Operation and maintenance method and device based on network traffic, electronic equipment and storage medium

Abstract

The invention discloses an operation and maintenance method and device based on network traffic, electronic equipment and a storage medium. The method comprises the following steps: acquiring network traffic data according to a first mode; analyzing the network traffic data based on a second mode; and obtaining index monitoring data of the network traffic according to an analysis result of the network traffic data so as to realize network operation and maintenance of the data center. According to the invention, fine monitoring and deep analysis of the network traffic are realized. On one hand, a network flow monitoring analysis scheme based on multi-dimensional refinement is provided, and the stability and reliability of network services can be ensured. And on the other hand, a network operation scheme of the data center is provided, and powerful technical support is provided for business innovation and customer service.

Description

Technical Field

[0001] The present application relates to the field of data center network operation and maintenance technology, and in particular to an operation and maintenance method, device, electronic device, and storage medium based on network traffic. Background Art

[0002] As the financial industry moves towards digital transformation, the rapid development of business has led to a surge in application systems, which in turn has led to an expansion in network scale and increased complexity, significantly increasing network risks and operational difficulties.

[0003] In the related technologies, the network traffic monitoring of data centers is limited to rough monitoring and simple analysis, and there is also a lack of systematic operation and maintenance solutions. Summary of the invention

[0004] The embodiments of the present application provide an operation and maintenance method, device, electronic device, and storage medium based on network traffic, so as to integrate multiple key dimensions to achieve precise monitoring and in-depth analysis of network traffic.

[0005] The present application embodiment adopts the following technical solutions:

[0006] In a first aspect, an embodiment of the present application provides an operation and maintenance method based on network traffic, wherein the operation and maintenance method comprises:

[0007] Collect and obtain network traffic data according to the first method;

[0008] Analyzing the network traffic data based on a second method; and

[0009] Based on the analysis results of the network traffic data, the indicator monitoring data of the network traffic is obtained to realize the network operation and maintenance of the data center.

[0010] In some embodiments, the collecting and obtaining network traffic data in the first manner includes:

[0011] Corresponding network traffic data is collected in a cross-regional manner;

[0012] According to the sensitive traffic mode, the encrypted traffic data in the network traffic data is collected;

[0013] in,

[0014] The cross-zone includes different security zones in a data center, and the sensitive traffic includes HTTP traffic.

[0015] In some embodiments, analyzing the network traffic data based on the second method includes:

[0016] Analyze network traffic data across operator lines and centers based on traffic on different network device interfaces and network operator lines;

[0017] Based on HTTP protocol decoding, analyze the network traffic data of HTTP traffic content;

[0018] Based on the network packet loss situation, analyze the corresponding network traffic data when the traffic strategy is adopted.

[0019] In some embodiments, the collecting and obtaining corresponding network traffic data in a cross-regional manner includes:

[0020] Determine the boundary of the area to be monitored according to the division relationship and location information of different security areas in the data center;

[0021] Determine data flow access rules between various security zones;

[0022] Determine the flow collection points on the boundaries of each security area according to the boundaries of the area to be monitored and the data flow access rules between the security areas;

[0023] Deploy traffic collection equipment according to the traffic collection points on the boundaries of each security zone and capture sensitive traffic data transmitted across zones in real time;

[0024] Based on the sensitive traffic data, abnormal behavior or potential security threats in cross-regional data transmission are obtained through real-time monitoring and anomaly detection strategies.

[0025] In some embodiments, the collecting of encrypted traffic data in the network traffic data in a sensitive traffic manner includes:

[0026] Establish a hardware SSL resource pool for HTTPS traffic;

[0027] Centrally decrypt and process HTTPS traffic based on the hardware SSL resource pool;

[0028] Collect decrypted data traffic and distribute the decrypted data traffic image to security tools;

[0029] The security tool is used to analyze and monitor network attack traffic data, and to send out an alarm for the network attack traffic data.

[0030] In some embodiments, according to the analysis result of the network traffic data, the index monitoring data of the network traffic is obtained to implement the network operation and maintenance of the data center, including:

[0031] According to the analysis result of the network traffic data, a TCP connection health analysis index of the network traffic is obtained;

[0032] According to any one or more indicators among the number of connection no responses, retransmission rate, and the combination of the number of connection no responses and retransmission rate in the TCP connection health analysis indicators, the network operation and maintenance of the data center is achieved by issuing an alarm for abnormal results of the TCP connection health analysis indicators.

[0033] In some embodiments, the method further comprises:

[0034] For the hardware SSL offloading device of the data center, collecting network traffic data according to the first method;

[0035] Based on the static resources in the network traffic data of the data center, the index monitoring data of the network traffic is obtained.

