Method and device for monitoring type b message flow based on standard deviation calculation

Abstract

The application discloses a typeB message flow monitoring method and device based on standard deviation calculation. The method comprises the following steps: obtaining log information of typeB messages in a first period, and determining a range interval of typeB message quantity, wherein the log information at least comprises program name information, time point information and transaction processing quantity per second; obtaining log information of typeB messages in a second period; determining whether the typeB message quantity in the second period is within the range interval, wherein the typeB message quantity in the second period is determined based on the log information of typeB messages in the second period; and generating an alarm instruction for controlling a target device to issue an alarm in the case that the typeB message quantity in the second period exceeds the range interval. The application solves the technical problem that the fixed threshold in the conventional monitoring method cannot adapt to flow changes.

Description

Technical Field

[0001] The present invention relates to the field of big data technology, and in particular to a method and device for monitoring type B message traffic based on standard deviation calculation. Background Art

[0002] Type B messages are non-real-time messages. Although they lack real-time capabilities, they must maintain a certain time sequence to ensure accurate information transmission. Monitoring Type B messages is particularly important. First, we must ensure that the message volume is appropriate. If the message volume is too high, it may cause a backlog, leading to message delays and negatively impacting communication efficiency. However, if the message volume is too low, it can also cause problems. This may indicate some form of obstruction or problem in the upstream link, hindering the normal transmission of messages.

[0003] Therefore, monitoring Type B packets requires simultaneous attention to two aspects of packet volume: ensuring that it is neither too high nor too low. This dual monitoring of packet volume is a unique feature of monitoring systems and requires special attention when managing packets. Existing monitoring programs often simply compare a specific value to determine whether it is greater than or less than a set threshold. However, this single comparison method is not suitable for all monitoring scenarios, especially when it comes to packet volume statistics.

[0004] To address the above-mentioned problems, no effective solutions have been proposed so far. Summary of the Invention

[0005] The embodiments of the present invention provide a method and apparatus for monitoring type B message traffic based on standard deviation calculation, so as to at least solve the technical problem that the fixed threshold in the traditional monitoring method cannot adapt to traffic changes.

[0006] According to one aspect of an embodiment of the present invention, a method for monitoring typeB message traffic based on standard deviation calculation is provided, including: obtaining log information of typeB messages in a first time period, determining a range of the typeB message volume, wherein the log information includes at least: program name information, time point information, and transaction processing volume per second; obtaining log information of typeB messages in a second time period; judging whether the typeB message volume in the second time period is within a range, wherein the typeB message volume in the second time period is determined based on the log information of the typeB messages in the second time period; and generating an alarm instruction when it is determined that the typeB message volume in the second time period exceeds the range, the alarm instruction being used to control the target device to issue an alarm.

[0007] Optionally, log information of typeB messages in the first time period is obtained to determine the range of typeB message volume, including: based on the log information of the first time period, analyzing and obtaining transaction processing volume data of the first time period, wherein the transaction processing volume data at least includes: maximum transaction processing volume, minimum transaction processing volume, and average transaction processing volume; based on the transaction processing volume data of the first time period, obtaining standard parameters of typeB message volume, the standard parameters at least include: standard deviation of typeB message volume, and average value of typeB message volume; based on the standard parameters of typeB message volume, determining the range of typeB message volume.

[0008] Optionally, based on the standard parameters of the typeB message volume, the range interval of the typeB message volume is determined, including: determining a first range interval according to the standard parameters, wherein the first range interval is the mean value ± standard deviation; determining a second range interval according to the standard parameters, wherein the second range interval is the mean value ± two times the standard deviation; determining a third range interval according to the standard parameters, wherein the third range interval is the mean value ± three times the standard deviation.

[0009] Optionally, determining whether the typeB message volume in the second time period is within a range interval includes: when determining that the typeB message volume in the second time period is within a first range interval, generating a normal characterization signal, the normal characterization signal being used to characterize that the typeB message volume in the second time period is in a normal state.

[0010] Optionally, determining whether the typeB message volume in the second time period is within a range interval includes: when determining that the typeB message volume in the second time period is within a second range interval, generating an early warning signal, the early warning signal being used to indicate that the typeB message volume in the second time period is in an early warning state.

[0011] Optionally, determining whether the typeB message volume in the second time period is within a range includes: generating an alarm instruction when determining that the typeB message volume in the second time period exceeds a third range, the alarm instruction being used to control the target device to issue an alarm.

[0012] According to another aspect of an embodiment of the present invention, a typeB message traffic monitoring device based on standard deviation calculation is also provided, including: a first acquisition module, the first acquisition module is used to obtain log information of typeB messages in a first time period, and determine the range interval of the typeB message volume, wherein the log information at least includes: program name information, time point information, and transaction processing volume per second; a second acquisition module, the second acquisition module is used to obtain log information of typeB messages in a second time period; a judgment module, the judgment module is used to judge whether the typeB message volume in the second time period is within the range interval, wherein the typeB message volume in the second time period is determined based on the log information of the typeB message in the second time period; a determination module, the determination module is used to generate an alarm instruction when it is determined that the typeB message volume in the second time period exceeds the range interval, and the alarm instruction is used to control the target device to issue an alarm.

