Network operation and maintenance method and device based on end-to-end detection, and program product

Abstract

The invention discloses a network operation and maintenance method and device based on end-to-end detection and a program product, and relates to the field of distributed systems, and the method comprises the steps: collecting the network information of N nodes in each region; performing anomaly detection on the network information of the N nodes by adopting a preset time sequence algorithm to obtain abnormal nodes in the N nodes; obtaining network segment information of the N nodes, and determining network segment information of an abnormal node according to the network segment information of the N nodes; and fault information of the N nodes is determined according to the network information of the N nodes and the network segment information of the N nodes, and abnormal nodes are processed according to the fault information of the N nodes. Through application of the method and the device, the problem that potential risks exist in a network due to relatively low operation and maintenance efficiency caused by the fact that network operation and maintenance depend on customer reporting complaints and then operation and maintenance troubleshooting and emergency processing according to customer feedback in related technologies is solved.

Description

Technical Field

[0001] The present application relates to the field of distributed systems, and more specifically, to a network operation and maintenance method, device, and program product based on end-to-end detection. Background Art

[0002] End-to-end monitoring is a common technology and method in network operation and maintenance. It is mainly used to fully understand and evaluate the performance, availability and reliability of the network. End-to-end monitoring means comprehensive monitoring and measurement from one end of the network (such as the client) to the other end (such as the server), including but not limited to monitoring the network equipment, operators, CDN, DNS, etc. between the two ends.

[0003] Existing technologies mainly rely on passive monitoring, mainly relying on customer complaints, and then performing operation and maintenance inspections and emergency response based on the limited information provided by customers. This passive response mode is extremely inefficient. Usually, customer complaints are not received until a large number of users have problems. Moreover, the problem information reported by customers is generally unrelated to operation and maintenance work, but is only related to user experience. This will cause certain difficulties for operation and maintenance personnel in locating problems, prolong emergency response time, and cause unnecessary risks to the network.

[0004] Currently, no effective solution has been proposed to address the problem that network operation and maintenance in related technologies relies on customers to report complaints, and then conducts operation and maintenance inspections and emergency response based on customer feedback, which results in low operation and maintenance efficiency and potential risks to the network. Summary of the invention

[0005] The main purpose of this application is to provide a network operation and maintenance method, device and program product based on end-to-end detection, so as to solve the problem in related technologies that network operation and maintenance relies on customers to report complaints, and then conducts operation and maintenance inspections and emergency processing based on customer feedback, which makes the operation and maintenance efficiency low and leads to potential risks in the network.

[0006] In order to achieve the above-mentioned purpose, according to one aspect of the present application, a network operation and maintenance method based on end-to-end detection is provided, the method comprising: collecting network information of N nodes in each area, wherein the network information of the N nodes at least includes: network information of a first node and network information of a second node, the first node represents a node that sends a request, the second node represents a node that receives a request, and N is a positive integer; using a preset timing algorithm to perform anomaly detection on the network information of the N nodes to obtain abnormal nodes among the N nodes; obtaining network segment information of the N nodes, and determining the network segment information of the abnormal nodes based on the network segment information of the N nodes; determining fault information of the N nodes based on the network information of the N nodes and the network segment information of the N nodes, and processing the abnormal nodes based on the fault information of the N nodes.

[0007] Furthermore, the fault information of the N nodes is determined based on the network information of the N nodes and the network segment information of the N nodes, including: calculating the number of successes and the number of failures of each request path respectively based on the network information of the N nodes, wherein the request path represents the routing path between the first node and the second node; calculating the network information of the N nodes by a tomography algorithm to determine the failure probability of each of the N nodes; calculating the forwarding success rate of each network segment based on the network segment information of the N nodes, the number of successes of each request path, and the number of failures of each request path based on the Markov Monte Carlo algorithm; and determining the fault information of the N nodes based on the number of successes of each request path, the number of failures of each request path, the forwarding success rate of each network segment, and the failure probability of each node.

[0008] Furthermore, the abnormal node is processed according to the fault information of the N nodes, including: locating the faulty network segment with a fault according to the forwarding success rate of each network segment, wherein the faulty network segment includes the faulty node with a fault; determining the network segment type of the faulty network segment according to the fault information of the N nodes; sending the forwarding success rate of each network segment, the faulty network segment, the network segment type of the faulty network segment and the network information of the abnormal node to a target device, wherein the abnormal node and the faulty node are processed by the target device.

[0009] Furthermore, determining the network segment information of the abnormal node based on the network segment information of the N nodes includes: obtaining the routing information of the N nodes based on the network information of the N nodes through a preset tool, wherein the information at least includes: the routing information between the first node and the second node; determining the network segment information of each request path based on the routing information of the N nodes and the network segment information of the N nodes; locating the network segment information of the abnormal node based on the network segment information of each request path and the network information corresponding to the abnormal node.

[0010] Furthermore, the network information of N nodes in each area is collected, including: sending a network request to the second node among the N nodes through the first node among the N nodes in each area, and receiving response data returned by the second node; determining the original data of the N nodes based on the response data returned by the second node, wherein the network information includes at least: request path, IP information of the first node, IP information of the second node, and indicator data; aggregating the original data of the N nodes to obtain the network information of the N nodes.

[0011] Furthermore, the original data of the N nodes are aggregated to obtain the network information of the N nodes, including: classifying the original data of the N nodes according to the request time of the network request to obtain a first classification result; classifying the original data of the N nodes according to the area to which the node sending the network request belongs to obtain a second classification result; classifying the original data of the N nodes according to the indicator information of the network request to obtain a third classification result; and constructing the network information of the N nodes based on the first classification result, the second classification result and the third classification result.

[0012] Furthermore, the network segment information of the N nodes is obtained, including: parsing the return code in the response data returned by the second node; extracting normal data and abnormal data respectively in the response data returned by the second node according to the return code, and storing the normal data and the abnormal data; performing data preprocessing on the normal data and the abnormal data respectively to obtain processed data; using a preset query algorithm to query the network segment information of the first node and the network segment information of the second node respectively in the processed data to obtain the network segment information of the N nodes.

[0013] In order to achieve the above-mentioned purpose, according to another aspect of the present application, a network operation and maintenance device based on end-to-end detection is provided, and the device includes: a collection unit, which is used to collect network information of N nodes in each area, wherein the network information of the N nodes at least includes: network information of a first node and network information of a second node, the first node represents a node that sends a request, the second node represents a node that receives a request, and N is a positive integer; a detection unit, which is used to perform anomaly detection on the network information of the N nodes using a preset timing algorithm to obtain abnormal nodes among the N nodes; an acquisition unit, which is used to acquire network segment information of the N nodes, and determine the network segment information of the abnormal nodes based on the network segment information of the N nodes; a processing unit, which is used to determine fault information of the N nodes based on the network information of the N nodes and the network segment information of the N nodes, and process the abnormal nodes based on the fault information of the N nodes.