[0036] In a second aspect, an embodiment of the present application further provides an operation and maintenance based on network traffic, wherein the operation and maintenance device includes:

[0037] The first module is used to collect network traffic data in a first manner;

[0038] A second module, configured to analyze the network traffic data based on a second method; and

[0039] The operation and maintenance module is used to obtain indicator monitoring data of network traffic based on the analysis results of the network traffic data, so as to realize network operation and maintenance of the data center.

[0040] In a third aspect, an embodiment of the present application further provides an electronic device, comprising: a processor; and a memory arranged to store computer executable instructions, wherein the executable instructions, when executed, cause the processor to perform the above method.

[0041] In a fourth aspect, an embodiment of the present application further provides a computer-readable storage medium, which stores one or more programs. When the one or more programs are executed by an electronic device including multiple application programs, the electronic device executes the above method.

[0042] At least one of the above-mentioned technical solutions adopted in the embodiments of the present application can achieve the following beneficial effects: network traffic data is collected in a first manner and the network traffic data is analyzed based on a second manner, and then indicator monitoring data of the network traffic is obtained according to the analysis results of the network traffic data to realize network operation and maintenance of the data center. Through refined processing in multiple dimensions such as traffic data collection, traffic data analysis, and traffic data indicators, operation and maintenance in the data center is realized to ensure the stability and reliability of network services. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0044] Figure 1 This is a schematic diagram of the architecture of a data center in an operation and maintenance method based on network traffic in an embodiment of the present application;

[0045] Figure 2 A flowchart of an operation and maintenance method based on network traffic in an embodiment of the present application;

[0046] Figure 3 It is a structural schematic diagram of an operation and maintenance device based on network traffic in an embodiment of the present application;

[0047] Figure 4 This is a schematic diagram of the structure of an electronic device in an embodiment of the present application. DETAILED DESCRIPTION

[0048] In order to make the purpose, technical solution and advantages of the present application clearer, the technical solution of the present application will be clearly and completely described below in combination with the specific embodiments of the present application and the corresponding drawings. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present application.

[0049] The network traffic monitoring and analysis methods in related technologies are mainly used to accurately monitor the traffic conditions in the network and analyze the trends, abnormal behaviors and other aspects of the network traffic, so as to ensure the optimal configuration of network resources and timely discovery and identification of risks.

[0050] At present, financial services are developing rapidly, and the types of financial services are becoming more and more complex. The network risks and operation and maintenance difficulties they face have also increased significantly. Traditional network traffic monitoring and analysis methods have shown their limitations. They are unable to cope with encrypted traffic analysis, traffic content analysis, traffic policy packet loss detection, TCP connection stability assessment, and effective coordination of multi-line and multi-center traffic management. In order to meet the current needs of network operation and maintenance, it is necessary to improve and innovate the methods of network traffic monitoring and analysis. Existing network traffic monitoring has the following shortcomings:

[0051] (1) Insufficient encrypted traffic analysis capabilities: With the continuous development of the cloud era and mobile Internet technology, the banking industry has fully entered the digital era, and business scenarios have become increasingly complex. In particular, there are more and more Internet business scenarios, which has led to an increasing amount of network traffic encrypted and transmitted via the HTTPS protocol. The HTTPS protocol protects the integrity and privacy of data through encryption technology. However, this encryption also brings challenges to security analysis, which requires improving the ability to analyze security traffic.

[0052] (2) Lack of effective monitoring of traffic policies: Speed ​​limit policies are a common means of traffic management, used to control the use of network resources and prevent certain traffic from occupying too much bandwidth. If the speed limit policy is not set properly or is not monitored effectively, it may cause packet loss and other network problems. It is necessary to effectively monitor and detect packet loss caused by speed limit policies and adjust traffic policies in a timely manner to ensure business stability.

[0053] (3) Insufficient analysis capabilities of TCP connections: Traditional network traffic monitoring often focuses on macro indicators such as bandwidth usage and packet transmission rate, but does not provide in-depth assessments of the health of TCP connections. In order to more effectively identify and locate network faults, more detailed monitoring and analysis of TCP connections is required.

[0054] (4) Insufficient traffic content mining capabilities: With the rapid development of business and frequent version iterations, the update and adjustment of static resources have become increasingly frequent. In this case, if there is a lack of effective analysis of network traffic content, a large number of static resources may not be optimized for access through technologies such as content distribution networks (CDNs). This will cause non-real-time transaction file transfer traffic to occupy precious Internet bandwidth resources, which will have a negative impact on the operating efficiency of business systems and user experience.

