Traffic sampling method and device, equipment and storage medium

Abstract

The invention relates to a traffic sampling method and device, equipment and a storage medium, and the method comprises the steps: monitoring a sampling traffic data set and a total traffic data sequence of target equipment in a certain time window, automatically adjusting the sampling frequency according to the monitored sampling traffic data set and the total traffic data sequence, and obtaining the optimal sampling frequency. The problems that samples are incomplete due to the fact that the sampling frequency is set too low and the load of network equipment is affected due to the fact that the sampling frequency is set too high are solved, network operation and maintenance work can be effectively supported, and sampling data obtained by sampling target equipment through the optimal sampling frequency is improved. And the actual conditions of the network flow, the cpu operation load and the memory occupation of the current target equipment can be better reflected.

Description

Technical Field

[0001] The present application relates to the field of software technology, and in particular to a flow sampling method, device, equipment and storage medium. Background Art

[0002] With the rapid development of the Internet, network traffic has shown explosive growth, and traffic sampling technology has emerged. Traffic sampling technology is widely used in network management, security monitoring, etc. By extracting a part of representative samples from a large amount of network traffic for sampling and analysis, the overall performance, security status and user behavior of the network can be inferred.

[0003] However, it is relatively difficult to set the sampling frequency in existing traffic sampling technologies. Setting the sampling frequency too high will affect the load of network equipment and cause serious faults such as traffic loss. Setting the sampling frequency too low will result in incomplete samples and inability to effectively support network operation and maintenance. Summary of the invention

[0004] The present application provides a traffic sampling method to solve the problem that the sampling frequency is relatively difficult to set in the existing traffic sampling technology. Setting the sampling frequency too high will affect the load of the network equipment and cause serious faults such as traffic loss. Setting the sampling frequency too low will result in incomplete samples and cannot effectively support network operation and maintenance work.

[0005] In a first aspect, the present application provides a flow sampling method, the method comprising:

[0006] In a current monitoring time window, the network traffic at the target device port is sampled at a first sampling frequency to obtain a sampled traffic data set, and a total traffic data sequence of the target device port in the current monitoring time window is obtained by monitoring;

[0007] According to the sampled traffic data set and the total traffic data sequence, the first sampling frequency is adjusted to obtain a second sampling frequency, so as to sample the network traffic at the target device port according to the second sampling frequency within the next monitoring time window.

[0008] In a possible implementation manner, adjusting the first sampling frequency according to the sampled flow data set and the total flow data sequence to obtain a second sampling frequency includes:

[0009] Determining a degree of match between the sampled flow data set and the total flow data sequence;

[0010] According to the matching degree, the first sampling frequency is adjusted to obtain a second sampling frequency.

[0011] In a possible implementation manner, determining the degree of matching between the sampled flow data set and the total flow data sequence includes:

[0012] Performing fitting processing on the sampled flow data set and the total flow data sequence respectively to obtain a sampled flow curve and a total flow curve;

[0013] The degree of overlap between the sampled flow curve and the total flow curve is determined, and the degree of overlap is determined as the degree of match between the sampled flow data set and the total flow data sequence.

[0014] In a possible implementation manner, the fitting process of the sampled flow data set includes:

[0015] Grouping the sampled flow data in the sampled flow data set according to a specified two-tuple to obtain a plurality of sampled flow data groups, wherein the two-tuple includes a source IP address and a destination IP address, the sampled flow data in the same sampled flow data group have the same two-tuple, and the sampled flow data in different sampled flow data groups have different two-tuples;

[0016] Performing fitting processing on each of the sampled flow data groups respectively to obtain a sub-sampling flow curve corresponding to each of the sampled flow data groups;

[0017] The sub-sampling flow curves of the plurality of sampling flow data groups are fitted to obtain a sampling flow curve.

[0018] In a possible implementation manner, adjusting the first sampling frequency according to the matching degree to obtain a second sampling frequency includes:

[0019] When the matching degree is less than a preset matching degree threshold, increasing the first sampling frequency to obtain a second sampling frequency;

[0020] When the matching degree is greater than or equal to the matching degree threshold, the first sampling frequency is reduced to obtain a second sampling frequency.

[0021] In a possible implementation, when the matching degree is greater than or equal to the matching degree threshold, reducing the first sampling frequency to obtain a second sampling frequency includes:

[0022] Obtaining load status data of the target device within a current monitoring time window;

[0023] When it is determined according to the load status data that the target device is overloaded, the first sampling frequency is reduced to obtain a second sampling frequency.

[0024] In a possible implementation, the method further includes:

[0025] When it is determined according to the load status data that the target device is not overloaded, the first sampling frequency is determined as a second sampling frequency.

[0026] In a second aspect, the present application provides a flow sampling device, the device comprising:

[0027] A sampling data acquisition module, used to sample the network traffic at the target device port at a first sampling frequency within a current monitoring time window to obtain a sampled traffic data set, and to obtain a total traffic data sequence of the target device port within the current monitoring time window;

[0028] A sampling frequency determination module is used to adjust the first sampling frequency according to the sampled traffic data set and the total traffic data sequence to obtain a second sampling frequency, so as to sample the network traffic at the target device port according to the second sampling frequency within the next time window.