[0014] Furthermore, the processing unit includes: a first calculation subunit, used to calculate the number of successes and the number of failures of each request path according to the network information of the N nodes, wherein the request path represents the routing path between the first node and the second node; a second calculation subunit, used to calculate the network information of the N nodes through a tomography algorithm to determine the failure probability of each of the N nodes; a third calculation subunit, used to calculate the forwarding success rate of each network segment based on the network segment information of the N nodes, the number of successes of each request path, and the number of failures of each request path based on the Markov Monte Carlo algorithm; a first determination subunit, used to determine the fault information of the N nodes based on the number of successes of each request path, the number of failures of each request path, the forwarding success rate of each network segment and the failure probability of each node.

[0015] Furthermore, the processing unit includes: a first positioning subunit, used to locate a faulty network segment with a fault based on the forwarding success rate of each network segment, wherein the faulty network segment includes a faulty node with a fault; a second determination subunit, used to determine the network segment type of the faulty network segment based on the fault information of the N nodes; a sending subunit, used to send the forwarding success rate of each network segment, the faulty network segment, the network segment type of the faulty network segment and the network information of the abnormal node to a target device, wherein the abnormal node and the faulty node are processed by the target device.

[0016] Furthermore, the acquisition unit includes: an acquisition subunit, used to acquire routing information of N nodes based on the network information of the N nodes through a preset tool, wherein the information at least includes: routing information between the first node and the second node; a third determination subunit, used to determine the network segment information of each request path based on the routing information of the N nodes and the network segment information of the N nodes; a second positioning subunit, used to locate the network segment information of the abnormal node based on the network segment information of each request path and the network information corresponding to the abnormal node.

[0017] Furthermore, the collection unit includes: a receiving subunit, used to send a network request to the second node among the N nodes through the first node among the N nodes in each area, and receive response data returned by the second node; a fourth determination subunit, used to determine the original data of the N nodes based on the response data returned by the second node, wherein the network information includes at least: a request path, IP information of the first node, IP information of the second node, and indicator data; an aggregation subunit, used to aggregate the original data of the N nodes to obtain the network information of the N nodes.

[0018] Furthermore, the aggregation subunit includes: a first classification module, used to classify the original data of the N nodes according to the request time of the network request to obtain a first classification result; a second classification module, used to classify the original data of the N nodes according to the area to which the node sending the network request belongs to obtain a second classification result; a third classification module, used to classify the original data of the N nodes according to the indicator information of the network request to obtain a third classification result; a construction module, used to construct the network information of the N nodes based on the first classification result, the second classification result and the third classification result.

[0019] Furthermore, the acquisition unit includes: a parsing subunit, used to parse the return code in the response data returned by the second node; an extraction subunit, used to extract normal data and abnormal data respectively in the response data returned by the second node according to the return code, and store the normal data and the abnormal data; a processing subunit, used to perform data preprocessing on the normal data and the abnormal data respectively to obtain processed data; and a query subunit, used to use a preset query algorithm to query the network segment information of the first node and the network segment information of the second node respectively in the processed data to obtain the network segment information of the N nodes.

[0020] In order to achieve the above-mentioned purpose, according to one aspect of the present application, a computer program product is provided, including a computer program, which, when executed by a processor, implements any one of the above-mentioned network operation and maintenance methods based on end-to-end detection, and which, when executed by a processor, implements the steps of the network operation and maintenance method based on end-to-end detection described in each embodiment of the present application.

[0021] In order to achieve the above-mentioned purpose, according to one aspect of the present application, a computer-readable storage medium is provided, wherein the computer-readable storage medium includes stored computer instructions, wherein when the computer instructions are executed by a processor, any one of the above-mentioned network operation and maintenance methods based on end-to-end detection is implemented.

[0022] In order to achieve the above-mentioned purpose, according to one aspect of the present application, an electronic device is provided, including one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by one or more processors, the one or more processors implement any one of the above-mentioned network operation and maintenance methods based on end-to-end detection.

[0023] In an embodiment of the present application, network information of N nodes in each area is collected, wherein the network information of the N nodes includes at least: network information of a first node and network information of a second node, the first node represents a node that sends a request, the second node represents a node that receives a request, and N is a positive integer; a preset timing algorithm is used to perform anomaly detection on the network information of the N nodes to obtain abnormal nodes among the N nodes; the network segment information of the N nodes is obtained, and the network segment information of the abnormal nodes is determined based on the network segment information of the N nodes; the fault information of the N nodes is determined based on the network information of the N nodes and the network segment information of the N nodes, and the abnormal nodes are processed based on the fault information of the N nodes, thereby solving the problem that network operation and maintenance relies on customer complaints reported, and then operation and maintenance investigation and emergency processing are performed based on customer feedback, resulting in low operation and maintenance efficiency and potential risks in the network.

[0024] By deploying monitoring nodes (first nodes) in prefecture-level cities across the country and actively sending network requests to the target node (second node), and using a preset timing algorithm for anomaly detection, it is possible to quickly identify abnormal nodes when a fault just occurs or performance begins to deteriorate. Compared with relying on customer complaints or post-analysis, it greatly improves the fault response speed, effectively shortens the fault handling time, and improves service quality. At the same time, by combining the anomaly detection results to determine the network segment information of the abnormal node, the specific location of the network fault can be more accurately located, whether it is an access network, a backbone network or an internal network of a data center, which significantly improves the efficiency and accuracy of fault location, reduces the troubleshooting workload of operation and maintenance personnel, avoids possible blindness and inefficiency in the troubleshooting process, and achieves the effect of improving the efficiency and accuracy of network operation and maintenance, and further achieves the effect of comprehensively improving the stability and quality of network services. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] The drawings constituting a part of the present application are used to provide a further understanding of the present application. The illustrative embodiments and descriptions of the present application are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0026] Figure 1 It is a hardware structure block diagram of a computer terminal (or mobile device) for implementing a network operation and maintenance method based on end-to-end detection according to the first embodiment of the present application;

[0027] Figure 2 is a flowchart of an optional network operation and maintenance method based on end-to-end detection provided according to Embodiment 1 of the present application;

[0028] Figure 3 This is a schematic diagram of an optional network operation and maintenance method based on end-to-end detection provided in accordance with the first embodiment of the present application. Figure 1 ;

[0029] Figure 4 This is a schematic diagram of an optional network operation and maintenance method based on end-to-end detection provided in accordance with the first embodiment of the present application. Figure 1 ;

[0030] Figure 5 This is a schematic diagram of an optional network operation and maintenance method based on end-to-end detection provided in accordance with the first embodiment of the present application. Figure 1 ;

[0031] Figure 6 This is a schematic diagram of an optional network operation and maintenance method based on end-to-end detection provided in accordance with the first embodiment of the present application. Figure 1 ;

[0032] Figure 7 is a schematic diagram of a network operation and maintenance device based on end-to-end detection provided according to Embodiment 2 of the present application;

[0033] Figure 8 It is a schematic diagram of a network operation and maintenance electronic device based on end-to-end detection provided according to Embodiment 5 of the present application. DETAILED DESCRIPTION

[0034] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0035] It should be noted that the methods and devices determined by the processing methods, devices, storage media and electronic devices of the present application documents can be used in the process of network operation and maintenance in the financial technology field to improve the operation and maintenance efficiency, and can also be used in any field except the financial technology field. The application fields of the methods and devices of the processing methods, devices, storage media and electronic devices of the present application documents are not limited.

