Computer network anomaly detection and automatic repair system and method

Abstract

The invention discloses a computer network anomaly detection and automatic repair system and method, and belongs to the technical field of network security. The problem that an existing method is not suitable for synchronous use of a plurality of computers is solved, and different network states of the multi-user terminals are obtained by coding and sequencing the multi-user terminals and detecting networks of the multi-user terminals; extracting the code of the user terminal to which the network anomaly belongs, and quickly positioning the user terminal to which the network anomaly belongs according to the code of the user terminal to ensure that the method is suitable for network anomaly detection of multiple computers; the method comprises the following steps: acquiring a user terminal to which network abnormality belongs and a code, extracting a code of a nearest normal user terminal, and acquiring and continuously executing a current instruction of the abnormal user terminal by the normal user terminal to ensure the operation efficiency of an abnormal terminal event; analyzing network fault factors, and retrieving a corresponding repair strategy for repair; the effect of automatically repairing the computer network anomaly is ensured, and the effectiveness of the computer network anomaly detection and automatic repairing system is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to a computer network anomaly detection and automatic repair system and method. Background Art

[0002] Computer network refers to a computer system that connects multiple computers and their external devices with independent functions in different geographical locations through communication lines and communication equipment, and realizes resource sharing and information transmission under the management and coordination of network operating system, network management software and network communication protocol; computer network is mainly composed of some general and programmable hardware interconnected, which can be used to transmit many different types of data and support a wide range of and growing applications; network failure refers to the state in which the network cannot provide normal services or the service quality is reduced due to hardware problems, software vulnerabilities, virus intrusion, etc.

[0003] Existing network anomaly detection and automatic repair methods can promptly detect the cause of the anomaly and perform automatic repairs when facing a single computer. However, if facing multiple computers in a computer room, it is difficult to promptly and effectively detect network anomalies and to quickly perform automatic repairs.

[0004] Therefore, the existing needs are not met, and we propose a computer network anomaly detection and automatic repair system and method. Summary of the invention

[0005] The purpose of the present invention is to provide a computer network anomaly detection and automatic repair system and method, which can detect the network of multiple user terminals by coding and sorting them, and obtain different network states of multiple user terminals; extract the user terminal code to which the network anomaly belongs, and quickly locate the user terminal according to the user terminal code, so as to ensure that it is suitable for use in multiple computer network anomaly detection; by obtaining the user terminal and code to which the network anomaly belongs, extract the code of the nearest normal user terminal, and the normal user terminal obtains and continues to execute the current instruction of the abnormal user terminal, so as to ensure the running efficiency of the abnormal terminal event; then analyze the network failure factors, and retrieve the corresponding repair strategy for repair; ensure the effect of automatic repair of computer network anomalies, improve the effectiveness of the computer network anomaly detection and automatic repair system, and solve the problems raised in the above-mentioned background technology.

[0006] To achieve the above object, the present invention provides the following technical solutions:

[0007] Computer network anomaly detection and automatic repair system, including:

[0008] Network anomaly detection unit, used to

[0009] Detect the network connection status between multiple user terminals and switch ports and terminal ports in the computer room, obtain at least one normal network connection signal and abnormal network connection signal under the multiple user terminals, and transmit the abnormal network connection signal to the network positioning analysis unit for abnormality analysis based on wireless transmission technology;

[0010] Network location analysis unit, used for

[0011] Locate and divide the user terminals to which the normal network connection signal and the abnormal network connection signal belong, and obtain the user terminal codes of the normal network connection signal and the abnormal network connection signal, that is, the normal user terminal code and the abnormal user terminal code; then analyze the abnormal network connection signal to obtain the abnormal cause information;

[0012] Network automatic repair unit for

[0013] Receive the abnormal user terminal code, and extract the normal user terminal code that is closest to the abnormal user terminal code. The normal user terminal code obtains the current execution instruction of the abnormal user terminal code based on the wireless transmission technology, and continues to complete the unfinished instructions of the abnormal user terminal code, and then performs repair processing according to the abnormal factors of the current network abnormal state signal, and feeds back the repair completion signal to the network repair feedback unit;

[0014] Network repair feedback unit for

[0015] After receiving the network abnormal status signal repair completion signal, the repair completion signal is fed back to the corresponding user terminal based on wireless transmission technology. The user terminal continues to execute the current instruction based on the feedback signal, and then detects and feeds back the current operating status of the user terminal according to the network abnormality detection unit until the network operating status of the user terminal is normal.

[0016] Furthermore, the network anomaly detection unit includes:

[0017] Hardware anomaly detection module, used to detect whether the network cable connection between each user terminal and its switch port and terminal port is firm, and to detect whether the modem, router and network adapter are working properly;

[0018] The software anomaly detection module is used to detect whether the network settings of each user terminal are correct. The network settings include: IP address, subnet mask, default gateway and DNS server address configuration.

[0019] Furthermore, the network anomaly detection unit further includes:

[0020] A real-time monitoring module, used for real-time monitoring of the data collection time of the software anomaly detection module and the hardware anomaly detection module and the data transmission time of the data transmission to the network positioning analysis unit;

[0021] A data transmission response time acquisition module is used to obtain the time difference between the data collection time of the software anomaly detection module and the hardware anomaly detection module and the data transmission time when the software anomaly detection module and the hardware anomaly detection module are transmitted to the network positioning analysis unit by using the data collection time of the software anomaly detection module and the hardware anomaly detection module and the data transmission time when the software anomaly detection module and the hardware anomaly detection module are transmitted to the network positioning analysis unit; wherein the time difference between the data collection time of the software anomaly detection module and the hardware anomaly detection module and the data transmission time when the software anomaly detection module and the hardware anomaly detection module are transmitted to the network positioning analysis unit The corresponding data transmission response time of the module;

