TypeB message flow monitoring method and device based on standard deviation calculation

Abstract

The invention discloses a typeB message flow monitoring method and device based on standard deviation calculation. The method comprises the steps that log information of typeB messages in a first time period is obtained, the range interval of the typeB message amount is determined, and the log information at least comprises program name information, time point information and transaction processing amount per second; obtaining log information of the typeB message in a second time period; whether the typeB message amount of the second time period is within the range interval or not is judged, and the typeB message amount of the second time period is determined based on log information of the typeB messages of the second time period; and when it is determined that the typeB message amount of the second time period exceeds the range interval, generating an alarm instruction which is used for controlling the target device to give an alarm. The technical problem that in a traditional monitoring method, a fixed threshold value cannot adapt to flow changes is solved.

Description

Technical Field

[0001] The present invention relates to the field of big data technology, and in particular to a type B message flow monitoring method and device based on standard deviation calculation. Background Art

[0002] Type B message is a non-real-time message. Although it is not real-time, it needs to maintain a certain timing to ensure the accurate transmission of information. The monitoring of Type B messages is particularly important. First of all, we need to ensure that the message volume is appropriate. If the message volume is too large, it may cause a backlog, which will cause message delays and have a negative impact on the efficiency of communication. However, if the message volume is too small, it will also cause problems. This is because it may mean that there is some form of obstacle or problem in the upstream link, which hinders the normal transmission of the message.

[0003] Therefore, monitoring Type B messages requires attention to two aspects of message volume: neither too large nor too small. This dual monitoring of message volume is a special feature of the monitoring system and is also an issue that we need to pay special attention to when managing messages. Existing monitoring programs often simply compare a specific value to determine whether the value is greater than or less than the set value. However, this single comparison method is not suitable for all types of monitoring scenarios, especially in terms of message volume statistics.

[0004] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0005] The embodiments of the present invention provide a method and device for monitoring type B message traffic based on standard deviation calculation, so as to at least solve the technical problem that the fixed threshold in the traditional monitoring method cannot adapt to traffic changes.

[0006] According to one aspect of an embodiment of the present invention, a method for monitoring typeB message traffic based on standard deviation calculation is provided, including: obtaining log information of typeB messages in a first time period, determining a range of typeB message volume, wherein the log information includes at least: program name information, time point information, and transaction processing volume per second; obtaining log information of typeB messages in a second time period; judging whether the typeB message volume in the second time period is within a range, wherein the typeB message volume in the second time period is determined based on the log information of the typeB message in the second time period; and generating an alarm instruction when it is determined that the typeB message volume in the second time period exceeds the range, the alarm instruction being used to control the target device to sound an alarm.

[0007] Optionally, log information of typeB messages in a first time period is obtained to determine a range of the typeB message volume, including: based on the log information of the first time period, analyzing and obtaining transaction volume data of the first time period, wherein the transaction volume data at least includes: a maximum transaction volume, a minimum transaction volume, and an average transaction volume; based on the transaction volume data of the first time period, obtaining standard parameters of the typeB message volume, the standard parameters at least include: a standard deviation of the typeB message volume, and an average value of the typeB message volume; based on the standard parameters of the typeB message volume, determining a range of the typeB message volume.

[0008] Optionally, based on the standard parameters of the typeB message volume, the range interval of the typeB message volume is determined, including: determining a first range interval according to the standard parameters, wherein the first range interval is the mean value ± the standard deviation; determining a second range interval according to the standard parameters, wherein the second range interval is the mean value ± two times the standard deviation; determining a third range interval according to the standard parameters, wherein the third range interval is the mean value ± three times the standard deviation.

[0009] Optionally, determining whether the typeB message volume in the second time period is within a range interval includes: when determining that the typeB message volume in the second time period is within a first range interval, generating a normal characterization signal, wherein the normal characterization signal is used to characterize that the typeB message volume in the second time period is in a normal state.

[0010] Optionally, determining whether the typeB message volume in the second time period is within a range includes: when determining that the typeB message volume in the second time period is within a second range, generating a warning signal, the warning signal being used to characterize that the typeB message volume in the second time period is in a warning state.

[0011] Optionally, determining whether the typeB message volume in the second time period is within a range includes: if it is determined that the typeB message volume in the second time period exceeds a third range, generating an alarm instruction, the alarm instruction being used to control the target device to sound an alarm.

[0012] According to another aspect of an embodiment of the present invention, there is also provided a typeB message traffic monitoring device based on standard deviation calculation, including: a first acquisition module, the first acquisition module is used to obtain log information of typeB messages in a first time period, and determine a range of typeB message volume, wherein the log information at least includes: program name information, time point information, and transaction processing volume per second; a second acquisition module, the second acquisition module is used to obtain log information of typeB messages in a second time period; a judgment module, the judgment module is used to judge whether the typeB message volume in the second time period is within the range, wherein the typeB message volume in the second time period is determined based on the log information of the typeB message in the second time period; a determination module, the determination module is used to generate an alarm instruction when it is determined that the typeB message volume in the second time period exceeds the range, and the alarm instruction is used to control the target device to issue an alarm.