[0013] According to another aspect of an embodiment of the present invention, an electronic device is provided, including: a memory storing an executable program; and a processor for running the program, wherein the program executes the methods of various embodiments of the present invention when running.

[0014] According to another aspect of an embodiment of the present invention, a computer-readable storage medium is provided. The computer-readable storage medium includes a stored executable program, wherein when the executable program runs, the device where the storage medium is located is controlled to execute the methods in various embodiments of the present invention.

[0015] According to another aspect of an embodiment of the present invention, a computer program product is provided, including a computer program. When the computer program is executed by a processor, the method in each embodiment of the present invention is implemented.

[0016] In an embodiment of the present invention, by collecting the log information of TypeB messages in the first time period, including the program name, time point, and transaction processing volume per second (TPS), and analyzing the statistical characteristics of these data, the normal range of message volume is determined. Subsequently, the system obtains the log information of TypeB messages in real time in the second time period, compares it with the range calculated in the first time period, and determines whether the current message volume is within the normal fluctuation range. If the message volume in the second time period exceeds this range, the system will automatically trigger the alarm mechanism and generate an alarm instruction. The purpose of accurately monitoring message traffic is achieved, thereby realizing the technical effect of dynamic threshold monitoring, and thus solving the technical problem that the fixed threshold in the traditional monitoring method cannot adapt to traffic changes. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of this application. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0018] Figure 1 A hardware structure block diagram of a computer terminal for implementing a type B message flow monitoring method based on standard deviation calculation is shown;

[0019] Figure 2 This is a flow chart of a type B message traffic monitoring method based on standard deviation calculation provided in an embodiment of the present application;

[0020] Figure 3 1 is a structural diagram of a first embodiment of a type B message flow monitoring device based on standard deviation calculation according to an embodiment of the present application;

[0021] Figure 4 2 is a schematic structural diagram of a second embodiment of a type B message flow monitoring device based on standard deviation calculation according to an embodiment of the present application;

[0022] Figure 5 This is a module call diagram of a type B message flow monitoring device based on standard deviation calculation according to an embodiment of the present application;

[0023] Figure 6 This is a structural block diagram of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0024] In order to enable those skilled in the art to better understand the present invention, the following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of this application.

[0025] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in a sequence other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0026] First, some nouns or terms that appear in the description of the embodiments of the present application are subject to the following interpretations:

[0027] Type B messages are a communication protocol used in the Aeronautical Telecommunication Network (ATN), primarily for transmitting non-real-time or low-priority aviation data. In the ATN system, messages are categorized into Type A and Type B. Type A messages are used for transmitting real-time, urgent communications, such as emergency voice communications or real-time data related to flight safety. Type B messages are suitable for transmitting non-real-time or non-urgent data, including but not limited to flight plans, weather information, and aircraft status reports.

[0028] Example 1

[0029] According to an embodiment of the present application, a method embodiment for monitoring type B message traffic based on standard deviation calculation is also provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0030] The method embodiment provided in the first embodiment of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Figure 1 FIG1 shows a hardware structure block diagram of a computer terminal (or mobile device) for implementing a type B message flow monitoring method based on standard deviation calculation. Figure 1 As shown, the computer terminal 10 (or mobile device) may include one or more (illustrated as 102a, 102b, ..., 102n in the figure) processors 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 104 for storing data, and a transmission device 106 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the BUS bus), a network interface, a power supply and / or a camera. It will be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 1 More or fewer components than shown, or with Figure 1 Different configurations shown.

[0031] It should be noted that the one or more processors 102 and / or other data processing circuits described above may generally be referred to herein as "data processing circuitry". The data processing circuitry may be embodied in whole or in part as software, hardware, firmware, or any other combination thereof. In addition, the data processing circuitry may be a single independent processing module, or may be incorporated in whole or in part into any of the other components of the computer terminal 10 (or mobile device). As described in the embodiments of the present application, the data processing circuitry serves as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).

[0032] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the Z method in the embodiment of the present application. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, that is, implementing the above-mentioned Z method. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include a memory remotely located relative to the processor 102, and these remote memories may be connected to the computer terminal 10 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0033] The transmission device 106 is used to receive or send data via a network. A specific example of the network may include a wireless network provided by the communications provider of the computer terminal 10. In one embodiment, the transmission device 106 includes a network interface controller (NIC), which can be connected to other network devices via a base station to enable communication with the Internet. In another embodiment, the transmission device 106 may be a radio frequency (RF) module for wireless communication with the Internet.

[0034] The display may be, for example, a touch screen liquid crystal display (LCD) that enables a user to interact with a user interface of the computer terminal 10 (or mobile device).

[0035] Under the above operating environment, this application provides Figure 2 The type B packet traffic monitoring method based on standard deviation calculation is shown. Figure 2 This is a flowchart of a type B message traffic monitoring method based on standard deviation calculation according to an embodiment of the present application.