[0029] In a possible implementation, the sampling frequency determination module includes:

[0030] A matching degree determination unit, used to determine the matching degree between the sampled flow data set and the total flow data sequence;

[0031] A sampling frequency adjustment unit is used to adjust the first sampling frequency according to the matching degree to obtain a second sampling frequency.

[0032] In a possible implementation, the matching degree determination unit includes:

[0033] A curve determination subunit, used for performing fitting processing on the sampled flow data set and the total flow data sequence respectively to obtain a sampled flow curve and a total flow curve;

[0034] The matching degree determination subunit is used to determine the overlap between the sampled flow curve and the total flow curve, and determine the overlap as the matching degree between the sampled flow data set and the total flow data sequence.

[0035] In a possible implementation manner, the curve determination subunit is used to:

[0036] Grouping the sampled flow data in the sampled flow data set according to a specified two-tuple to obtain a plurality of sampled flow data groups, wherein the two-tuple includes a source IP address and a destination IP address, the sampled flow data in the same sampled flow data group have the same two-tuple, and the sampled flow data in different sampled flow data groups have different two-tuples;

[0037] Performing fitting processing on each of the sampled flow data groups respectively to obtain a sub-sampling flow curve corresponding to each of the sampled flow data groups;

[0038] The sub-sampling flow curves of the plurality of sampling flow data groups are fitted to obtain a sampling flow curve.

[0039] In a possible implementation, the sampling frequency adjustment unit includes:

[0040] A sampling frequency increasing processing subunit, configured to increase the first sampling frequency to obtain a second sampling frequency when the matching degree is less than a preset matching degree threshold;

[0041] The sampling frequency reduction processing subunit is used to reduce the first sampling frequency to obtain a second sampling frequency when the matching degree is greater than or equal to the matching degree threshold.

[0042] In a possible implementation manner, the sampling frequency reduction processing subunit is used to:

[0043] Obtaining load status data of the target device within a current monitoring time window;

[0044] When it is determined according to the load status data that the target device is overloaded, the first sampling frequency is reduced to obtain a second sampling frequency.

[0045] In a possible implementation manner, the sampling frequency reduction processing subunit is used to:

[0046] When it is determined according to the load status data that the target device is not overloaded, the first sampling frequency is determined as a second sampling frequency.

[0047] In a third aspect, the present application provides a terminal / device / server, comprising: at least one communication interface; at least one bus connected to the at least one communication interface; at least one processor connected to the at least one bus; at least one memory connected to the at least one bus, wherein the processor is configured to:

[0048] In a current monitoring time window, the network traffic at the target device port is sampled at a first sampling frequency to obtain a sampled traffic data set, and a total traffic data sequence of the target device port in the current monitoring time window is obtained by monitoring;

[0049] According to the sampled traffic data set and the total traffic data sequence, the first sampling frequency is adjusted to obtain a second sampling frequency, so as to sample the network traffic at the target device port according to the second sampling frequency within the next monitoring time window.

[0050] In a fourth aspect, the present application further provides a computer storage medium storing computer executable instructions, wherein the computer executable instructions are used to execute the flow sampling method described in any one of the above items of the present application.

[0051] The above-mentioned technical scheme provided by the embodiment of the present application has the following advantages over the prior art: the method provided by the embodiment of the present application, by monitoring the sampled traffic data set and the total traffic data sequence of the target device within a certain time window, automatically adjusts the sampling frequency according to the monitored sampled traffic data set and the total traffic data sequence, to obtain the optimal sampling frequency, thereby avoiding the problem of incomplete samples caused by setting the sampling frequency too low and affecting the load of the network device due to setting the sampling frequency too high, and can effectively support network operation and maintenance work. The sampling data obtained by sampling the target device at the optimal sampling frequency can better reflect the actual situation of the current target device's network traffic size, CPU operating load and memory occupancy. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0053] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0054] One or more embodiments are exemplarily described by pictures in the corresponding drawings, and these exemplified descriptions do not constitute limitations on the embodiments. Elements with the same reference numerals in the drawings represent similar elements, and unless otherwise stated, the figures in the drawings do not constitute proportional limitations.

