Cloud network monitoring diagnosis method and device, electronic equipment and storage medium

Abstract

The invention discloses a cloud network monitoring diagnosis method and device, electronic equipment and a storage medium, and the method comprises the steps: determining a protocol format corresponding to each network flow message based on a neural network model after obtaining each network flow message in a cloud network; and then decoding each network flow message by adopting a decoding mode corresponding to the protocol format to obtain a transaction routing (BTR) text corresponding to each network flow message. After the IP information of the target user is obtained, performing session association and traffic tracking on the network traffic message of the target user according to the IP information and each transaction routing BTR text; and communication fault diagnosis is carried out on the network flow message of the target user through session association and flow tracking. According to the invention, the network flow message decoding accuracy and efficiency are improved. And communication fault diagnosis is carried out on the network flow message of the target user. And the accuracy and effectiveness of cloud network monitoring diagnosis are improved.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a cloud network monitoring and diagnosis method, device, electronic device and storage medium. Background Art

[0002] With the widespread application of hybrid cloud, multi-cloud environment, and container environment, cloud business observability and cloud network monitoring and diagnosis issues have received more and more attention. In order to achieve the ability to quickly diagnose faults in cloud services and avoid the cyclic workflow of hop-by-hop packet capture analysis and route search in daily fault location work of cloud network engineers, it is necessary to use automated tools to replace manual operations to achieve the goal of cloud network monitoring and diagnosis. In the prior art, the process of implementing cloud network monitoring and diagnosis through automated tools generally relies only on TCP / IP five-tuple information to diagnose the health of user business traffic.

[0003] However, in the process of cloud network operation and maintenance, we gradually realized the complexity of the cloud network base. Compared with the classic network, the cloud network has more virtualized nodes, the underlying network has complex user data encapsulation, and the source and destination addresses change repeatedly due to the large number of proxy nodes. At the same time, the virtual network address on the user virtualization side is customized, and different business flows of different tenants may use the same IP address. The above problems have caused the traditional diagnostic method that only relies on TCP / IP five-tuple information to diagnose the health of user business traffic to fail. Therefore, the existing technology has the problem of poor effectiveness of cloud network monitoring and diagnosis. Summary of the invention

[0004] The present application provides a cloud network monitoring and diagnosis method, device, electronic device and storage medium to solve the problem of poor effectiveness of cloud network monitoring and diagnosis.

[0005] In a first aspect, the present application provides a cloud network monitoring and diagnosis method, the method comprising:

[0006] Acquire each network flow message in the cloud network, wherein each network flow message includes a physical network flow message and a virtual network flow message;

[0007] Inputting each of the network traffic messages into a pre-trained neural network model, and determining a protocol format corresponding to each of the network traffic messages based on the neural network model;

[0008] Determine the decoding method corresponding to each network traffic message according to the protocol format corresponding to each network traffic message; decode each network traffic message using the corresponding decoding method to obtain the transaction route BTR text corresponding to each network traffic message;

[0009] Obtain the IP information of the target user, and perform session association and traffic tracking on the network traffic messages of the target user based on the IP information and each transaction route BTR text; and perform communication fault diagnosis on the network traffic messages of the target user through session association and traffic tracking.

[0010] The above technical solution has the following advantages or beneficial effects:

[0011] In the present application, after acquiring each network traffic message in the cloud network, the protocol format corresponding to each network traffic message is determined based on the pre-trained neural network model; then, each network traffic message is decoded using a decoding method corresponding to the protocol format to obtain the transaction route BTR text corresponding to each network traffic message. After acquiring the IP information of the target user, the network traffic message of the target user is subjected to session association and traffic tracking based on the IP information and each transaction route BTR text; and then, communication fault diagnosis of the network traffic message of the target user is achieved through session association and traffic tracking. The present application determines the protocol format corresponding to each network traffic message based on the neural network model, and then decodes each transaction route BTR text, thereby improving the accuracy and efficiency of network traffic message decoding. Then, communication fault diagnosis of the network traffic message of the target user is achieved based on the IP information of the target user and each transaction route BTR text. Therefore, the present application improves the accuracy and effectiveness of cloud network monitoring diagnosis.

[0012] Furthermore, the obtaining of each network traffic message in the cloud network includes:

[0013] By configuring port mirroring on a switch device, each physical network traffic message in the cloud network is obtained;

[0014] By deploying a soft probe program for collection at the host machine level, each virtual network traffic message in the cloud network is obtained.

[0015] The above technical solution has the following advantages or beneficial effects:

[0016] In this application, the physical network traffic packets in the cloud network are acquired by configuring port mirroring on the switch device; the virtual network traffic packets in the cloud network are acquired by deploying a soft probe program for collection at the host level. This achieves the acquisition of cloud network traffic packets in a non-invasive manner, which reduces the cost of acquiring cloud network traffic packets on the one hand, and avoids the impact of the acquisition of cloud network traffic packets on the services of cloud users on the other hand.

[0017] Furthermore, inputting each network traffic message into a pre-trained neural network model includes:

[0018] For each of the network traffic messages, each character in the network traffic message is converted into a corresponding first vector; the first vectors corresponding to each character in the network traffic message are concatenated to obtain a second vector corresponding to the network traffic message; the second vector is converted into a two-dimensional matrix array, and the two-dimensional matrix array is input into the pre-trained neural network model.

[0019] The above technical solution has the following advantages or beneficial effects:

[0020] In this application, in order to realize the recognition of message data by the neural network model, for the network flow message, each character in the network flow message is first converted into a corresponding first vector, and then each character in the network flow message is converted into a corresponding first vector for splicing to obtain a second vector corresponding to the network flow message; finally, the second vector is converted into a two-dimensional matrix array. That is, the network flow message is converted into a two-dimensional matrix array that can be recognized by the neural network model, and then the two-dimensional matrix array is input into the pre-trained neural network model. Thereby, the protocol format corresponding to the network flow message is determined based on the neural network model.

[0021] Furthermore, the process of pre-training the neural network model includes:

[0022] Convert each sample network traffic message in the training set into a corresponding sample two-dimensional matrix array; for each sample two-dimensional matrix array, input the sample two-dimensional matrix array and the decoding method label of the sample network traffic message corresponding to the sample two-dimensional matrix array into the neural network model to be trained; determine the predicted decoding method of the sample network traffic message based on the neural network model to be trained; determine the model loss value according to the predicted decoding method and the decoding method label; and iteratively train the neural network model to be trained according to the model loss value.

[0023] In the present application, for each sample network traffic message in the training set, the sample network traffic message is first converted into a corresponding sample two-dimensional matrix array. Specifically, each character in the sample network traffic message is converted into a corresponding third vector; each character in the sample network traffic message is converted into a corresponding third vector and spliced ​​to obtain a fourth vector corresponding to the sample network traffic message; the fourth vector is converted into a sample two-dimensional matrix array. Then the sample two-dimensional matrix array and the corresponding decoding method label of the sample network traffic message are input into the neural network model to be trained; the predicted decoding method of the sample network traffic message is determined based on the neural network model to be trained; according to the predicted decoding method and the decoding method label, the model loss value is determined; and then the neural network model to be trained is iteratively trained according to the model loss value. The neural network model trained in this way has the ability to determine the protocol format corresponding to the network traffic message.