[0022] A data transmission response coefficient acquisition module, used to acquire the data transmission response coefficients corresponding to the software anomaly detection module and the hardware anomaly detection module by using the data transmission response times corresponding to the software anomaly detection module and the hardware anomaly detection module;

[0023] The data transmission response coefficients corresponding to the software anomaly detection module and the hardware anomaly detection module are obtained by the following formula:

[0024]

[0025] Wherein, Y represents the data transmission response coefficient; n represents the number of times the software anomaly detection module or the hardware anomaly detection module transmits data to the network positioning analysis unit; T yi represents the data transmission response time corresponding to the i-th data transmission; T e Indicates the preset data sending response time threshold; T ymax Indicates the maximum value of the data transmission response time corresponding to n data transmissions; T yp represents the average data transmission response time corresponding to n data transmissions; p represents the module theoretical response delay rate corresponding to each cycle duration of the software anomaly detection module and the hardware anomaly detection module, and the value range corresponding to the cycle duration is 6-12 months; m represents the number of cycle durations experienced by the software anomaly detection module and the hardware anomaly detection module; t represents the compensation coefficient, and the compensation coefficient is obtained by the following formula:

[0026]

[0027] Where t represents the compensation coefficient; m represents the number of cycles experienced by the software anomaly detection module and the hardware anomaly detection module; p irepresents the actual data transmission response time delay rate corresponding to the i-th cycle duration of the software anomaly detection module and the hardware anomaly detection module; p represents the module theoretical response delay rate corresponding to each cycle duration of the software anomaly detection module and the hardware anomaly detection module;

[0028] The data transmission operation abnormality judgment module is used to perform data transmission operation abnormality judgment on the software abnormality detection module and / or the hardware abnormality detection module corresponding to the data transmission response coefficient exceeding the preset data transmission response coefficient threshold value when the data transmission response coefficient corresponding to the software abnormality detection module and the hardware abnormality detection module exceeds the preset data transmission response coefficient threshold value.

[0029] Furthermore, the data transmission operation abnormality determination module includes:

[0030] a target monitoring module determination module, configured to use the software anomaly detection module and / or the hardware anomaly detection module corresponding to the data transmission response coefficient exceeding a preset data transmission response coefficient threshold as a target monitoring module;

[0031] A data transmission times extraction module, used to extract the data transmission times that cause data transmission delay during the data transmission from the target monitoring module to the network positioning analysis unit;

[0032] A data transmission response time extraction module is used to extract the data transmission response time corresponding to each data transmission that generates a data transmission delay;

[0033] A data transmission duration extraction module is used to extract the data transmission duration corresponding to each data transmission delay; wherein the data transmission duration refers to the sum of the data transmission response time length and the time length experienced during the data transmission process;

[0034] The data transmission response impact factor acquisition module is used to obtain the data transmission response impact factor by using the data transmission duration corresponding to each data transmission delay and the corresponding data transmission response time; wherein the data transmission response impact factor is obtained by the following formula:

[0035]

[0036] Wherein, K represents the data transmission response influencing factor; n represents the number of times the software anomaly detection module or the hardware anomaly detection module transmits data to the network positioning analysis unit; T yi represents the data transmission response time corresponding to the i-th data transmission; T si represents the actual data transmission duration corresponding to the i-th data transmission; T ki Indicates the theoretical data transmission duration corresponding to the i-th data transmission;

[0037] A comparison module, used for comparing the data sending response influencing factor with a preset factor threshold;

[0038] The abnormality determination and early warning module is used to determine that the data sending response is abnormal and issue a data sending response abnormality alarm when the data sending response influencing factor exceeds a preset factor threshold.

[0039] Furthermore, the network location analysis unit includes:

[0040] The terminal coding module is used to code and sort multiple user terminals in the computer room so that each user terminal obtains its own coding number;

[0041] A coding positioning module is used to obtain the user terminal according to the normal network connection signal and the abnormal network connection signal, and obtain the coding information in combination with the user terminal;

[0042] The abnormal classification module is used to classify the abnormal cause information of the network abnormal connection signal into factors, and the classification range includes: software failure factors and hardware failure factors.

[0043] Furthermore, the network automatic repair unit includes:

[0044] The positioning analysis module is used to receive the abnormal user terminal code, extract the adjacent user terminal code according to the current abnormal user terminal code, and filter out the normal user terminal code from the adjacent user terminal codes to obtain the normal user terminal closest to the abnormal user terminal;

[0045] The first-level repair module is used to control the adjacent normal user terminal to obtain and continue to execute the current instruction of the abnormal user terminal based on wireless transmission technology;

[0046] The secondary repair module is used to retrieve the corresponding repair strategy according to the current network fault factors of the user terminal;

[0047] The signal feedback module is used to feed back the current repair completion signal to the network repair feedback unit through wireless transmission technology, and synchronously copy the user terminal code during the feedback.

[0048] Furthermore, the secondary repair module includes

[0049] The strategy database is used to collect and store the repair strategies for various fault factors in the past, and to establish multiple search keywords based on the fault factors.

[0050] Furthermore, the network repair feedback unit includes

[0051] A signal association module, used for receiving a repair completion signal and a user terminal code, and associating the repair completion signal with the corresponding user terminal code;

[0052] The first-level feedback module is used to feed back the repair completion signal to the corresponding user terminal, urging the user terminal to continue to execute the current instruction;

[0053] The secondary feedback module is used to feed back the repair completion signal to the network anomaly detection unit, and urge the network anomaly detection unit to continue to perform network detection on the user terminal.

[0054] Furthermore, when the network anomaly detection unit detects a network anomaly in any one or more user terminals, it marks the abnormal user terminal and suspends detection until the secondary feedback module feeds back a signal that the user terminal has been repaired to the network anomaly detection unit, and then the network anomaly detection unit resumes detection.