[0055] Figure 1 A flow chart of an embodiment of a flow sampling method provided in an embodiment of the present application;

[0056] Figure 2 A flow chart of another flow sampling method embodiment provided in the present application;

[0057] Figure 3 A sample topology diagram of a traffic sampling method provided in an embodiment of the present application;

[0058] Figure 4 A schematic diagram of a total flow curve provided in an embodiment of the present application;

[0059] Figure 5 A schematic diagram of a sampled flow data set provided in an embodiment of the present application;

[0060] Figure 6 A schematic diagram of a sub-sampling flow curve corresponding to a different sampling flow data group provided in an embodiment of the present application;

[0061] Figure 7 A comparison chart of sampling flow and total flow curve provided in an embodiment of the present application;

[0062] Figure 8 A flow chart of another flow sampling method embodiment provided in the embodiment of the present application;

[0063] Fig. 9 A schematic diagram of another sampled flow data set provided in an embodiment of the present application;

[0064] Fig.10 A comparison diagram of another sampling flow rate and total flow rate curve provided in an embodiment of the present application;

[0065] Fig.11 A flow visualization curve schematic diagram provided in an embodiment of the present application;

[0066] Fig.12 A block diagram of a flow sampling device provided in an embodiment of the present application;

[0067] Fig.13 A schematic diagram of the structure of a device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0068] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0069] The disclosure below provides many different embodiments or examples to realize the different structures of the present application. In order to simplify the disclosure of the present application, the parts and settings of specific examples are described below. Of course, they are only examples, and the purpose is not to limit the present application. In addition, the present application can repeat reference numbers and / or letters in different examples. This repetition is for the purpose of simplification and clarity, and does not itself indicate the relationship between the various embodiments and / or settings discussed.

[0070] In order to solve the technical problems that the setting of sampling frequency in the existing traffic sampling technology is relatively difficult, setting the sampling frequency too high will affect the load of network equipment and cause serious faults such as traffic loss, and setting the sampling frequency too low will cause incomplete samples and cannot effectively support network operation and maintenance work, the method provided in the present application can automatically adjust the sampling frequency to obtain the optimal sampling frequency, avoiding the problem that the sampling frequency is set too low to cause incomplete samples, and the sampling frequency is set too high to affect the load of network equipment. The sampling data obtained by sampling the target device at the optimal sampling frequency can better reflect the actual network traffic size, CPU operating load and memory occupancy of the current target device, and effectively support network operation and maintenance work.

[0071] Figure 1 The flow chart of an embodiment of a flow sampling method provided in the present application is as follows. In one embodiment, the execution subject of the method is a computer program or a computer device, such as Figure 1 As shown, it mainly includes the following steps:

[0072] Step 101: within a current monitoring time window, sample the network traffic at a target device port at a first sampling frequency to obtain a sampled traffic data set, and monitor and obtain a total traffic data sequence of the target device port within the current monitoring time window.

[0073] The traffic in modern networks is huge, and tens of thousands or even more packets may be generated per second. If all network traffic is analyzed, a huge amount of data will be generated, which will further lead to excessive CPU load and memory usage. Therefore, it is particularly important to sample and analyze network traffic. However, if the sampling frequency of network traffic is set too low, short-term network failures cannot be discovered in time, which will further lead to delays and packet loss in the network.

[0074] The traffic sampling method provided in the embodiment of the present application can avoid network failures caused by setting the sampling frequency too high or too low by automatically adjusting the sampling frequency of the network traffic. An Agent is deployed on a network device (such as a router or a switch). The Agent can be a software program or module whose main responsibility is to sample and preliminarily analyze network traffic locally on behalf of the server. In addition, the sflow protocol, netflow protocol, netstream protocol, and snmp protocol can also be configured on the network device. Traffic sampling refers to a traffic analysis method in which a network device uses an Agent and related protocols to sample and analyze traffic, and pushes the analysis results to a server.

[0075] In one embodiment, within the current monitoring time window, the network traffic at the target device port is sampled at a first sampling frequency to obtain a sampled traffic data set and the total traffic data sequence of the target device port within the current monitoring time window is specifically implemented as follows: within the current monitoring time window, the Agent analyzes the network device port traffic sampled data through the sflow protocol, samples the network traffic at the target device port at the first sampling frequency, and obtains the sampled traffic data set. At the same time, the network device port traffic sampled data is analyzed and monitored through the snmp protocol to obtain the total traffic data sequence of the target device port within the current monitoring time window.

[0076] Among them, each sampled traffic data set may include several sampled traffic data sequences, each sampled traffic data sequence may include multiple sampled traffic data, and each sampled traffic data contains information such as source IP address, destination IP address, traffic rate, sampling time and port number. Different sampled traffic data sequences are distinguished by source IP address and destination IP address. The total traffic data sequence may contain multiple total traffic data, and the total traffic data contains information such as input traffic rate, output traffic rate, time and port number. The above-mentioned traffic rate refers to the amount of data transmitted through the network per unit time, which can intuitively reflect the speed of network data transmission.

[0077] As a possible implementation manner, the total flow data sequence and the sampled flow data set obtained by the above sampling can be stored in a database.

[0078] Step 102: According to the sampled flow data set and the total flow data sequence, the first sampling frequency is adjusted to obtain a second sampling frequency, so as to sample the network flow at the target device port according to the second sampling frequency within the next monitoring time window.

[0079] In one embodiment, the first sampling frequency is adjusted according to the sampled traffic data set and the total traffic data sequence to obtain a second sampling frequency, so that the network traffic at the target device port is sampled according to the second sampling frequency in the next monitoring time window. The specific implementation method is: a fitting curve graph is obtained according to the sampled traffic data set and the total traffic data sequence, the fitting curve graph of the sampled traffic data set is compared with the fitting curve graph of the total traffic data sequence to obtain the curve coincidence, the first sampling frequency is adjusted according to the curve coincidence to obtain the second sampling frequency, and the network traffic at the target device port is sampled according to the second sampling frequency in the next monitoring time window until the sampling frequency is adjusted to the optimal sampling frequency.