[0055] (5) Lack of means to comprehensively analyze cross-operator lines and cross-regional network traffic: In modern network environments, in order to ensure high availability and performance of services, a multi-line load balancing strategy is usually adopted. However, the peak traffic time of each line may vary, and a comprehensive analysis is required to accurately evaluate the actual traffic of a specific system at a specific time. Faced with the complexity of Internet applications, especially scenarios involving multiple operator lines and multiple data center exits, it becomes particularly important to accurately monitor the overall traffic of the system across lines and data centers. This is not only related to the accuracy of capacity planning and evaluation, but also the key to ensuring service quality and user experience.

[0056] In view of the above shortcomings, an operation and maintenance method based on network traffic is provided in the embodiments of the present application. This method realizes fine monitoring and in-depth analysis of network traffic by integrating multiple key dimensions. It not only greatly enhances the ability to analyze encrypted traffic, but also can deeply analyze traffic content, accurately identify and locate packet loss problems, measure the stability of TCP connections, and effectively monitor complex network traffic across operator lines and centers.

[0057] The technical solutions provided by various embodiments of the present application are described in detail below in conjunction with the accompanying drawings.

[0058] The present application embodiment provides an operation and maintenance method based on network traffic, such as Figure 2 As shown, a schematic diagram of the operation and maintenance method based on network traffic in an embodiment of the present application is provided, and the method at least includes the following steps S210 to S230:

[0059] Step S210: collecting network traffic data in a first manner.

[0060] like Figure 1 As shown, it is a schematic diagram of the architecture of a data center. The data center may include multiple data centers 1, data center 2, ..., corresponding to data centers deployed in different regions or data centers deployed in different locations.

[0061] "Network traffic data" refers to the traffic data in network devices and networking devices in the data center.

[0062] The network traffic data to be monitored may be collected in a first manner, and the first manner includes but is not limited to any traffic collection manner or any optimized traffic collection manner.

[0063] Exemplarily, the cross-region traffic and encrypted traffic are collected and obtained in the first manner. It can be understood that the cross-region traffic mainly refers to the traffic data between different data centers, and the encrypted traffic mainly refers to the encrypted traffic data in a data center or different data centers.

[0064] Step S220: analyzing the network traffic data based on the second method.

[0065] Based on the second method, the network traffic data is analyzed. Through line traffic analysis, the data traffic flowing through the network can be monitored and analyzed so as to understand the traffic conditions of different lines. The second method includes but is not limited to any traffic analysis method or any optimization method of traffic collection and analysis.

[0066] It can be understood that the first method or the first approach is only used to refer to a certain collection or analysis method, and is not used to limit the specific implementation method in the embodiments of the present application.

[0067] Exemplarily, the analysis of network traffic data based on the second method includes a comprehensive analysis of cross-operator lines and cross-center network traffic, HTTP traffic content analysis, and traffic strategy analysis.

[0068] Step S230, obtaining network traffic indicator monitoring data based on the analysis result of the network traffic data to implement network operation and maintenance of the data center.

[0069] The network traffic data is analyzed to obtain corresponding analysis results, including detection results and analysis results of the traffic data. Based on these results, the index monitoring data of the network traffic can be obtained, so as to realize the network operation and maintenance of the data center according to whether the index monitoring data is abnormal. The index monitoring data of the network traffic at least includes the TCP connection stability index.

[0070] Through the above method, network traffic data is first collected according to the first method, then the network traffic data is analyzed based on the second method, and finally, according to the analysis results of the network traffic data, the index monitoring data of the network traffic is obtained to realize the network operation and maintenance of the data center. Through the collection, analysis and refined optimization of network traffic data and index monitoring, the collection efficiency is improved, the unified monitoring and analysis of multi-line and multi-data center traffic is completed, the in-depth analysis of HTTP static resource content and the early warning and judgment of key indicators are completed.

[0071] Through the above methods, multiple key dimensions of traffic are comprehensively considered to achieve refined monitoring and in-depth analysis of network traffic. It can not only improve the ability to analyze encrypted traffic, but also deeply explore the traffic content, accurately detect and diagnose packet loss problems, evaluate the stability of TCP connections, and effectively manage and optimize complex network traffic across operator lines and centers. In addition, it enhances the ability to understand and control network traffic, provides more powerful and flexible tools for network operation and maintenance, thereby improving the efficiency and reliability of overall network operation, and providing technical support for business innovation and customer service.

[0072] Different from the problem of traditional network traffic monitoring in related technologies, the decrypted data traffic is uniformly collected for the monitored network traffic data. Through the above method, the refinement of traffic collection dimension can more effectively monitor and analyze HTTPS traffic. The refinement of traffic analysis dimension can identify static resources with high access frequency. The refinement of traffic indicator dimension can not only speed up the problem location speed, but also improve the monitoring and optimization of TCP connection quality.