[0036] It should be noted that the collected information (including but not limited to user device information, user personal information, collected data, used data, generated data, processed data, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, collected information, used information, generated information, processed information, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of relevant data are in compliance with the relevant laws, regulations and standards of relevant countries and regions, necessary confidentiality measures are taken, and public order and good customs are not violated, and corresponding operation entrances are provided for users to choose to authorize or refuse. For example, an interface is set up between this system and relevant users or institutions to provide users with corresponding operation entrances for users to choose to agree or refuse the results of automated decision-making; if the user chooses to refuse, the expert decision-making process will be entered.

[0037] Example 1

[0038] According to an embodiment of the present application, a method embodiment of network operation and maintenance based on end-to-end detection is also provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although the logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0039] The method embodiment provided in the first embodiment of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Figure 1 The hardware structure block diagram of a computer terminal (or mobile device) for implementing a network operation and maintenance method based on end-to-end detection is shown. Figure 1As shown, the computer terminal 10 (or mobile device) may include one or more (102a, 102 based on end-to-end detection of network operation and maintenance, ..., 102n are used as illustrations in the figure) processors 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 104 for storing data, and a transmission device 106 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (US) port (which may be included as one of the ports of the US bus based on end-to-end detection of network operation and maintenance), a network interface, a power supply and / or a camera. It can be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations are shown.

[0040] It should be noted that the one or more processors 102 and / or other data processing circuits described above may generally be referred to herein as "data processing circuits". The data processing circuits may be embodied in whole or in part as software, hardware, firmware, or any other combination thereof. In addition, the data processing circuit may be a single independent processing module, or may be incorporated in whole or in part into any of the other components in the computer terminal 10 (or mobile device). As described in the embodiments of the present application, the data processing circuit acts as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).

[0041] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the network operation and maintenance method based on end-to-end detection in the embodiment of the present application. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, that is, realizing the above-mentioned network operation and maintenance method based on end-to-end detection. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories may be connected to the computer terminal 10 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0042] The transmission device 106 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the computer terminal 10. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0043] The display may be, for example, a touch screen liquid crystal display (LCD) that enables a user to interact with a user interface of the computer terminal 10 (or mobile device).

[0044] Under the above operating environment, this application provides Figure 2 The network operation and maintenance method based on end-to-end detection is shown. Figure 2 It is a flow chart of a network operation and maintenance method based on end-to-end detection according to Example 1 of the present application.

[0045] Step S101, collecting network information of N nodes in each area, wherein the network information of the N nodes at least includes: network information of a first node and network information of a second node, the first node represents a node sending a request, the second node represents a node receiving a request, and N is a positive integer.

[0046] In the first embodiment of the present invention, multiple monitoring nodes can be deployed in each area, and the performance and status of the network can be evaluated by collecting network information of N nodes in each area. Each area can include different areas such as cities above the prefecture level across the country, and each area is equipped with a monitoring node. N is a positive integer, and the value of N can be adjusted according to the monitoring needs and resource conditions. For example, if more detailed data is needed, the value of N can be increased, that is, the city is divided into smaller areas, and monitoring nodes are deployed in each area, so that more detailed data can be collected through the monitoring nodes.

[0047] The first node usually refers to the node that sends the request, that is, the monitoring node; the second node refers to the node that receives the request, usually the target server or a specific destination in the network. The collected information includes but is not limited to the network delay, packet loss rate, response time and other performance indicators from the monitoring node (first node) to the target point (second node). This information is crucial for analyzing network quality and locating faults.

[0048] By deploying multiple monitoring nodes in each area and collecting network information between these nodes and the target node, end-to-end network monitoring can be achieved, and network failures, performance bottlenecks and other problems can be discovered in a timely manner, and fault location and cause analysis can be performed, thereby improving the efficiency and response speed of network operation and maintenance.

[0049] Step S102: Using a preset time series algorithm to perform anomaly detection on network information of N nodes to obtain abnormal nodes among the N nodes.

[0050] In the first embodiment, when monitoring network performance, the collected network information of N nodes is usually in the form of time series. For example, performance indicators such as the response time from the monitoring node to the target IP, DNS resolution time, and SSL handshake time will change over time. The preset time series algorithm refers to a statistical or machine learning algorithm suitable for time series data, such as the 3Sigma algorithm, the moving average method, the autoregressive moving average model (ARIMA), the long short-term memory network (LSTM), etc. These algorithms can identify trends, periodicity, and abnormal fluctuations in data.

[0051] By performing anomaly detection on the network information of N nodes through a time series algorithm, it is possible to identify monitoring nodes that exhibit abnormal characteristics, namely the abnormal nodes mentioned above. The network information of abnormal nodes may indicate a failure or performance degradation in a certain part of the network, and is the focus of subsequent fault location and cause analysis.

[0052] Through the above steps, network problems can be discovered in a timely and proactive manner, which greatly improves the efficiency and initiative of network operation and maintenance compared to the passive response mode that relies on user complaints.

[0053] Step S103, obtaining network segment information of N nodes, and determining the network segment information of the abnormal node according to the network segment information of the N nodes.

[0054] In the first embodiment of the present invention, after determining the abnormal node, it is necessary to locate the network segment information of the abnormal node, that is, the network range and operator to which the abnormal node belongs, so as to narrow the scope of fault location based on the network segment information, help operation and maintenance personnel quickly locate the network environment where the problem may occur, and improve operation and maintenance efficiency.

[0055] The network segment information refers to the address range or identification of the network where each monitoring node is located. By obtaining the network segment information of the monitoring node, the network environment where the node is located can be determined, for example, the ISP (Internet Service Provider), geographical location and other network environment information.

[0056] By combining anomaly detection of network performance and node segment information, fault location can be made more accurate and faster. For example, if multiple monitoring nodes from the same network segment report abnormally high latency or frequent packet loss, the operation and maintenance personnel can determine that the problem may be with the network equipment or operator service in this network segment, thereby avoiding ineffective troubleshooting of other normal network segments and saving valuable troubleshooting time and resources.

