Network inspection fault tracing method and device

Abstract

The invention provides a network inspection fault tracing method and device, and relates to the technical field of fault inspection, and the method comprises the steps: an intelligent calculation node obtains target data of each region of a data center collected by each sensor and log data related to each sensor; the intelligent calculation node analyzes the target data to obtain analysis results corresponding to the target data; the analysis result shows that the target data is normal data or abnormal data; and the intelligent calculation node performs fault tracing on the abnormal data based on the log data to obtain an inspection tracing result corresponding to the target data. Determining whether the target data is abnormal data or not by analyzing the target data collected by the plurality of sensors; meanwhile, by analyzing the log data related to the sensor, the reason that the target data is the abnormal data is determined, fault tracing of the abnormal data is automatically achieved, and therefore the efficiency and accuracy of fault tracing are improved.

Description

Technical Field

[0001] The present invention relates to the technical field of fault inspection, and in particular to a method and device for tracing a network fault. Background Art

[0002] With the rapid development of computer technology, information networks have become an important guarantee for social development. In the era of cloud-network integration, flexible and agile network service capabilities directly affect the competitiveness of operators. Segment Routing (SR) is a type of source routing technology. SRv6 is the application of SR technology in IPv6 networks. The emergence of SRv6 is a huge innovation. It combines software-defined network (SDN) technology to enable programmable networks, which provides innovative soil for network infrastructure services and value-added network services in the cloud-network era. In such a large SRv6 network scale, when IPv6 nodes in the SRv6 network obtain traffic, forwarding messages to more matching nodes through a large model is a future development trend.

[0003] In the existing technology, message forwarding is based on manual settings or network policies to prioritize certain protocols, and there is a lack of intelligent analysis and scheduling processes. During the inspection process, data center inspections are mainly completed by automated script inspections, and potentially hidden nodes cannot be inspected. During the inspection process, alarms are found that can only locate the current fault source, which may not be the actual fault source, and can only be found through log analysis, which has poor timeliness and affects troubleshooting.

[0004] In such a large SRv6 network, manual analysis or comprehensive inspection of the equipment room to find the root cause of abnormal data makes fault tracing less timely and may also result in false alarms, resulting in low efficiency and accuracy of fault tracing. Summary of the invention

[0005] The present invention provides a network inspection fault tracing method and device, which are used to solve the problems of low efficiency and low accuracy of fault tracing.

[0006] The present invention provides a network inspection fault tracing method, which is applied to an operation and maintenance service platform deployed in a data center. The operation and maintenance service platform includes at least one sensor, an intelligent computing node and a scheduling node, including: The intelligent computing node obtains the target data of each area of ​​the data center collected by each sensor and the log data related to each sensor; The intelligent computing node analyzes each of the target data to obtain an analysis result corresponding to each of the target data; the analysis result indicates whether the target data is normal data or abnormal data; The intelligent computing node traces the fault of the abnormal data based on the log data to obtain the inspection and tracing results corresponding to the target data.

[0007] According to a network inspection fault tracing method provided by the present invention, the intelligent computing node analyzes each of the target data to obtain an analysis result corresponding to each of the target data, including: For each of the target data, the intelligent computing node performs a network security situation assessment and scoring on the target data to obtain at least one score corresponding to the target data; The intelligent computing node determines whether the target data is abnormal data based on each of the scores; The intelligent computing node marks the target data based on the judgment result to obtain the analysis result.

[0008] According to a network inspection fault tracing method provided by the present invention, the intelligent computing node performs network security situation assessment and scoring on the target data to obtain at least one score corresponding to the target data, including: The intelligent computing node determines at least one data set based on a target indicator; the target indicator includes at least one of the following: target assets, hazard, number of events, and clearability; The intelligent computing node performs network security situation assessment and scoring on each of the data sets to obtain the scores corresponding to the target data.

[0009] According to a network inspection fault tracing method provided by the present invention, the intelligent computing node performs fault tracing on the abnormal data based on the log data to obtain the inspection tracing result corresponding to the target data, including: The intelligent computing node obtains the path nodes between the intelligent computing node and the destination node, at least one device associated with the target data, and other devices associated with each of the devices based on the traffic quintuple information of the log data; the traffic quintuple information includes the source address, source port, destination address, destination port, and transport layer protocol; The intelligent computing node forms an association relationship chain based on the address of each of the devices, the address of the sensor corresponding to the target data, and the address of the other devices; The intelligent computing node transmits the association relationship chain, the business weight corresponding to the address of each of the devices, the business weight corresponding to the address of the sensor corresponding to the target data, the business weight corresponding to the address of the other devices, and the proportion of the marked target data to the inspection model, and obtains the inspection tracing results corresponding to the target data output by the large model.