[0080] The method provided in the embodiment of the present application monitors the sampled traffic data set and the total traffic data sequence of the target device within a certain time window, and automatically adjusts the sampling frequency according to the monitored sampled traffic data set and the total traffic data sequence to obtain the optimal sampling frequency, thereby avoiding the problem of incomplete samples caused by setting the sampling frequency too low and affecting the load of the network device due to setting the sampling frequency too high. The method can effectively support network operation and maintenance work, and the sampling data obtained by sampling the target device at the optimal sampling frequency can better reflect the actual network traffic size, CPU operating load and memory occupancy of the current target device.

[0081] Figure 2 A flow chart of another flow sampling method embodiment provided in the present application is shown in FIG. Figure 1 Based on the process shown in the figure, this paper mainly describes how to determine the matching degree between the sampled flow data set and the total flow data series, such as Figure 2 As shown, the following steps are included:

[0082] Step 201: within the current monitoring time window, sample the network traffic at the target device port at a first sampling frequency to obtain a sampled traffic data set, and monitor and obtain a total traffic data sequence of the target device port within the current monitoring time window.

[0083] For a detailed description of step 201, see the above Figure 1 Description of the relevant steps of the process shown in the embodiment.

[0084] Step 202: Fitting is performed on the sampled flow data set and the total flow data sequence to obtain a sampled flow curve and a total flow curve.

[0085] Fitting processing refers to fitting multiple data into a continuous curve. In one embodiment, the sampling flow data set and the total flow data sequence are fitted respectively to obtain the sampling flow curve and the total flow curve. The specific implementation method is as follows: first, the sampling flow data in the sampling flow data set are grouped according to the specified binary group to obtain multiple sampling flow data groups, wherein the above binary group includes the source IP address and the destination IP address. The sampling flow data with the same source IP address and destination IP address are divided into the same sampling flow data group, that is, the sampling flow data in the same sampling flow data group have the same binary group. Similarly, the sampling flow data with different source IP addresses and destination IP addresses are divided into different sampling flow data groups, that is, the sampling flow data in different sampling flow data groups have different binary groups.

[0086] Secondly, the sampling flow data in the several sampling flow data groups obtained after the above grouping are fitted to obtain the sub-sampling flow curve corresponding to each sampling flow data group, and then the sub-sampling flow curves of multiple sampling flow data groups are fitted to obtain the sampling flow curve. In addition, the sampling flow data set can also be processed in other ways to obtain the sampling flow curve, which is not limited to the embodiments of the present application.

[0087] In addition, the flow data in the total flow data sequence is fitted to obtain a total flow curve.

[0088] For example, Figure 3 Take the GE0 / 0 / 1 port of the monitoring router R2 as an example. Figure 3 A sample topology diagram of a flow sampling method provided in an embodiment of the present application, such as Figure 3 As shown in the figure, it mainly includes routers (R1 and R2), switches (S11, S12, S21, S22, S221) and servers. R represents router, S represents switch, GE0 / 0 / 1 is the port number of router R2, and 10.0.4.1, 10.0.3.1, 10.0.1.2, 10.0.1.1, 10.0.0.1 are the IP addresses of the servers.

[0089] Assuming that the first sampling frequency is 1 / 1000 and the current monitoring time window is 30 minutes, the Agent uses the SNMP protocol to monitor the target port of the network device to obtain the total flow data sequence, and uses the fitting algorithm to fit the total flow data sequence into a curve to obtain the total flow curve as shown below: Figure 4 As shown, Figure 4 A schematic diagram of a total flow curve provided in an embodiment of the present application is a flow curve at the R2 router port GE0 / 0 / 0 obtained by monitoring by Agent using the SNMP protocol.

[0090] Similarly, within the current monitoring time window, i.e., 30 minutes, the Agent uses the sflow protocol to monitor the target port of the network device at the first sampling frequency of 1 / 1000 to obtain the sampled traffic data set such as Figure 5 As shown, Figure 5 A schematic diagram of a sampled traffic data set provided in an embodiment of the present application.

[0091] See also Figure 5 , which contains 6 sampled traffic data groups corresponding to different source IP addresses and destination IP addresses. Each sampled traffic data group has the same source IP address and destination IP address. For example, the red box represents the sampled traffic data group corresponding to the source IP address 10.0.0.1 and the destination IP address 10.0.4.1. In addition, there are other sampled traffic data groups corresponding to the source IP address and the destination IP address in the figure, which will not be repeated here. Using the fitting algorithm, Figure 5 The sampled traffic data groups corresponding to the 6 pairs of source IP addresses and destination IP addresses shown in are fitted into a curve respectively, and the sub-sampling traffic curves corresponding to 6 different sampled traffic data groups are obtained as shown in Figure 6 As shown, Figure 6 A schematic diagram of sub-sampling flow curves corresponding to different sampling flow data groups provided in an embodiment of the present application.