[0013] According to another aspect of an embodiment of the present invention, there is further provided an electronic device, comprising: a memory storing an executable program; and a processor for running the program, wherein the method in each embodiment of the present invention is executed when the program is running.

[0014] According to another aspect of an embodiment of the present invention, a computer-readable storage medium is provided. The computer-readable storage medium includes a stored executable program, wherein when the executable program is running, the device where the storage medium is located is controlled to execute the methods in various embodiments of the present invention.

[0015] According to another aspect of an embodiment of the present invention, a computer program product is provided, including a computer program. When the computer program is executed by a processor, the method in each embodiment of the present invention is implemented.

[0016] In an embodiment of the present invention, by collecting the log information of TypeB messages in the first time period, including the program name, time point and transaction processing volume per second (TPS), analyzing the statistical characteristics of these data, the normal range of the message volume is determined. Subsequently, the system obtains the log information of TypeB messages in real time in the second time period, compares it with the range calculated in the first time period, and determines whether the current message volume is within the normal fluctuation range. If the message volume in the second time period exceeds this range, the system will automatically trigger the alarm mechanism and generate an alarm instruction, thereby achieving the purpose of accurately monitoring the message flow, thereby realizing the technical effect of dynamic threshold monitoring, and then solving the technical problem that the fixed threshold in the traditional monitoring method cannot adapt to the flow change. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of this application. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0018] Figure 1 A hardware structure block diagram of a computer terminal for implementing a typeB message flow monitoring method based on standard deviation calculation is shown;

[0019] Figure 2 It is a flow chart of a typeB message flow monitoring method based on standard deviation calculation provided in an embodiment of the present application;

[0020] Figure 3 It is a structural diagram of a first embodiment of a typeB message flow monitoring device based on standard deviation calculation provided in an embodiment of the present application;

[0021] Figure 4 It is a structural diagram of a second embodiment of a typeB message flow monitoring device based on standard deviation calculation provided in an embodiment of the present application;

[0022] Figure 5 It is a module calling diagram of a typeB message flow monitoring device based on standard deviation calculation provided in an embodiment of the present application;

[0023] Figure 6 It is a structural block diagram of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0024] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0025] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0026] First, some nouns or terms that appear in the description of the embodiments of the present application are subject to the following explanations:

[0027] Type B message is a communication protocol used in the Aeronautical Telecommunication Network (ATN), mainly used for non-real-time or low-priority aviation data transmission. In the ATN system, the types of messages are divided into Type A and Type B, where Type A messages are used to transmit communications with high real-time requirements and urgency, such as voice communications in emergency situations or real-time data related to flight safety; while Type B messages are suitable for transmitting non-real-time or non-urgent data, including but not limited to flight plans, weather information, aircraft status reports, etc.

[0028] Example 1

[0029] According to an embodiment of the present application, a method embodiment of typeB message traffic monitoring based on standard deviation calculation is also provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although the logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0030] The method embodiment provided in the first embodiment of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Figure 1 The hardware structure block diagram of a computer terminal (or mobile device) for implementing a type B message flow monitoring method based on standard deviation calculation is shown. Figure 1 As shown, the computer terminal 10 (or mobile device) may include one or more (102a, 102b, ..., 102n are used to illustrate) processors 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 104 for storing data, and a transmission device 106 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the BUS bus), a network interface, a power supply and / or a camera. It can be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations are shown.

[0031] It should be noted that the one or more processors 102 and / or other data processing circuits described above may generally be referred to herein as "data processing circuits". The data processing circuits may be embodied in whole or in part as software, hardware, firmware, or any other combination thereof. In addition, the data processing circuit may be a single independent processing module, or may be incorporated in whole or in part into any of the other components in the computer terminal 10 (or mobile device). As involved in the embodiments of the present application, the data processing circuit acts as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).

[0032] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the Z method in the embodiment of the present application. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, that is, implementing the above-mentioned Z method. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories may be connected to the computer terminal 10 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0033] The transmission device 106 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the computer terminal 10. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0034] The display may be, for example, a touch screen liquid crystal display (LCD) that enables a user to interact with a user interface of the computer terminal 10 (or mobile device).

[0035] Under the above operating environment, this application provides Figure 2 The typeB message traffic monitoring method based on standard deviation calculation is shown. Figure 2 It is a flowchart of a typeB message flow monitoring method based on standard deviation calculation according to an embodiment of the present application.

[0036] Step S101, obtaining log information of type B messages in a first period, and determining a range of type B message volume, wherein the log information at least includes: program name information, time point information, and transaction volume per second;

[0037] In step S101, the typeB message volume is determined based on the log information of the typeB message in the first period, that is, the typeB message volume specifically refers to the transaction volume in the first period. The above range interval is used to evaluate whether the typeB message volume in the second period is normal.

[0038] Step S102, obtaining log information of type B messages in the second period;

[0039] In step S10, the log information of the typeB message in the second period includes at least: program name information, time point information, and transaction processing volume per second.