[0024] Furthermore, the transaction routing BTR text includes virtual local area network VLAN area information, decoded TCP / IP quintuple information, common field information of network measurement message, virtual network card information, and sequence number of network measurement message.

[0025] Furthermore, performing session association and traffic tracking on the network traffic message of the target user according to the source public network IP information and each transaction route BTR text includes:

[0026] For each tunnel message encapsulated by the gateway from the Internet zone to the gateway zone, obtaining a sequence number carried by each tunnel message;

[0027] According to the source public network IP information and the sequence number carried by each tunnel message, session association and traffic tracking are performed on the tunnel message from the Internet zone to the gateway zone of the target user.

[0028] The above technical solution has the following advantages or beneficial effects:

[0029] All links of service access and call will generate intermediate network traffic packets. The analysis based on network traffic packets can cover most link nodes, such as Internet area (AGGWC, AGGSW, WC, etc.), gateway area (NFVW, TGW, STGW, NFVL), general server area (LA, Host, VM), network core area (LC), internal dedicated line (PLL), external dedicated line (PLW), AZ interconnection area (BD), cloud server CVM and other areas and corresponding components. According to the source public network IP information of the target user and the serial number carried by each tunnel message, the tunnel message from the Internet area to the gateway area of ​​the target user can be associated with the session and tracked.

[0030] Furthermore, performing session association and traffic tracking on the network traffic message of the target user according to the source public network IP information and each transaction route BTR text includes:

[0031] For each tunnel message encapsulated by the gateway from the general server area to the cloud server, the layout pattern feature value of each tunnel message is obtained by performing load parsing on the tunnel message;

[0032] According to the source public network IP information, the layout pattern feature value of each tunnel message and each transaction route BTR text, session association and traffic tracking are performed on the tunnel message from the general server area to the cloud server of the target user.

[0033] The above technical solution has the following advantages or beneficial effects:

[0034] The present application takes into account that each tunnel message encapsulated by the gateway from the general server area to the cloud server has a header carrying an outer data packet header of the tunnel encapsulation. Therefore, for each tunnel message encapsulated by the gateway from the general server area to the cloud server, the layout pattern feature value of each tunnel message is obtained by load parsing each tunnel message; and the session association and traffic tracking of the tunnel message from the general server area to the cloud server of the target user are achieved by retrieving the pattern feature value.

[0035] Furthermore, the communication fault diagnosis of the network traffic message of the target user through session association and traffic tracking includes:

[0036] Through session association and traffic tracking, a physical network path vector diagram is generated based on the virtual local area network VLAN area information; a traffic model is generated through TCP / IP five-tuple information and the sequence number of each network measurement message of the target user, wherein the traffic model includes traffic path information and data packet transmission information; and the communication fault diagnosis result of the network traffic message of the target user is determined by concatenating, comparing, calculating and analyzing each standard header field of TCP / IP in the communication link of the traffic model.

[0037] The above technical solution has the following advantages or beneficial effects:

[0038] In this application, the source public network IP information of the target user is obtained, and the target user's network traffic message is subjected to session association and traffic tracking according to the source public network IP information and each transaction route BTR text; then a physical network path vector diagram is generated based on the virtual local area network VLAN area information; a traffic model is generated through the TCP / IP five-tuple information and the sequence number of each network measurement message of the target user; finally, the communication fault diagnosis result of the target user's network traffic message is determined by concatenating, comparing, calculating, and analyzing each standard header field of TCP / IP in the communication link of the traffic model. Thus, accurate and effective monitoring and diagnosis of the target user's network traffic message is achieved.

[0039] In a second aspect, the present application provides a cloud network monitoring and diagnosis device, the device comprising:

[0040] An acquisition module, used to acquire each network flow message in the cloud network, wherein each network flow message includes a physical network flow message and a virtual network flow message;

[0041] A determination module, used to input each of the network traffic messages into a pre-trained neural network model, and determine the protocol format corresponding to each of the network traffic messages based on the neural network model;

[0042] A decoding module, used to determine a decoding method corresponding to each network traffic message according to a protocol format corresponding to each network traffic message; decode each network traffic message using a corresponding decoding method to obtain a transaction route BTR text corresponding to each network traffic message;

[0043] The diagnostic module is used to obtain the source public network IP information of the target user, and perform session association and traffic tracking on the network traffic messages of the target user based on the source public network IP information and each transaction route BTR text; and perform communication fault diagnosis on the network traffic messages of the target user through session association and traffic tracking.

[0044] In a third aspect, the present application provides an electronic device, including a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other via the communication bus;

[0045] Memory, used to store computer programs;

[0046] The processor is used to implement the method when executing the program stored in the memory.

[0047] In a fourth aspect, the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the described method is implemented.

[0048] In a fifth aspect, the present application provides a computer program product, wherein the computer program product comprises an executable program, and the executable program is executed by a processor to implement the described method. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0050] Figure 1 This is a schematic diagram of a distributed tracing example in the prior art;

[0051] Figure 2 It is a schematic diagram of cloud network monitoring and diagnosis in the prior art;

[0052] Figure 3 Schematic diagram of the cloud network monitoring and diagnosis process provided for this application;

[0053] Figure 4 A schematic diagram of the process of capturing full data packets of north-south and east-west traffic in a cloud network provided for this application;

[0054] Figure 5 Schematic diagram of the principle of capturing cloud network traffic provided for this application;

[0055] Figure 6 Schematic diagram of the intelligent network data packet decoding engine provided for this application;

[0056] Figure 7 A schematic diagram of the convolutional neural network structure provided for this application;

[0057] Figure 8 Schematic diagram of the communication scenario for accessing the CVM cloud host from the external network provided for this application;

[0058] Fig. 9 A schematic diagram of the interface for searching the IP address of the application provided by this application on the public network for external services;

[0059] Fig.10 A schematic diagram of an interface for distinguishing abnormal access sessions provided by this application;

[0060] Fig.11 A schematic diagram of the interface for associating session information provided by this application;

[0061] Fig.12 A schematic diagram of the session association display provided for this application;

[0062] Fig.13 Schematic diagram of the user source public network IP provided for this application;

[0063] Fig.14 A schematic diagram of session association by retrieving pattern feature values ​​provided in this application;

[0064] Fig.15 Schematic diagram of data packet load analysis provided for this application;

[0065] Fig.16 A schematic diagram of the structure of a cloud network monitoring and diagnosis device provided in this application;

[0066] Fig.17 This is a schematic diagram of the electronic device structure provided in this application. DETAILED DESCRIPTION

[0067] In order to make the purpose and implementation method of the present application clearer, the exemplary implementation method of the present application will be clearly and completely described below in conjunction with the drawings in the exemplary embodiments of the present application. Obviously, the described exemplary embodiments are only part of the embodiments of the present application, rather than all the embodiments.

[0068] It should be noted that the brief description of terms in this application is only for the convenience of understanding the embodiments described below, and is not intended to limit the embodiments of this application. Unless otherwise specified, these terms should be understood according to their common and usual meanings.