[0092] See also Figure 6 , six different sub-sampling flow curves are superimposed to obtain a sampling flow curve. In addition, the sub-sampling flow curves can also be processed by other processing methods to obtain a sampling flow curve, which is not limited in the embodiment of the present application.

[0093] Step 203: determine the overlap between the sampled flow curve and the total flow curve, and determine the overlap as the matching degree between the sampled flow data set and the total flow data sequence.

[0094] Based on the relevant description of the above steps, the above sampling flow fitting curves are superimposed to obtain a sampling flow curve, and the overlap is determined according to the sampling flow curve and the total flow curve. In one embodiment, the overlap between the sampling flow curve and the total flow curve is determined, and the overlap is determined as the matching degree between the sampling flow data set and the total flow data sequence. The specific implementation method is: using the comparison chart of the sampling flow curve and the total flow curve to calculate the overlap, and determine the overlap as the matching degree between the sampling flow data set and the total flow data sequence.

[0095] For example, a comparison chart of the sampling flow rate and the total flow rate curve is obtained according to the above sampling flow rate curve and the total flow rate curve, such as Figure 7 As shown, Figure 7 A comparison chart of sampling flow and total flow curve provided in the embodiment of the present application is based on Figure 7The curve comparison diagram shown above uses the following formula to calculate the curve coincidence:

[0096]

[0097] Among them, score represents the curve coincidence, f sflow is the summary value of all sampled flow in the sampled flow data set at a certain moment, f snmp is the flow size in the total flow data sequence at a certain moment, N is a certain time period, that is, the time information monitored in the current monitoring time window, and time represents time.

[0098] by Figure 3 As an example of the sample topology diagram shown in the figure, the first sampling frequency is 1 / 1000. Figure 7 The relevant data in the sample flow and total flow curve comparison diagram shown in the figure is calculated to obtain a curve overlap of 0.8996, so the curve overlap of 0.8996 is used as the matching degree between the sample flow data set and the total flow data sequence. In addition, the matching degree between the sample flow data set and the total flow data sequence can also be obtained by other means, and the embodiment of the present application is not limited to this.

[0099] Step 204: According to the matching degree, the first sampling frequency is adjusted to obtain a second sampling frequency, so as to sample the network traffic at the target device port according to the second sampling frequency in the next monitoring time window.

[0100] In one embodiment, the first sampling frequency is adjusted according to the matching degree to obtain the second sampling frequency, and the specific implementation method for sampling the network traffic at the target device port according to the second sampling frequency in the next monitoring time window is: obtain a preset matching degree threshold, and when the current matching degree is greater than the preset matching degree threshold, use the first sampling frequency as the second sampling frequency; when the current matching degree is less than the preset matching degree threshold, adjust the first sampling frequency to obtain the second sampling frequency, and sample the network traffic at the target device port according to the second sampling frequency in the next monitoring time window.

[0101] For example, assuming that the preset matching threshold is 0.9 and 0.8996 is less than 0.9, then the first sampling frequency is adjusted to obtain the second sampling frequency. Assuming that the preset matching threshold is 0.8 and 0.8996 is greater than 0.8, then the first sampling frequency is used as the second sampling frequency, that is, there is no need to adjust the sampling frequency. In addition, the sampling frequency can also be adjusted in other ways, which is not limited in the embodiments of the present application.

[0102] pass Figure 2The relevant description of the process of the illustrated embodiment determines the matching degree between the sampled flow data set and the total flow data sequence based on the degree of overlap between the sampled flow curve and the total flow curve, which can more intuitively reflect the accuracy of the current sampled flow data. Furthermore, it can reflect whether the current sampling frequency is set too high or too low, so as to adjust the current sampling frequency and obtain the optimal sampling frequency.

[0103] Figure 8 A flow chart of another flow sampling method embodiment provided in the present application is as follows: Figure 8 As shown, in Figure 1 Based on the process shown, how to determine the second sampling frequency according to the matching degree is mainly described, including the following steps:

[0104] Step 801: within the current monitoring time window, sample the network traffic at the target device port at a first sampling frequency to obtain a sampled traffic data set, and monitor and obtain a total traffic data sequence of the target device port within the current monitoring time window.

[0105] Step 802: Determine the degree of match between the sampled flow data set and the total flow data sequence. If the degree of match is less than a preset degree of match threshold, execute step 803; if the degree of match is greater than or equal to the degree of match threshold, execute step 804.

[0106] For detailed description of step 801-step 802, please refer to the description of relevant steps in the above process, which will not be repeated here.

[0107] Step 803: Increase the first sampling frequency to obtain a second sampling frequency.

[0108] When the matching degree is less than the preset matching degree threshold, it means that the curve overlap between the sampled traffic curve and the total traffic curve is low, that is, the first sampling frequency is set low, and the sampled traffic data obtained is too little. Further, it means that the current sampled traffic data set cannot intuitively reflect the actual network traffic situation of the current port. The current sampled traffic data set may not have sampled the most critical network traffic data that can reflect network congestion or operating conditions. At this time, the sampling frequency needs to be adjusted.