[0055] The computer network anomaly detection and automatic repair method comprises the following steps:

[0056] S1. Sort the codes of multiple user terminals in the computer room so that each user terminal obtains its own code;

[0057] S2. Detect the network connection status between multiple user terminals and switch ports and terminal ports in the computer room to obtain the network status of multiple user terminals;

[0058] S3, obtaining the user terminal to which the abnormal network connection signal belongs, extracting the user terminal code of the nearest normal network connection signal according to the user terminal code, and the normal user terminal obtains the current instruction of the abnormal user terminal through wireless transmission technology, and replaces the abnormal user terminal to continue to execute the current instruction;

[0059] S4, analyzing the network failure factors of the abnormal user terminal and finding the category to which the network failure factors belong;

[0060] S5. Retrieve the corresponding repair strategy from the strategy database according to the network failure factor, and provide feedback to the abnormal user terminal and the network anomaly detection unit after the repair is completed;

[0061] S6. After receiving the repair completion signal, the abnormal user terminal continues to execute the current instruction, and the network anomaly detection unit continues to detect the network of the user terminal; if an abnormal signal is detected, it continues to feedback to the network positioning analysis unit, forming an iterative loop.

[0062] Compared with the prior art, the present invention has the following beneficial effects:

[0063] 1. The present invention obtains different network states of multiple user terminals by coding and sorting multiple user terminals in a computer room, and then detecting the network connection states between the multiple user terminals and the switch ports and the terminal ports; extracts the network abnormal connection signal and the user terminal code to which it belongs, and then quickly locates the user terminal to which it belongs according to the user terminal code, thereby ensuring that this method is suitable for use in network anomaly detection of multiple computers in a computer room.

[0064] 2. The present invention obtains the user terminal and code to which the network abnormal connection signal belongs, and extracts the code of the user terminal that is closest and has a normal network according to the user terminal code. The normal user terminal obtains the current instruction of the abnormal user terminal through wireless transmission technology, and replaces the abnormal user terminal to continue to execute the current instruction, so as to ensure that the event currently running by the abnormal terminal is not disturbed, thereby ensuring the efficiency of the event operation; secondly, the network fault factor is analyzed, and it is concluded that the network fault factor is a hardware fault or a software fault. According to the fault factor, the corresponding repair strategy is retrieved from the policy database, and the repair completion signal is fed back to the abnormal user terminal to enable it to continue to run, and then the network detection is continued through the network anomaly detection unit, thereby forming an iterative cycle; thereby ensuring the effect of automatic repair of computer network anomalies, and improving the effectiveness of the computer network anomaly detection and automatic repair system. BRIEF DESCRIPTION OF THE DRAWINGS

[0065] Figure 1 It is a composition diagram of the computer network anomaly detection and automatic repair system of the present invention;

[0066] Figure 2 The present invention is a flowchart of the computer network anomaly detection and automatic repair method. DETAILED DESCRIPTION

[0067] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0068] In order to solve the technical problem that the network anomaly detection and automatic repair method can detect the anomaly cause in time and perform automatic repair when facing a single computer, it is difficult to detect the network anomaly factor in time and effectively, and it is also difficult to perform automatic repair quickly when facing multiple computers in the computer room. Please refer to Figure 1-Figure 2 , this embodiment provides the following technical solutions:

[0069] Computer network anomaly detection and automatic repair system, including:

[0070] Network anomaly detection unit, used to

[0071] The network connection status between multiple user terminals and switch ports and terminal ports in the computer room is detected, at least one normal network connection signal and an abnormal network connection signal under the multiple user terminals are obtained, and the abnormal network connection signal is transmitted to the network positioning analysis unit for abnormal analysis based on wireless transmission technology; specifically, as is well known, there are many factors that affect the normal operation of computer networks; different repair methods need to be adopted for different reasons; therefore, in order to ensure the effectiveness of the repair method, when detecting network faults, it is necessary to determine the factors to which the fault belongs in the first place.

[0072] Network anomaly detection unit, including:

[0073] The hardware anomaly detection module is used to detect whether the network cable connection between each user terminal and its switch port and terminal port is firm, and to detect whether the modem, router and network adapter are working properly; specifically, first check the computer's hardware connection to ensure that the network cable connection is firm and the wireless network adapter is working properly; if it is a wireless connection, you can try to reconnect to the wireless network, or try to use a wired connection; secondly, if the hardware connection is normal, but the computer still cannot connect to the network, you can try to restart the router; and turn off the router power, wait a few seconds and then turn it back on to solve the problem.

[0074] The software anomaly detection module is used to detect whether the network settings of each user terminal are correct. The network settings include: IP address, subnet mask, default gateway and DNS server address configuration; specifically, in the specific implementation, if the network settings are incorrect, such as incorrect configuration of IP address, subnet mask, default gateway and DNS server address, it may cause network connection failure; first check the IP address, open the command prompt on the user terminal, that is, on the computer, enter the command ipconfi g, and check whether the IP address is normal; if an IP address conflict is found, you can try to modify the computer's IP address or restart the router; secondly, check the firewall settings. The firewall may block certain network connections. Check the firewall settings to ensure that the required network traffic is allowed to pass. You can turn off the firewall for testing.