[0057] By obtaining the network segment information of the monitoring node and determining the network segment of the abnormal node based on this information, the cause of the fault can be quickly determined based on the abnormal node and its network segment information, achieving the effect of significantly improving the efficiency and accuracy of network operation and maintenance.

[0058] Step S104, determining fault information of the N nodes according to the network information of the N nodes and the network segment information of the N nodes, and processing the abnormal nodes according to the fault information of the N nodes.

[0059] In the first embodiment of the present invention, specific fault information can be further analyzed and identified based on the above network information and network segment information. This includes determining the nature of the fault (for example, whether it is a packet loss problem or a delay problem), the severity of the fault, the possible root cause of the fault (for example, whether it is a problem with the monitoring node access network, a problem with the server node network, or a problem with the intermediate forwarding network), etc. The determination of the fault information is based on an in-depth analysis of the abnormal network information and a comprehensive consideration of the network segment information, so that the fault location is more accurate.

[0060] After determining the fault information, the operation and maintenance personnel can take corresponding treatment measures based on the fault information. For example, if it is a problem with the monitoring node access network, it may be necessary to coordinate with the local ISP to solve it; if it is a problem with the intermediate forwarding network, it may be necessary to adjust the routing path of the data packet; if it is a problem with the target server network, it may be necessary to troubleshoot and repair the fault on the server side. The formulation of treatment measures depends on the accurate understanding and location of the fault information.

[0061] By collecting and analyzing the network information and network segment information of the monitoring nodes, network faults can be detected and located proactively without waiting for user complaints or alarm triggers, thereby significantly reducing fault response time and improving network operation and maintenance efficiency and user experience. At the same time, based on the processing of fault information, problems can be solved more specifically, avoiding blind operations and improving the success rate and speed of fault resolution.

[0062] Optionally, in the network operation and maintenance method based on end-to-end detection provided in Example 1 of the present application, the fault information of N nodes is determined based on the network information of N nodes and the network segment information of N nodes, including: calculating the number of successes of each request path and the number of failures of each request path based on the network information of the N nodes, wherein the request path represents the routing path between the first node and the second node; calculating the network information of N nodes through a tomography algorithm to determine the failure probability of each node in the N nodes; calculating the forwarding success rate of each network segment based on the network segment information of N nodes, the number of successes of each request path, and the number of failures of each request path based on the Markov Monte Carlo algorithm; determining the fault information of N nodes based on the number of successes of each request path, the number of failures of each request path, the forwarding success rate of each network segment and the failure probability of each node.

[0063] In the first embodiment, the network information can be monitored to calculate whether the request from each node to the target node is successful, and the number of successes or failures. Each request path refers to the routing path from the monitoring node (first node) to the target server node (second node). For example, if the monitoring node A sends 100 requests to the server B, 90 of which are successful and 10 are failed, then for this request path, the number of successes is 90 and the number of failures is 10.

[0064] Then, based on the collected network information, especially the number of successes and failures of each path, the failure probability of each monitoring node is calculated through a tomography algorithm. The tomography algorithm can analyze the path and status of data packets transmitted in the network, identify nodes or paths with failure rates higher than a preset value, and thus determine the failure probability of the node.

[0065] Secondly, the network segment information of N nodes, the number of successes of each request path, and the number of failures of each request path are calculated based on the Markov Monte Carlo algorithm to obtain the forwarding success rate of each network segment. The Markov Chain Monte Carlo (MCMC) algorithm is a method used to simulate the state transition of complex systems and estimate probability distribution. It is used to estimate the forwarding success rate of each network segment. The forwarding success rate reflects the probability of successful transmission of a data packet when passing through a network segment, which is very important for evaluating the health status of the network segment and locating faults.

[0066] Finally, by comprehensively analyzing the above information, the fault information of each monitoring node is determined, including the specific type of fault (such as packet loss, delay, connectivity problems), the severity of the fault, and the possible cause of the fault. For example, the number of failures of a monitoring node to multiple target servers is much higher than the number of successes, and the forwarding success rate of the network segment where the monitoring node is located is low. This may mean that there is a problem with the access network of the monitoring node, which needs further investigation.

[0067] Through statistical analysis of monitoring data, fault location using tomography algorithms, and calculation of network segment forwarding success rates using the Markov Monte Carlo algorithm, network faults can be discovered and located proactively and promptly, fault response time can be reduced, and the efficiency and accuracy of network operation and maintenance can be improved. This overcomes the limitations of traditional passive monitoring methods, improves the operation and maintenance efficiency of financial institutions, and thereby achieves the effect of improving the business stability of financial institutions.

[0068] Optionally, in the network operation and maintenance method based on end-to-end detection provided in Example 1 of the present application, abnormal nodes are processed according to the fault information of N nodes, including: locating the faulty network segment with faults according to the forwarding success rate of each network segment, wherein the faulty network segment includes the faulty node with faults; determining the network segment type of the faulty network segment according to the fault information of N nodes; sending the forwarding success rate of each network segment, the faulty network segment, the network segment type of the faulty network segment and the network information of the abnormal node to the target device, wherein the abnormal node and the faulty node are processed by the target device.

[0069] In the first embodiment of the present invention, if the forwarding success rate of a certain network segment is significantly lower than the average value or the set threshold, the network segment is determined to be a "faulty network segment" with a fault. The faulty network segment may contain one or more "faulty nodes", that is, network devices or connection points, whose abnormalities lead to a decrease in the forwarding success rate. Locating the faulty network segment can help operation and maintenance personnel quickly narrow the scope of troubleshooting and improve the efficiency of fault location.

[0070] By analyzing the fault information of N nodes, the "segment type" of the faulty network segment is determined, that is, the specific network environment where the fault occurs, such as the access network (usually the connection between the client and the ISP), the backbone network (the connection between ISPs), or the data center network (the internal network on the server side). Determining the segment type helps operation and maintenance personnel understand the background of the fault and adopt a more appropriate fault handling strategy.

[0071] Finally, the forwarding success rate of each network segment, the faulty network segment, the network segment type of the faulty network segment, and the network information of the abnormal node are sent to the target device: the target device here can be understood as a centralized monitoring platform or a fault handling system used by operation and maintenance personnel. Once the target device receives this fault information, it can start the corresponding fault handling process. This may include direct repair of abnormal nodes (such as restarting network devices, adjusting configurations, etc.), rerouting traffic on the faulty network segment (avoiding the fault point), communicating with network operators to solve problems with the backbone network, etc. The processing process is usually automated, based on preset fault handling strategies and workflows to achieve fast and efficient fault recovery.