[0036] Step S101: Obtain log information of type B messages in a first time period and determine a range of type B message volume, wherein the log information includes at least: program name information, time point information, and transaction volume per second;

[0037] In step S101, the typeB message volume is determined based on the log information of the typeB messages in the first period, that is, the typeB message volume specifically refers to the transaction volume in the first period. The above range is used to evaluate whether the typeB message volume in the second period is normal.

[0038] Step S102: Obtain log information of type B messages in the second time period;

[0039] In step S10, the log information of the type B message in the second period includes at least: program name information, time point information, and transaction processing volume per second.

[0040] Step S103: determining whether the amount of type B messages in the second time period is within a range, wherein the amount of type B messages in the second time period is determined based on log information of type B messages in the second time period;

[0041] In step S103, the volume of type B messages in the second period is used to represent the transaction volume during that period. The volume is compared with the range determined for the first period to determine whether it exceeds the normal range. If the volume is abnormal (i.e., outside the range), the system will flag this and prepare for the generation of a subsequent alert.

[0042] Step S104: When it is determined that the amount of type B messages in the second time period exceeds the range, an alarm instruction is generated, where the alarm instruction is used to control the target device to issue an alarm.

[0043] In step S104, the target device may be a server, a monitoring terminal, an alarm, a mobile phone, etc.

[0044] Through the above steps, by collecting the log information of TypeB messages in the first time period, including the program name, time point, and transactions per second (TPS), and analyzing the statistical characteristics of this data, the normal range of message volume is determined. Subsequently, the system obtains the log information of TypeB messages in real time in the second time period, compares it with the range calculated in the first time period, and determines whether the current message volume is within the normal fluctuation range. If the message volume in the second time period exceeds this range, the system will automatically trigger the alarm mechanism and generate an alarm instruction. This achieves the purpose of accurately monitoring message traffic, thereby realizing the technical effect of dynamic threshold monitoring, and further solves the technical problem that the fixed threshold in traditional monitoring methods cannot adapt to traffic changes.

[0045] Optionally, in the type B message traffic monitoring method based on standard deviation calculation provided in an embodiment of the present application, obtaining log information of type B messages in a first time period and determining a range of type B message volume include:

[0046] Step S1011: Analyze and obtain transaction volume data for the first period based on the log information for the first period, wherein the transaction volume data includes at least: a maximum transaction volume, a minimum transaction volume, and an average transaction volume;

[0047] In step S1011, the specific steps include: data preparation: extracting the transaction volume information of Type B messages from the log information of the first time period, which generally includes the transaction volume per second. Statistical analysis: conducting an in-depth analysis of the collected transaction volume data to calculate the maximum transaction volume, minimum transaction volume, and average transaction volume. The maximum transaction volume is the maximum transaction volume at a certain second within a minute, the minimum transaction volume is the minimum transaction volume at a certain second within a minute, and the average transaction volume is the average value of transactions within a minute.

[0048] Step S1012: Based on the transaction volume data of the first period, obtain standard parameters of the type B message volume, the standard parameters including at least: a standard deviation of the type B message volume and an average value of the type B message volume;

[0049] In step S1012 , the standard deviation (σ) is calculated as follows: σ=(maximum TPS−minimum TPS) / 6, and the average value (μ) is calculated as follows: μ=(maximum TPS+4*average TPS+minimum TPS) / 6.

[0050] Step S1013: Determine the range of the type B message volume based on the standard parameter of the type B message volume.

[0051] In step S1013, based on the normal distribution principle, the range interval of type B message volume is obtained to distinguish normal traffic from abnormal traffic, where the range interval includes three different range intervals: μ±σ, μ±2σ, and μ±3σ. These intervals can cover the data distribution under normal circumstances.

[0052] Through the above steps, in-depth analysis of historical data has determined the normal range of Type B packet traffic, providing an accurate basis for real-time monitoring. The advantage of this method is that it can dynamically adapt to fluctuations in packet volume, avoiding the false positives and false negatives that may occur with fixed threshold monitoring, significantly improving the accuracy and effectiveness of monitoring.

[0053] Optionally, in the type B message traffic monitoring method based on standard deviation calculation provided in an embodiment of the present application, determining the range of the type B message volume based on the standard parameter of the type B message volume includes:

[0054] Step S10131: determining a first range interval according to the standard parameters, wherein the first range interval is the mean ± standard deviation;

[0055] In step S10131, the first range covers approximately 68.27% of normal traffic fluctuations. This range allows the monitoring system to quickly identify traffic that deviates from normal fluctuations but remains within the slightly abnormal range. This range design helps the system promptly detect potential traffic issues while avoiding excessive false alarms due to oversensitivity.

[0056] Step S10132: determining a second range interval according to the standard parameters, wherein the second range interval is the mean ± twice the standard deviation;

[0057] In step S10132, the second range covers approximately 95.45% of normal traffic fluctuations. When Type B packet traffic exceeds the first range but remains within the second range, the monitoring system will mark it as a warning state, indicating that traffic fluctuations are beginning to increase significantly but have not yet reached the level of a serious anomaly. At this point, the system will trigger a warning mechanism to alert operations and maintenance personnel, but will not immediately issue an emergency alert.