[0073] In one embodiment of the present application, the network traffic data collected in a first manner includes: collecting corresponding network traffic data in a cross-regional manner; collecting encrypted traffic data in the network traffic data in a sensitive traffic manner; wherein the cross-region includes different security areas in a data center, and the sensitive traffic includes HTTP traffic.

[0074] For data centers that may be cross-center or cross-regional, considering that cross-firewall traffic involves data exchange between network areas with different security levels, strict security monitoring and filtering mechanisms need to be adopted to prevent potential network attacks and data leaks. When the corresponding network traffic data is collected in a cross-regional manner, the traffic between these key security areas can be effectively monitored. In related technologies, the region can only analyze the traffic data of a single center or line, and lacks the ability to coordinate and analyze multiple centers. In a cross-regional manner, real-time monitoring of traffic between network areas can be achieved, and comprehensive traffic analysis can be carried out using security tools to quickly identify and respond to security threats, which helps to ensure the security of data centers, optimize cross-regional network traffic management, and enhance the overall network defense capabilities.

[0075] According to the sensitive traffic mode, the encrypted traffic data in the network traffic data is collected: HTTP traffic can be effectively processed and in-depth security analysis can be performed. The design of the entire process according to the sensitive traffic mode fully considers the balance between efficiency and security, which not only ensures the efficiency of data collection, but also ensures the security and privacy of data. It solves the problem of insufficient encrypted traffic analysis capabilities in related technologies. It solves the problem of lack of means for coordinating and analyzing cross-operator lines and cross-regional network traffic in related technologies.

[0076] Through the refinement of the above traffic collection dimensions, sensitive traffic across different networks is collected to promptly identify security threats; HTTPS traffic is centrally decrypted and the decrypted data traffic is uniformly collected, which not only ensures the efficiency of data collection, but also ensures the security and privacy of data. In this way, HTTPS traffic can be monitored and analyzed more effectively, and various network security challenges can be promptly identified and responded to.

[0077] In one embodiment of the present application, the analysis of the network traffic data based on the second method includes: analyzing the network traffic data across operator lines and across centers based on the traffic on different network device interfaces and network operator lines; analyzing the network traffic data of HTTP traffic content based on decoding of the HTTP protocol; and analyzing the corresponding network traffic data when the traffic strategy is adopted based on the network packet loss situation.

[0078] The coordinated analysis of cross-operator lines and cross-center network traffic means that when multiple network devices, multiple operator lines and multiple data centers are involved, in order to achieve effective monitoring and analysis of these dispersed traffic, a global traffic definition method based on IP and port information is used to integrate the traffic on different network device interfaces and operator lines, thereby achieving unified monitoring and analysis of multi-line and multi-data center traffic.

[0079] HTTP traffic content analysis means to achieve in-depth analysis of http traffic content by decoding the HTTP protocol and analyzing other key information. The following information can be analyzed: URI type, number of requests / responses for different URIs, page size, etc. By analyzing the number of requests / responses for different URIs, frequently accessed static resources such as images, videos, style sheets, and scripts can be identified.

[0080] Preferably, for the static resources, the content delivery network (CDN) technology can be used to cache the static content of the website (such as images, videos, style sheets and scripts, etc.) on the distributed server to reduce the pressure on the Internet bandwidth within the bank, shorten the access delay, and improve the reliability of content delivery. This solves the problem of insufficient traffic content mining capabilities in related technologies.

[0081] Traffic strategy analysis refers to the traffic strategy implemented at key network locations such as backbone networks and the Internet in order to ensure the reasonable allocation of network resources and the stable operation of the system. In an embodiment of the present application, the network packet loss is monitored on a daily basis. Specifically, the equipment is inspected regularly by automated means, and the packet loss data of the current time and the same period of the previous day are automatically compared. If the number of packet losses is found to have increased, this usually means that a system has experienced a traffic peak and may have reached its speed limit. Comparative analysis of network packet loss helps to promptly identify potential traffic management and network performance problems, and adjust the speed limit strategy in a timely manner based on the analysis results to ensure stable business operation. This solves the problem of lack of effective monitoring of traffic strategies in related technologies.

[0082] Through the refinement of the above traffic analysis dimensions, the overall analysis of traffic across operator lines and centers can provide a more comprehensive perspective for network management decisions, show the overall traffic situation of cross-line and cross-center applications, and optimize overall network performance; analyze HTTP traffic content, identify frequently accessed static resources, and use CDN technology to cache high-frequency static resources to reduce the pressure on the bank's Internet bandwidth, shorten access delays, and improve the reliability of content delivery and shorten access delays; monitor and analyze the packet loss of traffic strategies based on automated inspection methods to promptly discover potential traffic management and network performance issues.