[0069] The terms "first", "second", "third", etc. in the specification and claims of this application and the above drawings are used to distinguish similar or similar objects or entities, and do not necessarily mean to limit a specific order or sequence, unless otherwise noted. It should be understood that the terms used in this way can be interchangeable under appropriate circumstances.

[0070] The terms "comprises," "comprising," and "having," and any variations thereof, are intended to cover but not exclude inclusion, for example, a product or device comprising a list of components is not necessarily limited to all the components expressly listed but may include other components not expressly listed or inherent to such product or device.

[0071] The term "module" refers to any known or later developed hardware, software, firmware, artificial intelligence, fuzzy logic, or combination of hardware and / or software code that is capable of performing the functions associated with that element.

[0072] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present application.

[0073] For the convenience of explanation, the above description has been made in conjunction with specific embodiments. However, the above exemplary discussion is not intended to be exhaustive or limit the embodiments to the specific forms disclosed above. Based on the above teachings, various modifications and variations can be obtained. The selection and description of the above embodiments are to better explain the principles and practical applications, so that those skilled in the art can better use the embodiments and various different variations of the embodiments suitable for specific use considerations.

[0074] In the process of cloud network operation and maintenance, we gradually realized the complexity of the cloud network base. Compared with the classic network, the cloud network has more virtualized nodes, the underlying network has complex encapsulation of user data, and the source and destination addresses change repeatedly due to the large number of proxy nodes. At the same time, the virtual network address on the user virtualization side is customized and planned, and different business flows of different tenants may use the same IP address. The above problems have caused the traditional diagnostic method that only relies on TCP / IP five-tuple information to diagnose the health of user business traffic to fail. Therefore, the existing technology has the problem of poor effectiveness of cloud network monitoring and diagnosis. If an intrusive monitoring mode is used, the cost is high and it has unpredictable impacts on the business of users on the cloud. The high complexity of the cloud network has created great technical difficulties in achieving the goals of the cloud network monitoring and diagnosis project.

[0075] In view of the characteristics of cloud networks, this application proposes a cloud network monitoring and diagnosis method based on network traffic message (or data packet) analysis. By encapsulating, rewriting, collecting, decoding the header of the original data packet and deeply analyzing the standard protocol part of the original data packet, combined with the communication scenario, the same service access is associated and tracked in the cloud network node, so as to quickly analyze the penetration performance of the service in the cloud network environment and quickly and effectively locate the fault.

[0076] In the broad field of end-to-end tracking technology, there are currently the following technologies and standards:

[0077] The first type: distributed full-link tracing technology implemented based on the OpenTelemetry community, such as Jaeger, Zipin, SkyWalking and other landing products. In 2010, Google's Dapper paper introduced the concept and principle of distributed tracing. Later, the Cloud Native Computing Foundation (CNCF) used OpenTracing as the standard protocol for distributed tracing, defined a set of open source and programming language-independent specifications, and combined with the OpenCensus project proposed by Google and Microsoft, using its powerful API capabilities, and polishing and optimizing existing standards, and finally upgraded to the OpenTelemetry protocol as a standard protocol and open source implementation supporting the three pillars of observability. OpenTelemetry technology implements distributed link tracing in cloud environments. Figure 1 The figure is a schematic diagram of a distributed tracing example in the prior art. Figure 1 The span in the definition is the smallest granularity call. A span can represent a remote call process of a protocol such as HTTP, or the execution of a program block. All spans form a trace of a directed acyclic graph. Through OpenTelemetry, users can correlate and analyze the jump performance of microservices in each call process.

[0078] The second type: application tracking and observability technology based on eBPF (Extended Berkeley Packet Filter). As a technology that extends the operating system kernel, users can run customized programs in the system kernel environment to achieve the goal of distributed application tracking in cloud networks and container network environments. The eBPF program has the advantage of good compatibility. Compared with the original method of directly modifying the kernel code, the eBPF program does not need to recompile the kernel, nor does it need to adapt to kernel version updates. Through code transplantation, it can be directly loaded on different CPU architectures, and has better compatibility with the user environment. At the same time, because the eBPF program runs in the kernel, the high priority allows the eBPF program to be executed by the operating system as quickly as possible, so it also has higher performance. Figure 2 FIG. 1 is a schematic diagram of cloud network monitoring and diagnosis in the prior art. Figure 2As shown in the figure, by developing an eBPF program, defining the eBPF program to be called when an event is triggered at the insertion point, and using LLVM to compile the eBPF program into BPF bytecode, running it in the eBPF virtual machine, and then in user mode through the BPF system call, the BPF bytecode is loaded into the kernel, and then the kernel verifies and runs the BPF bytecode, and saves the event status in the BPF mapping table. Finally, the user program can query the running status of the BPF bytecode through the BPF mapping table to obtain the required monitoring data, and finally realize the observability of the cloud network, and realize the effects such as link tracking through correlation of monitoring data.

[0079] The problems existing in the prior art are as follows:

[0080] 1. The distributed full-link tracing technology implemented based on the OpenTelemetry community is a standardized technology. By providing standardization of telemetry data, its associated indicators and tracing capabilities can simplify the work process of fault location and performance analysis, and play an important role in the observable field.

[0081] In practice, OpenTelemetry provides a vendor-independent model that provides libraries for various programming languages ​​and frameworks. It can generate telemetry data in various application environments and export it to different backends for data consumption. However, it is somewhat invasive during the deployment process. In the application running environment, users use the OpenTelemetry SDK to call corresponding libraries and tools to detect and collect data for monitoring their applications. In this process, the SDK needs to be integrated into the application's programming environment, which violates the separation of concerns principle and may require learning additional expertise and skills. In addition, as the application version is iterated and updated, the OpenTelemetry code needs to be continuously maintained and upgraded.

[0082] In addition, OpenTelemetry cannot complete the addition of telemetry data on the service entry side. For example, when service access enters through the Internet zone of the data center, the Internet zone mainly includes network devices such as AGGWC, AGGSW, and WC. OpenTelemetry components cannot be deployed on these devices, so it is impossible to associate and track services on these device nodes. The same situation also occurs in the gateway area. The NFV network function virtualization node in the gateway area is a network module implemented in a specific environment. It is not compatible with the general application deployment environment, so it cannot effectively support service association and tracking. It is not until the service access jumps to the general server area at the back end that its telemetry data can be better implanted into the service communication to achieve service association and tracking analysis.

[0083] 2. Application tracing and observability technology based on eBPF (Extended Berkeley Packet Filter), whose eBPF program runs in the operating system kernel.

[0084] The eBPF program is more concerned with kernel-level association actions. When an application runs in the operating system user state, it needs to call the CPU through the operating system and allocate CPU threads to process application tasks. Since CPU threads involve time-division multiplexing, the eBPF program needs to correctly distinguish different tasks performed by the same thread in different time periods. However, in practice, association errors are often prone to occur, and poor association effects sometimes occur. In addition, when the eBPF program collects monitoring data in the kernel, the links involved in the data are too long. There are large differences in the links from application processes, system calls to virtual networks, gateways, etc. The situations of the above link nodes in different application environments are also different. The eBPF program needs deep customization to achieve a relatively complete link tracking effect, especially in the NFV network function virtualization module in the gateway area. Since NFV is only responsible for NAT forwarding and routing forwarding of business access, the eBPF program cannot obtain effective monitoring data on the gateway node.