[0058] Step S10133: Determine a third range interval according to the standard parameters, wherein the third range interval is the mean value ± three times the standard deviation.

[0059] In step S10133, the third range interval can cover approximately 99.73% of traffic fluctuations under normal circumstances. Therefore, when the Type B message traffic exceeds this range, the system will regard it as an abnormal state, immediately trigger the alarm mechanism, and send an emergency alarm to the operation and maintenance personnel, prompting possible network problems or system failures.

[0060] Through the above steps, the monitoring system can more accurately identify traffic anomalies of different types and degrees, thereby achieving early warning and rapid response, and effectively maintaining the stability and security of the civil aviation communication network.

[0061] Optionally, in the type B message traffic monitoring method based on standard deviation calculation provided in an embodiment of the present application, determining whether the type B message volume in the second time period is within a range includes:

[0062] Step S1031: When it is determined that the amount of type B packets in the second time period is within the first range, a normality signal is generated, where the normality signal is used to indicate that the amount of type B packets in the second time period is normal.

[0063] Through the above steps, by real-time monitoring of the Type B message volume and comparing it with the first range interval, a "normal signal" can be generated when the traffic is in normal fluctuation, providing instant and accurate data basis for the stable operation of the system, resource optimization and decision support.

[0064] Optionally, in the type B message traffic monitoring method based on standard deviation calculation provided in an embodiment of the present application, determining whether the type B message volume in the second time period is within a range includes:

[0065] Step S1032: When it is determined that the amount of type B messages in the second time period is within the second range, an early warning signal is generated, where the early warning signal is used to indicate that the amount of type B messages in the second time period is in an early warning state.

[0066] Through the above steps, by real-time monitoring of the message volume and comparing it with the second range interval, an early warning signal can be generated when the traffic fluctuation is significant, thereby providing an early warning to the operation and maintenance personnel, prompting them to take preventive measures to avoid potential system failures.

[0067] Optionally, in the type B message traffic monitoring method based on standard deviation calculation provided in an embodiment of the present application, determining whether the type B message volume in the second time period is within a range includes:

[0068] Step S1033: When it is determined that the amount of type B messages in the second time period exceeds a third range, an alarm instruction is generated, where the alarm instruction is used to control the target device to issue an alarm.

[0069] Through the above steps, the third range interval is the alarm trigger point. When the type B message volume exceeds the third range interval, the system can respond immediately when the traffic anomaly reaches an emergency level, avoiding system failure or service interruption caused by delayed processing.

[0070] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0071] Example 2

[0072] The present application also provides a device for monitoring Type B message traffic based on standard deviation calculation. It should be noted that the device for monitoring Type B message traffic based on standard deviation calculation in the present application can be used to implement the method for monitoring Type B message traffic based on standard deviation calculation provided in the present application. The following describes the device for monitoring Type B message traffic based on standard deviation calculation provided in the present application.

[0073] According to an embodiment of the present application, a device for implementing the above-mentioned typeB message flow monitoring method based on standard deviation calculation is also provided, such as Figure 3 As shown, the device includes: a first acquisition module 201, the first acquisition module 201 is used to obtain the log information of the typeB message in the first time period, and determine the range interval of the typeB message volume, wherein the log information at least includes: program name information, time point information, and transaction processing volume per second; a second acquisition module 202, the second acquisition module 202 is used to obtain the log information of the typeB message in the second time period; a judgment module 203, the judgment module 203 is used to judge whether the typeB message volume of the second time period is within the range interval, wherein the typeB message volume of the second time period is determined based on the log information of the typeB message in the second time period; a determination module 204, the determination module 204 is used to generate an alarm instruction when it is determined that the typeB message volume of the second time period exceeds the range interval, and the alarm instruction is used to control the target device to issue an alarm.

[0074] The type B message flow monitoring device based on standard deviation calculation provided by the embodiment of the present application collects the log information of the Type B message in the first time period, including the program name, time point and transaction processing volume per second (TPS), analyzes the statistical characteristics of these data, and determines the normal range interval of the message volume. Subsequently, the system obtains the log information of the Type B message in real time in the second time period, compares it with the range calculated in the first time period, and determines whether the current message volume is within the normal fluctuation range. If the message volume in the second time period exceeds this range, the system will automatically trigger the alarm mechanism and generate an alarm instruction, thereby achieving the purpose of accurately monitoring the message flow, thereby realizing the technical effect of dynamic threshold monitoring, and thus solving the technical problem that the fixed threshold in the traditional monitoring method cannot adapt to traffic changes.