[0040] Step S103, determining whether the amount of typeB messages in the second time period is within a range, wherein the amount of typeB messages in the second time period is determined based on log information of typeB messages in the second time period;

[0041] In step S103, the type B message volume in the second period is used to characterize the transaction volume in the second period, and the message volume in the second period is compared with the range determined in the first period to check whether it exceeds the normal range. If the message volume is found to be abnormal, that is, not within the range, the system will mark this situation to prepare for the generation of subsequent alarms.

[0042] Step S104: when it is determined that the type B message volume in the second time period exceeds the range, an alarm instruction is generated, and the alarm instruction is used to control the target device to issue an alarm.

[0043] In step S104, the target device may be a server, a monitoring terminal, an alarm, a mobile phone, etc.

[0044] Through the above steps, by collecting the log information of TypeB messages in the first time period, including the program name, time point and transaction processing volume per second (TPS), analyzing the statistical characteristics of these data, and determining the normal range of the message volume. Subsequently, the system obtains the log information of TypeB messages in real time in the second time period, and compares it with the range calculated in the first time period to determine whether the current message volume is within the normal fluctuation range. If the message volume in the second time period exceeds this range, the system will automatically trigger the alarm mechanism and generate an alarm instruction, thereby achieving the purpose of accurately monitoring the message flow, thereby realizing the technical effect of dynamic threshold monitoring, and then solving the technical problem that the fixed threshold in the traditional monitoring method cannot adapt to the flow change.

[0045] Optionally, in the typeB message traffic monitoring method based on standard deviation calculation provided in an embodiment of the present application, obtaining log information of typeB messages in a first time period and determining a range interval of the typeB message volume include:

[0046] Step S1011, based on the log information of the first period, analyzing and obtaining the transaction volume data of the first period, wherein the transaction volume data at least includes: the maximum transaction volume, the minimum transaction volume, and the average transaction volume;

[0047] In step S1011, the specific steps include: data preparation: extracting the transaction volume information of TypeB messages from the log information of the first time period, which usually includes the transaction volume per second. Statistical analysis: conducting in-depth analysis on the collected transaction volume data, and calculating the maximum transaction volume, the minimum transaction volume and the average transaction volume. The above-mentioned maximum transaction volume is the maximum data value of the transaction processing at a certain second within one minute, the above-mentioned minimum transaction volume is the minimum data value of the transaction processing at a certain second within one minute, and the above-mentioned average transaction volume is the average value of the transaction processing within one minute.

[0048] Step S1012, based on the transaction volume data of the first period, obtain standard parameters of the type B message volume, the standard parameters at least including: the standard deviation of the type B message volume and the average value of the type B message volume;

[0049] In step S1012, the calculation formula of the standard deviation (σ) is: σ=(maximum TPS-minimum TPS) / 6, and the calculation formula of the average value (μ) is: μ=(maximum TPS+4*average TPS+minimum TPS) / 6.

[0050] Step S1013: Determine the range of the typeB message volume based on the standard parameter of the typeB message volume.

[0051] In step S1013, according to the normal distribution principle, the range interval of type B message volume is obtained to distinguish normal traffic from abnormal traffic, where the range interval includes three different range intervals, namely: μ±σ, μ±2σ, μ±3σ, which can cover the data distribution under normal circumstances.

[0052] Through the above steps, the normal range of Type B message traffic is determined through in-depth analysis of historical data, thus providing an accurate basis for real-time monitoring. The advantage of this method is that it can dynamically adapt to the fluctuation of message volume, avoiding the false alarm or missed alarm problem that may be caused by fixed threshold monitoring, and significantly improving the accuracy and effectiveness of monitoring.

[0053] Optionally, in the typeB message traffic monitoring method based on standard deviation calculation provided in an embodiment of the present application, determining the range interval of the typeB message volume based on the standard parameter of the typeB message volume includes:

[0054] Step S10131, determining a first range interval according to standard parameters, wherein the first range interval is mean value ± standard deviation;

[0055] In step S10131, the first range interval can cover about 68.27% of the fluctuation of normal message traffic. Through this interval, the monitoring system can quickly identify those message traffics that deviate from normal fluctuations but are still within the slightly abnormal range. The design of this interval can help the system to detect potential traffic problems in time, while avoiding excessive sensitivity and excessive false alarms.

[0056] Step S10132, determining a second range interval according to the standard parameters, wherein the second range interval is the mean value ± twice the standard deviation;

[0057] In step S10132, the second range interval can cover about 95.45% of normal traffic fluctuations. When the Type B message traffic exceeds the first range interval but is still within the second range interval, the monitoring system will mark it as a warning state, which means that the traffic begins to fluctuate greatly but has not yet reached the level of serious abnormality. At this time, the system will trigger the warning mechanism to remind the operation and maintenance personnel to pay attention, but will not immediately issue an emergency alarm.

[0058] Step S10133: determine a third range interval according to the standard parameters, wherein the third range interval is the mean value ± three times the standard deviation.