[0075] Specifically, the network anomaly detection unit further includes:

[0076] A real-time monitoring module, used for real-time monitoring of the data collection time of the software anomaly detection module and the hardware anomaly detection module and the data transmission time of the data transmission to the network positioning analysis unit;

[0077] A data transmission response time acquisition module is used to obtain the time difference between the data collection time of the software anomaly detection module and the hardware anomaly detection module and the data transmission time when the software anomaly detection module and the hardware anomaly detection module are transmitted to the network positioning analysis unit by using the data collection time of the software anomaly detection module and the hardware anomaly detection module and the data transmission time when the software anomaly detection module and the hardware anomaly detection module are transmitted to the network positioning analysis unit; wherein the time difference between the data collection time of the software anomaly detection module and the hardware anomaly detection module and the data transmission time when the software anomaly detection module and the hardware anomaly detection module are transmitted to the network positioning analysis unit The corresponding data transmission response time of the module;

[0078] A data transmission response coefficient acquisition module, used to acquire the data transmission response coefficients corresponding to the software anomaly detection module and the hardware anomaly detection module by using the data transmission response times corresponding to the software anomaly detection module and the hardware anomaly detection module;

[0079] The data transmission response coefficients corresponding to the software anomaly detection module and the hardware anomaly detection module are obtained by the following formula:

[0080]

[0081] Wherein, Y represents the data transmission response coefficient; n represents the number of times the software anomaly detection module or the hardware anomaly detection module transmits data to the network positioning analysis unit; T yi represents the data transmission response time corresponding to the i-th data transmission; T e Indicates the preset data sending response time threshold; T ymax Indicates the maximum value of the data transmission response time corresponding to n data transmissions; T yp represents the average data transmission response time corresponding to n data transmissions; p represents the module theoretical response delay rate corresponding to each cycle duration of the software anomaly detection module and the hardware anomaly detection module, and the value range corresponding to the cycle duration is 6-12 months; m represents the number of cycle durations experienced by the software anomaly detection module and the hardware anomaly detection module; t represents the compensation coefficient, and the compensation coefficient is obtained by the following formula:

[0082]

[0083] Where t represents the compensation coefficient; m represents the number of cycles experienced by the software anomaly detection module and the hardware anomaly detection module; p i represents the actual data transmission response time delay rate corresponding to the i-th cycle duration of the software anomaly detection module and the hardware anomaly detection module; p represents the module theoretical response delay rate corresponding to each cycle duration of the software anomaly detection module and the hardware anomaly detection module;

[0084] The data transmission operation abnormality judgment module is used to perform data transmission operation abnormality judgment on the software abnormality detection module and / or the hardware abnormality detection module corresponding to the data transmission response coefficient exceeding the preset data transmission response coefficient threshold value when the data transmission response coefficient corresponding to the software abnormality detection module and the hardware abnormality detection module exceeds the preset data transmission response coefficient threshold value.

[0085] The technical effect of the above technical solution is: through the real-time monitoring module, the data collection and data transmission time of the software anomaly detection module and the hardware anomaly detection module can be tracked in real time, so as to accurately calculate the data transmission response time. This function is crucial for timely discovering and locating delay problems in data transmission, and helps to quickly respond to network or system anomalies.

[0086] The data transmission response time is used to calculate the data transmission response coefficient (Y) through a complex but accurate formula. This coefficient not only takes into account the response time of a single data transmission, but also incorporates multiple factors such as the average response time of multiple transmissions, the maximum response time, the preset response time threshold, the cycle length of the module operation, and the corresponding theoretical / actual response delay rate. This multi-dimensional evaluation method makes the evaluation of data transmission performance more comprehensive and accurate.

[0087] By setting a preset data transmission response coefficient threshold, when the data transmission response coefficient of the software or hardware anomaly detection module exceeds this threshold, it can be determined that the data transmission operation is abnormal. This quantitative indicator-based anomaly determination method has higher accuracy and flexibility than the traditional experience-based or simple threshold-based method, and can more effectively identify potential network or system problems.

[0088] When calculating the data sending response coefficient, a compensation coefficient (t) is introduced. This coefficient takes into account the difference between the actual data sending response time delay rate and the theoretical delay rate of the module in different operating cycles, thereby correcting the evaluation deviation caused by periodic changes to a certain extent and improving the accuracy of the evaluation results.

[0089] Through the implementation of the above technical solutions, abnormal problems in data transmission can be discovered and located in a timely manner, providing strong support for system maintenance and optimization. At the same time, through continuous monitoring and evaluation of data transmission performance, the system's network architecture and data processing flow can be continuously improved and optimized, improving the overall performance and stability of the system.

[0090] In summary, this technical solution effectively improves the accuracy and efficiency of network anomaly detection through real-time monitoring, precise evaluation, flexible judgment and precise compensation, providing a strong guarantee for the stable operation of the system.

[0091] Specifically, the data transmission operation abnormality determination module includes:

[0092] a target monitoring module determination module, configured to use the software anomaly detection module and / or the hardware anomaly detection module corresponding to the data transmission response coefficient exceeding a preset data transmission response coefficient threshold as a target monitoring module;

[0093] A data transmission times extraction module, used to extract the data transmission times that cause data transmission delay during the data transmission from the target monitoring module to the network positioning analysis unit;

[0094] A data transmission response time extraction module is used to extract the data transmission response time corresponding to each data transmission that generates a data transmission delay;

[0095] A data transmission duration extraction module is used to extract the data transmission duration corresponding to each data transmission delay; wherein the data transmission duration refers to the sum of the data transmission response time length and the time length experienced during the data transmission process;

[0096] The data transmission response impact factor acquisition module is used to obtain the data transmission response impact factor by using the data transmission duration corresponding to each data transmission delay and the corresponding data transmission response time; wherein the data transmission response impact factor is obtained by the following formula:

[0097]

[0098] Wherein, K represents the data transmission response influencing factor; n represents the number of times the software anomaly detection module or the hardware anomaly detection module transmits data to the network positioning analysis unit; T yi represents the data transmission response time corresponding to the i-th data transmission; T si represents the actual data transmission duration corresponding to the i-th data transmission; T ki Indicates the theoretical data transmission duration corresponding to the i-th data transmission;

[0099] A comparison module, used for comparing the data sending response influencing factor with a preset factor threshold;

[0100] The abnormality determination and early warning module is used to determine that the data sending response is abnormal and issue a data sending response abnormality alarm when the data sending response influencing factor exceeds a preset factor threshold.