[0075] Optionally, in the typeB message traffic monitoring device based on standard deviation calculation provided in an embodiment of the present application, the above-mentioned first acquisition module 201 includes an analysis module, an acquisition module, and a determination module. The analysis module is used to analyze and obtain transaction processing volume data of the first time period based on the log information of the first time period, wherein the transaction processing volume data at least includes: maximum transaction processing volume, minimum transaction processing volume, and average transaction processing volume; the acquisition module is used to obtain standard parameters of typeB message volume based on the transaction processing volume data of the first time period, and the standard parameters at least include: standard deviation of typeB message volume and average value of typeB message volume; the determination module is used to determine the range interval of typeB message volume based on the standard parameters of typeB message volume.

[0076] Optionally, in the typeB message traffic monitoring device based on standard deviation calculation provided in an embodiment of the present application, the above-mentioned determination module includes: a first determination submodule, a second determination submodule, and a third determination submodule. The first determination submodule is used to determine a first range interval based on standard parameters, wherein the first range interval is the mean value ± standard deviation; the second determination submodule is used to determine a second range interval based on standard parameters, wherein the second range interval is the mean value ± two times the standard deviation; the third determination submodule is used to determine a third range interval based on standard parameters, wherein the third range interval is the mean value ± three times the standard deviation.

[0077] Optionally, in the typeB message traffic monitoring device based on standard deviation calculation provided in an embodiment of the present application, the above-mentioned judgment module 203 includes: a normal characterization module, which is used to generate a normal characterization signal when it is determined that the typeB message volume in the second time period is in the first range interval. The normal characterization signal is used to characterize that the typeB message volume in the second time period is in a normal state.

[0078] Optionally, in the typeB message traffic monitoring device based on standard deviation calculation provided in an embodiment of the present application, the above-mentioned judgment module 203 includes: an early warning module, which is used to generate an early warning signal when it is determined that the typeB message volume in the second time period is in the second range interval. The early warning signal is used to characterize that the typeB message volume in the second time period is in a warning state.

[0079] Optionally, in the typeB message traffic monitoring device based on standard deviation calculation provided in an embodiment of the present application, the above-mentioned judgment module 203 includes: an alarm module, the alarm module is used to generate an alarm instruction when it is determined that the typeB message volume in the second time period exceeds the third range interval, and the alarm instruction is used to control the target device to issue an alarm.

[0080] It should be noted that the first acquisition module 201, the second acquisition module 202, the judgment module 203, and the determination module 204 correspond to steps S101 to S104 in Example 1. The examples and application scenarios implemented by the four modules and the corresponding steps are the same, but are not limited to the contents disclosed in the above-mentioned Example 1. It should be noted that the above-mentioned modules or units can be hardware components or software components stored in a memory (e.g., memory 104) and processed by one or more processors (e.g., processors 102a, 102b, ..., 102n). The above-mentioned modules can also be run as part of the device in the computer terminal 10 provided in Example 1.

[0081] Example 3

[0082] The embodiment of the present application can also provide a typeB message flow monitoring device based on standard deviation calculation. Figure 4 As shown, the device includes: an acquisition module, a storage module, an analysis and calculation module, and a monitoring module. Figure 5 The structure diagram of the typeB message flow monitoring method based on standard deviation calculation calling the typeB message flow monitoring device based on standard deviation calculation. Figure 5 shown.

[0083] During the acquisition process, the system records TPS data per second to ensure real-time and accurate data. To facilitate subsequent data statistics and analysis, the acquisition module automatically performs information collection tasks every minute, continuously monitoring and updating data. All collected information is properly stored in the database for easy query and calculation at any time.

[0084] In this way, the acquisition module can not only capture the dynamic information of system operation in real time, but also provide powerful data support, making query and calculation more convenient and efficient.

[0085] The storage module design builds two core database tables to facilitate efficient data management and analysis. The first table is dedicated to storing real-time data, recording key information about program execution, including program name, recording time, and transactions per second (TPS). This real-time data is crucial for monitoring program performance and provides immediate insights into system operational status.

[0086] The second table, on the other hand, stores calculated data, representing the results of in-depth analysis and processing of real-time data from the previous minute. Specifically, it contains the maximum, minimum, and average TPS observed during that minute. By recording these key metrics, we can not only understand the system's instantaneous performance but also assess its stability.

[0087] Furthermore, statistical methods are used to conduct in-depth analysis based on this calculated data. First, by calculating the mean (μ) and standard deviation (σ) of this data, the fluctuation of TPS within a minute can be quantified. Then, combining the mean and standard deviation, the variance of TPS within that minute is calculated. This metric is important for measuring the performance stability of the system. Finally, these calculation results are properly stored in a database table to facilitate subsequent data query and analysis, providing solid data support for system optimization and improvement.

[0088] The analysis and calculation module uses the data from the collection module to accurately calculate the maximum TPS (transaction processing capacity), minimum TPS, and average TPS per minute. These three key indicators provide basic statistical information for message traffic.

[0089] On this basis, the analysis and calculation module further utilizes these basic data to calculate the standard deviation σ and average μ through mathematical statistical methods. The standard deviation σ can quantify the degree of fluctuation of the TPS value, while the average μ reflects the overall level of TPS.

[0090] The analysis and calculation module dynamically determines abnormalities in packet traffic based on the principle of normal distribution. By comparing real-time data with the normal distribution model, the analysis and calculation module can effectively identify abnormal fluctuations in packet traffic, thereby achieving accurate alarms.