[0059] In step S10133, the third range interval can cover about 99.73% of the traffic fluctuations under normal circumstances. Therefore, when the Type B message traffic exceeds this range, the system will regard it as an abnormal state, immediately trigger the alarm mechanism, and send an emergency alarm to the operation and maintenance personnel, prompting possible network problems or system failures.

[0060] Through the above steps, the monitoring system can more accurately identify traffic anomalies of different types and degrees, thereby achieving early warning and rapid response, and effectively maintaining the stability and security of the civil aviation communication network.

[0061] Optionally, in the typeB message traffic monitoring method based on standard deviation calculation provided in an embodiment of the present application, determining whether the typeB message volume in the second time period is within a range includes:

[0062] Step S1031: when it is determined that the amount of type B messages in the second time period is within the first range, a normal characterization signal is generated, where the normal characterization signal is used to characterize that the amount of type B messages in the second time period is in a normal state.

[0063] Through the above steps, by real-time monitoring of the Type B message volume and comparing it with the first range interval, a "normal signal" can be generated when the traffic is in normal fluctuation, providing instant and accurate data basis for the stable operation of the system, resource optimization and decision support.

[0064] Optionally, in the typeB message traffic monitoring method based on standard deviation calculation provided in an embodiment of the present application, determining whether the typeB message volume in the second time period is within a range includes:

[0065] Step S1032: when it is determined that the amount of type B messages in the second time period is within the second range, a warning signal is generated, where the warning signal is used to indicate that the amount of type B messages in the second time period is in a warning state.

[0066] Through the above steps, by real-time monitoring of the message volume and comparing it with the second range interval, a warning signal can be generated when the traffic fluctuates significantly, thereby providing a warning to the operation and maintenance personnel, prompting them to take preventive measures to avoid potential system failures.

[0067] Optionally, in the typeB message traffic monitoring method based on standard deviation calculation provided in an embodiment of the present application, determining whether the typeB message volume in the second time period is within a range includes:

[0068] Step S1033: when it is determined that the amount of type B messages in the second time period exceeds a third range, an alarm instruction is generated, where the alarm instruction is used to control the target device to issue an alarm.

[0069] Through the above steps, the third range interval is the alarm trigger point. When the type B message volume exceeds the third range interval, the system can respond immediately when the traffic anomaly reaches an emergency level, avoiding system failure or service interruption caused by delayed processing.

[0070] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0071] Example 2

[0072] The embodiment of the present application also provides a typeB message flow monitoring device based on standard deviation calculation. It should be noted that the typeB message flow monitoring device based on standard deviation calculation in the embodiment of the present application can be used to execute the typeB message flow monitoring method based on standard deviation calculation provided in the embodiment of the present application. The typeB message flow monitoring device based on standard deviation calculation provided in the embodiment of the present application is introduced below.

[0073] According to an embodiment of the present application, a device for implementing the above-mentioned typeB message flow monitoring method based on standard deviation calculation is also provided, such as Figure 3 As shown, the device includes: a first acquisition module 201, the first acquisition module 201 is used to obtain the log information of the typeB message in the first time period, and determine the range interval of the typeB message volume, wherein the log information at least includes: program name information, time point information, and transaction processing volume per second; a second acquisition module 202, the second acquisition module 202 is used to obtain the log information of the typeB message in the second time period; a judgment module 203, the judgment module 203 is used to judge whether the typeB message volume of the second time period is within the range interval, wherein the typeB message volume of the second time period is determined based on the log information of the typeB message in the second time period; a determination module 204, the determination module 204 is used to generate an alarm instruction when it is determined that the typeB message volume of the second time period exceeds the range interval, and the alarm instruction is used to control the target device to issue an alarm.

[0074] The typeB message flow monitoring device based on standard deviation calculation provided by the embodiment of the present application collects the log information of the TypeB message in the first time period, including the program name, time point and transaction processing volume per second (TPS), analyzes the statistical characteristics of these data, and determines the normal range interval of the message volume. Subsequently, the system obtains the log information of the TypeB message in real time in the second time period, compares it with the range calculated in the first time period, and determines whether the current message volume is within the normal fluctuation range. If the message volume in the second time period exceeds this range, the system will automatically trigger the alarm mechanism and generate an alarm instruction, thereby achieving the purpose of accurately monitoring the message flow, thereby realizing the technical effect of dynamic threshold monitoring, and then solving the technical problem that the fixed threshold in the traditional monitoring method cannot adapt to the flow change.

[0075] Optionally, in the typeB message flow monitoring device based on standard deviation calculation provided in the embodiment of the present application, the above-mentioned first acquisition module 201 includes an analysis module, an acquisition module, and a determination module. Among them, the analysis module is used to analyze and obtain the transaction volume data of the first time period based on the log information of the first time period, wherein the transaction volume data at least includes: the maximum transaction volume, the minimum transaction volume, and the average transaction volume; the acquisition module is used to obtain the standard parameters of the typeB message volume based on the transaction volume data of the first time period, and the standard parameters at least include: the standard deviation of the typeB message volume and the average value of the typeB message volume; the determination module is used to determine the range interval of the typeB message volume based on the standard parameters of the typeB message volume.