[0101] The technical effect of the above technical solution is that through the target monitoring module determination module, the software anomaly detection module or hardware anomaly detection module that exceeds the preset data transmission response coefficient threshold can be accurately identified as the target monitoring module. This precise positioning helps to concentrate resources for in-depth analysis of potential problem modules, thereby improving the efficiency of anomaly detection.

[0102] This technical solution not only considers the data transmission response time, but also introduces multiple dimensions such as the number of data transmissions, actual data transmission duration, and theoretical data transmission duration for analysis. This multi-dimensional data analysis method can more comprehensively reflect the problems in the data transmission process and improve the accuracy of abnormality judgment.

[0103] By calculating the data transmission response impact factor (K), the relationship between the data transmission response time, the actual data transmission time and the theoretical data transmission time is comprehensively considered. This indicator can more accurately reflect the performance deviation in the data transmission process and provide a more scientific basis for abnormal judgment.

[0104] The comparison module compares the calculated data transmission response impact factor with the preset factor threshold. When the threshold is exceeded, the abnormal judgment and early warning module will trigger an alarm. This flexible abnormal judgment and early warning mechanism can timely discover and respond to abnormal problems in data transmission to prevent the problem from further expanding.

[0105] Through real-time monitoring and abnormal judgment of the data transmission process, this technical solution can promptly discover and solve potential network or system problems, thereby improving the stability and reliability of the entire system. This is especially important for application scenarios that require high reliability and low latency, such as financial transactions and real-time communications.

[0106] By continuously collecting and analyzing various data during the data transmission process, we can provide strong support for the continuous optimization of the system. According to the changing trend of the data transmission response influencing factors, we can adjust the network configuration, optimize the data processing process, etc., to further improve the performance of the system.

[0107] In summary, this technical solution effectively improves the monitoring and anomaly judgment capabilities of the data transmission process by accurately locating abnormal modules, performing multi-dimensional data analysis, introducing factors affecting data sending responses, and establishing flexible anomaly judgment and early warning mechanisms, providing a strong guarantee for the stable operation and continuous optimization of the system.

[0108] Network location analysis unit, used for

[0109] Positioning and dividing the user terminals to which the normal network connection signal and the abnormal network connection signal belong, obtaining the user terminal codes of the normal network connection signal and the abnormal network connection signal, that is, the normal user terminal code and the abnormal user terminal code; then analyzing the abnormal network connection signal to obtain abnormal cause information; the network positioning analysis unit includes:

[0110] The terminal coding module is used to code and sort multiple user terminals in the computer room so that each user terminal obtains its own coding number;

[0111] In this embodiment, for example, a computer room is provided with twenty computer devices, namely, the user terminals mentioned above, and the twenty user terminals are coded and sorted in sequence, namely, A1, A2, A3, A4, A5, ..., A20, based on which each user terminal obtains its own code, so that when a network abnormality is detected in a user terminal, the user terminal to which it belongs can be quickly determined according to the code.

[0112] A coding positioning module is used to obtain the user terminal according to the normal network connection signal and the abnormal network connection signal, and obtain the coding information in combination with the user terminal;

[0113] Continuing with the above embodiment, for example, the network anomaly detection unit detects that a file transfer speed value of a certain user terminal is lower than a preset transmission threshold, thereby obtaining a network abnormal connection signal of the user terminal, and the terminal code is obtained according to the user terminal to which the signal belongs, that is, the A4 user terminal. Based on this, it is not only convenient to quickly locate the position of the abnormal user terminal, but also convenient to find the normal user terminal adjacent to the A4 user terminal.

[0114] The abnormal classification module is used to classify the abnormal cause information of the network abnormal connection signal into factors, and the classification range includes: software failure factors and hardware failure factors;

[0115] Continuing with the above embodiment, for example, network detection is performed on multiple user terminals through a hardware anomaly detection module and a software anomaly detection module, and it is detected that the network anomaly factor of the A4 user terminal is an IP address setting error. Based on this, it is concluded that the network anomaly factor of the A4 user terminal is a software fault, and thus it is classified as a software fault factor, and so on, so as to perform targeted repairs on the network anomaly.

[0116] Network automatic repair unit for

[0117] Receive the abnormal user terminal code, and extract the normal user terminal code that is closest to the abnormal user terminal code. The normal user terminal code obtains the current execution instruction of the abnormal user terminal code based on the wireless transmission technology, and continues to complete the unfinished instruction of the abnormal user terminal code, and then performs repair processing according to the abnormal factors of the current network abnormal state signal, and feeds back the repair completion signal to the network repair feedback unit; the network automatic repair unit includes:

[0118] The positioning analysis module is used to receive the abnormal user terminal code, extract the adjacent user terminal code according to the current abnormal user terminal code, and filter out the normal user terminal code from the adjacent user terminal codes to obtain the normal user terminal closest to the abnormal user terminal;

[0119] Continuing with the above embodiment, for example, it is detected that the A4 user terminal has a network anomaly, and the user terminal codes adjacent to it are obtained according to the A4 code: A1, A2, A3 and A5, A6, A7. The network anomaly detection unit detects that A1, A2, A3 and A5, A6, A7 are all normal user terminals; then the current running instructions of A1, A2, A3 and A5, A6, A7 are obtained through wireless transmission technology, and it is concluded that the current running loads of A2 and A5 are relatively low; further, according to the distribution of A2, it is concluded that A5 is closest to A4, so the A5 user terminal is selected to assist the A4 user terminal in automatic repair.