[0091] In statistical analysis, standard deviation and mean are often used to describe the dispersion and central tendency of data. In this study, the following formulas were used to calculate standard deviation and mean:

[0092] The formula for calculating the standard deviation (σ) is: σ = (maximum TPS - minimum TPS) / 6;

[0093] The calculation formula for the average value (μ) is: μ = (maximum TPS + 4*average TPS + minimum TPS) / 6.

[0094] Furthermore, in order to gain a deeper understanding of the fluctuation range of the data, it is necessary to calculate the following key values: μ-σ, μ+σ, μ-2σ, μ+2σ, μ-3σ and μ+3σ.

[0095] Example 1: For example, the TPS of a router collected in one minute are as follows, as shown in Table 1:

[0096] Table 1:

[0097]

[0098] The analysis shows that the maximum value is 99, the minimum value is 12, and the average value is 40. Based on the beta distribution, the average value μ = (99+12+4*40) / 6 = 45, and the standard deviation is σ = (99-12) / 6 = 15. Then 2σ and 3σ are 30 and 45 respectively. The calculated intervals are 31-60, 74-16, and 89-2 respectively.

[0099] Example 2: For example, the TPS of a router collected in one minute are as follows, including the extreme values ​​99 and 0. As shown in Table 2:

[0100] Table 2:

[0101]

[0102] Analysis and calculation show that the maximum value is 99, the minimum value is 0, and the average value is 40. Based on the beta distribution, the average value μ = (99+0+4*40) / 6 = 43, and the standard deviation is σ = (99-0) / 6 = 17. Then 2σ and 3σ are 34 and 51 respectively, and the calculated intervals are 27-60, 10-76, and 93-0 respectively.

[0103] The monitoring and alarm module's primary function is to monitor collected data in real time and provide anomaly alerts. In statistics, data normality is typically determined by the standard deviation σ and the mean μ. Specifically, data values ​​between twice the standard deviation and the mean (μ - 2σ and μ + 2σ) are considered slightly abnormal. While slightly off, such data are still within acceptable limits and do not significantly impact the overall analysis.

[0104] During data collection, the program automatically compares and analyzes the newly collected data with pre-calculated results. Specifically, if the calculated standard deviation is σ and the mean is μ, the normality of the data can be determined as follows: data falling between μ-σ and μ+σ is considered normal, indicating that the system is operating stably and without abnormalities.

[0105] Furthermore, data that falls between σ and μ but deviates slightly from the normal range is defined as slightly abnormal. Such data, while slightly above or below the average, remains within an acceptable range, indicating that the system may experience some fluctuations but generally does not affect normal operation.

[0106] However, when the data distribution falls between three standard deviations and the mean (μ - 3σ and μ + 3σ), it is considered a warning state. This indicates that the data has a certain risk of abnormality and requires attention. In this case, the data fluctuation may indicate some instability in the system or process, requiring further investigation and adjustment.

[0107] Furthermore, if the data value exceeds three standard deviations, it indicates a data anomaly and requires an immediate alarm. Data exceeding μ + 3σ indicates excessive data volume, potentially exceeding the system's maximum processing capacity. In this case, a comprehensive assessment of the data volume and queue threshold is necessary. If both simultaneously reach the alarm condition, message processing may be delayed. To address this situation, a capacity expansion program is necessary to quickly identify the problem and implement appropriate measures.

[0108] In short, by carefully analyzing the distribution of data in the three intervals of μ-σ and μ+σ, μ-2σ and μ+2σ, μ-3σ and μ+3σ, we can more accurately grasp the degree of data abnormality, thereby timely adjusting and optimizing the system to ensure efficient and stable data processing.

[0109] In addition to judging the interval, the continuity of the alarm must also be judged. If it only occurs once in a certain period of time, generally within one minute, then no alarm will be issued. If the above situation occurs five times in a row within one minute, then a warning or alarm message will be sent.

[0110] Example 1: According to the monitoring data, if the data is between 31-60, it will be judged as normal. If the data is between 74-89 or 2-16 for five consecutive times, it will be a warning. If the data is between 89-99 or 0-2 for five consecutive times, it will be abnormal and an alarm message will be issued.

[0111] Example 2: According to the monitoring data, if the data is between 27-60, it will be judged as normal. If the data is between 10-27 or 60-76 for five consecutive times, it will be a warning. If the data is between 93-99 for five consecutive times, it will be abnormal and an alarm message will be issued.

[0112] Example 4

[0113] An embodiment of the present application may provide an electronic device, Figure 6 This is a structural block diagram of an electronic device according to an embodiment of the present application. Figure 6 As shown, the electronic device may include: one or more ( Figure 6 Only one is shown) processor 1002, memory 1004, storage controller, and peripheral interface, wherein the peripheral interface is connected to the radio frequency module, audio module and display.