[0076] Optionally, in the typeB message traffic monitoring device based on standard deviation calculation provided in an embodiment of the present application, the above-mentioned determination module includes: a first determination submodule, a second determination submodule, and a third determination submodule. The first determination submodule is used to determine a first range interval according to standard parameters, wherein the first range interval is the mean value ± the standard deviation; the second determination submodule is used to determine a second range interval according to standard parameters, wherein the second range interval is the mean value ± two times the standard deviation; the third determination submodule is used to determine a third range interval according to standard parameters, wherein the third range interval is the mean value ± three times the standard deviation.

[0077] Optionally, in the typeB message traffic monitoring device based on standard deviation calculation provided in an embodiment of the present application, the above-mentioned judgment module 203 includes: a normal characterization module, which is used to generate a normal characterization signal when it is determined that the typeB message volume in the second time period is in a first range interval, and the normal characterization signal is used to characterize that the typeB message volume in the second time period is in a normal state.

[0078] Optionally, in the typeB message traffic monitoring device based on standard deviation calculation provided in an embodiment of the present application, the above-mentioned judgment module 203 includes: an early warning module, the early warning module is used to generate an early warning signal when it is determined that the typeB message volume in the second time period is in a second range interval, and the early warning signal is used to characterize that the typeB message volume in the second time period is in a warning state.

[0079] Optionally, in the typeB message traffic monitoring device based on standard deviation calculation provided in an embodiment of the present application, the above-mentioned judgment module 203 includes: an alarm module, the alarm module is used to generate an alarm instruction when it is determined that the typeB message volume in the second time period exceeds a third range interval, and the alarm instruction is used to control the target device to issue an alarm.

[0080] It should be noted that the first acquisition module 201, the second acquisition module 202, the judgment module 203, and the determination module 204 correspond to steps S101 to S104 in Example 1, and the four modules and the corresponding steps implement the same examples and application scenarios, but are not limited to the contents disclosed in the above-mentioned Example 1. It should be noted that the above-mentioned modules or units can be hardware components or software components stored in a memory (e.g., memory 104) and processed by one or more processors (e.g., processors 102a, 102b, ..., 102n), and the above-mentioned modules can also be part of the device and can be run in the computer terminal 10 provided in Example 1.

[0081] Example 3

[0082] The embodiment of the present application can also provide a type B message flow monitoring device based on standard deviation calculation. Figure 4 As shown, the device includes: a collection module, a storage module, an analysis and calculation module, and a monitoring module. Figure 5 The structure diagram of the typeB message flow monitoring method based on standard deviation calculation calling the typeB message flow monitoring device based on standard deviation calculation. Figure 5 shown.

[0083] During the collection process, the system will record TPS data per second to ensure the real-time and accuracy of the data. In order to facilitate subsequent data statistics and analysis, the collection module will automatically perform information collection tasks every minute, continuously monitor and update the data. All collected information will be properly stored in the database for easy query and calculation at any time.

[0084] In this way, the acquisition module can not only capture the dynamic information of system operation in real time, but also provide powerful data support, making query and calculation more convenient and efficient.

[0085] In the storage module design, two core tables in the database are built to facilitate efficient management and analysis of data. The first table is dedicated to storing real-time data, which records key information during program operation, including program name, recording time, and number of transactions per second (TPS). These real-time data are crucial for monitoring program performance and can help to instantly understand the operating status of the system.

[0086] On the other hand, the second table is responsible for storing calculated data, which is the result of in-depth analysis and processing of real-time data in the previous minute. Specifically, it contains the maximum TPS, minimum TPS, and average TPS observed in this minute. By recording these key indicators, we can not only grasp the instantaneous performance of the system, but also evaluate its stability.

[0087] Furthermore, based on these calculated data, statistical methods are used for in-depth analysis. First, by calculating the mean value (μ) and standard deviation (σ) of these data, the fluctuation of TPS within one minute can be quantified. Then, by combining the mean value and standard deviation, the variance of TPS within this minute is calculated. This indicator is of great significance for measuring the performance stability of the system. Finally, these calculation results are properly stored in the database table to facilitate subsequent data query and analysis, thereby providing solid data support for system optimization and improvement.

[0088] The analysis and calculation module accurately calculates the maximum TPS (transaction processing capacity), minimum TPS and average TPS per minute based on the data from the collection module. These three key indicators provide basic statistical information for message traffic.

[0089] On this basis, the analysis and calculation module further uses these basic data to calculate the standard deviation σ and the average value μ through mathematical statistical methods. The standard deviation σ can quantify the fluctuation degree of the TPS value, while the average value μ reflects the overall level of TPS.

[0090] The analysis and calculation module dynamically determines the abnormality of message traffic based on the normal distribution principle. By comparing real-time data with the normal distribution model, the analysis and calculation module can effectively identify abnormal fluctuations in message traffic, thereby achieving accurate alarm.