[0120] The first-level repair module is used to control the adjacent normal user terminal to obtain and continue to execute the current instruction of the abnormal user terminal based on wireless transmission technology;

[0121] Continuing with the above embodiment, for example, after the A5 user terminal is screened out to assist the A4 user terminal in performing automatic repair, the A5 user terminal obtains the information of the event currently being run by the A4 user terminal through wireless transmission technology, such as text upload. After the A5 user terminal obtains the running event, it continues to take over the A4 user terminal to upload text through wireless transmission technology until the network of the A4 user terminal is normal. The A5 user terminal suspends the taking over work, and then the A4 user terminal continues to upload on its own, thereby realizing the process of assisting the A4 user terminal in performing automatic repair, ensuring that the abnormal user terminal running events are not interfered with, and ensuring the event running efficiency.

[0122] The secondary repair module is used to retrieve the corresponding repair strategy according to the current fault factor of the network of the user terminal; the secondary repair module includes: a strategy database, which is used to collect and store the repair strategies of various fault factors in the past, and establish multiple search keywords based on the fault factors;

[0123] Continuing with the above embodiment, for example, when the A5 user terminal takes over the work of the A4 user terminal, the network abnormality factor of the A4 user terminal is obtained as an IP address setting error, and the fault category to which it belongs is a software fault factor; by searching the policy database for keywords with the same factors such as IP address setting error or IP address repair, the corresponding repair strategy is obtained, and the network abnormality of the A4 user terminal is repaired according to the obtained repair strategy, thereby further realizing the process of automatically repairing the computer network abnormality.

[0124] The signal feedback module is used to feed back the current repair completion signal to the network repair feedback unit through wireless transmission technology, and synchronously copy the user terminal code during the feedback.

[0125] Network repair feedback unit for

[0126] After receiving the network abnormal state signal repair completion signal, the repair completion signal is fed back to the corresponding user terminal based on the wireless transmission technology, and the user terminal continues to run the current instruction based on the feedback signal, and then detects and feeds back the current running state of the user terminal according to the network abnormality detection unit until the network running state of the user terminal is normal; the network repair feedback unit includes:

[0127] A signal association module, used for receiving a repair completion signal and a user terminal code, and associating the repair completion signal with the corresponding user terminal code;

[0128] Continuing with the above embodiment, for example, after the IP address of the A4 user terminal is repaired, the repair completion signal and the user terminal code to which it belongs are fed back here, and the user terminal code to which it belongs, that is, the A4 user terminal is associated with the repair completion signal, thereby obtaining a complete repair completion signal, that is, the A4 user terminal has been repaired, and the signal is transmitted to the A4 user terminal and the network anomaly detection unit respectively.

[0129] The first-level feedback module is used to feed back the repair completion signal to the corresponding user terminal, urging the user terminal to continue to execute the current instruction;

[0130] Continuing with the above embodiment, for example, a signal "the A4 user terminal has been repaired" is fed back to the A4 user terminal. After the A4 user terminal receives the signal based on wireless transmission technology, the buffer processor obtains the currently running instruction, i.e., text upload. The A5 user terminal has taken over the text upload to 80%. At this time, the A5 user terminal suspends the taking over work, and the A4 user terminal continues to upload the text, thereby maximizing the efficiency of text upload.

[0131] The secondary feedback module is used to feed back the repair completion signal to the network anomaly detection unit, and urge the network anomaly detection unit to continue network detection on the user terminal; wherein, when the network anomaly detection unit detects that any one or more user terminals have a network anomaly, the abnormal user terminal is marked and detection is suspended until the secondary feedback module feeds back the user terminal repair completion signal to the network anomaly detection unit, and the network anomaly detection unit resumes detection on it;

[0132] Continuing with the above embodiment, for example, while feeding back the "A4 user terminal has been repaired" signal to the A4 user terminal, the signal is also fed back to the network anomaly detection unit; after the A4 user terminal continues to work normally, the network anomaly detection unit resumes the detection of the network status of the A4 user terminal; if an anomaly is detected in the A4 user terminal network again in the subsequent time, the report is continued to be processed upward, and so on, forming an iterative loop, thereby ensuring the effectiveness of the computer network anomaly detection and automatic repair system.

[0133] In order to better demonstrate the operation process of computer network anomaly detection and automatic repair, the present invention provides a computer network anomaly detection and automatic repair method, including the following steps:

[0134] S1. Sort the codes of multiple user terminals in the computer room so that each user terminal obtains its own code;

[0135] S2. Detect the network connection status between multiple user terminals and switch ports and terminal ports in the computer room to obtain the network status of multiple user terminals;

[0136] S3, obtaining the user terminal to which the abnormal network connection signal belongs, extracting the user terminal code of the nearest normal network connection signal according to the user terminal code, and the normal user terminal obtains the current instruction of the abnormal user terminal through wireless transmission technology, and replaces the abnormal user terminal to continue to execute the current instruction;

[0137] S4, analyzing the network failure factors of the abnormal user terminal and finding the category to which the network failure factors belong;

[0138] S5. Retrieve the corresponding repair strategy from the strategy database according to the network failure factor, and provide feedback to the abnormal user terminal and the network anomaly detection unit after the repair is completed;

[0139] S6. After receiving the repair completion signal, the abnormal user terminal continues to execute the current instruction, and the network anomaly detection unit continues to detect the network of the user terminal; if an abnormal signal is detected, it continues to feedback to the network positioning analysis unit, forming an iterative loop.