[0085] Compared with other technologies, the eBPF program appeared later (2014). Under the X86 architecture, the eBPF program can only be well supported when the operating system kernel version is higher than 4.14 (lower kernel versions cannot meet all the functions of the eBPF program), and the ARM architecture requires at least 4.18 kernel version. In addition, the eBPF program needs to be adapted for different versions of the kernel. Due to the changes in the structure of different versions of the kernel, the offsets of different versions of the kernel are also different, so the eBPF program needs to be customized according to the actual situation.

[0086] In order to solve the above technical problems, the present application provides a cloud network monitoring and diagnosis solution. Figure 3 The cloud network monitoring and diagnosis process diagram provided for this application includes the following steps:

[0087] S101: Acquire various network flow messages in the cloud network, wherein the various network flow messages include physical network flow messages and virtual network flow messages;

[0088] S102: Inputting each of the network traffic messages into a pre-trained neural network model, and determining a protocol format corresponding to each of the network traffic messages based on the neural network model;

[0089] S103: Determine a decoding method corresponding to each network traffic message according to a protocol format corresponding to each network traffic message; decode each network traffic message using the corresponding decoding method to obtain a transaction route BTR text corresponding to each network traffic message;

[0090] S104: Obtain the source public network IP information of the target user, and perform session association and traffic tracking on the network traffic messages of the target user according to the source public network IP information and each transaction route BTR text; and perform communication fault diagnosis on the network traffic messages of the target user through session association and traffic tracking.

[0091] The cloud network monitoring and diagnosis method provided in the present application is applied to an electronic device, which may be a server.

[0092] The server obtains each network traffic message in the cloud network. Optionally, the server obtains each network traffic message of the entire cloud network within a specified preset time period. Each network traffic message includes a physical network traffic message and a virtual network traffic message. In the following text, the physical network traffic message may be referred to as a north-south traffic message. For example, traffic messages from switch to switch, traffic messages from switch to server, traffic messages from server to server, etc. Virtual network traffic messages may be referred to as east-west traffic messages. For example, traffic messages between virtual gateways, traffic messages from virtual gateway to server, etc.

[0093] This application takes into account that there are network traffic messages of different protocol formats in each network traffic message obtained in the cloud network. In order to efficiently and accurately determine the protocol format corresponding to each network traffic message, and provide a basis for accurate decoding of subsequent network traffic messages and accurate cloud network monitoring and diagnosis, this application pre-trains a neural network model for predicting the protocol format corresponding to each network traffic message. The neural network model can be a convolutional neural network (Convolutional Neural Network, hereinafter referred to as CNN). Each network traffic message is input into the pre-trained neural network model, and the protocol format corresponding to each network traffic message is determined based on the neural network model.

[0094] The electronic device pre-stores decoding methods corresponding to different protocol formats, and determines the decoding methods corresponding to each network traffic message according to the protocol format corresponding to each network traffic message; decodes each network traffic message using the corresponding decoding method to obtain the transaction route BTR text corresponding to each network traffic message. The transaction route BTR text includes virtual local area network VLAN area information, decoded TCP / IP quintuple information, public field information of network measurement messages, virtual network card information, and the sequence number of the network measurement message.

[0095] Finally, the user of interest is taken as the target user. The source public network IP information of the target user is obtained, and the network traffic packets of the target user are subjected to session association and traffic tracking based on the source public network IP information and each transaction route BTR text; and communication fault diagnosis is performed on the network traffic packets of the target user through session association and traffic tracking.

[0096] In the present application, after acquiring each network traffic message in the cloud network, the protocol format corresponding to each network traffic message is determined based on the pre-trained neural network model; then, each network traffic message is decoded using a decoding method corresponding to the protocol format to obtain the transaction route BTR text corresponding to each network traffic message. After acquiring the IP information of the target user, the network traffic message of the target user is subjected to session association and traffic tracking based on the IP information and each transaction route BTR text; and then, communication fault diagnosis of the network traffic message of the target user is achieved through session association and traffic tracking. The present application determines the protocol format corresponding to each network traffic message based on the neural network model, and then decodes each transaction route BTR text, thereby improving the accuracy and efficiency of network traffic message decoding. Then, communication fault diagnosis of the network traffic message of the target user is achieved based on the IP information of the target user and each transaction route BTR text. Therefore, the present application improves the accuracy and effectiveness of cloud network monitoring diagnosis.

[0097] In this application, the acquisition of each network traffic message in the cloud network includes:

[0098] By configuring port mirroring on a switch device, each physical network traffic message in the cloud network is obtained;

[0099] By deploying a soft probe program for collection at the host machine level, each virtual network traffic message in the cloud network is obtained.

[0100] In this application, the physical network traffic packets in the cloud network are acquired by configuring port mirroring on the switch device; the virtual network traffic packets in the cloud network are acquired by deploying a soft probe program for collection at the host level. This achieves the acquisition of cloud network traffic packets in a non-invasive manner, which reduces the cost of acquiring cloud network traffic packets on the one hand, and avoids the impact of the acquisition of cloud network traffic packets on the services of cloud users on the other hand.

[0101] In the present application, inputting each network traffic message into a pre-trained neural network model includes:

[0102] For each of the network traffic messages, each character in the network traffic message is converted into a corresponding first vector; the first vectors corresponding to each character in the network traffic message are concatenated to obtain a second vector corresponding to the network traffic message; the second vector is converted into a two-dimensional matrix array, and the two-dimensional matrix array is input into the pre-trained neural network model.

[0103] In this application, in order to realize the recognition of message data by the neural network model, for the network flow message, each character in the network flow message is first converted into a corresponding first vector, and then each character in the network flow message is converted into a corresponding first vector for splicing to obtain a second vector corresponding to the network flow message; finally, the second vector is converted into a two-dimensional matrix array. That is, the network flow message is converted into a two-dimensional matrix array that can be recognized by the neural network model, and then the two-dimensional matrix array is input into the pre-trained neural network model. Thereby, the protocol format corresponding to the network flow message is determined based on the neural network model.

[0104] In this application, the process of pre-training the neural network model includes:

[0105] Convert each sample network traffic message in the training set into a corresponding sample two-dimensional matrix array; for each sample two-dimensional matrix array, input the sample two-dimensional matrix array and the decoding method label of the sample network traffic message corresponding to the sample two-dimensional matrix array into the neural network model to be trained; determine the predicted decoding method of the sample network traffic message based on the neural network model to be trained; determine the model loss value according to the predicted decoding method and the decoding method label; and iteratively train the neural network model to be trained according to the model loss value.