[0083] In one embodiment of the present application, the corresponding network traffic data is collected in a cross-regional manner, including: determining the boundaries of the area to be monitored based on the division relationship and location information of different security areas in the data center; determining the data flow access rules between the various security areas; determining the traffic collection points on the boundaries of each security area based on the boundaries of the area to be monitored and the data flow access rules between the various security areas; deploying traffic collection equipment based on the traffic collection points on the boundaries of each security area and capturing sensitive traffic data transmitted across regions in real time; obtaining abnormal behavior or potential security threats in cross-regional data transmission through real-time monitoring and anomaly detection strategies based on the sensitive traffic data.

[0084] Data centers are usually divided into multiple different virtual security areas, for example, they can be divided into production core areas, production external areas, Internet areas, etc. These areas are securely segmented through firewalls or physical isolation to protect data security in high-security areas. Cross-firewall traffic involves data exchange between network areas with different security levels, such as communication between production external areas and core production areas, so strict security monitoring and filtering mechanisms are required to prevent potential network attacks and data leaks.

[0085] In order to achieve effective monitoring of traffic between these key security areas, in an embodiment of the present application, S1, network segmentation combing: first, clarify the division and location of different security areas in the data center to identify the boundaries of the areas that need to be monitored. S2, mutual access rule confirmation: determine the data flow access rules between each security area, and clarify which traffic is legal cross-regional access and which is potential abnormal behavior. S3, traffic collection point confirmation: based on the information combed in the first two steps, determine the traffic collection points on the boundaries of each security area. These points are usually set on key network nodes to ensure comprehensive collection of cross-regional traffic. S4, sensitive traffic collection: at the determined collection points, deploy traffic collection equipment to capture sensitive traffic data transmitted across regions in real time. These data will be sent to security tools for in-depth analysis. S5, real-time monitoring and anomaly detection: based on the collected traffic data, through real-time monitoring and anomaly detection technology, timely discover abnormal behavior or potential security threats in cross-regional data transmission to prevent data leakage and network attacks.

[0086] It is understood that the security tools include, but are not limited to, intrusion detection systems, data loss prevention systems, etc. It should be noted that the key network nodes include, but are not limited to, firewalls, routers, and the like.

[0087] This method enables real-time monitoring of traffic between network regions, and the use of security tools to conduct comprehensive traffic analysis to quickly identify and respond to security threats, helping to ensure the security of data centers, optimize cross-regional network traffic management, and enhance the overall network's defense capabilities.

[0088] In one embodiment of the present application, the encrypted traffic data in the network traffic data is collected in a sensitive traffic manner, including: establishing a hardware SSL resource pool for HTTPS traffic; centrally decrypting and processing HTTPS traffic based on the hardware SSL resource pool; collecting decrypted data traffic and distributing the decrypted data traffic mirror to security tools; analyzing and monitoring network attack traffic data through the security tools, and alerting the network attack traffic data.

[0089] The process of encrypted traffic collection mainly includes: S1, building a hardware SSL resource pool dedicated to centralized management and decryption of HTTPS traffic S2, centralized decryption processing of HTTPS traffic through the hardware SSL resource pool. This process not only optimizes the use of resources, but also ensures the efficiency of data collection S3, uniformly collects decrypted data traffic, and distributes the decrypted traffic mirror to various security tools S4, uses security tools to carry out targeted network attack traffic monitoring and analysis S5, and transmits alarm logs to the situation awareness platform for unified analysis and disposal.

[0090] The above encrypted traffic collection method fully considers the balance between efficiency and security, ensuring both the efficiency of data collection and the security and privacy of data. Through this method, HTTPS traffic can be monitored and analyzed more effectively, and various potential network security risks can be discovered and responded to in a timely manner.

[0091] In one embodiment of the present application, based on the analysis results of the network traffic data, indicator monitoring data of the network traffic is obtained to implement network operation and maintenance of the data center, including: based on the analysis results of the network traffic data, a TCP connection health analysis indicator of the network traffic is obtained; based on any one or more indicators of the number of connection no responses, the retransmission rate, and the combination of the number of connection no responses and the retransmission rate in the TCP connection health analysis indicator, the network operation and maintenance of the data center is implemented by issuing an alarm for abnormal results of the TCP connection health analysis indicator.

[0092] Health analysis indicators include, but are not limited to, the number of connection no responses, the retransmission rate, and the combination of the number of connection no responses and the retransmission rate. Specifically, the number of connection no responses refers to the number of all SYN packet retransmissions and the number of SYN packet no responses within the current time. In the TCP three-way handshake, within a specific time, if the SYN packet does not receive the SYN+ACK response packet in time, it will be marked as a connection no response, which includes two possible phenomena: (1) The SYN packet is retransmitted multiple times, and if the interval between each retransmission exceeds a specific time, it is marked as a connection no response. (2) The SYN packet is not retransmitted, and RST is directly used to force the link to be disconnected, which is also marked as a connection no response. In the embodiments of the present application, by monitoring the number of connection no responses, the quality of the TCP connection can be quickly identified and diagnosed, which helps to discover potential network problems, such as network congestion, configuration errors, or hardware failures, which may lead to connection establishment failures or delays.