[0091] In statistical analysis, standard deviation and mean are often used to describe the dispersion and central tendency of data. In this study, the following formulas were used to calculate the standard deviation and mean:

[0092] The calculation formula of standard deviation (σ) is: σ = (maximum TPS-minimum TPS) / 6;

[0093] The calculation formula for the average value (μ) is: μ=(maximum TPS+4*average TPS+minimum TPS) / 6.

[0094] Furthermore, in order to have a deeper understanding of the fluctuation range of the data, it is necessary to calculate the following key values: μ-σ, μ+σ, μ-2σ, μ+2σ, μ-3σ and μ+3σ.

[0095] Example 1: For example, the TPS of a router collected in one minute are as follows, as shown in Table 1:

[0096] Table 1:

[0097]

[0098] The analysis shows that the maximum value is 99, the minimum value is 12, and the average value is 40. Based on the Beta distribution, the average value μ=(99+12+4*40) / 6=45, and the standard deviation is σ=(99-12) / 6=15. Then 2σ and 3σ are 30 and 45 respectively, and the calculated intervals are 31-60, 74-16, and 89-2 respectively.

[0099] Example 2: For example, the TPS of a router collected in one minute are as follows, including the limit values ​​99 and 0. As shown in Table 2:

[0100] Table 2:

[0101]

[0102] Analysis and calculation show that the maximum value is 99, the minimum value is 0, and the average value is 40. Based on the Beta distribution, the average value μ=(99+0+4*40) / 6=43, and the standard deviation is σ=(99-0) / 6=17. Then 2σ and 3σ are 34 and 51 respectively, and the calculated intervals are 27-60, 10-76, and 93-0 respectively.

[0103] The main function of the monitoring and alarm module is to monitor the real-time collected data and alarm for abnormalities. In statistics, the normality of data is usually judged by the standard deviation σ and the mean value μ. Specifically, data values ​​between two times the standard deviation and the mean value, that is, between μ-2σ and μ+2σ, are defined as slightly abnormal. Although this type of data has a slight deviation, it is still within the acceptable range and will not have a significant impact on the overall analysis.

[0104] During the data collection process, the program will automatically compare and analyze the newly collected data with the pre-calculated results. Specifically, if the calculated standard deviation is σ and the mean is μ, then the normality of the data can be judged in the following way: data between μ-σ and μ+σ is considered normal data, indicating that the system is running stably and there are no abnormalities.

[0105] Furthermore, data that is between σ and μ but slightly deviates from the normal range is defined as slightly abnormal. Although this type of data is slightly higher or lower than the average, it is still within the acceptable range, indicating that the system may have certain fluctuations, but generally will not affect normal operation.

[0106] However, when the data is distributed between three times the standard deviation and the mean, that is, between μ-3σ and μ+3σ, it will be considered a warning state. This means that the data has a certain abnormal risk and needs attention. At this time, the fluctuation of the data may indicate that there is some instability in the system or process, which requires further investigation and adjustment.

[0107] Furthermore, if the data value exceeds three times the standard deviation, that is, the data is abnormal, an alarm is required immediately. Data greater than μ+3σ indicates that the data volume is too large and may exceed the maximum processing capacity of the system. In this case, the data volume and the queue threshold need to be comprehensively judged. If both meet the alarm conditions at the same time, the processing of the message may be delayed. In order to deal with this situation, an expansion program is necessary, which can help quickly locate the problem and take appropriate measures.

[0108] In short, by carefully analyzing the distribution of data in the three intervals of μ-σ and μ+σ, μ-2σ and μ+2σ, μ-3σ and μ+3σ, we can more accurately grasp the degree of data abnormality, so as to adjust and optimize the system in time to ensure efficient and stable data processing.

[0109] In addition to judging the interval, the continuity of the alarm must also be judged. If it only occurs once within a certain period of time, generally within one minute, then no alarm will be issued. If the above situation occurs five times in a row within one minute, then a warning or alarm message will be sent.

[0110] Example 1: According to the monitoring data, if the data is between 31-60, it will be judged as normal. If the data is between 74-89 and 2-16 for five consecutive times, it will be a warning. If the data is between 89-99 and 0-2 for five consecutive times, it will be abnormal and an alarm message will be issued.

[0111] Example 2: According to the monitoring data, if the data is between 27-60, it will be judged as normal. If the data is between 10-27 or 60-76 for five consecutive times, it will be a warning. If the data is between 93-99 for five consecutive times, it will be abnormal and an alarm message will be issued.

[0112] Example 4

[0113] An embodiment of the present application may provide an electronic device, Figure 6 is a structural block diagram of an electronic device according to an embodiment of the present application. Figure 6 As shown, the electronic device may include: one or more ( Figure 6 (only one is shown) processor 1002, memory 1004, storage controller, and peripheral interface, wherein the peripheral interface is connected to the radio frequency module, audio module and display.