[0114] Among them, the memory can be used to store software programs and modules, such as program instructions / modules corresponding to the methods and devices in the embodiments of the present application. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory, that is, implementing the above-mentioned method. The memory may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include a memory remotely arranged relative to the processor, and these remote memories may be connected to the terminal via a network. Examples of the above-mentioned network include but are not limited to the Internet, an intranet, a local area network, a mobile communication network and a combination thereof.

[0115] The processor may call the information and application stored in the memory through the transmission device to perform the following steps:

[0116] Step S101: Obtain log information of type B messages in a first time period and determine a range of type B message volume, wherein the log information includes at least: program name information, time point information, and transaction volume per second;

[0117] Step S102: Obtain log information of type B messages in the second time period;

[0118] Step S103: determining whether the amount of type B messages in the second time period is within a range, wherein the amount of type B messages in the second time period is determined based on log information of type B messages in the second time period;

[0119] Step S104: When it is determined that the amount of type B messages in the second time period exceeds the range, an alarm instruction is generated, where the alarm instruction is used to control the target device to issue an alarm.

[0120] The processor may also call the information and application stored in the memory through the transmission device to perform the following steps:

[0121] Step S1011: Analyze and obtain transaction volume data for the first period based on the log information for the first period, wherein the transaction volume data includes at least: a maximum transaction volume, a minimum transaction volume, and an average transaction volume;

[0122] Step S1012: Based on the transaction volume data of the first period, obtain standard parameters of the type B message volume, the standard parameters including at least: a standard deviation of the type B message volume and an average value of the type B message volume;

[0123] Step S1013: Determine the range of the type B message volume based on the standard parameter of the type B message volume.

[0124] The processor may also call the information and application stored in the memory through the transmission device to perform the following steps:

[0125] Step S10131: determining a first range interval according to the standard parameters, wherein the first range interval is the mean ± standard deviation;

[0126] Step S10132: determining a second range interval according to the standard parameters, wherein the second range interval is the mean ± twice the standard deviation;

[0127] Step S10133: Determine a third range interval according to the standard parameters, wherein the third range interval is the mean value ± three times the standard deviation.

[0128] The processor may also call the information and application stored in the memory through the transmission device to perform the following steps:

[0129] Step S1031: When it is determined that the amount of type B packets in the second time period is within the first range, a normality signal is generated, where the normality signal is used to indicate that the amount of type B packets in the second time period is normal.

[0130] The processor may also call the information and application stored in the memory through the transmission device to perform the following steps:

[0131] Step S1032: When it is determined that the amount of type B messages in the second time period is within the second range, an early warning signal is generated, where the early warning signal is used to indicate that the amount of type B messages in the second time period is in an early warning state.

[0132] The processor may also call the information and application stored in the memory through the transmission device to perform the following steps:

[0133] Step S1033: When it is determined that the amount of type B messages in the second time period exceeds a third range, an alarm instruction is generated, where the alarm instruction is used to control the target device to issue an alarm.

[0134] By adopting the embodiment of the present application, a type B message traffic monitoring method based on standard deviation calculation is provided. By collecting the log information of the Type B message in the first time period, including the program name, time point and transaction processing volume per second (TPS), the statistical characteristics of these data are analyzed to determine the normal range interval of the message volume. Subsequently, the system obtains the log information of the Type B message in real time in the second time period, compares it with the range calculated in the first time period, and determines whether the current message volume is within the normal fluctuation range. If the message volume in the second time period exceeds this range interval, the system will automatically trigger the alarm mechanism and generate an alarm instruction, thereby achieving the purpose of accurately monitoring the message traffic, thereby realizing the technical effect of dynamic threshold monitoring, and thus solving the technical problem that the fixed threshold in the traditional monitoring method cannot adapt to traffic changes.

[0135] It can be understood by those skilled in the art that Figure 6 The structure shown is for illustration only, and the electronic device may also be a smart phone (such as an Android phone, an iOS phone, etc.), a tablet computer, a PDA, a mobile Internet device (Mobile Internet Devices, MID), a PAD, or other terminal devices. Figure 6 It does not limit the structure of the above electronic device. For example, the electronic device may also include Figure 6 More or fewer components (such as network interfaces, display devices, etc.) shown in, or with Figure 6 Different configurations shown.

[0136] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be completed by instructing the hardware related to the terminal device through a program, and the program can be stored in a computer-readable storage medium, which may include: a flash drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0137] Example 5

[0138] The embodiment of the present application further provides a storage medium. Optionally, in this embodiment, the storage medium can be used to store the program code executed by the type B message flow monitoring method based on standard deviation calculation provided in the first embodiment.

[0139] Optionally, in this embodiment, the storage medium may be configured to store a computer program for performing the following steps:

[0140] Step S101: Obtain log information of type B messages in a first time period and determine a range of type B message volume, wherein the log information includes at least: program name information, time point information, and transaction volume per second;

[0141] Step S102: Obtain log information of type B messages in the second time period;

[0142] Step S103: determining whether the amount of type B messages in the second time period is within a range, wherein the amount of type B messages in the second time period is determined based on log information of type B messages in the second time period;

[0143] Step S104: When it is determined that the amount of type B messages in the second time period exceeds the range, an alarm instruction is generated, where the alarm instruction is used to control the target device to issue an alarm.