[0140] The beneficial effects achieved by the above content are as follows: through the above method, under the condition of multiple computers in the computer room, the user terminal to which the network fault belongs can still be located at the fastest speed; and after determining that a certain user terminal is in a network abnormality, the user terminal with the closest distance and a normal network state is screened out according to the coding sequence, and the normal user terminal obtains and continues to execute the current instructions of the abnormal user terminal through wireless technology to ensure that the operation event to which the abnormal user terminal belongs is not disturbed and the event operation efficiency is ensured; then the network abnormality factors are analyzed and the corresponding repair strategies are retrieved; and the repair completion signal is fed back to the user terminal to enable it to operate normally; and the network detection of the user terminal is continued, and the abnormal state is detected and continued to be reported, thereby iterating the cycle to ensure the effect of automatic repair of computer network abnormalities and improve the effectiveness of the computer network abnormality detection and automatic repair system.

[0141] Working principle: by coding and sorting multiple user terminals in the computer room, and then detecting the network connection status between multiple user terminals and the switch port and terminal port, different network status of multiple user terminals are obtained; the network abnormal connection signal and the user terminal code to which it belongs are extracted, and then the user terminal to which it belongs is quickly located according to the user terminal code; by obtaining the user terminal and code to which the network abnormal connection signal belongs, the code of the user terminal with the closest distance and normal network is extracted according to the user terminal code, and the normal user terminal obtains the current instruction of the abnormal user terminal through wireless transmission technology, and replaces the abnormal user terminal to continue to execute the current instruction; secondly, the network fault factor is analyzed, and it is concluded that the network fault factor is a hardware fault or a software fault. According to the fault factor, the corresponding repair strategy is retrieved in the policy database, and the repair completion signal is fed back to the abnormal user terminal to enable it to continue to run, and then the network detection is continued through the network abnormality detection unit, thereby forming an iterative cycle.

[0142] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device.

[0143] While the embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and alterations may be made to the embodiments without departing from the principles and spirit of the invention.

Claims

1. Computer network anomaly detection and automatic repair system, including: Network anomaly detection unit, used to Detect the network connection status between multiple user terminals and switch ports and terminal ports in the computer room, obtain at least one normal network connection signal and abnormal network connection signal under the multiple user terminals, and transmit the abnormal network connection signal to the network positioning analysis unit for abnormality analysis based on wireless transmission technology; Network location analysis unit, used for Locate and divide the user terminals to which the normal network connection signal and the abnormal network connection signal belong, obtain the user terminal codes of the normal network connection signal and the abnormal network connection signal, and then analyze the abnormal network connection signal to obtain the abnormal cause information; Network automatic repair unit for Receive the abnormal user terminal code, and extract the normal user terminal code that is closest to the abnormal user terminal code. The normal user terminal code obtains the current execution instruction of the abnormal user terminal code based on the wireless transmission technology, and continues to complete the unfinished instructions of the abnormal user terminal code, and then performs repair processing according to the abnormal factors of the current network abnormal state signal, and feeds back the repair completion signal to the network repair feedback unit; Network repair feedback unit for After receiving the network abnormal status signal repair completion signal, the repair completion signal is fed back to the corresponding user terminal based on wireless transmission technology. The user terminal continues to execute the current instruction based on the feedback signal, and then detects and feeds back the current operating status of the user terminal according to the network abnormality detection unit until the network operating status of the user terminal is normal.

2. The computer network anomaly detection and automatic repair system according to claim 1, characterized in that: The network anomaly detection unit comprises Hardware anomaly detection module, used to detect whether the network cable connection between each user terminal and its switch port and terminal port is firm, and to detect whether the modem, router and network adapter are working properly; The software anomaly detection module is used to detect whether the network settings of each user terminal are correct. The network settings include: IP address, subnet mask, default gateway and DNS server address configuration.

3. The computer network anomaly detection and automatic repair system according to claim 2, characterized in that: The network anomaly detection unit further includes: A real-time monitoring module, used for real-time monitoring of the data collection time of the software anomaly detection module and the hardware anomaly detection module and the data transmission time of the data transmission to the network positioning analysis unit; A data transmission response time acquisition module is used to obtain the time difference between the data collection time of the software anomaly detection module and the hardware anomaly detection module and the data transmission time when the software anomaly detection module and the hardware anomaly detection module are transmitted to the network positioning analysis unit by using the data collection time of the software anomaly detection module and the hardware anomaly detection module and the data transmission time when the software anomaly detection module and the hardware anomaly detection module are transmitted to the network positioning analysis unit; wherein the time difference between the data collection time of the software anomaly detection module and the hardware anomaly detection module and the data transmission time when the software anomaly detection module and the hardware anomaly detection module are transmitted to the network positioning analysis unit The corresponding data transmission response time of the module; A data transmission response coefficient acquisition module, used to acquire the data transmission response coefficients corresponding to the software anomaly detection module and the hardware anomaly detection module by using the data transmission response times corresponding to the software anomaly detection module and the hardware anomaly detection module; The data transmission response coefficients corresponding to the software anomaly detection module and the hardware anomaly detection module are obtained by the following formula: Wherein, Y represents the data transmission response coefficient; n represents the number of times the software anomaly detection module or the hardware anomaly detection module transmits data to the network positioning analysis unit; T yi represents the data transmission response time corresponding to the i-th data transmission; T e Indicates the preset data sending response time threshold; T ymax Indicates the maximum value of the data transmission response time corresponding to n data transmissions; T yp represents the average data transmission response time corresponding to n data transmissions; p represents the module theoretical response delay rate corresponding to each cycle duration of the software anomaly detection module and the hardware anomaly detection module, and the value range corresponding to the cycle duration is 6-12 months; m represents the number of cycle durations experienced by the software anomaly detection module and the hardware anomaly detection module; t represents the compensation coefficient, and the compensation coefficient is obtained by the following formula: Where t represents the compensation coefficient; m represents the number of cycles experienced by the software anomaly detection module and the hardware anomaly detection module; p i represents the actual data transmission response time delay rate corresponding to the i-th cycle duration of the software anomaly detection module and the hardware anomaly detection module; p represents the module theoretical response delay rate corresponding to each cycle duration of the software anomaly detection module and the hardware anomaly detection module; The data transmission operation abnormality judgment module is used to perform data transmission operation abnormality judgment on the software abnormality detection module and / or the hardware abnormality detection module corresponding to the data transmission response coefficient exceeding the preset data transmission response coefficient threshold value when the data transmission response coefficient corresponding to the software abnormality detection module and the hardware abnormality detection module exceeds the preset data transmission response coefficient threshold value.