[0106] In the present application, for each sample network traffic message in the training set, the sample network traffic message is first converted into a corresponding sample two-dimensional matrix array. Specifically, each character in the sample network traffic message is converted into a corresponding third vector; each character in the sample network traffic message is converted into a corresponding third vector and spliced ​​to obtain a fourth vector corresponding to the sample network traffic message; the fourth vector is converted into a sample two-dimensional matrix array. Then the sample two-dimensional matrix array and the corresponding decoding method label of the sample network traffic message are input into the neural network model to be trained; the predicted decoding method of the sample network traffic message is determined based on the neural network model to be trained; according to the predicted decoding method and the decoding method label, the model loss value is determined; and then the neural network model to be trained is iteratively trained according to the model loss value. The neural network model trained in this way has the ability to determine the protocol format corresponding to the network traffic message.

[0107] In the present application, the session association and traffic tracking of the target user's network traffic message according to the source public network IP information and each transaction route BTR text includes:

[0108] For each tunnel message encapsulated by the gateway from the Internet zone to the gateway zone, obtaining a sequence number carried by each tunnel message;

[0109] According to the source public network IP information and the sequence number carried by each tunnel message, session association and traffic tracking are performed on the tunnel message from the Internet zone to the gateway zone of the target user.

[0110] All links of service access and call will generate intermediate network traffic packets. The analysis based on network traffic packets can cover most link nodes, such as Internet area (AGGWC, AGGSW, WC, etc.), gateway area (NFVW, TGW, STGW, NFVL), general server area (LA, Host, VM), network core area (LC), internal dedicated line (PLL), external dedicated line (PLW), AZ interconnection area (BD), cloud server CVM and other areas and corresponding components. According to the source public network IP information of the target user and the serial number carried by each tunnel message, the tunnel message from the Internet area to the gateway area of ​​the target user can be associated with the session and tracked.

[0111] In the present application, the session association and traffic tracking of the target user's network traffic message according to the source public network IP information and each transaction route BTR text includes:

[0112] For each tunnel message encapsulated by the gateway from the general server area to the cloud server, the layout pattern feature value of each tunnel message is obtained by performing load parsing on the tunnel message;

[0113] According to the source public network IP information, the layout pattern feature value of each tunnel message and each transaction route BTR text, session association and traffic tracking are performed on the tunnel message from the general server area to the cloud server of the target user.

[0114] The present application takes into account that each tunnel message encapsulated by the gateway from the general server area to the cloud server has a header carrying an outer data packet header of the tunnel encapsulation. Therefore, for each tunnel message encapsulated by the gateway from the general server area to the cloud server, the layout pattern feature value of each tunnel message is obtained by load parsing each tunnel message; and the session association and traffic tracking of the tunnel message from the general server area to the cloud server of the target user are achieved by retrieving the pattern feature value.

[0115] In the present application, the communication fault diagnosis of the network traffic message of the target user through session association and traffic tracking includes:

[0116] Through session association and traffic tracking, a physical network path vector diagram is generated based on the virtual local area network VLAN area information; a traffic model is generated through TCP / IP five-tuple information and the sequence number of each network measurement message of the target user, wherein the traffic model includes traffic path information and data packet transmission information; and the communication fault diagnosis result of the network traffic message of the target user is determined by concatenating, comparing, calculating and analyzing each standard header field of TCP / IP in the communication link of the traffic model.

[0117] In this application, the source public network IP information of the target user is obtained, and the target user's network traffic message is subjected to session association and traffic tracking according to the source public network IP information and each transaction route BTR text; then a physical network path vector diagram is generated based on the virtual local area network VLAN area information; a traffic model is generated through the TCP / IP five-tuple information and the sequence number of each network measurement message of the target user; finally, the communication fault diagnosis result of the target user's network traffic message is determined by concatenating, comparing, calculating, and analyzing each standard header field of TCP / IP in the communication link of the traffic model. Thus, accurate and effective monitoring and diagnosis of the target user's network traffic message is achieved.

[0118] This application provides a cloud network monitoring and diagnosis method based on data packet analysis, which has the following main advantages:

[0119] Use non-intrusive methods to obtain distributed traffic: Based on the cloud session association technology of packet analysis, the data source completely obtains network packets in a bypass manner through the mirror collection method, which is a non-intrusive solution. There are two main ways to obtain traffic: the first is the north-south traffic capture of physical network devices and NFV (Network Function Virtualization) network function virtualization nodes, which is mainly achieved by configuring port mirroring on the switching device and using mature technologies such as mirrored traffic to achieve the replication, encapsulation, distribution, and aggregation of network packets. No plug-ins are involved in deployment; the second is the collection of internal east-west traffic in the general server area, which is mainly achieved by deploying soft probe programs for collection at the host level in the area, realizing the east-west traffic collection of virtual network cards at the virtual network level in the host, and collecting user-related traffic data by creating virtual network cards through user information encoding. The collection probe is deployed in the user state of the operating system, and there is no need to collect monitoring data by analyzing the running status of BPF bytecode at the kernel level.

[0120] Based on traffic packet analysis, the whole network traffic is connected in series through the identification of custom fields: Currently, whether it is a classic network, a virtualized network, or even a new network such as a container network or a service mesh, applications still need to go through the network to complete business interactions. Therefore, all links of business access and calling will generate intermediate network data. The analysis based on network data packets can cover most of the link nodes, such as the Internet area (AGGWC, AGGSW, WC, etc.), the gateway area (NFVW, TGW, STGW, NFVL), the general server area (LA, Host, VM), the network core area (LC), the internal dedicated line (PLL), the external dedicated line (PLW), the AZ interconnection area (BD) and other areas and corresponding components. Taking external network access as an example, the access path is roughly as follows:

[0121] AGGWC->AGGSW->WC->NFVW->TGW->NFVL->LC->LA->STGW->LA->LC->LA->HOST->CVM.

[0122] On the access path, the path from the public network to the STGW can obtain north-south network traffic through switch mirroring, while the path from the HOST to the CVM can collect east-west network traffic through the host (physical machine) probe. Through the collection of all node data and the decoding and analysis of data packets, the fault details can be quickly located.

[0123] The technology is highly versatile, and other network environment monitoring methods can be applied based on this method: network data packets follow the universal standard protocol of the TCP / IP protocol stack. Network data that follows the TCP / IP protocol stack has natural good compatibility and rich optional fields. The communication scenarios of classic networks and cloud networks based on the TCP / IP protocol are also fully in line with the provisions of the protocol itself. Even the large second-layer technology in the cloud network is only a secondary innovation based on the framework of the TCP / IP protocol. It has no particularity and is easier to expand to a wider range of cloud network scenarios. When parsing the header and payload content of the network data packet, there is no need to be compatible with the architectural differences between network devices, nor is it necessary to consider the operating system environment factors where the application is running, and there is no need to consider the programming language type of the application. It is only necessary to offset and disassemble and translate the network data packet based on the relevant details of the TCP / IP protocol to achieve the parsing of the network data. For example, by disassembling the packet header, network analysis and diagnosis can be quickly performed based on the network five-tuple information.