[0144] Optionally, in this embodiment, the storage medium may be located in any computer terminal in a computer terminal group in a computer network, or in any mobile terminal in a mobile terminal group.

[0145] Optionally, in this embodiment, the above-mentioned storage medium may include but is not limited to: a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk, and other media that can store computer programs.

[0146] Example 6

[0147] The present application also provides a computer program product, which, when executed on a data processing device, is suitable for executing the steps of the type B message traffic monitoring method based on standard deviation calculation.

[0148] Optionally, in this embodiment, the computer program product may be configured as a computer program for executing the following steps:

[0149] Step S101: Obtain log information of type B messages in a first time period and determine a range of type B message volume, wherein the log information includes at least: program name information, time point information, and transaction volume per second;

[0150] Step S102: Obtain log information of type B messages in the second time period;

[0151] Step S103: determining whether the amount of type B messages in the second time period is within a range, wherein the amount of type B messages in the second time period is determined based on log information of type B messages in the second time period;

[0152] Step S104: When it is determined that the amount of type B messages in the second time period exceeds the range, an alarm instruction is generated, where the alarm instruction is used to control the target device to issue an alarm.

[0153] The serial numbers of the above embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0154] In the above embodiments of the present application, the description of each embodiment has its own focus. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0155] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0156] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0157] In addition, the functional units in the various embodiments of the present application may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0158] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for enabling a computer device (which can be a personal computer, a server or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk.

[0159] The above is only a preferred embodiment of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A type B message flow monitoring method based on standard deviation calculation, characterized in that: include: Obtain log information of type B messages in the first time period and determine a range of the type B message volume, wherein the log information includes at least: program name information, time point information, and transaction processing volume per second; Analyze the log information of the first period to obtain transaction volume data of the first period, wherein the transaction volume data includes at least: a maximum transaction volume, a minimum transaction volume, and an average transaction volume; Based on the transaction volume data of the first time period, obtain standard parameters of the type B message volume, the standard parameters including at least: a standard deviation of the type B message volume and an average value of the type B message volume; Determining a range of the typeB message volume based on the standard parameter of the typeB message volume; Determine a first range interval according to the standard parameter, wherein the first range interval is the mean ± standard deviation; Determining a second range interval according to the standard parameter, wherein the second range interval is the mean ± twice the standard deviation; Determining a third range interval according to the standard parameter, wherein the third range interval is the mean ± three times the standard deviation; Get the log information of typeB messages in the second period; Determine whether the amount of typeB messages in the second time period is within the range, wherein the amount of typeB messages in the second time period is determined based on log information of typeB messages in the second time period; When it is determined that the amount of type B messages in the second time period exceeds the range, an alarm instruction is generated, where the alarm instruction is used to control the target device to issue an alarm.

2. The type B message flow monitoring method based on standard deviation calculation according to claim 1 is characterized in that: Determining whether the type B message volume in the second time period is within the range includes: When it is determined that the amount of typeB messages in the second time period is within the first range, a normality signal is generated, where the normality signal is used to indicate that the amount of typeB messages in the second time period is in a normal state.

3. The type B message flow monitoring method based on standard deviation calculation according to claim 1 is characterized in that: Determining whether the type B message volume in the second time period is within the range includes: When it is determined that the amount of typeB messages in the second time period is within the second range, an early warning signal is generated, where the early warning signal is used to indicate that the amount of typeB messages in the second time period is in an early warning state.

4. The type B message flow monitoring method based on standard deviation calculation according to claim 1 is characterized in that: Determining whether the type B message volume in the second time period is within the range includes: When it is determined that the type B message volume in the second time period exceeds the third range, the alarm instruction is generated, and the alarm instruction is used to control the target device to issue an alarm.

5. A type B message flow monitoring device based on standard deviation calculation, characterized in that: include: A first acquisition module, configured to acquire log information of type B messages in a first time period and determine a range of type B message volume, wherein the log information includes at least program name information, time point information, and transaction volume per second; A second acquisition module, configured to acquire log information of type B messages in a second time period; a judgment module, configured to judge whether the amount of typeB messages in the second time period is within the range, wherein the amount of typeB messages in the second time period is determined based on log information of typeB messages in the second time period; A determination module is configured to generate an alarm instruction when determining that the amount of type B messages in the second time period exceeds the range interval, wherein the alarm instruction is configured to control the target device to issue an alarm.

6. An electronic device, characterized in that: include: a memory storing an executable program; A processor, configured to run the program, wherein the program executes the method according to any one of claims 1 to 4 when running.

7. A computer-readable storage medium, characterized in that The computer-readable storage medium includes a stored executable program, wherein when the executable program is run, the device where the storage medium is located is controlled to execute the method according to any one of claims 1 to 4.

8. A computer program product, characterized in that The invention comprises a computer program which, when executed by a processor, implements the method according to any one of claims 1 to 4.

Images