[0010] According to a network inspection fault tracing method provided by the present invention, the method further includes: The intelligent computing node forms a transmission path based on the path nodes between the intelligent computing node and the destination node; The intelligent computing node extracts weight indicators of the path nodes in the transmission path from the log data, and weight-marks the transmission path based on the weight indicators.

[0011] According to a network inspection fault tracing method provided by the present invention, the method further includes: The intelligent computing node forwards the marked target data and the inspection tracing result to the scheduling node; The scheduling node forwards the marked target data and the inspection tracing result to the destination node based on a set priority; the priority is set based on a proportion corresponding to the marked target data or a business weight corresponding to the target data.

[0012] According to a network inspection fault tracing method provided by the present invention, the intelligent computing node forwards the marked target data to the scheduling node, including: Based on the target score corresponding to the target data, the intelligent computing node forwards the marked target data to the scheduling node using the shortest transmission path between the intelligent computing node and the scheduling node; the target score is obtained by summing up the scores corresponding to the target data.

[0013] The present invention also provides a network inspection fault tracing device, which is applied to an operation and maintenance service platform deployed in a data center. The operation and maintenance service platform includes at least one sensor, an intelligent computing node and a scheduling node, including: An acquisition module, used to acquire target data of each area of ​​the data center collected by each sensor and log data related to each sensor; An analysis module, used to analyze each of the target data to obtain an analysis result corresponding to each of the target data; the analysis result indicates whether the target data is normal data or abnormal data; The tracing module is used to perform fault tracing on the abnormal data based on the log data to obtain the inspection tracing result corresponding to the target data.

[0014] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the network inspection fault tracing method described in any one of the above methods is implemented.

[0015] The present invention also provides a non-transitory computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the network inspection fault tracing method as described in any one of the above methods is implemented.

[0016] The present invention also provides a computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the network inspection fault tracing method described in any one of the above methods is implemented.

[0017] The network inspection fault tracing method and device provided by the present invention are applied to an operation and maintenance service platform deployed in a data center, wherein the operation and maintenance service platform includes at least one sensor and an intelligent computing node, and the target data of each area of ​​the data center collected by each sensor and the log data related to each sensor are obtained through the intelligent computing node; the intelligent computing node analyzes each target data to obtain the analysis result corresponding to each target data; the analysis result indicates that the target data is normal data or abnormal data; based on the log data, the abnormal data is traced to obtain the inspection tracing result corresponding to the target data. By analyzing the target data collected by multiple sensors, it is determined whether the target data is abnormal data; at the same time, by analyzing the log data related to the sensor, the reason why the target data is abnormal data is determined, and the fault tracing of the abnormal data is automatically realized, thereby improving the efficiency and accuracy of fault tracing. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0019] Figure 1 This is one of the flow charts of the network inspection fault tracing method provided by the present invention.

[0020] Figure 2 This is the second flow chart of the network inspection fault tracing method provided by the present invention.

[0021] Figure 3 It is a structural schematic diagram of the network inspection fault tracing device provided by the present invention.

[0022] Figure 4 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0023] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0024] Figure 1 This is one of the flow charts of the network inspection fault tracing method provided by the present invention, such as Figure 1 As shown, it is applied to an operation and maintenance service platform deployed in a data center, and the operation and maintenance service platform includes at least one sensor and an intelligent computing node. The method includes the following steps 101 and 103.

[0025] Step 101: The intelligent computing node obtains the target data of each area of ​​the data center collected by each sensor and the log data related to each sensor.

[0026] It should be noted that the network inspection fault tracing method provided by the present invention is applied to the fault tracing scenario of the inspection computer room under the computer room operation and maintenance scenario. The executor of the method can be a network inspection fault tracing device, such as an electronic device, or a control module in the network inspection fault tracing device for executing the network inspection fault tracing method.