[0072] Through data analysis and algorithm application, we can achieve fault detection at the monitoring node, location of the faulty network segment and determination of the fault type, and finally transmit this information to the target device for fault handling in an automated or semi-automated manner, thus significantly improving the efficiency of network fault detection and handling, thereby reducing network interruption time and improving the service quality of financial institutions.

[0073] Optionally, in the network operation and maintenance method based on end-to-end detection provided in Example 1 of the present application, the network segment information of the abnormal node is determined based on the network segment information of N nodes, including: obtaining the routing information of N nodes based on the network information of N nodes through a preset tool, wherein at least including: the routing information between the first node and the second node; determining the network segment information of each request path based on the routing information of N nodes and the network segment information of N nodes; locating the network segment information of the abnormal node based on the network segment information of each request path and the network information corresponding to the abnormal node.

[0074] In the first embodiment, the "preset tool" generally refers to a network diagnostic tool, such as a traceroute. Tracing the route can help us understand the specific path of a data packet transmitted in the network. By using the preset tool, the routing information between the monitoring node (first node) and the target server (second node) can be obtained based on the network information of these monitoring nodes. The routing information records in detail each step of the data packet from the monitoring node (first node) to the target server, including the IP address of each intermediate router passed through.

[0075] After obtaining the routing information of N monitoring nodes, the network segment information of each request path is determined in combination with the network segment information. The network segment information refers to the network range or ISP (Internet Service Provider) to which the monitoring node and the routers along the way belong. By matching the IP address of each router in each request path with the network segment information, the specific network segment that the data packet passes through during transmission can be determined.

[0076] By using the network segment information of each request path and the network performance information of the abnormal nodes, the network environment in which these abnormal nodes are located can be more accurately located. For example, if multiple monitoring nodes report abnormally high packet loss rates when communicating with the same target server, and the request paths of these nodes pass through the same network segment, it is determined that the network segment information of the abnormal node may be that network segment, and it can be inferred that the network segment may have a network failure or performance bottleneck.

[0077] By collecting network information, obtaining routing information, and combining it with segment information for analysis, we can achieve active monitoring and precise positioning of network faults. By utilizing the distribution advantages of monitoring nodes and the power of network diagnostic tools, we can help operation and maintenance personnel discover and handle network faults before customers perceive the problem, greatly improving the stability of network services and user experience.

[0078] Optionally, in the network operation and maintenance method based on end-to-end detection provided in Example 1 of the present application, network information of N nodes in each area is collected, including: sending a network request to a second node among the N nodes through a first node among the N nodes in each area, and receiving response data returned by the second node; determining the original data of the N nodes based on the response data returned by the second node, wherein the network information includes at least: a request path, IP information of the first node, IP information of the second node, and indicator data; and aggregating the original data of the N nodes to obtain the network information of the N nodes.

[0079] In the first embodiment, the "first node" refers to the monitoring nodes distributed in each area, and the "second node" generally refers to the target server or a key node in the network. The monitoring node will send network requests to the target node regularly or on demand, such as HTTP requests, PING, dial test data, etc., to test the connectivity and performance of the network. At the same time, the monitoring node will receive the response data returned by the target node, which includes the response status code, response time, etc., for subsequent network performance analysis.

[0080] Raw data refers to the detailed information about network requests and responses received by the monitoring node, including but not limited to the request path, IP information of the monitoring node (first node), IP information of the target node (second node), and various network performance indicator data, such as response time, packet loss rate, connectivity, etc. These raw data are the basis of network monitoring, and they provide direct evidence of the network status when each monitoring node communicates with the target node.

[0081] After the original data is collected, data aggregation is required to extract key network information and obtain the network information of the N nodes mentioned above. This usually includes statistics on the original data by time window (such as every 5 minutes) and by spatial range (such as by province), calculating aggregation indicators such as average response time and average packet loss rate, and determining the success rate and number of failures of communication between the monitoring node and the target point. The aggregated data can more intuitively reflect the overall performance and trends of the network, helping operation and maintenance personnel quickly identify potential problems or failures in the network.

[0082] Through the above process, the health of the network can be actively monitored and evaluated, and network performance degradation or failures can be discovered and located in a timely manner, so that corresponding measures can be taken to repair and optimize them, thereby improving the efficiency of fault detection and thus improving network stability and user experience.

[0083] Optionally, in the network operation and maintenance method based on end-to-end detection provided in Example 1 of the present application, the original data of N nodes are aggregated to obtain network information of the N nodes, including: classifying the original data of the N nodes according to the request time of the network request to obtain a first classification result; classifying the original data of the N nodes according to the area to which the node sending the network request belongs to obtain a second classification result; classifying the original data of the N nodes according to the indicator information of the network request to obtain a third classification result; and constructing the network information of the N nodes based on the first classification result, the second classification result and the third classification result.

[0084] In the first embodiment, the original data can be classified in chronological order, usually to observe the trend of network performance over time. For example, the data can be grouped according to the time granularity of 5 minutes, 1 hour or one day to determine the performance of the network in different time periods, such as the performance difference between peak and trough periods. The first classification result helps to identify periodic problems or sudden failures of the network and provides a basis for subsequent time series analysis.

[0085] Then, the data is classified by geographic location, that is, the data is grouped according to the different regions (such as provinces and cities) where the monitoring nodes are located. In this way, the network status in a specific area can be analyzed, such as finding that the network latency in a certain area is higher than that in other areas. The second classification result helps to understand the geographical distribution characteristics of the network and identify regional network problems.

[0086] Secondly, the raw data can be classified according to the indicator information, where the indicator information refers to the quantitative indicators of network performance, including response time, packet loss rate, connectivity status, etc. This classification method can more clearly understand the performance of the network under different performance indicators, for example, find out which nodes have a packet loss rate that reaches or exceeds a certain threshold. Third, the classification results help locate performance bottlenecks or fault points, providing a basis for network optimization.

[0087] Finally, these classification results (i.e., the first classification results, the second classification results, and the third classification results) are combined to construct comprehensive network information for each monitoring node, such as performance trends over time, performance overviews by region, and statistical analysis results of specific performance indicators.

[0088] Through this multi-dimensional classification and aggregation method, huge amounts of raw monitoring data can be converted into structured and meaningful network information, providing strong data support for network health monitoring, fault location and performance optimization, thereby improving data processing efficiency and information availability.

[0089] Optionally, in the network operation and maintenance method based on end-to-end detection provided in Example 1 of the present application, network segment information of N nodes is obtained, including: parsing the return code in the response data returned by the second node; extracting normal data and abnormal data from the response data returned by the second node according to the return code, and storing the normal data and abnormal data; performing data preprocessing on the normal data and the abnormal data, respectively, to obtain processed data; and using a preset query algorithm to query the network segment information of the first node and the network segment information of the second node in the processed data, respectively, to obtain the network segment information of N nodes.