[0109] In one embodiment, when the degree of match is less than a preset degree of match threshold, the first sampling frequency is increased to obtain the second sampling frequency in a specific implementation manner: pre-set an adjustment threshold of the sampling frequency, and when the degree of match is less than the preset degree of match threshold, increase the frequency according to the adjustment threshold, that is, increase the first sampling frequency by an adjustment threshold to obtain the second sampling frequency. In addition, the adjustment threshold may be multiplied by the first sampling frequency to obtain the second sampling frequency. In addition, the first sampling frequency may be increased in other ways, and the embodiment of the present application does not limit this.

[0110] For example, Figure 3 Taking the port number shown as an example, assuming that the preset matching degree threshold is 0.9, the first sampling frequency is 1 / 1000, and the adjustment threshold is 10, the actual matching degree obtained by the above calculation is 0.8996, 0.8996 is less than 0.9, that is, the matching degree is less than the preset matching degree threshold. According to the adjustment threshold 10, the first sampling frequency is increased by 1 / 1000 to obtain the second sampling frequency 1 / 100.

[0111] Step 804: Reduce the first sampling frequency to obtain a second sampling frequency.

[0112] When the matching degree is greater than or equal to the matching degree threshold, it means that the curve overlap between the sampling flow curve and the total flow curve is large. Further, it means that the current first sampling frequency is high. Therefore, the sampling flow data set collected according to the first sampling frequency is more comprehensive, and can better reflect the actual situation of the network flow operation of the current port. The network flow of the current port is monitored according to the sampling flow curve corresponding to the sampling flow data set, so as to timely discover whether the network flow of the current port is abnormally congested.

[0113] However, when the sampling frequency is too high, the network device will need to sample more data, the database and server memory usage will be higher, which may affect the CPU load and further lead to a lower network traffic rate on the current port. At this time, the sampling frequency needs to be adjusted.

[0114] In one embodiment, when the degree of match is greater than or equal to a matching degree threshold, the first sampling frequency is reduced to obtain a second sampling frequency. The specific implementation method is as follows: first, the load status data of the target device in the current monitoring time window is obtained, and whether to adjust the first sampling frequency is determined according to the load status data. For example, when it is determined according to the load status data that the target device is overloaded, the first sampling frequency can be reduced to obtain the second sampling frequency; when it is determined according to the load status data that the target device is not overloaded, the first sampling frequency is not adjusted, that is, the first sampling frequency is determined as the second sampling frequency.

[0115] Load status data can include CPU load, memory usage, time, etc. The network device configured with Agent monitors the CPU and memory load of the target device through the SNMP protocol to obtain load status data. Load status data can intuitively reflect the busyness and performance of the device.

[0116] As a possible implementation method, the target device uses Agent to monitor CPU and memory load conditions through the SNMP protocol to obtain load status data. In addition, the user can preset a memory load threshold and a CPU load threshold, and determine whether the first sampling frequency needs to be adjusted according to the load threshold.

[0117] For example, Figure 3 Taking the port shown as an example, the Agent monitors the target port GE0 / 0 / 1 through snmp, and finds that the cpu load is 49% and the memory usage is 48% during the current monitoring time window of the first sampling frequency. Assuming that the user presets the cpu load threshold to 50% and the preset memory usage to 50%, at this time, the cpu load and memory usage of the target device are both less than the preset load threshold, indicating that the current load of the target device is good, and there is no need to adjust the first sampling frequency, and the first sampling frequency can be used as the second sampling frequency. Similarly, when it is determined that the target device is overloaded according to the load status data, the first sampling frequency is reduced to obtain the second sampling frequency.

[0118] Step 805: Sample the network traffic at the target device port according to the second sampling frequency within the next monitoring time window.

[0119] In the next monitoring time window, the network traffic at the target device port is sampled according to the second sampling frequency. Figure 3 Taking the port shown as an example, for example, Figures 4 to 7 The data and curve graph are obtained when the first sampling frequency is 1 / 1000. Based on the description of the above steps, the second sampling frequency obtained after adjustment according to the first sampling frequency is 1 / 100.

[0120] The network traffic at the target device port is sampled according to the second sampling frequency 1 / 100, and the device command is used to control the Agent to sample the network traffic of the target port GE0 / 0 / 1 through the sflow protocol to obtain the sampled traffic data set as follows: Fig. 9 As shown, Fig. 9 A schematic diagram of another sample flow data set provided in an embodiment of the present application is shown in FIG. After the sample flow data sets are grouped, fitting processing and superposition processing are performed respectively to obtain a sample flow curve.

[0121] Use the device command to control the Agent to sample the network traffic of the target port GE0 / 0 / 1 through the SNMP protocol to obtain the total traffic data sequence, and fit the total traffic data sequence to obtain the total traffic curve. Figure 3 The network traffic of the target port GE0 / 0 / 1 is sampled. The total traffic curve here is the same as the above Figure 4 The total flow curve shown is the same and therefore will not be repeated here.