[0027] Specifically, the inspection room is a data center, and the 5G RedCap protocol is used to build a dedicated inspection network in the distributed network environment of the data center. An operation and maintenance service platform is deployed on a server in the network to monitor the network. The operation and maintenance service platform includes at least one sensor and intelligent computing node, and the operation and maintenance service platform may also include a scheduling node.

[0028] Sensors are deployed in various areas of the data center. Intelligent computing nodes can collect target data from each area of ​​the data center through sensors, including temperature, humidity, carbon emissions and other data (such as Bluetooth and Wi-Fi device data). Intelligent computing nodes can also obtain log data related to each sensor, that is, network traffic log data.

[0029] Step 102: The intelligent computing node analyzes each of the target data respectively to obtain an analysis result corresponding to each of the target data; the analysis result indicates whether the target data is normal data or abnormal data.

[0030] Specifically, the intelligent computing node analyzes each target data and can obtain the analysis results corresponding to each target data; wherein the analysis results indicate whether the target data is normal data or abnormal data, that is, it is determined whether the target data is abnormal data or normal data. When the target data is abnormal data, it indicates that there is a fault in the sensor of the data center.

[0031] Step 103: The intelligent computing node traces the fault of the abnormal data based on the log data to obtain the inspection and tracing results corresponding to the target data.

[0032] Specifically, based on log data, the intelligent computing node can trace the fault of abnormal data and obtain the inspection tracing results corresponding to the target data. The inspection tracing results represent information related to the abnormal data, that is, through the log data related to the sensor, the source and cause of the fault can be further determined.

[0033] The network inspection fault tracing method and device provided by the present invention are applied to an operation and maintenance service platform deployed in a data center, wherein the operation and maintenance service platform includes at least one sensor and an intelligent computing node, and the target data of each area of ​​the data center collected by each sensor and the log data related to each sensor are obtained through the intelligent computing node; the intelligent computing node analyzes each target data to obtain the analysis result corresponding to each target data; the analysis result indicates that the target data is normal data or abnormal data; based on the log data, the abnormal data is traced to obtain the inspection tracing result corresponding to the target data. By analyzing the target data collected by multiple sensors, it is determined whether the target data is abnormal data; at the same time, by analyzing the log data related to the sensor, the reason why the target data is abnormal data is determined, and the fault tracing of the abnormal data is automatically realized, thereby improving the efficiency and accuracy of fault tracing.

[0034] Optionally, a specific implementation of step 102 includes: For each of the target data, the intelligent computing node performs a network security situation assessment and scoring on the target data to obtain at least one score corresponding to the target data; the intelligent computing node determines whether the target data is abnormal data based on each of the scores; the intelligent computing node marks the target data based on the judgment result to obtain the analysis result.

[0035] Specifically, after receiving the collected target data sent by the sensor and before forwarding it to the scheduling node, the intelligent computing node performs a network security situation assessment and scoring on the target data collected by each sensor, and can obtain at least one score corresponding to the target data. It should be noted that after determining the network security situation assessment elements, the assessment elements need to be quantified. The network security situation assessment elements are used to determine whether the target data is safe. If the target data is found to be abnormal data, the target data is isolated. There are many quantification algorithms for network security situation assessment elements. In the selection of specific quantification algorithms, they can be selected according to the needs of the assessors and the characteristics of the specific assessment object.

[0036] The intelligent computing node then compares each score corresponding to the target data with a preset threshold value to determine whether each score is greater than the preset threshold value. When at least one of the scores is greater than the preset threshold value, the target data is determined to be abnormal data. When all scores are not greater than the preset threshold value, the target data is determined to be normal data, i.e., it is determined whether there is a fault in the inspection room. The intelligent computing node marks the target data based on the judgment result to obtain an analysis result, i.e., the target data is marked as abnormal data or normal data.

[0037] Optionally, the intelligent computing node performs a network security situation assessment and scoring on the target data to obtain at least one score corresponding to the target data, including: The intelligent computing node determines at least one data set based on the target indicators; the target indicators include at least one of the following: target assets, harmfulness, number of events, and clearability; the intelligent computing node performs network security situation assessment and scoring on each of the data sets to obtain the scores corresponding to the target data.

[0038] Specifically, the target indicator includes at least one of the following: target assets, hazard, number of events, and removability. Based on the target indicator, the intelligent computing node divides the target data into at least one data set. For example, the target asset set is , the set of hazardous data is , the purgeable data set is , where n represents the number of events. Among them, the target asset, the criticality and the number of events can be obtained by querying the alarm event library, and the clearability is a static attribute.