[0124] The cloud network monitoring and diagnosis method based on data packet analysis provided by the present application, first, completes the collection and flow identification of the full amount of data packets at each flow node on the network side through the distributed flow collection technology, and the collection interface uses the VLAN identification of each node (such as vlan255 = Internet area, vlan256 = dedicated line area, etc., VLAN1000 = physical server) to encapsulate the original TCP / IP data packets of all users collected in the current area, and distributes the identified data packets to the flow decoding engine according to the strategy for asynchronous decoding and analysis of the flow. Then, the flow processing device disassembles the massive data packets to obtain relevant information such as: custom VLAN area information, decoded TCP / IP five-tuple information, system side GRE / VXLAN protocol encapsulation and rewriting of the data packet public field information (such as VXLAN VIN field, identifying the user application business system ID), virtual network card information (user virtual network ID as the network card number, to facilitate subsequent flow collection and association), data packet IPID (TCP / IP sequence number field). Finally, the information of the data packets of interest after decoding is automatically associated and the traffic is tracked. The overall physical network path vector diagram is generated through VLAN information, and the single-user service data integration is formed by combining the custom information of the encapsulation header in the virtual network. Finally, the single-user, single-service traffic model is realized through TCP / IP quintuple information and IPID information. The model contains traffic path information and data packet transmission information. Then, by concatenating, comparing, calculating and analyzing the standard TCP / IP header fields in the communication link of the traffic model, the transmission status of the service flow within a time period is obtained, such as data packet delay, retransmission rate, etc., and then the penetration performance of a single user's single service in the cloud network environment is quickly analyzed, and the fault is quickly and effectively located.

[0125] Figure 4 This is a schematic diagram of the process of capturing the full amount of data packets of the north-south and east-west traffic of the cloud network provided by this application. Figure 4 As shown, the host probe is deployed in the Hypervisor layer of the CVM mother machine (host). The host collection probe is based on the libvirt feature and uses the API it provides to enumerate, monitor and use the available resources on the host. At the same time, the host probe automatically matches and verifies the CVM cloud host ID hit in the collection strategy with the information of its corresponding CVM network card ID. After the information verification is passed, the mapping device of the corresponding CVM cloud host business network card in the host is captured, thereby realizing the capture of the full amount of business data packets, and encapsulating the original traffic through large Layer 2 technologies such as GRE / VXLAN, and sending the traffic to the TAP device.

[0126] Figure 5 This is a schematic diagram of the principle of capturing cloud network traffic provided by this application. Figure 5As shown in the figure, the bypass probe is deployed in Daemonset mode on each TKE Node, which can collect the east-west traffic and north-south traffic of containers on each TKE Node on demand; by modifying standard protocols such as GRE / VXLAN, the original traffic is encapsulated through the second layer technology, and the marked traffic is sent to the collection device; the traffic is mirrored at the uplink port where NFVL connects to the Spine, which can capture all gateway traffic passing through the NFV cluster, and the traffic is sent to the TAP device.

[0127] Figure 6 The schematic diagram of the intelligent network data packet decoding engine provided by this application is as follows: Figure 6 As shown in the figure, the intelligent network packet decoding engine is mainly divided into two modules. The first module is heuristic detection: including network raw packet input, intelligent detection of packets, inference of the highest probability protocol, and generation of decoding protocol configuration. The second module is network message decoding: calling the decoding engine for decoding, and outputting BTR transaction text records.

[0128] Among them, the heuristic detection module needs to use automated means to quickly identify the application protocol of the network message. Due to the diversity of data messages, there are a large number of network messages in different protocol formats in the captured traffic of the same probe. Since network messages in different protocol formats require different decoding processes, through practice, the automatic protocol detection technology trained by convolutional neural network (Convolutional Neural Network, hereinafter referred to as CNN) is a relatively efficient parsing method. CNN is usually composed of multiple convolutional layers, pooling layers and fully connected layers. The convolutional layer is responsible for extracting local features of the input data, the pooling layer is responsible for reducing the dimension of the data and enhancing the robustness of the features, and the fully connected layer is responsible for mapping the features extracted by the previous layer to the final output. In terms of network message protocol recognition, training based on CNN (convolutional neural network) requires converting the message into a two-dimensional matrix array similar to an image, and then training. In order to convert the network message into image data that can be processed by CNN, the following steps are required:

[0129] Encoding: Convert each character into a number. For example, we can use one-hot encoding to convert each character into a vector.

[0130] Serialization: connect all the characters in the message to form a long vector;

[0131] Reshape: Reshape this long vector into an image-like 2D matrix array.

[0132] The following is an example of the payload data of two network messages:

[0133] Message 1 (HTTP protocol):

[0134] GET / index.html HTTP / 1.1;

[0135] Host: www.example.com.

[0136] Message 2 (FTP protocol):

[0137] USER anonymous;

[0138] PASS password123.

[0139] In order to convert the characters of HTTP protocol messages and FTP protocol messages into vectors, one-hot encoding can be used. One-hot encoding is a method of converting categorical variables into a format that is easy to use for machine learning algorithms. For each character, a vector equal to the size of the possible character set can be created, in which only the element corresponding to the index position of the character is 1 and the rest of the elements are 0. Next, we will enter the formal CNN training process. Figure 7 The schematic diagram of the convolutional neural network structure provided for this application is as follows: Figure 7 As shown in the figure, the convolutional neural network includes a convolution layer, a nonlinear activation layer (commonly used ReLU layer), a pooling layer, a fully connected layer, and a Softmax layer.

[0140] The training process of a convolutional neural network is as follows:

[0141] Pass the input image-like 2D matrix array into the CNN model;

[0142] Through the Convolution layer, each convolution kernel scans the local area of ​​the input two-dimensional matrix array and calculates the dot product with the area; the convolution layer may contain multiple convolution kernels, each of which learns different features;

[0143] Add a bias term and get the output through an activation function (such as ReLU);

[0144] Next is the Pooling layer, which samples the output of the convolutional layer to reduce the dimension of the data;

[0145] Finally, there is the Full-Connected layer, which maps the output of the previous layer to the final classification or regression task;

[0146] The final output is obtained through the Softmax function (for classification tasks) or linear regression (for regression tasks).

[0147] In this application, the electronic device performs session association based on the key information after decoding the data packet. Taking the communication scenario of accessing the CVM cloud host from the external network as an example, Figure 8 The communication scenario diagram for accessing the CVM cloud host from the external network provided for this application. The communication path is roughly as follows:

[0148] AGGWC->AGGSW->WC->NFVW->TGW->NFVL->LC->LA->STGW->LA->LC->LA->HOST->CVM.

[0149] Through path decomposition, the above communication path can be roughly divided into two parts.

[0150] The first part is described as follows:

[0151] Path A: North-south service access traffic (AGGWC->AGGSW->WC->NFVW->TGW->NFVL->LC->LA->STGW) obtained by switch port mirroring. Through the above intelligent decoding engine technology, electronic devices can quickly parse and obtain detailed message information for each link of the above path A, and through comparative analysis and induction, it can be concluded that the user source public network IP of the above path A remains unchanged: if a tunnel message encapsulated by the gateway (such as GRE) appears, the IPID of the original data packet of the inner layer service remains consistent. On this basis, IP+IPID can be combined to achieve session association of the path.