[0114] Among them, the memory can be used to store software programs and modules, such as program instructions / modules corresponding to the methods and devices in the embodiments of the present application, and the processor executes various functional applications and data processing by running the software programs and modules stored in the memory, that is, realizing the above-mentioned method. The memory may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include a memory remotely arranged relative to the processor, and these remote memories may be connected to the terminal via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0115] The processor may call the information and application program stored in the memory through the transmission device to perform the following steps:

[0116] Step S101, obtaining log information of type B messages in a first period, and determining a range of type B message volume, wherein the log information at least includes: program name information, time point information, and transaction volume per second;

[0117] Step S102, obtaining log information of type B messages in the second period;

[0118] Step S103, determining whether the amount of typeB messages in the second time period is within a range, wherein the amount of typeB messages in the second time period is determined based on log information of typeB messages in the second time period;

[0119] Step S104: when it is determined that the type B message volume in the second time period exceeds the range, an alarm instruction is generated, and the alarm instruction is used to control the target device to issue an alarm.

[0120] The processor may also call the information and application program stored in the memory through the transmission device to perform the following steps:

[0121] Step S1011, based on the log information of the first period, analyzing and obtaining the transaction volume data of the first period, wherein the transaction volume data at least includes: the maximum transaction volume, the minimum transaction volume, and the average transaction volume;

[0122] Step S1012, based on the transaction volume data of the first period, obtain standard parameters of the type B message volume, the standard parameters at least including: the standard deviation of the type B message volume and the average value of the type B message volume;

[0123] Step S1013: Determine the range of the typeB message volume based on the standard parameter of the typeB message volume.

[0124] The processor may also call the information and application program stored in the memory through the transmission device to perform the following steps:

[0125] Step S10131, determining a first range interval according to standard parameters, wherein the first range interval is mean value ± standard deviation;

[0126] Step S10132, determining a second range interval according to the standard parameters, wherein the second range interval is the mean value ± twice the standard deviation;

[0127] Step S10133: determine a third range interval according to the standard parameters, wherein the third range interval is the mean value ± three times the standard deviation.

[0128] The processor may also call the information and application program stored in the memory through the transmission device to perform the following steps:

[0129] Step S1031: when it is determined that the amount of type B messages in the second time period is within the first range, a normal characterization signal is generated, where the normal characterization signal is used to characterize that the amount of type B messages in the second time period is in a normal state.

[0130] The processor may also call the information and application program stored in the memory through the transmission device to perform the following steps:

[0131] Step S1032: when it is determined that the amount of type B messages in the second time period is within the second range, a warning signal is generated, where the warning signal is used to indicate that the amount of type B messages in the second time period is in a warning state.

[0132] The processor may also call the information and application program stored in the memory through the transmission device to perform the following steps:

[0133] Step S1033: when it is determined that the amount of type B messages in the second time period exceeds a third range, an alarm instruction is generated, where the alarm instruction is used to control the target device to issue an alarm.

[0134] By adopting the embodiment of the present application, a type B message flow monitoring method based on standard deviation calculation is provided. By collecting the log information of the Type B message in the first time period, including the program name, time point and transaction processing volume per second (TPS), the statistical characteristics of these data are analyzed to determine the normal range interval of the message volume. Subsequently, the system obtains the log information of the Type B message in real time in the second time period, compares it with the range calculated in the first time period, and determines whether the current message volume is within the normal fluctuation range. If the message volume in the second time period exceeds this range interval, the system will automatically trigger the alarm mechanism and generate an alarm instruction. The purpose of accurately monitoring the message flow is achieved, thereby realizing the technical effect of dynamic threshold monitoring, and then solving the technical problem that the fixed threshold in the traditional monitoring method cannot adapt to the flow change.

[0135] It can be understood by those skilled in the art that Figure 6 The structure shown is for illustration only, and the electronic device may also be a smart phone (such as an Android phone, an iOS phone, etc.), a tablet computer, a PDA, a mobile Internet device (Mobile Internet Devices, MID), a PAD, or other terminal devices. Figure 6 The structure of the electronic device is not limited. Figure 6 More or fewer components (such as network interfaces, display devices, etc.) shown in, or having Figure 6 Different configurations are shown.

[0136] A person of ordinary skill in the art can understand that all or part of the steps in the various methods of the above embodiments can be completed by instructing the hardware related to the terminal device through a program, and the program can be stored in a computer-readable storage medium, and the storage medium may include: a flash drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0137] Example 5

[0138] The embodiment of the present application further provides a storage medium. Optionally, in this embodiment, the storage medium can be used to store the program code executed by the type B message flow monitoring method based on standard deviation calculation provided in the first embodiment.

[0139] Optionally, in this embodiment, the storage medium may be configured to store a computer program for performing the following steps:

[0140] Step S101, obtaining log information of type B messages in a first period, and determining a range of type B message volume, wherein the log information at least includes: program name information, time point information, and transaction volume per second;

[0141] Step S102, obtaining log information of type B messages in the second period;

[0142] Step S103, determining whether the amount of typeB messages in the second time period is within a range, wherein the amount of typeB messages in the second time period is determined based on log information of typeB messages in the second time period;

[0143] Step S104: when it is determined that the type B message volume in the second time period exceeds the range, an alarm instruction is generated, and the alarm instruction is used to control the target device to issue an alarm.

[0144] Optionally, in this embodiment, the above storage medium may be located in any computer terminal in a computer terminal group in a computer network, or in any mobile terminal in a mobile terminal group.