[0039] The intelligent computing node evaluates and scores each data set for network security situation, and can obtain the scores corresponding to the target data. Perform cybersecurity situation assessment and scoring on the target asset set, using The network security situation assessment and scoring of the harmful data set is carried out using Perform cybersecurity posture assessment scoring on purgeability data sets.

[0040] Optionally, a specific implementation of step 103 includes: Based on the traffic quintuple information of the log data, the intelligent computing node obtains the path nodes between the intelligent computing node and the destination node, at least one device associated with the target data, and other devices associated with each of the devices; the traffic quintuple information includes the source address, source port, destination address, destination port and transport layer protocol; the intelligent computing node forms an association relationship chain based on the address of each of the devices, the address of the sensor corresponding to the target data, and the addresses of the other devices; the intelligent computing node transmits the association relationship chain, the business weight corresponding to the address of each of the devices, the business weight corresponding to the address of the sensor corresponding to the target data, the business weight corresponding to the address of the other devices, and the proportion of the number of marked target data to the inspection big model to obtain the inspection tracing result output by the big model.

[0041] Specifically, the intelligent computing node stores log data related to each sensor. The traffic five-tuple information includes source address, source port, destination address, destination port and transport layer protocol. The source address refers to the IP address of the sensor, the source port refers to the port of the sensor, the destination address refers to the IP address of the destination node for sending target data, the destination port refers to the port of the destination node, and the transport layer protocol refers to the protocol for transmitting data. The traffic five-tuple information also includes information about other nodes between the intelligent computing node and the scheduling node and between the scheduling node and the destination node.

[0042] Based on the traffic quintuple information of the log data, the intelligent computing node can obtain the path nodes between the intelligent computing node and the destination node, at least one device associated with the target data, and other devices associated with each device, that is, obtain the devices related to the sensor, and can also obtain the business data associated with the target data. The intelligent computing node forms an association relationship chain based on the address of each device, the address of the sensor corresponding to the target data, and the address of other devices, that is, the association relationship chain represents the association relationship between each device.

[0043] The inspection big model is deployed on the intelligent computing node. The inspection big model is the Xingchen big model, which is a pre-trained model. The intelligent computing node transmits the association relationship chain, the business weight corresponding to the address of each device, the business weight corresponding to the address of the sensor corresponding to the target data, the business weight corresponding to the address of other devices, and the number of marked target data to the inspection big model. The inspection big model can be queried from the database and directly obtain the inspection traceability results output by the big model, making the fault location of abnormal data efficient and accurate.

[0044] Optionally, the method further comprises: The intelligent computing node forms a transmission path based on the path nodes between the intelligent computing node and the destination node; the intelligent computing node extracts weight indicators of the path nodes in the transmission path from the log data, and weight-marks the transmission path based on the weight indicators.

[0045] Specifically, the operation and maintenance service platform also includes a scheduling node. The intelligent computing node can form a transmission path based on the path nodes between the intelligent computing node and the destination node, wherein the path nodes can be scheduling nodes or other nodes directly between the scheduling node and the destination node; the traffic quintuple information also includes information about other nodes between the intelligent computing node and the scheduling node and between the scheduling node and the destination node. The intelligent computing node can extract the weight index of the path nodes in the transmission path from the log data, that is, it can also obtain the business data associated with the target data, and weight the transmission path based on the weight index.

[0046] Optionally, the method further comprises: The intelligent computing node forwards the marked target data and the inspection and tracing results to the scheduling node; the scheduling node forwards the marked target data and the inspection and tracing results to the destination node based on the set priority; the priority is set based on the proportion corresponding to the marked target data or the business weight corresponding to the target data.

[0047] Specifically, the intelligent computing node forwards the marked target data and inspection traceability results to the scheduling node; the scheduling node forwards the marked target data and inspection traceability results to the destination node based on the set priority, and the marked target data and inspection traceability results are saved at the destination node for subsequent scheduling processing. The priority is set based on the proportion of the marked target data or the business weight of the target data. The scheduling node can also filter abnormal data according to the tag, add the filtered normal data to the 802.1Q-Tag (i.e. 802.1q) cos field through the IPv6 packet header information to set the priority parameter value, and can also set the priority parameter value according to the service weight corresponding to the target data; among them, the priority value range is between 8-15, 8 represents the highest sending priority, and 15 represents the lowest priority.