[0093] The retransmission rate refers to the total number of retransmitted packets compared to the total number of packets. The reasons for retransmission include packet loss at the network layer, server no response or discarding of the data packet, false retransmission, etc. By combining the number of unresponsive links and the retransmission rate, an efficient combined alarm system can be constructed, which will significantly improve the speed and accuracy of problem location. This analysis method can quickly distinguish whether the root cause of the problem is at the network level or the service level, so as to take targeted solutions. If there are a large number of connection failures and the retransmission rate is low, this may indicate a network connection problem; if the connection is successful, but the number of retransmission packets is high, this may indicate insufficient processing capacity on the server side.

[0094] Furthermore, considering that the quality of TCP connection includes not only the efficiency of connection establishment and data transmission, but also the stability and reliability of the connection. By monitoring the number of unresponsive connections and the retransmission rate, problems affecting the quality of TCP connections can be discovered and solved in a timely manner to ensure efficient and stable network communications. That is, by combining the number of unresponsive connections and the retransmission rate for analysis, not only can the problem location be accelerated, but also the monitoring of TCP connection quality can be strengthened. This helps to ensure efficient, stable and secure network communications and provide users with a better service experience. The problem of insufficient analysis capabilities of TCP connections in related technologies is solved.

[0095] Through the refinement of the above-mentioned traffic indicator dimensions, the indicators of connection no response number and retransmission rate are set, and the connection no response number and retransmission rate are combined for analysis, which makes up for the shortcomings of insufficient analysis of traditional monitoring methods (the relevant technology only focuses on the relevant quality indicators of network layer connectivity, and lacks analysis of TCP connection quality). It can not only speed up the problem location speed, but also improve the monitoring and optimization of TCP connection quality. This helps to ensure the efficiency, stability and security of network communication and provide users with a better service experience.

[0096] In one embodiment of the present application, the method further includes: collecting network traffic data for the hardware SSL offloading device of the data center in accordance with a first method; and obtaining indicator monitoring data of the network traffic based on static resources in the network traffic data of the data center.

[0097] In the embodiments of the present application, in terms of the traffic collection dimension, it includes the collection of traffic across network security areas, centralized construction of hardware SSL offloading equipment, and centralized collection of encrypted traffic after offloading to improve collection efficiency.

[0098] In the embodiments of the present application, emphasis is placed on improving the in-depth analysis and processing capabilities of HTTP static resource content, and the ability to perform detailed analysis and optimization of static resources on the network, such as images, videos, CSS and JavaScript files.

[0099] The present application embodiment also provides an operation and maintenance device 300 based on network traffic, such as Figure 3 As shown, a schematic diagram of the structure of an operation and maintenance device based on network traffic in an embodiment of the present application is provided, wherein the operation and maintenance device based on network traffic 300 at least includes: a first module 310, a second module 320, and an operation and maintenance module 330, wherein:

[0100] In one embodiment of the present application, the first module 310 is specifically used to collect network traffic data in a first manner.

[0101] like Figure 1 The figure shows a schematic diagram of the architecture of a data center. A data center may include multiple data centers deployed in different regions or data centers deployed in different locations.

[0102] "Network traffic data" refers to the traffic data in network devices and networking devices in the data center.

[0103] The network traffic data to be monitored may be collected in a first manner, and the first manner includes but is not limited to any traffic collection manner or any optimized traffic collection manner.

[0104] Exemplarily, the cross-region traffic and encrypted traffic are collected and obtained in the first manner. It can be understood that the cross-region traffic mainly refers to the traffic data between different data centers, and the encrypted traffic mainly refers to the encrypted traffic data in a data center or different data centers.

[0105] In one embodiment of the present application, the second module 320 is specifically used to: analyze the network traffic data based on a second method.

[0106] Based on the second method, the network traffic data is analyzed. Through line traffic analysis, the data traffic flowing through the network can be monitored and analyzed so as to understand the traffic conditions of different lines. The second method includes but is not limited to any traffic analysis method or any optimization method of traffic collection and analysis.

[0107] It can be understood that the first method or the first approach is only used to refer to a certain collection or analysis method, and is not used to limit the specific implementation method in the embodiments of the present application.

[0108] Exemplarily, the analysis of network traffic data based on the second method includes a comprehensive analysis of cross-operator lines and cross-center network traffic, HTTP traffic content analysis, and traffic strategy analysis.