[0145] Optionally, in this embodiment, the above-mentioned storage medium may include but is not limited to: a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk, and other media that can store computer programs.

[0146] Example 6

[0147] The present application also provides a computer program product, which, when executed on a data processing device, is suitable for executing the program steps of the type B message traffic monitoring method based on standard deviation calculation.

[0148] Optionally, in this embodiment, the computer program product may be configured as a computer program for executing the following steps:

[0149] Step S101, obtaining log information of type B messages in a first period, and determining a range of type B message volume, wherein the log information at least includes: program name information, time point information, and transaction volume per second;

[0150] Step S102, obtaining log information of type B messages in the second period;

[0151] Step S103, determining whether the amount of typeB messages in the second time period is within a range, wherein the amount of typeB messages in the second time period is determined based on log information of typeB messages in the second time period;

[0152] Step S104: when it is determined that the type B message volume in the second time period exceeds the range, an alarm instruction is generated, and the alarm instruction is used to control the target device to issue an alarm.

[0153] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0154] In the above embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0155] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0156] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0157] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0158] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, server or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or CD-ROM and other media that can store program codes.

[0159] The above is only a preferred implementation of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A typeB message flow monitoring method based on standard deviation calculation, characterized in that: include: Obtain log information of typeB messages in the first period, and determine a range of typeB message volume, wherein the log information at least includes: program name information, time point information, and transaction volume per second; Get the log information of typeB messages in the second period; Determine whether the amount of typeB messages in the second time period is within the range, wherein the amount of typeB messages in the second time period is determined based on log information of typeB messages in the second time period; When it is determined that the amount of type B messages in the second time period exceeds the range, an alarm instruction is generated, where the alarm instruction is used to control the target device to issue an alarm.

2. The typeB message flow monitoring method based on standard deviation calculation according to claim 1 is characterized in that: Obtain the log information of typeB messages in the first period and determine the range of typeB message volume, including: Based on the log information of the first period, analyzing and obtaining transaction volume data of the first period, wherein the transaction volume data at least includes: a maximum transaction volume, a minimum transaction volume, and an average transaction volume; Based on the transaction volume data of the first time period, obtain the standard parameters of the typeB message volume, the standard parameters at least including: the standard deviation of the typeB message volume and the average value of the typeB message volume; Based on the standard parameter of the typeB message volume, a range interval of the typeB message volume is determined.

3. The typeB message flow monitoring method based on standard deviation calculation according to claim 2 is characterized in that: Determining a range of the typeB message volume based on the standard parameter of the typeB message volume includes: Determine a first range interval according to the standard parameter, wherein the first range interval is a mean value ± a standard deviation; Determine a second range interval according to the standard parameter, wherein the second range interval is the mean value ± twice the standard deviation; A third range interval is determined according to the standard parameter, wherein the third range interval is the mean value±three times the standard deviation.

4. The typeB message flow monitoring method based on standard deviation calculation according to claim 3 is characterized in that: Determining whether the amount of type B messages in the second time period is within the range includes: When it is determined that the amount of typeB messages in the second time period is within the first range, a normal characterization signal is generated, where the normal characterization signal is used to indicate that the amount of typeB messages in the second time period is in a normal state.

5. The typeB message flow monitoring method based on standard deviation calculation according to claim 3 is characterized in that: Determining whether the amount of type B messages in the second time period is within the range includes: When it is determined that the amount of typeB messages in the second time period is within the second range, a warning signal is generated, where the warning signal is used to indicate that the amount of typeB messages in the second time period is in a warning state.

6. The typeB message flow monitoring method based on standard deviation calculation according to claim 3 is characterized in that: Determining whether the amount of type B messages in the second time period is within the range includes: When it is determined that the amount of type B messages in the second time period exceeds the third range, the alarm instruction is generated, and the alarm instruction is used to control the target device to issue an alarm.

7. A typeB message flow monitoring device based on standard deviation calculation, characterized in that: include: A first acquisition module, the first acquisition module is used to obtain log information of typeB messages in a first period of time, and determine a range of the typeB message volume, wherein the log information at least includes: program name information, time point information, and transaction volume per second; A second acquisition module, the second acquisition module is used to obtain log information of typeB messages in a second time period; A judgment module, the judgment module is used to judge whether the typeB message volume of the second time period is within the range, wherein the typeB message volume of the second time period is determined based on the log information of the typeB message of the second time period; A determination module, wherein the determination module is used to generate an alarm instruction when determining that the amount of type B messages in the second time period exceeds the range interval, and the alarm instruction is used to control the target device to issue an alarm.

8. An electronic device, characterized in that: include: A memory storing an executable program; A processor, configured to run the program, wherein the program executes the method according to any one of claims 1 to 6 when running.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes a stored executable program, wherein when the executable program is executed, the device where the storage medium is located is controlled to execute the method according to any one of claims 1 to 6.

10. A computer program product, characterized in that The invention comprises a computer program which, when executed by a processor, implements the method according to any one of claims 1 to 6.

Images