[0048] Optionally, the intelligent computing node forwards the marked target data to the scheduling node, including: Based on the target score corresponding to the target data, the intelligent computing node forwards the marked target data to the scheduling node using the shortest transmission path between the intelligent computing node and the scheduling node; the target score is obtained by summing up the scores corresponding to the target data.

[0049] Specifically, the target score is obtained by summing up the scores corresponding to the target data. The intelligent computing node can send the target data corresponding to the highest ranked target score first and the target data corresponding to the lowest ranked target score last based on the target scores corresponding to the target data, and forward the marked target data to the scheduling node using the shortest transmission path between the intelligent computing node and the scheduling node.

[0050] Optionally, the intelligent computing node can also send the inspection and tracing results to the scheduling node according to the business weight, that is, the inspection and tracing results with high business weight are sent first, and the inspection and tracing results with low business weight are sent last.

[0051] Figure 2 FIG. 2 is a flow chart of the network inspection fault tracing method provided by the present invention. Figure 2 As shown, the method includes steps 201 to 209.

[0052] Step 201: The intelligent computing node obtains the target data of each area of ​​the data center collected by each sensor and the log data related to each sensor.

[0053] Step 202: For each target data, the intelligent computing node performs a network security situation assessment and scoring on the target data to obtain at least one score corresponding to the target data.

[0054] Step 203: The intelligent computing node determines whether the target data is abnormal data based on each score.

[0055] Step 204: The intelligent computing node marks the target data based on the judgment result to obtain the analysis result.

[0056] Step 205: The intelligent computing node obtains the path nodes between the intelligent computing node and the destination node, at least one device associated with the target data, and other devices associated with each device based on the traffic quintuple information of the log data; the traffic quintuple information includes the source address, source port, destination address, destination port, and transport layer protocol.

[0057] Step 206: The intelligent computing node forms an association relationship chain based on the address of each device, the address of the sensor corresponding to the target data, and the addresses of other devices.

[0058] Step 207: The intelligent computing node transmits the association relationship chain, the business weight corresponding to the address of each device, the business weight corresponding to the address of the sensor corresponding to the target data, the business weight corresponding to the address of other devices, and the proportion of the marked target data to the inspection model to obtain the inspection traceability results corresponding to the target data output by the large model.

[0059] Step 208: The intelligent computing node forwards the marked target data and inspection tracing results to the scheduling node.

[0060] Step 209: The scheduling node forwards the marked target data and the inspection tracing result to the destination node based on the set priority; the priority is set based on the proportion corresponding to the marked target data or the business weight corresponding to the target data.

[0061] The method provided by the present invention determines the inspection fault by analyzing the target data, and then compensates for the defect that the marked target data cannot be traced by using log data mining, realizes the traceability of the sensor wireless data, and improves the timeliness and accuracy of fault processing.

[0062] The network inspection fault tracing device provided by the present invention is described below. The network inspection fault tracing device described below and the network inspection fault tracing method described above can be referenced to each other.

[0063] Figure 3 is a schematic diagram of the structure of the network inspection fault tracing device provided by the present invention, such as Figure 3 As shown, it is applied to an operation and maintenance service platform deployed in a data center, the operation and maintenance service platform includes at least one sensor and an intelligent computing node, and the network inspection fault tracing device 300 includes: an acquisition module 301, an analysis module 302 and a tracing module 303; wherein, An acquisition module 301 is used to acquire target data of each area of ​​the data center collected by each sensor and log data related to each sensor; The analysis module 302 is used to analyze each of the target data to obtain an analysis result corresponding to each of the target data; the analysis result indicates whether the target data is normal data or abnormal data; The tracing module 303 is used to perform fault tracing on the abnormal data based on the log data to obtain the inspection tracing result corresponding to the target data.

[0064] The network inspection fault tracing device provided by the present invention is applied to an operation and maintenance service platform deployed in a data center. The operation and maintenance service platform includes at least one sensor and an intelligent computing node. The target data of each area of ​​the data center collected by each sensor and the log data related to each sensor are obtained through the intelligent computing node; the intelligent computing node analyzes each target data to obtain the analysis result corresponding to each target data; the analysis result indicates that the target data is normal data or abnormal data; based on the log data, the abnormal data is traced to obtain the inspection tracing result corresponding to the target data. By analyzing the target data collected by multiple sensors, it is determined whether the target data is abnormal data; at the same time, by analyzing the log data related to the sensor, the reason why the target data is abnormal data is determined, and the fault tracing of the abnormal data is automatically realized, thereby improving the efficiency and accuracy of fault tracing.