[0122] According to the sampling flow curve and the total flow curve, we can get Fig.10 The comparison of sampling flow and total flow curves shown in the figure, Fig.10 Another comparison chart of sampling flow and total flow curves provided in an embodiment of the present application.

[0123] See also Fig.10 , we can intuitively see that the sampled traffic curve and the total traffic curve are almost overlapped. The curve overlap score calculated by the above formula (I) is 0.952953, which is greater than the matching threshold of 0.9. The load status data of the target device monitored by the Agent through the SNMP protocol shows that the CPU and memory occupancy loads are both lower than the load threshold of 50%. At this time, it means that the second sampling frequency 1 / 100 is the optimal sampling frequency. Finally, the traffic visualization curve obtained by sampling the network traffic of the target device according to the second sampling frequency is as follows Fig.11 As shown, Fig.11 A schematic diagram of a flow visualization curve provided in an embodiment of the present application.

[0124] See also Fig.11 As shown, Fig.11 There are 6 curves in total, each corresponding to a different binary group. Each binary group contains a pair of source IP address and destination IP address to form a sub-sampling traffic curve. The above sub-sampling traffic curves are superimposed to obtain Fig.10 The sflow (10 / 1000) sampling flow curve shown in .

[0125] pass Figure 8 The relevant description of the process shown in the figure adjusts the first sampling frequency to obtain the second sampling frequency according to the curve overlap between the sampling flow curve and the total flow curve, and then obtains the flow visualization curve according to the second sampling frequency. This can intuitively reflect the actual situation of the network flow at the port of the current target device, and effectively support network operation and maintenance work based on the sampled flow data.

[0126] Fig.12 A flow sampling device block diagram provided in an embodiment of the present application, such as Fig.12 As shown, the device comprises:

[0127] The sampling data acquisition module 121 is used to sample the network traffic at the target device port according to the first sampling frequency within the current monitoring time window to obtain a sampled traffic data set, and to obtain a total traffic data sequence of the target device port within the current monitoring time window;

[0128] The sampling frequency determination module 122 is used to adjust the first sampling frequency according to the sampled traffic data set and the total traffic data sequence to obtain a second sampling frequency, so as to sample the network traffic at the target device port according to the second sampling frequency within the next time window.

[0129] In a possible implementation, the sampling frequency determination module 122 includes:

[0130] A matching degree determination unit, used to determine the matching degree between the sampled flow data set and the total flow data sequence;

[0131] A sampling frequency adjustment unit is used to adjust the first sampling frequency according to the matching degree to obtain a second sampling frequency.

[0132] In a possible implementation, the matching degree determination unit includes:

[0133] A curve determination subunit, used for performing fitting processing on the sampled flow data set and the total flow data sequence respectively to obtain a sampled flow curve and a total flow curve;

[0134] The matching degree determination subunit is used to determine the overlap between the sampled flow curve and the total flow curve, and determine the overlap as the matching degree between the sampled flow data set and the total flow data sequence.

[0135] In a possible implementation manner, the curve determination subunit is used to:

[0136] Grouping the sampled flow data in the sampled flow data set according to a specified two-tuple to obtain a plurality of sampled flow data groups, wherein the two-tuple includes a source IP address and a destination IP address, the sampled flow data in the same sampled flow data group have the same two-tuple, and the sampled flow data in different sampled flow data groups have different two-tuples;

[0137] Performing fitting processing on each of the sampled flow data groups respectively to obtain a sub-sampling flow curve corresponding to each of the sampled flow data groups;

[0138] The sub-sampling flow curves of the plurality of sampling flow data groups are fitted to obtain a sampling flow curve.

[0139] In a possible implementation, the sampling frequency adjustment unit includes:

[0140] A sampling frequency increasing processing subunit, configured to increase the first sampling frequency to obtain a second sampling frequency when the matching degree is less than a preset matching degree threshold;

[0141] The sampling frequency reduction processing subunit is used to reduce the first sampling frequency to obtain a second sampling frequency when the matching degree is greater than or equal to the matching degree threshold.

[0142] In a possible implementation manner, the sampling frequency reduction processing subunit is used to:

[0143] Obtaining load status data of the target device within a current monitoring time window;

[0144] When it is determined according to the load status data that the target device is overloaded, the first sampling frequency is reduced to obtain a second sampling frequency.

[0145] In a possible implementation manner, the sampling frequency reduction processing subunit is used to:

[0146] When it is determined according to the load status data that the target device is not overloaded, the first sampling frequency is determined as a second sampling frequency.

[0147] like Fig.13 As shown, the embodiment of the present application provides a flow sampling device, including a processor 111, a communication interface 112, a memory 113 and a communication bus 114, wherein the processor 111, the communication interface 112, and the memory 113 communicate with each other through the communication bus 114.