[0090] In the first embodiment of the present invention, in order to obtain the network segment information of N nodes, the return code in the response data returned by the second node can be parsed. The return code is the response status of the network request, which is usually expressed as an HTTP status code in the HTTP protocol, such as 200 for a successful request, 404 for resource not found, and 500 series for server-side errors. By parsing the return code, it can be determined whether the network request is successfully executed, thereby identifying the normal operation and abnormal state of the network. According to the return code, the response data can be divided into normal data and abnormal data. Normal data refers to data whose return code indicates a successful request or a normal response, while abnormal data refers to data whose return code indicates a failed request or an abnormal response.

[0091] Then, data preprocessing refers to cleaning, converting or formatting the raw data before data analysis to remove noise, fill missing values, unify data formats, etc. For normal data and abnormal data, the purpose of preprocessing is to ensure that the subsequent algorithms can accurately analyze and use this data. The processed data will be cleaner and in a consistent format, which is convenient for subsequent analysis.

[0092] Secondly, the preset query algorithm is used to query the network segment information of the first node and the network segment information of the second node in the processed data respectively to obtain the network segment information of N nodes. The preset query algorithm is usually based on a network query tool (in this embodiment one, it refers to a tool for obtaining relevant information such as domain names and IP addresses) to query the database, and the database contains the allocation information of the IP addresses of the detection nodes in each region and the corresponding network segment attribution data. By querying the IP addresses of the first node (monitoring node) and the second node (target node) in the processed data, the network segment information of each of them can be obtained.

[0093] Through this process, the response data of network requests can be effectively processed and classified, and key network segment information can be extracted, so as to achieve proactive discovery and rapid location of network faults, thereby achieving the effect of improving fault response speed and reducing customer complaints, while also improving the efficiency of network operation and maintenance and the quality of network services.

[0094] Optionally, in the first embodiment, the process of end-to-end network fault monitoring and location in the present solution can be as follows: Figure 3 As shown in the figure. Through monitoring nodes spread across prefecture-level cities across the country, network data is actively collected to obtain comprehensive network status information. Use network query tools to query IP addresses and determine the network segment to which they belong, providing key information for building network topology. Aggregate the original network data and classify and summarize them according to time, space and network indicators to facilitate subsequent in-depth analysis. Build the topology of the network and draw a network link diagram based on the monitored router information and network segment ownership. Through timing anomaly detection (such as the 3sigma algorithm), identify abnormal values ​​in network performance indicators, which may indicate network failures. Use tomography technology, combined with timing anomaly information and network topology, to locate the specific location of network failures. Finally, based on fault location and network indicator analysis, the root cause of the failure is inferred, which may be network equipment failure, link congestion or software problems. Figure 3 The process integrates data collection, analysis, fault location and cause inference, realizes active monitoring and rapid response to network faults, and significantly improves the efficiency and accuracy of network operation and maintenance.

[0095] Optionally, in the first embodiment, the process of processing the initial data of network fault monitoring in the present solution can be as follows: Figure 4As shown. First, in step S401, the monitoring nodes distributed in prefecture-level cities across the country actively initiate network requests according to the preset URL list, and collect comprehensive network data including monitoring node IP, target server IP, response time, etc. Then, in step S402, the response return code is parsed, and the normal response and abnormal response data are distinguished and marked, and stored in the database respectively, providing a clear data set for subsequent analysis. Finally, in step S403, the cache acceleration technology is used to quickly obtain the network segment information of the monitoring node and the routers along the way. This step helps to build the network topology and understand the network segment ownership in the data transmission path, providing a reference for the network structure for fault location.

[0096] Optionally, in the first embodiment, the process of analyzing monitoring data and building network topology in this solution can be as follows: Figure 5 As shown. In step S501, the collected network information is aggregated. This process not only integrates the network data of multiple monitoring nodes, but also classifies the data according to predefined time and space granularity (such as 5-minute intervals and provinces), which is convenient for subsequent detailed analysis. In step S502, the average values ​​of network indicators under specific time and space classifications, such as delay, bandwidth, success rate, etc., are calculated, which helps to identify the normal and abnormal modes of network performance. In step S503, the traceroute technology is used to obtain the IP address of each router on the path from the monitoring node to the target server, which provides important information for understanding the specific path of data packet transmission. Finally, in the S504 stage, through the network query tool, the system obtains the network segment ownership information of the above router IP address, and combines the data of S501 and S503 to construct a detailed network topology map. This topology map not only reveals the complete path from the monitoring node to the server, but also marks the ownership of each network segment in the path, which is the basis for network fault location and performance optimization. Figure 5 The process ensures the full integration and utilization of data, providing a clear network view and data support for subsequent fault diagnosis and network operation and maintenance.

[0097] Optionally, in the first embodiment, the process of network fault monitoring and locating of the solution can be as follows: Figure 6 As shown. Starting from S601, the 3sigma algorithm is used to detect anomalies on the aggregated time series data. This algorithm can identify measurement values ​​that exceed the normal fluctuation range. These abnormal values ​​usually indicate potential problems or failures in the network. In S602, the monitored end-to-end data is used as the basis for analysis, and the number of measurement successes and failures of each path is counted to provide a quantitative basis for evaluating the health of the network. Entering S603, based on Figure 5Based on the network topology information constructed in the system, the system can determine the specific network segment that each path passes through. This step provides a specific reference on the network structure for fault location. In S604, the Markov Monte Carlo method is used to combine the number of measurement successes and failures of the path to estimate the forwarding success rate of each network segment, which is used to measure the network quality. For example, a network segment with a low forwarding success rate is likely to be the source of the fault. In S605, based on the analysis of the forwarding success rate of the above network segment, the network segment location of the network fault, that is, the fault point, is accurately located, so that the operation and maintenance personnel can quickly focus on the problem and perform targeted troubleshooting and repair. Finally, in S606, all analysis results, including outliers, forwarding success rates, fault point location, etc., will be sent to the centralized monitoring platform, and relevant personnel will be notified by email to ensure the timely transmission and response of fault information, thereby improving the efficiency and speed of fault handling.

[0098] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0099] In summary, the network operation and maintenance method based on end-to-end detection provided in the embodiment of the present application collects network information of N nodes in each area, wherein the network information of the N nodes at least includes: network information of the first node, network information of the second node, the first node represents the node that sends the request, the second node represents the node that receives the request, and N is a positive integer; a preset timing algorithm is used to perform anomaly detection on the network information of the N nodes to obtain abnormal nodes among the N nodes; the network segment information of the N nodes is obtained, and the network segment information of the abnormal nodes is determined based on the network segment information of the N nodes; the fault information of the N nodes is determined based on the network information of the N nodes and the network segment information of the N nodes, and the abnormal nodes are processed based on the fault information of the N nodes, which solves the problem that network operation and maintenance in related technologies rely on customers to report complaints, and then perform operation and maintenance investigation and emergency processing based on customer feedback, which makes the operation and maintenance efficiency low and leads to potential risks in the network.