[0065] Optionally, the analysis module 302 is specifically configured to: For each of the target data, a network security situation assessment score is performed on the target data to obtain at least one score corresponding to the target data; Based on each of the scores, determining whether the target data is abnormal data; Based on the judgment result, the target data is marked to obtain the analysis result.

[0066] Optionally, the analysis module 302 is further configured to: Determine at least one data set based on target indicators; the target indicators include at least one of the following: target assets, hazard, number of events, and removability; Perform network security situation assessment and scoring on each of the data sets respectively to obtain the scores corresponding to the target data.

[0067] Optionally, the tracing module 303 is specifically used to: Based on the traffic quintuple information of the log data, obtain the path nodes between the intelligent computing node and the destination node, at least one device associated with the target data, and other devices associated with each of the devices; the traffic quintuple information includes the source address, source port, destination address, destination port, and transport layer protocol; Based on the address of each of the devices, the address of the sensor corresponding to the target data and the address of the other devices, forming an association relationship chain; The association relationship chain, the business weight corresponding to the address of each of the devices, the business weight corresponding to the address of the sensor corresponding to the target data, the business weight corresponding to the address of the other devices and the proportion of the marked target data are transmitted to the inspection big model to obtain the inspection tracing result output by the big model.

[0068] Optionally, the network inspection fault tracing device 300 further includes: A formation module, used to form a transmission path based on the path nodes between the intelligent computing node and the destination node; The extraction module is used to extract the weight index of the path node in the transmission path from the log data, and weight-mark the transmission path based on the weight index.

[0069] Optionally, the operation and maintenance service platform further includes a scheduling node, and the network inspection fault tracing device 300 further includes: A first forwarding module, used for forwarding the marked target data and the inspection and tracing result to the scheduling node; The second forwarding module is used to forward the marked target data and the inspection tracing result to the destination node based on the set priority; the priority is set based on the proportion corresponding to the marked target data or the business weight corresponding to the target data.

[0070] Optionally, the first forwarding module is specifically configured to: Based on the target score corresponding to the target data, the marked target data is forwarded to the scheduling node using the shortest transmission path between the intelligent computing node and the scheduling node; the target score is obtained by summing up the scores corresponding to the target data.

[0071] Figure 4 is a schematic diagram of the physical structure of an electronic device provided by the present invention, such as Figure 4 As shown, the electronic device 400 may include: a processor 410, a communication interface 420, a memory 430 and a communication bus 440, wherein the processor 410, the communication interface 420 and the memory 430 communicate with each other through the communication bus 440. The processor 410 may call the logic instructions in the memory 430 to execute the network inspection fault tracing method, which includes: the intelligent computing node obtains the target data of each area of ​​the data center collected by each sensor and the log data related to each sensor; the intelligent computing node analyzes each target data to obtain the analysis result corresponding to each target data; the analysis result indicates that the target data is normal data or abnormal data; the intelligent computing node traces the fault of the abnormal data based on the log data to obtain the inspection tracing result corresponding to the target data.

[0072] In addition, the logic instructions in the above-mentioned memory 430 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0073] On the other hand, the present invention also provides a computer program product, which includes a computer program. The computer program can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the network inspection fault tracing method provided by the above methods, and the method includes: the intelligent computing node obtains the target data of each area of ​​the data center collected by each of the sensors and the log data related to each of the sensors; the intelligent computing node analyzes each of the target data to obtain an analysis result corresponding to each of the target data; the analysis result indicates that the target data is normal data or abnormal data; the intelligent computing node traces the fault of the abnormal data based on the log data to obtain the inspection tracing result corresponding to the target data.

[0074] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, it is implemented to execute the network inspection fault tracing method provided by the above-mentioned methods, the method comprising: the intelligent computing node obtains the target data of each area of ​​the data center collected by each of the sensors and the log data related to each of the sensors; the intelligent computing node analyzes each of the target data to obtain an analysis result corresponding to each of the target data; the analysis result indicates that the target data is normal data or abnormal data; the intelligent computing node traces the fault of the abnormal data based on the log data to obtain the inspection tracing result corresponding to the target data.