[0152] Taking a business failure as an example, a user reports an abnormality in accessing the server. Based on the business clues provided by the user, the IP address of the application's external service on the public network can be quickly located and retrieved (101.230.65.117). Fig. 9 A schematic diagram of the interface for searching the IP address of the application program provided for this application on the public network for external services.

[0153] Since users access the server multiple times during the same period, it is necessary to distinguish abnormal access sessions. Fig.10 A schematic diagram of the interface for distinguishing abnormal access sessions provided by this application.

[0154] Through session positioning, the network five-tuple information such as IP+Port corresponding to the session can be obtained synchronously. At this time, according to the source IP+Port conditions, it can be associated with WC->NFVW->TGW->NFVL session information (58.247.31.242:6481). Fig.11 A schematic diagram of the interface for associating session information provided by this application.

[0155] When a tunnel message (such as GRE) is encapsulated by a gateway, the IP ID of the original data packet of the inner service remains consistent. On this basis, IP+IP ID can be combined to realize the session association of NFVL->LC->LA->STGW. Fig.12 A schematic diagram of the session association display provided for this application.

[0156] The second part is described as follows:

[0157] Path B: East-west business access traffic (HOST->CVM) collected by the host probe. Similarly, through the intelligent decoding engine technology, the electronic device can quickly parse and obtain the detailed information of the message of the above path B segment, and it can be concluded that the user source public network IP of the above path B segment remains unchanged. Fig.13 Schematic diagram of the user source public IP provided for this application.

[0158] Because the east-west traffic of the business belongs to the cloud traffic, its header carries the outer data packet header encapsulated by the tunnel. Therefore, the monitoring platform needs to perform session association by retrieving the pattern feature value. Fig.14 A schematic diagram of session association by retrieving pattern feature values ​​provided in this application.

[0159] Through the load analysis of the data packet, it can also be confirmed that the east-west traffic of the CVM cloud host in the general server area is characterized by the structure of the outer tunnel encapsulation header + the inner original data packet, and the source IP of the inner original data packet is still the user's public network IP. Through the integration of the above path segment A + segment B, the session-level association of the entire path is finally completed, and the goal of automatic fault diagnosis is finally achieved. Fig.15 Schematic diagram of data packet payload parsing provided for this application.

[0160] The Chinese equivalents and definitions of the English terms involved in this application are shown in Table 1 below.

[0161] Table 1

[0162]

[0163]

[0164] Fig.16 A schematic diagram of the structure of a cloud network monitoring and diagnosis device provided in this application, the device comprising:

[0165] The acquisition module 201 is used to acquire each network flow message in the cloud network, wherein each network flow message includes a physical network flow message and a virtual network flow message;

[0166] A determination module 202 is used to input each of the network traffic messages into a pre-trained neural network model, and determine the protocol format corresponding to each of the network traffic messages based on the neural network model;

[0167] The decoding module 203 is used to determine the decoding method corresponding to each network traffic message according to the protocol format corresponding to each network traffic message; decode each network traffic message using the corresponding decoding method to obtain the transaction route BTR text corresponding to each network traffic message;

[0168] The diagnostic module 204 is used to obtain the source public network IP information of the target user, and perform session association and traffic tracking on the network traffic messages of the target user based on the source public network IP information and each transaction route BTR text; and perform communication fault diagnosis on the network traffic messages of the target user through session association and traffic tracking.

[0169] The acquisition module 201 is specifically used to acquire each physical network traffic message in the cloud network by configuring port mirroring on the switch device; and to acquire each virtual network traffic message in the cloud network by deploying a soft probe program for collection at the host machine level.

[0170] The determination module 202 is specifically used to convert each character in the network traffic message into a corresponding first vector for each network traffic message; concatenate the first vectors corresponding to each character in the network traffic message to obtain a second vector corresponding to the network traffic message; convert the second vector into a two-dimensional matrix array, and input the two-dimensional matrix array into the pre-trained neural network model.

[0171] The device also includes:

[0172] The training module 205 is used to convert each sample network traffic message in the training set into a corresponding sample two-dimensional matrix array; for each sample two-dimensional matrix array, the sample two-dimensional matrix array and the decoding method label of the sample network traffic message corresponding to the sample two-dimensional matrix array are input into the neural network model to be trained; based on the neural network model to be trained, the predicted decoding method of the sample network traffic message is determined; according to the predicted decoding method and the decoding method label, the model loss value is determined; according to the model loss value, the neural network model to be trained is iteratively trained.

[0173] The diagnostic module 204 is specifically used to obtain the serial number carried by each tunnel message encapsulated by the gateway from the Internet zone to the gateway zone; based on the source public network IP information and the serial number carried by each tunnel message, perform session association and traffic tracking on the tunnel message from the Internet zone to the gateway zone of the target user.

[0174] The diagnostic module 204 is specifically used to obtain the layout pattern feature value of each tunnel message encapsulated by the gateway from the general server area to the cloud server by load parsing the each tunnel message; and perform session association and traffic tracking on the tunnel message from the general server area to the cloud server of the target user based on the source public network IP information, the layout pattern feature value of each tunnel message and each transaction route BTR text.

[0175] The diagnostic module 204 is specifically used to generate a physical network path vector diagram based on virtual local area network VLAN area information through session association and traffic tracking; generate a traffic model through TCP / IP five-tuple information and the sequence number of each network measurement message of the target user, wherein the traffic model includes traffic path information and data packet transmission information; and determine the communication fault diagnosis result of the network traffic message of the target user by concatenating, comparing, calculating and analyzing each standard header field of TCP / IP in the communication link of the traffic model.

[0176] The present application also provides an electronic device, such as Fig.17 As shown, it includes: a processor 301, a communication interface 302, a memory 303 and a communication bus 304, wherein the processor 301, the communication interface 302, and the memory 303 communicate with each other through the communication bus 304;

[0177] The memory 303 stores a computer program, and when the program is executed by the processor 301, the processor 301 executes any one of the above method steps.

[0178] The communication bus mentioned in the above electronic device can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0179] The communication interface 302 is used for communication between the electronic device and other devices.

[0180] The memory may include a random access memory (RAM) or a non-volatile memory (NVM), such as at least one disk memory. Optionally, the memory may also be at least one storage device located away from the aforementioned processor.

[0181] The above-mentioned processor can be a general-purpose processor, including a central processing unit, a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component, etc.

[0182] The present application also provides a computer storage readable storage medium, wherein the computer readable storage medium stores a computer program executable by an electronic device, and when the program runs on the electronic device, the electronic device implements any of the above method steps when executing.

[0183] The present application provides a computer program product, wherein the computer program product comprises an executable program, and when the executable program is executed by a processor, the method described above is implemented.

[0184] Although the preferred embodiments of the present application have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0185] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A cloud network monitoring and diagnosis method, characterized in that: The method comprises: Acquire each network flow message in the cloud network, wherein each network flow message includes a physical network flow message and a virtual network flow message; Inputting each of the network traffic messages into a pre-trained neural network model, and determining a protocol format corresponding to each of the network traffic messages based on the neural network model; Determine the decoding method corresponding to each network traffic message according to the protocol format corresponding to each network traffic message; decode each network traffic message using the corresponding decoding method to obtain the transaction route BTR text corresponding to each network traffic message; The source public network IP information of the target user is obtained, and based on the source public network IP information and each transaction route BTR text, the network traffic message of the target user is subjected to session association and traffic tracking; and communication fault diagnosis is performed on the network traffic message of the target user through session association and traffic tracking.