[0100] By deploying monitoring nodes (first nodes) in prefecture-level cities across the country and actively sending network requests to the target node (second node), and using a preset timing algorithm for anomaly detection, it is possible to quickly identify abnormal nodes when a fault just occurs or performance begins to deteriorate. Compared with relying on customer complaints or post-analysis, it greatly improves the fault response speed, effectively shortens the fault handling time, and improves service quality. At the same time, by combining the anomaly detection results to determine the network segment information of the abnormal node, the specific location of the network fault can be more accurately located, whether it is an access network, a backbone network or an internal network of a data center, which significantly improves the efficiency and accuracy of fault location, reduces the troubleshooting workload of operation and maintenance personnel, avoids possible blindness and inefficiency in the troubleshooting process, and achieves the effect of improving the efficiency and accuracy of network operation and maintenance, and further achieves the effect of comprehensively improving the stability and quality of network services.

[0101] Example 2

[0102] The embodiment of the present application also provides a network operation and maintenance device based on end-to-end detection. It should be noted that the network operation and maintenance device based on end-to-end detection in the embodiment of the present application can be used to execute the network operation and maintenance method based on end-to-end detection provided in the embodiment of the present application. The network operation and maintenance device based on end-to-end detection provided in the embodiment of the present application is introduced below.

[0103] According to an embodiment of the present application, a device for implementing the above-mentioned network operation and maintenance method based on end-to-end detection is also provided, such as Figure 7 As shown, the device comprises:

[0104] Specifically, the collection unit 701 is used to collect network information of N nodes in each area, wherein the network information of the N nodes at least includes: network information of the first node and network information of the second node, the first node represents the node sending the request, the second node represents the node receiving the request, and N is a positive integer.

[0105] The detection unit 702 is used to perform anomaly detection on the network information of N nodes by using a preset time series algorithm to obtain abnormal nodes among the N nodes.

[0106] The acquisition unit 703 is used to acquire the network segment information of N nodes, and determine the network segment information of the abnormal node according to the network segment information of the N nodes.

[0107] The processing unit 704 is used to determine the fault information of the N nodes according to the network information of the N nodes and the network segment information of the N nodes, and process the abnormal nodes according to the fault information of the N nodes.

[0108] The network operation and maintenance device based on end-to-end detection provided in the embodiment of the present application collects network information of N nodes in each area through a collection unit 701, wherein the network information of the N nodes at least includes: network information of a first node and network information of a second node, the first node represents a node that sends a request, the second node represents a node that receives a request, and N is a positive integer; the detection unit 702 uses a preset timing algorithm to perform anomaly detection on the network information of the N nodes to obtain abnormal nodes among the N nodes; the acquisition unit 703 acquires the network segment information of the N nodes, and determines the network segment information of the abnormal nodes based on the network segment information of the N nodes; the processing unit 704 determines the fault information of the N nodes based on the network information of the N nodes and the network segment information of the N nodes, and processes the abnormal nodes based on the fault information of the N nodes, thereby solving the problem in the related art that network operation and maintenance relies on customers to report complaints, and then performs operation and maintenance investigation and emergency processing based on customer feedback, which makes the operation and maintenance efficiency low and leads to potential risks in the network.

[0109] By deploying monitoring nodes (first nodes) in prefecture-level cities across the country and actively sending network requests to the target node (second node), and using a preset timing algorithm for anomaly detection, it is possible to quickly identify abnormal nodes when a fault just occurs or performance begins to deteriorate. Compared with relying on customer complaints or post-analysis, it greatly improves the fault response speed, effectively shortens the fault handling time, and improves service quality. At the same time, by combining the anomaly detection results to determine the network segment information of the abnormal node, the specific location of the network fault can be more accurately located, whether it is an access network, a backbone network or an internal network of a data center, which significantly improves the efficiency and accuracy of fault location, reduces the troubleshooting workload of operation and maintenance personnel, avoids possible blindness and inefficiency in the troubleshooting process, and achieves the effect of improving the efficiency and accuracy of network operation and maintenance, and further achieves the effect of comprehensively improving the stability and quality of network services.

[0110] Optionally, in the network operation and maintenance device based on end-to-end detection provided in Example 2 of the present application, the above-mentioned processing unit 704 includes: a first calculation subunit, used to calculate the number of successes of each request path and the number of failures of each request path according to the network information of N nodes, wherein the request path represents the routing path between the first node and the second node; a second calculation subunit, used to calculate the network information of N nodes through a tomography algorithm to determine the failure probability of each node in the N nodes; a third calculation subunit, used to calculate the forwarding success rate of each network segment based on the network segment information of N nodes, the number of successes of each request path and the number of failures of each request path based on the Markov Monte Carlo algorithm; a first determination subunit, used to determine the fault information of N nodes based on the number of successes of each request path, the number of failures of each request path, the forwarding success rate of each network segment and the failure probability of each node.

[0111] Optionally, in the network operation and maintenance device based on end-to-end detection provided in Example 2 of the present application, the above-mentioned processing unit 704 includes: a first positioning sub-unit, used to locate the faulty network segment with a fault based on the forwarding success rate of each network segment, wherein the faulty network segment includes a faulty node with a fault; a second determination sub-unit, used to determine the network segment type of the faulty network segment based on the fault information of N nodes; a sending sub-unit, used to send the forwarding success rate of each network segment, the faulty network segment, the network segment type of the faulty network segment and the network information of the abnormal node to the target device, wherein the abnormal node and the faulty node are processed by the target device.

[0112] Optionally, in the network operation and maintenance device based on end-to-end detection provided in Example 2 of the present application, the above-mentioned acquisition unit 703 includes: an acquisition sub-unit, used to obtain the routing information of N nodes based on the network information of N nodes through a preset tool, wherein at least includes: the routing information between the first node and the second node; a third determination sub-unit, used to determine the network segment information of each request path based on the routing information of the N nodes and the network segment information of the N nodes; a second positioning sub-unit, used to locate the network segment information of the abnormal node based on the network segment information of each request path and the network information corresponding to the abnormal node.

[0113] Optionally, in the network operation and maintenance device based on end-to-end detection provided in Example 2 of the present application, the above-mentioned collection unit 701 includes: a receiving subunit, used to send a network request to a second node among the N nodes through the first node among the N nodes in each area, and receive response data returned by the second node; a fourth determination subunit, used to determine the original data of the N nodes based on the response data returned by the second node, wherein the network information includes at least: a request path, IP information of the first node, IP information of the second node, and indicator data; an aggregation subunit, used to aggregate the original data of the N nodes to obtain network information of the N nodes.