[0075] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0076] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0077] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A network inspection fault tracing method, characterized in that: Applied to an operation and maintenance service platform deployed in a data center, the operation and maintenance service platform includes at least one sensor and an intelligent computing node, including: The intelligent computing node obtains the target data of each area of ​​the data center collected by each sensor and the log data related to each sensor; The intelligent computing node analyzes each of the target data to obtain an analysis result corresponding to each of the target data; the analysis result indicates whether the target data is normal data or abnormal data; The intelligent computing node traces the fault of the abnormal data based on the log data to obtain the inspection and tracing results corresponding to the target data.

2. The network inspection fault tracing method according to claim 1, characterized in that: The intelligent computing node analyzes each of the target data to obtain analysis results corresponding to each of the target data, including: For each of the target data, the intelligent computing node performs a network security situation assessment and scoring on the target data to obtain at least one score corresponding to the target data; The intelligent computing node determines whether the target data is abnormal data based on each of the scores; The intelligent computing node marks the target data based on the judgment result to obtain the analysis result.

3. The network inspection fault tracing method according to claim 2 is characterized in that: The intelligent computing node performs a network security situation assessment and scoring on the target data to obtain at least one score corresponding to the target data, including: The intelligent computing node determines at least one data set based on a target indicator; the target indicator includes at least one of the following: target assets, hazard, number of events, and clearability; The intelligent computing node performs network security situation assessment and scoring on each of the data sets to obtain the scores corresponding to the target data.

4. The network inspection fault tracing method according to claim 1, characterized in that: The intelligent computing node performs fault tracing on the abnormal data based on the log data to obtain an inspection tracing result corresponding to the target data, including: The intelligent computing node obtains the path nodes between the intelligent computing node and the destination node, at least one device associated with the target data, and other devices associated with each of the devices based on the traffic quintuple information of the log data; the traffic quintuple information includes the source address, source port, destination address, destination port, and transport layer protocol; The intelligent computing node forms an association relationship chain based on the address of each of the devices, the address of the sensor corresponding to the target data, and the address of the other devices; The intelligent computing node transmits the association relationship chain, the business weight corresponding to the address of each of the devices, the business weight corresponding to the address of the sensor corresponding to the target data, the business weight corresponding to the address of the other devices, and the proportion of the marked target data to the inspection model, and obtains the inspection tracing results corresponding to the target data output by the large model.

5. The network inspection fault tracing method according to claim 4 is characterized in that: The method further comprises: The intelligent computing node forms a transmission path based on the path nodes between the intelligent computing node and the destination node; The intelligent computing node extracts weight indicators of the path nodes in the transmission path from the log data, and weight-marks the transmission path based on the weight indicators.

6. The network inspection fault tracing method according to claim 2 or 3, characterized in that: The operation and maintenance service platform further includes a scheduling node, and the method further includes: The intelligent computing node forwards the marked target data and the inspection tracing result to the scheduling node; The scheduling node forwards the marked target data and the inspection tracing result to the destination node based on a set priority; the priority is set based on a proportion corresponding to the marked target data or a business weight corresponding to the target data.

7. The network inspection fault tracing method according to claim 6, characterized in that: The intelligent computing node forwards the marked target data to the scheduling node, including: Based on the target score corresponding to the target data, the intelligent computing node forwards the marked target data to the scheduling node using the shortest transmission path between the intelligent computing node and the scheduling node; the target score is obtained by summing up the scores corresponding to the target data.

8. A network inspection fault tracing device, characterized in that: Applied to an operation and maintenance service platform deployed in a data center, the operation and maintenance service platform includes at least one sensor and an intelligent computing node, including: An acquisition module, used to acquire target data of each area of ​​the data center collected by each sensor and log data related to each sensor; An analysis module, used to analyze each of the target data to obtain an analysis result corresponding to each of the target data; the analysis result indicates whether the target data is normal data or abnormal data; The tracing module is used to perform fault tracing on the abnormal data based on the log data to obtain the inspection tracing result corresponding to the target data.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the network inspection fault tracing method as described in any one of claims 1 to 6 is implemented.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the network inspection fault tracing method according to any one of claims 1 to 6 is implemented.

Images