[0148] A memory 113, for storing computer programs;

[0149] In one embodiment of the present application, the processor 111 is used to execute the program stored in the memory 113 to implement the flow sampling method provided by any of the above method embodiments, including:

[0150] In a current monitoring time window, the network traffic at the target device port is sampled at a first sampling frequency to obtain a sampled traffic data set, and a total traffic data sequence of the target device port in the current monitoring time window is obtained by monitoring;

[0151] According to the sampled traffic data set and the total traffic data sequence, the first sampling frequency is adjusted to obtain a second sampling frequency, so as to sample the network traffic at the target device port according to the second sampling frequency within the next monitoring time window.

[0152] An embodiment of the present application further provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the steps of the flow sampling method provided in any of the aforementioned method embodiments are implemented.

[0153] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0154] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a general hardware platform, and of course, by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the relevant technology can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0155] It should be understood that the terms used herein are only for the purpose of describing specific example embodiments and are not intended to be limiting. Unless the context clearly indicates otherwise, the singular forms "one", "an" and "said" as used herein may also be meant to include plural forms. The terms "include", "comprise", "contain", and "have" are inclusive, and therefore specify the existence of stated features, steps, operations, elements and / or parts, but do not exclude the existence or addition of one or more other features, steps, operations, elements, parts, and / or combinations thereof. The method steps, processes, and operations described herein are not interpreted as necessarily requiring them to be performed in the specific order described or illustrated, unless the execution order is clearly indicated. It should also be understood that additional or alternative steps may be used.

[0156] The above description is only a specific implementation of the present application, so that those skilled in the art can understand or implement the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein can be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest range consistent with the principles and novel features applied for herein.

Claims

1. A flow sampling method, characterized in that: include: In a current monitoring time window, the network traffic at the target device port is sampled at a first sampling frequency to obtain a sampled traffic data set, and a total traffic data sequence of the target device port in the current monitoring time window is obtained by monitoring; According to the sampled traffic data set and the total traffic data sequence, the first sampling frequency is adjusted to obtain a second sampling frequency, so as to sample the network traffic at the target device port according to the second sampling frequency within the next monitoring time window.

2. The method according to claim 1, characterized in that The adjusting the first sampling frequency according to the sampled flow data set and the total flow data sequence to obtain a second sampling frequency includes: Determining a degree of match between the sampled flow data set and the total flow data sequence; According to the matching degree, the first sampling frequency is adjusted to obtain a second sampling frequency.

3. The method according to claim 2, characterized in that Determining the matching degree between the sampled flow data set and the total flow data sequence includes: Performing fitting processing on the sampled flow data set and the total flow data sequence respectively to obtain a sampled flow curve and a total flow curve; The degree of overlap between the sampled flow curve and the total flow curve is determined, and the degree of overlap is determined as the degree of match between the sampled flow data set and the total flow data sequence.

4. The method according to claim 3, characterized in that The fitting process of the sampled flow data set includes: Grouping the sampled flow data in the sampled flow data set according to a specified two-tuple to obtain a plurality of sampled flow data groups, wherein the two-tuple includes a source IP address and a destination IP address, the sampled flow data in the same sampled flow data group have the same two-tuple, and the sampled flow data in different sampled flow data groups have different two-tuples; Performing fitting processing on each of the sampled flow data groups respectively to obtain a sub-sampling flow curve corresponding to each of the sampled flow data groups; The sub-sampling flow curves of the plurality of sampling flow data groups are fitted to obtain a sampling flow curve.

5. The method according to claim 2, characterized in that: The adjusting the first sampling frequency according to the matching degree to obtain a second sampling frequency includes: When the matching degree is less than a preset matching degree threshold, increasing the first sampling frequency to obtain a second sampling frequency; When the matching degree is greater than or equal to the matching degree threshold, the first sampling frequency is reduced to obtain a second sampling frequency.

6. The method according to claim 5, characterized in that When the matching degree is greater than or equal to the matching degree threshold, reducing the first sampling frequency to obtain a second sampling frequency includes: Obtaining load status data of the target device within a current monitoring time window; When it is determined according to the load status data that the target device is overloaded, the first sampling frequency is reduced to obtain a second sampling frequency.

7. The method according to claim 6, characterized in that The method further comprises: When it is determined according to the load status data that the target device is not overloaded, the first sampling frequency is determined as a second sampling frequency.

8. A flow sampling device, characterized in that: The device comprises: A sampling data acquisition module, used to sample the network traffic at the target device port at a first sampling frequency within a current monitoring time window to obtain a sampled traffic data set, and to obtain a total traffic data sequence of the target device port within the current monitoring time window; A sampling frequency determination module is used to adjust the first sampling frequency according to the sampled traffic data set and the total traffic data sequence to obtain a second sampling frequency, so as to sample the network traffic at the target device port according to the second sampling frequency within the next time window.

9. A device, characterized in that: include: A processor and a memory, wherein the processor is used to execute a flow sampling program stored in the memory to implement the flow sampling method according to any one of claims 1 to 7.

10. A storage medium, characterized in that: The storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the flow sampling method according to any one of claims 1 to 7.

Images