching determination submodule 4084, which is used to determine that the first business flow data matches the corresponding business port baseline data when the first business flow parsing data is successfully compared with the business public port baseline data, or is successfully compared with the baseline data in the business private port baseline data whose baseline status is confirmed. The data mismatch determination submodule 4085 is used to determine that the first business flow data does not match the corresponding business port baseline data when the first business flow parsing data fails to be compared with the business public port baseline data and also fails to be compared with the baseline data with the baseline status as confirmed in the business private port baseline data.

[0166] In some embodiments, the business application port monitoring and early warning system also includes: a feedback information acquisition module 410, which is used to obtain business abnormality problems reported by users through an abnormal problem feedback table to obtain feedback information; an early warning information search module 411, which is used to search for the business abnormality early warning information corresponding to the feedback information to obtain business feedback abnormality early warning information; an early warning information upload module 412, which is used to upload the business feedback abnormality early warning information to the abnormal problem feedback table.

[0167] In some embodiments, the business application port monitoring and early warning system also includes: an abnormal baseline search module 413, used to search for a baseline whose baseline status is abnormal in the business private port baseline data; an abnormal baseline display module 414, used to display information of the baseline whose baseline status is abnormal.

[0168] The embodiment of the present application also provides a monitoring server. The monitoring server in the embodiment of the present application is described below in conjunction with the hardware structure diagram of the monitoring server provided in the present application.

[0169] See also Figure 5 , is a hardware structure diagram of the monitoring server in an embodiment of the present application.

[0170] In some embodiments, the monitoring server 500 is a computer device, which may be a terminal device. The computer device includes a processor 501, a memory 502, a communication module 503, an input device 504 and an output device 505 connected via a system bus. Among them, the processor 501 of the computer device is used to provide computing and control capabilities. The memory 502 of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database is used to store data. The communication module 503 of the computer device is used to send business abnormality warning information to railway operation and maintenance personnel. The input device 504 of the computer device is used to receive business flow data collected by the router. The output device 505 of the computer device is used to display various information, including abnormal baseline information, business abnormality warning information, etc. When the computer program is executed by the processor 501, the business application port monitoring and early warning method in the embodiment of the present application is implemented.

[0171] Those skilled in the art will understand that Figure 5 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0172] In some embodiments of the present application, a computer-readable storage medium is also provided, including instructions, which, when executed on the monitoring server 500, can enable the monitoring server 500 to execute the business application port monitoring and early warning method in the embodiments of the present application.

[0173] As described above, the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present application.

[0174] As used in the above embodiments, the term "when..." may be interpreted to mean "if..." or "after..." or "in response to determining..." or "in response to detecting...", depending on the context. Similarly, the phrases "upon determining..." or "if (the stated condition or event) is detected" may be interpreted to mean "if determining..." or "in response to determining..." or "upon detecting (the stated condition or event)" or "in response to detecting (the stated condition or event)", depending on the context.

[0175] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that contains one or more available media integration. The available medium can be a magnetic medium, (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state hard disk), etc.

[0176] Those skilled in the art can understand that to implement all or part of the processes in the above-mentioned embodiments, the processes can be completed by computer programs to instruct related hardware, and the programs can be stored in computer-readable storage media. When the programs are executed, they can include the processes of the above-mentioned method embodiments. The aforementioned storage media include: ROM or random access memory RAM, magnetic disk or optical disk and other media that can store program codes.

Claims

1. A service application port monitoring and early warning method, characterized in that: include: Based on the original baseline data of the service port of each railway service, the corresponding service port baseline data is generated, the service port original baseline data includes one or more service port original baselines, the service port original baseline is the standard reference data established for the service flow of the service application port when the service application port is in a normal operation state, the normal operation state includes a normal operation state and an abnormal operation state, the service port baseline data is the standard reference data established for the service flow of the service application port when the service application port is in a normal operation state, and is divided into service public port baseline data and service private port baseline data, the service public port baseline data includes one or more service public port baselines, the service public port baseline is a standard reference data determined when there are service requests for the same railway service on multiple service clients, and is used to determine whether the service application port involved in the baseline is in a normal state, the service private port baseline data includes one or more service private port baselines, the service private port baseline is a standard reference data determined when there is a service request for the same railway service on only one service client, and is used to determine whether the service application port involved in the baseline is in a normal state; After generating the service port baseline data, monitoring the first service flow data of each service application port, wherein the first service flow data is flow packet data sent by the sender during the railway service interaction process; In response to monitoring the operation of the first service flow data, determining whether the first service flow data matches the corresponding service port baseline data; If not, a service abnormality warning message is issued, wherein the service abnormality warning message includes the first service flow data of the abnormal service, the time when the abnormality occurs, the time when the abnormality ends, and the number of times the abnormality occurs.