[0109] In one embodiment of the present application, the operation and maintenance module 330 is specifically used to obtain indicator monitoring data of network traffic based on the analysis results of the network traffic data to achieve network operation and maintenance of the data center.

[0110] The network traffic data is analyzed to obtain corresponding analysis results, including detection results and analysis results of the traffic data. Based on these results, the index monitoring data of the network traffic can be obtained, so as to realize the network operation and maintenance of the data center according to whether the index monitoring data is abnormal. The index monitoring data of the network traffic at least includes the TCP connection stability index.

[0111] In one embodiment of the present application, the first module 310 is also used to

[0112] Corresponding network traffic data is collected in a cross-regional manner;

[0113] According to the sensitive traffic mode, the encrypted traffic data in the network traffic data is collected;

[0114] in,

[0115] The cross-zone includes different security zones in a data center, and the sensitive traffic includes HTTP traffic.

[0116] In one embodiment of the present application, the second module 320 is also used to

[0117] Analyze network traffic data across operator lines and centers based on traffic on different network device interfaces and network operator lines;

[0118] Based on HTTP protocol decoding, analyze the network traffic data of HTTP traffic content;

[0119] Based on the network packet loss situation, analyze the corresponding network traffic data when the traffic strategy is adopted.

[0120] In one embodiment of the present application, the first module 310 is also used to

[0121] Determine the boundary of the area to be monitored according to the division relationship and location information of different security areas in the data center;

[0122] Determine data flow access rules between various security zones;

[0123] Determine the flow collection points on the boundaries of each security area according to the boundaries of the area to be monitored and the data flow access rules between the security areas;

[0124] Deploy traffic collection equipment according to the traffic collection points on the boundaries of each security zone and capture sensitive traffic data transmitted across zones in real time;

[0125] Based on the sensitive traffic data, abnormal behavior or potential security threats in cross-regional data transmission are obtained through real-time monitoring and anomaly detection strategies.

[0126] In one embodiment of the present application, the first module 310 is further used to establish a hardware SSL resource pool for HTTPS traffic;

[0127] Centrally decrypt and process HTTPS traffic based on the hardware SSL resource pool;

[0128] Collect decrypted data traffic and distribute the decrypted data traffic image to security tools;

[0129] The security tool is used to analyze and monitor network attack traffic data, and to send out an alarm for the network attack traffic data.

[0130] In one embodiment of the present application, the operation and maintenance module 330 is also used to

[0131] According to the analysis result of the network traffic data, a TCP connection health analysis index of the network traffic is obtained;

[0132] According to any one or more indicators among the number of connection no responses, retransmission rate, and the combination of the number of connection no responses and retransmission rate in the TCP connection health analysis indicators, the network operation and maintenance of the data center is achieved by issuing an alarm for abnormal results of the TCP connection health analysis indicators.

[0133] It can be understood that the above-mentioned operation and maintenance device based on network traffic can implement the various steps of the network traffic monitoring method provided in the aforementioned embodiment. The relevant explanations about the network traffic monitoring method are applicable to the operation and maintenance device based on network traffic and will not be repeated here.

[0134] Figure 4 This is a schematic diagram of the structure of an electronic device according to an embodiment of the present application. Figure 4 At the hardware level, the electronic device includes a processor, and optionally also includes an internal bus, a network interface, and a memory. The memory may include a memory, such as a high-speed random access memory (RAM), and may also include a non-volatile memory (non-volatile memory), such as at least one disk storage. Of course, the electronic device may also include hardware required for other services.

[0135] The processor, network interface and memory can be interconnected through an internal bus, which can be an ISA (Industry Standard Architecture) bus, a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 4 Only one bidirectional arrow is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0136] The memory is used to store the program. Specifically, the program may include a program code, and the program code includes a computer operation instruction. The memory may include a memory and a non-volatile memory, and provides instructions and data to the processor.

[0137] The processor reads the corresponding computer program from the non-volatile memory into the memory and then runs it, forming an operation and maintenance device based on network traffic at the logical level. The processor executes the program stored in the memory and is specifically used to perform the following operations:

[0138] Collect and obtain network traffic data according to the first method;

[0139] Analyzing the network traffic data based on a second method; and

[0140] Based on the analysis results of the network traffic data, the indicator monitoring data of the network traffic is obtained to realize the network operation and maintenance of the data center.

[0141] The above application Figure 2The method performed by the network traffic-based operation and maintenance device disclosed in the illustrated embodiment can be applied to a processor or implemented by a processor. The processor may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by an integrated logic circuit of hardware in the processor or an instruction in software form. The above processor may be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it may also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present application can be implemented or executed. The general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc. The steps of the method disclosed in conjunction with the embodiments of the present application can be directly embodied as a hardware decoding processor for execution, or a combination of hardware and software modules in the decoding processor for execution. The software module can be located in a mature storage medium in the field such as random access memory, flash memory, read-only memory, programmable read-only memory or electrically erasable programmable memory, register, etc. The storage medium is located in the memory, and the processor reads the information in the memory and completes the steps of the above method in combination with its hardware.