4. The computer network anomaly detection and automatic repair system according to claim 3, characterized in that: The data transmission operation abnormality determination module includes: a target monitoring module determination module, configured to use the software anomaly detection module and / or the hardware anomaly detection module corresponding to the data transmission response coefficient exceeding a preset data transmission response coefficient threshold as a target monitoring module; A data transmission times extraction module, used to extract the data transmission times that cause data transmission delay during the data transmission from the target monitoring module to the network positioning analysis unit; A data transmission response time extraction module is used to extract the data transmission response time corresponding to each data transmission that generates a data transmission delay; A data transmission duration extraction module is used to extract the data transmission duration corresponding to each data transmission delay; wherein the data transmission duration refers to the sum of the data transmission response time length and the time length experienced during the data transmission process; The data transmission response impact factor acquisition module is used to obtain the data transmission response impact factor by using the data transmission duration corresponding to each data transmission delay and the corresponding data transmission response time; wherein the data transmission response impact factor is obtained by the following formula: Wherein, K represents the data transmission response influencing factor; n represents the number of times the software anomaly detection module or the hardware anomaly detection module transmits data to the network positioning analysis unit; T yi represents the data transmission response time corresponding to the i-th data transmission; T si represents the actual data transmission duration corresponding to the i-th data transmission; T ki Indicates the theoretical data transmission duration corresponding to the i-th data transmission; A comparison module, used for comparing the data sending response influencing factor with a preset factor threshold; The abnormality determination and early warning module is used to determine that the data sending response is abnormal and issue a data sending response abnormality alarm when the data sending response influencing factor exceeds a preset factor threshold.

5. The computer network anomaly detection and automatic repair system according to claim 1, characterized in that: The network location analysis unit includes: The terminal coding module is used to code and sort multiple user terminals in the computer room so that each user terminal obtains its own coding number; A coding positioning module is used to obtain the user terminal according to the normal network connection signal and the abnormal network connection signal, and obtain the coding information in combination with the user terminal; The abnormal classification module is used to classify the abnormal cause information of the network abnormal connection signal into factors, and the classification range includes: software failure factors and hardware failure factors.

6. The computer network anomaly detection and automatic repair system according to claim 1, characterized in that: The network automatic repair unit includes: The positioning analysis module is used to receive the abnormal user terminal code, extract the adjacent user terminal code according to the current abnormal user terminal code, and filter out the normal user terminal code from the adjacent user terminal codes to obtain the normal user terminal closest to the abnormal user terminal; The first-level repair module is used to control the adjacent normal user terminal to obtain and continue to execute the current instruction of the abnormal user terminal based on wireless transmission technology; The secondary repair module is used to retrieve the corresponding repair strategy according to the current network fault factors of the user terminal; The signal feedback module is used to feed back the current repair completion signal to the network repair feedback unit through wireless transmission technology, and synchronously copy the user terminal code during the feedback.

7. The computer network anomaly detection and automatic repair system according to claim 6, characterized in that: The secondary repair module includes The strategy database is used to collect and store the repair strategies for various fault factors in the past, and to establish multiple search keywords based on the fault factors.

8. The computer network anomaly detection and automatic repair system according to claim 1, characterized in that: The network repair feedback unit includes A signal association module, used for receiving a repair completion signal and a user terminal code, and associating the repair completion signal with the corresponding user terminal code; The first-level feedback module is used to feed back the repair completion signal to the corresponding user terminal, urging the user terminal to continue to execute the current instruction; The secondary feedback module is used to feed back the repair completion signal to the network anomaly detection unit, and urge the network anomaly detection unit to continue to perform network detection on the user terminal.

9. The computer network anomaly detection and automatic repair system according to claim 8, characterized in that: When the network anomaly detection unit detects that any one or more user terminals have a network anomaly, it marks the abnormal user terminal and suspends detection until the secondary feedback module feeds back a repair completion signal of the user terminal to the network anomaly detection unit, and then the network anomaly detection unit resumes detection.

10. A method for detecting and automatically repairing anomalies in a computer network, implemented based on the computer network anomaly detection and automatic repair system according to any one of claims 1 to 9, characterized in that: The following steps are involved: S1. Sort the codes of multiple user terminals in the computer room so that each user terminal obtains its own code; S2. Detect the network connection status between multiple user terminals and switch ports and terminal ports in the computer room to obtain the network status of multiple user terminals; S3, obtaining the user terminal to which the abnormal network connection signal belongs, extracting the user terminal code of the nearest normal network connection signal according to the user terminal code, and the normal user terminal obtains the current instruction of the abnormal user terminal through wireless transmission technology, and replaces the abnormal user terminal to continue to execute the current instruction; S4, analyzing the network failure factors of the abnormal user terminal and finding the category to which the network failure factors belong; S5. Retrieve the corresponding repair strategy from the strategy database according to the network failure factor, and provide feedback to the abnormal user terminal and the network anomaly detection unit after the repair is completed; S6. After receiving the repair completion signal, the abnormal user terminal continues to execute the current instruction, and the network anomaly detection unit continues to detect the network of the user terminal; if an abnormal signal is detected, it continues to feedback to the network positioning analysis unit, forming an iterative loop.

Images