2. The method according to claim 1, characterized in that The obtaining of each network traffic message in the cloud network includes: By configuring port mirroring on a switch device, each physical network traffic message in the cloud network is obtained; By deploying a soft probe program for collection at the host machine level, each virtual network traffic message in the cloud network is obtained.

3. The method according to claim 1, characterized in that Inputting each network traffic message into a pre-trained neural network model includes: For each of the network traffic messages, each character in the network traffic message is converted into a corresponding first vector; the first vectors corresponding to each character in the network traffic message are concatenated to obtain a second vector corresponding to the network traffic message; the second vector is converted into a two-dimensional matrix array, and the two-dimensional matrix array is input into the pre-trained neural network model.

4. The method according to claim 1, characterized in that The process of pre-training a neural network model includes: Convert each sample network traffic message in the training set into a corresponding sample two-dimensional matrix array; for each sample two-dimensional matrix array, input the sample two-dimensional matrix array and the decoding method label of the sample network traffic message corresponding to the sample two-dimensional matrix array into the neural network model to be trained; determine the predicted decoding method of the sample network traffic message based on the neural network model to be trained; determine the model loss value according to the predicted decoding method and the decoding method label; and iteratively train the neural network model to be trained according to the model loss value.

5. The method according to claim 1, characterized in that The transaction routing BTR text includes virtual local area network VLAN area information, decoded TCP / IP quintuple information, public field information of network measurement message, virtual network card information, and sequence number of network measurement message.

6. The method according to claim 1, characterized in that The performing session association and traffic tracking on the network traffic message of the target user according to the source public network IP information and each transaction route BTR text includes: For each tunnel message encapsulated by the gateway from the Internet zone to the gateway zone, obtaining a sequence number carried by each tunnel message; According to the source public network IP information and the sequence number carried by each tunnel message, session association and traffic tracking are performed on the tunnel messages from the Internet zone to the gateway zone of the target user.

7. The method according to claim 1, characterized in that The performing session association and traffic tracking on the network traffic message of the target user according to the source public network IP information and each transaction route BTR text includes: For each tunnel message encapsulated by the gateway from the general server area to the cloud server, the layout pattern feature value of each tunnel message is obtained by performing load parsing on the tunnel message; According to the source public network IP information, the layout pattern feature value of each tunnel message and each transaction route BTR text, session association and traffic tracking are performed on the tunnel message from the general server area to the cloud server of the target user.

8. The method according to claim 1, characterized in that The communication fault diagnosis of the network traffic message of the target user through session association and traffic tracking includes: Through session association and traffic tracking, a physical network path vector diagram is generated based on the virtual local area network VLAN area information; a traffic model is generated through TCP / IP five-tuple information and the sequence number of each network measurement message of the target user, wherein the traffic model includes traffic path information and data packet transmission information; and the communication fault diagnosis result of the network traffic message of the target user is determined by concatenating, comparing, calculating and analyzing each standard header field of TCP / IP in the communication link of the traffic model.

9. A cloud network monitoring and diagnostic device, characterized in that: The device comprises: An acquisition module, used to acquire each network flow message in the cloud network, wherein each network flow message includes a physical network flow message and a virtual network flow message; A determination module, used to input each of the network traffic messages into a pre-trained neural network model, and determine the protocol format corresponding to each of the network traffic messages based on the neural network model; A decoding module, used to determine a decoding method corresponding to each network traffic message according to a protocol format corresponding to each network traffic message; decode each network traffic message using a corresponding decoding method to obtain a transaction route BTR text corresponding to each network traffic message; The diagnostic module is used to obtain the source public network IP information of the target user, and perform session association and traffic tracking on the network traffic messages of the target user based on the source public network IP information and each transaction route BTR text; and perform communication fault diagnosis on the network traffic messages of the target user through session association and traffic tracking.

10. The device according to claim 9, characterized in that The acquisition module is specifically used to acquire each physical network traffic message in the cloud network by configuring port mirroring on a switch device; and to acquire each virtual network traffic message in the cloud network by deploying a soft probe program for collection at the host machine level.

11. The device according to claim 9, characterized in that The determination module is specifically used to convert each character in the network traffic message into a corresponding first vector for each network traffic message; concatenate the first vectors corresponding to each character in the network traffic message to obtain a second vector corresponding to the network traffic message; convert the second vector into a two-dimensional matrix array, and input the two-dimensional matrix array into the pre-trained neural network model.

12. The device according to claim 9, characterized in that The device also includes: A training module is used to convert each sample network traffic message in a training set into a corresponding sample two-dimensional matrix array; for each sample two-dimensional matrix array, the sample two-dimensional matrix array and the decoding method label of the sample network traffic message corresponding to the sample two-dimensional matrix array are input into the neural network model to be trained; based on the neural network model to be trained, a predicted decoding method of the sample network traffic message is determined; according to the predicted decoding method and the decoding method label, a model loss value is determined; according to the model loss value, the neural network model to be trained is iteratively trained.

13. The device according to claim 9, characterized in that The transaction routing BTR text includes virtual local area network VLAN area information, decoded TCP / IP quintuple information, public field information of network measurement message, virtual network card information, and sequence number of network measurement message.

14. The device according to claim 9, characterized in that The diagnostic module is specifically used to obtain the serial number carried by each tunnel message encapsulated by the gateway from the Internet zone to the gateway zone; based on the source public network IP information and the serial number carried by each tunnel message, the session is associated and the traffic is tracked for the tunnel message from the Internet zone to the gateway zone of the target user.

15. The device according to claim 9, characterized in that The diagnostic module is specifically used to obtain the layout pattern feature value of each tunnel message encapsulated by the gateway from the general server area to the cloud server by performing load analysis on each tunnel message; According to the source public network IP information, the layout pattern feature value of each tunnel message and each transaction route BTR text, session association and traffic tracking are performed on the tunnel message from the general server area to the cloud server of the target user.

16. The device according to claim 9, characterized in that The diagnostic module is specifically used to generate a physical network path vector diagram based on virtual local area network VLAN area information through session association and traffic tracking; generate a traffic model through TCP / IP quintuple information and the sequence number of each network measurement message of the target user, wherein the traffic model includes traffic path information and data packet transmission information; and determine the communication fault diagnosis result of the network traffic message of the target user by concatenating, comparing, calculating and analyzing each standard header field of TCP / IP in the communication link of the traffic model.

17. An electronic device, characterized in that: It includes a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus; Memory, used to store computer programs; A processor, for implementing the method according to any one of claims 1 to 8 when executing a program stored in a memory.

18. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 8 is implemented.

19. A computer program product, characterized in that The computer program product comprises an executable program, which is executed by a processor to implement the method according to any one of claims 1 to 8.

Images