[0142] The electronic device may also perform Figure 2 A method for executing an operation and maintenance device based on network traffic in a Figure 2 The functions of the illustrated embodiment will not be described in detail in the embodiments of the present application.

[0143] The present application also provides a computer-readable storage medium, which stores one or more programs, wherein the one or more programs include instructions, which, when executed by an electronic device including multiple application programs, enable the electronic device to execute Figure 2 The method performed by the operation and maintenance device based on network traffic in the illustrated embodiment is specifically used to perform:

[0144] Collect and obtain network traffic data according to the first method;

[0145] Analyzing the network traffic data based on a second method; and

[0146] Based on the analysis results of the network traffic data, the indicator monitoring data of the network traffic is obtained to realize the network operation and maintenance of the data center.

[0147] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0148] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0149] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0150] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0151] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0152] The memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0153] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0154] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0155] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0156] The above is only an embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included in the scope of the claims of the present application.

Claims

1. An operation and maintenance method based on network traffic, wherein: The operation and maintenance method comprises: Collect and obtain network traffic data according to the first method; Analyzing the network traffic data based on a second method; and Based on the analysis results of the network traffic data, the indicator monitoring data of the network traffic is obtained to realize the network operation and maintenance of the data center.

2. The method of claim 1, wherein: The collecting and obtaining network traffic data in the first manner includes: Corresponding network traffic data is collected in a cross-regional manner; According to the sensitive traffic mode, the encrypted traffic data in the network traffic data is collected; in, The cross-zone includes different security zones in a data center, and the sensitive traffic includes HTTP traffic.

3. The method of claim 2, wherein: The analyzing the network traffic data based on the second method includes: Analyze network traffic data across operator lines and centers based on traffic on different network device interfaces and network operator lines; Based on HTTP protocol decoding, analyze the network traffic data of HTTP traffic content; Based on the network packet loss situation, analyze the corresponding network traffic data when the traffic strategy is adopted.

4. The method of claim 2, wherein: The corresponding network traffic data is collected in a cross-regional manner, including: Determine the boundary of the area to be monitored according to the division relationship and location information of different security areas in the data center; Determine data flow access rules between various security zones; Determine the flow collection points on the boundaries of each security area according to the boundaries of the area to be monitored and the data flow access rules between the security areas; Deploy traffic collection equipment according to the traffic collection points on the boundaries of each security zone and capture sensitive traffic data transmitted across zones in real time; Based on the sensitive traffic data, abnormal behavior or potential security threats in cross-regional data transmission are obtained through real-time monitoring and anomaly detection strategies.

5. The method of claim 2, wherein: The encrypted traffic data collected in the network traffic data in a sensitive traffic manner includes: Establish a hardware SSL resource pool for HTTPS traffic; Centrally decrypt and process HTTPS traffic based on the hardware SSL resource pool; Collect decrypted data traffic and distribute the decrypted data traffic image to security tools; The security tool is used to analyze and monitor network attack traffic data, and to send out an alarm for the network attack traffic data.

6. The method of claim 1, wherein: According to the analysis results of the network traffic data, the index monitoring data of the network traffic is obtained to realize the network operation and maintenance of the data center, including: According to the analysis result of the network traffic data, a TCP connection health analysis index of the network traffic is obtained; According to any one or more indicators among the number of connection no responses, retransmission rate, and the combination of the number of connection no responses and retransmission rate in the TCP connection health analysis indicators, the network operation and maintenance of the data center is achieved by issuing an alarm for abnormal results of the TCP connection health analysis indicators.

7. The method according to any one of claims 1 to 6, wherein: The method further comprises: For the hardware SSL offloading device of the data center, collecting network traffic data according to the first method; Based on the static resources in the network traffic data of the data center, the index monitoring data of the network traffic is obtained.

8. An operation and maintenance device based on network traffic, wherein: The operation and maintenance device comprises: The first module is used to collect network traffic data in a first manner; A second module, configured to analyze the network traffic data based on a second method; and The operation and maintenance module is used to obtain indicator monitoring data of network traffic based on the analysis results of the network traffic data, so as to realize network operation and maintenance of the data center.

9. An electronic device, comprising: processor; as well as A memory arranged to store computer executable instructions, which when executed cause the processor to perform the method of any one of claims 1 to 7.

10. A computer-readable storage medium storing one or more programs, which, when executed by an electronic device including a plurality of application programs, causes the electronic device to execute any one of the methods of claims 1 to 7.

Images