2. The method according to claim 1, characterized in that: The generating of the corresponding service port baseline data based on the service port original baseline data of each railway service specifically includes: Extracting the intersection port data with the same VPN number and S end from the original baseline data of the service port, storing it in the service common port baseline data, and generating the service common port baseline data; Extracting baseline data other than the service public port baseline data from the service port original baseline data, storing the baseline data in the service private port baseline data, and generating the service private port baseline data to be confirmed; Determine whether each baseline to be confirmed in the service private port baseline data to be confirmed is a normal baseline, and the baseline status of the baseline to be confirmed is to be confirmed; If the baseline to be confirmed is the normal baseline, changing the baseline status of the baseline to be confirmed to confirmed; If the baseline to be confirmed is an abnormal baseline, the baseline state of the baseline to be confirmed is changed to abnormal.

3. The method according to claim 2, characterized in that The determining whether each baseline to be confirmed in the service private port baseline data to be confirmed is a normal baseline specifically includes: Confirm whether there is a high-risk port in the application port list of each baseline to be confirmed in the service private port baseline data to be confirmed, wherein the high-risk port is an application port that is not used for normal business; If the high-risk port exists in the application port list of the baseline to be confirmed, it is determined that the baseline does not have any particularity, and the particularity is the basis for judging whether the baseline state is normal; In the case where the baseline to be confirmed has the particularity, determining the baseline as the normal baseline; When the baseline to be confirmed does not have the particularity, the baseline is determined to be the abnormal baseline.

4. The method according to claim 1, characterized in that Before generating corresponding service port baseline data based on the service port original baseline data of each railway service, the method further includes: Acquire second service flow data of each service application port, where the second service flow data is flow packet data transmitted during the railway service interaction process; Parsing the acquired second service flow data to obtain second service flow parsing data; The second service flow parsing data is classified according to the C-end, VPN number, S-end and port number to obtain classified data, wherein the data structure of the classified data is consistent with the data structure of the original baseline data of the service port, and the C-end, VPN and S-end of any two data will not be completely consistent in the classified data; Determine whether the application port list in the classification data does not change within a certain period of time; If so, the classified data is stored in the service port original baseline data to generate the service port original baseline data.

5. The method according to claim 1, characterized in that The operation of, in response to monitoring the first service flow data, determining whether the first service flow data matches the corresponding service port baseline data specifically includes: Parsing the monitored first service flow data to obtain first service flow parsing data; According to the unique identifier of the service common port baseline data, the first service flow parsing data is compared with the service common port baseline data, the unique identifier of the service common port baseline data is VPN number + S end + application port list, and the comparison is to determine whether there is a baseline in the baseline data according to the unique identifier, and whether the identification content matches the identification content of the first service flow parsing data, if so, it indicates that the comparison is successful, if not, it indicates that the comparison fails; If the comparison between the first service flow parsing data and the service public port baseline data fails, the first service flow parsing data is compared with the baseline data with the baseline status as confirmed in the service private port baseline data according to the unique identifier of the service private port baseline data, and the unique identifier of the service private port baseline data is C-end+VPN number+S-end+application port list; If the first service flow parsing data is successfully compared with the service public port baseline data, or is successfully compared with the baseline data with the baseline status of confirmed in the service private port baseline data, it is determined that the first service flow data matches the corresponding service port baseline data; If the first service flow parsing data fails to match the service public port baseline data, and also fails to match the baseline data with the baseline status as confirmed in the service private port baseline data, it is determined that the first service flow data does not match the corresponding service port baseline data.

6. The method according to claim 1, characterized in that After issuing a business abnormality warning message if no, the method further includes: Obtaining the service abnormality problem reported by the user through the abnormality problem feedback form to obtain feedback information, wherein the abnormality problem feedback form is used to record the user's feedback information, and the feedback information includes the terminal service device where the abnormality occurs, the time when the abnormality occurs, and the service where the abnormality occurs; Searching for the service abnormality warning information corresponding to the feedback information to obtain the service feedback abnormality warning information; The business feedback abnormal warning information is uploaded to the abnormal problem feedback form.

7. The method according to claim 1, characterized in that After generating the corresponding service port baseline data based on the service port original baseline data of each railway service, the method further includes: Searching for a baseline whose baseline status is abnormal in the service private port baseline data; The information of the baseline whose status is abnormal is displayed, and the displayed information includes the C end, VPN number, S end and port number.

8. A business application port monitoring and early warning system, characterized in that: include: A baseline generation module is used to generate corresponding business port baseline data based on the original baseline data of the business ports of each railway business; A service monitoring module, used for monitoring the first service flow data of each service application port after generating the service port baseline data; A data matching module, used for determining whether the first service flow data matches the corresponding service port baseline data when the operation of the first service flow data is monitored; The service warning module is used to issue a service abnormality warning message when the first service flow data and the service port baseline data do not match.

9. A monitoring server, characterized in that: include: one or more processors and memory; The memory is coupled to the one or more processors, and the memory is used to store computer program codes, wherein the computer program codes include computer instructions, and the one or more processors call the computer instructions to enable the monitoring server to execute the method according to any one of claims 1 to 7.

10. A computer-readable storage medium comprising instructions, characterized in that: When the instruction is executed on the monitoring server, the monitoring server is caused to execute the method according to any one of claims 1 to 7.

Images