[0114] Optionally, in the network operation and maintenance device based on end-to-end detection provided in Example 2 of the present application, the above-mentioned aggregation subunit includes: a first classification module, used to classify the original data of N nodes according to the request time of the network request, and obtain a first classification result; a second classification module, used to classify the original data of N nodes according to the area to which the node sending the network request belongs, and obtain a second classification result; a third classification module, used to classify the original data of N nodes according to the indicator information of the network request, and obtain a third classification result; a construction module, used to construct the network information of N nodes based on the first classification result, the second classification result and the third classification result.

[0115] Optionally, in the network operation and maintenance device based on end-to-end detection provided in Example 2 of the present application, the above-mentioned acquisition unit 703 includes: a parsing subunit, used to parse the return code in the response data returned by the second node; an extraction subunit, used to extract normal data and abnormal data respectively from the response data returned by the second node according to the return code, and store the normal data and abnormal data; a processing subunit, used to perform data preprocessing on the normal data and the abnormal data respectively to obtain processed data; a query subunit, used to use a preset query algorithm to query the network segment information of the first node and the network segment information of the second node respectively in the processed data to obtain the network segment information of N nodes.

[0116] It should be noted that the above-mentioned acquisition unit 701, detection unit 702, acquisition unit 703 and processing unit 704 correspond to steps S201 to S204 in Example 1, and the two modules and the corresponding steps implement the same examples and application scenarios, but are not limited to the contents disclosed in the above-mentioned Example 1. It should be noted that the above-mentioned modules or units may be hardware components or software components stored in a memory (e.g., memory 104) and processed by one or more processors (e.g., processors 102a, 102 network operation and maintenance based on end-to-end detection, ..., 102n), and the above-mentioned modules may also be part of the device and may be run in the computer terminal 10 provided in Example 1.

[0117] Example 3

[0118] An embodiment of the present application may provide an electronic device, Figure 8 is a structural block diagram of an electronic device according to an embodiment of the present application. Figure 8 As shown, the electronic device may include: one or more ( Figure 8 (only one is shown) processor 802, memory 804, storage controller, and peripheral interface, wherein the peripheral interface is connected to the radio frequency module, audio module and display.

[0119] Among them, the memory can be used to store software programs and modules, such as program instructions / modules corresponding to the methods and devices in the embodiments of the present application, and the processor executes various functional applications and data processing by running the software programs and modules stored in the memory, that is, realizing the above-mentioned method. The memory may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include a memory remotely arranged relative to the processor, and these remote memories may be connected to the terminal via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0120] The processor can call the information and application stored in the memory through the transmission device to perform the following steps: collect network information of N nodes in each area, wherein the network information of the N nodes at least includes: network information of a first node and network information of a second node, the first node represents a node that sends a request, the second node represents a node that receives a request, and N is a positive integer; use a preset timing algorithm to perform anomaly detection on the network information of the N nodes to obtain abnormal nodes among the N nodes; obtain network segment information of the N nodes, and determine the network segment information of the abnormal nodes based on the network segment information of the N nodes; determine fault information of the N nodes based on the network information of the N nodes and the network segment information of the N nodes, and process the abnormal nodes based on the fault information of the N nodes.

[0121] The processor can call the information and application stored in the memory through the transmission device to perform the following steps: determine the fault information of the N nodes based on the network information of the N nodes and the network segment information of the N nodes, including: calculate the number of successes and the number of failures of each request path respectively based on the network information of the N nodes, wherein the request path represents the routing path between the first node and the second node; calculate the network information of the N nodes through a tomography algorithm to determine the failure probability of each node in the N nodes; calculate the forwarding success rate of each network segment based on the network segment information of the N nodes, the number of successes of each request path, and the number of failures of each request path based on the Markov Monte Carlo algorithm; determine the fault information of the N nodes based on the number of successes of each request path, the number of failures of each request path, the forwarding success rate of each network segment and the failure probability of each node.

[0122] The processor can call the information and application stored in the memory through the transmission device to perform the following steps: process the abnormal node according to the fault information of N nodes, including: locate the faulty network segment with faults according to the forwarding success rate of each network segment, wherein the faulty network segment includes the faulty node with faults; determine the network segment type of the faulty network segment according to the fault information of N nodes; send the forwarding success rate of each network segment, the faulty network segment, the network segment type of the faulty network segment and the network information of the abnormal node to the target device, wherein the abnormal node and the faulty node are processed by the target device.

[0123] The processor can call the information and application stored in the memory through the transmission device to perform the following steps: determine the network segment information of the abnormal node based on the network segment information of N nodes, including: obtaining the routing information of N nodes based on the network information of N nodes through a preset tool, which at least includes: routing information between the first node and the second node; determine the network segment information of each request path based on the routing information of N nodes and the network segment information of N nodes; locate the network segment information of the abnormal node based on the network segment information of each request path and the network information corresponding to the abnormal node.

[0124] The processor can call the information and application programs stored in the memory through the transmission device to perform the following steps: collect network information of N nodes in each area, including: sending a network request to the second node among the N nodes through the first node among the N nodes in each area, and receiving response data returned by the second node; determining the original data of the N nodes based on the response data returned by the second node, wherein the network information includes at least: request path, IP information of the first node, IP information of the second node, and indicator data; aggregating the original data of the N nodes to obtain the network information of the N nodes.

[0125] The processor can call the information and application stored in the memory through the transmission device to perform the following steps: aggregating the original data of N nodes to obtain network information of the N nodes, including: classifying the original data of the N nodes according to the request time of the network request to obtain a first classification result; classifying the original data of the N nodes according to the area to which the node sending the network request belongs to obtain a second classification result; classifying the original data of the N nodes according to the indicator information of the network request to obtain a third classification result; and constructing the network information of the N nodes based on the first classification result, the second classification result and the third classification result.

[0126] The processor can call the information and application stored in the memory through the transmission device to execute the following steps: obtain the network segment information of N nodes, including: parsing the return code in the response data returned by the second node; extracting normal data and abnormal data from the response data returned by the second node according to the return code, and storing the normal data and abnormal data; performing data preprocessing on the normal data and abnormal data respectively to obtain processed data; using a preset query algorithm to query the network segment information of the first node and the network segment information of the second node in the processed data respectively to obtain the network segment information of N nodes.

[0127] By adopting the embodiment of the present application, a network operation and maintenance method based on end-to-end detection is provided. By collecting the network information of N nodes in each area, wherein the network information of the N nodes at least includes: the network information of the first node, the network information of the second node, the first node represents the node that sends the request, the second node represents the node that receives the request, and N is a positive integer; using a preset timing algorithm to perform abnormal detection on the network information of the N nodes, and obtain the abnormal nodes among the N nodes; obtaining the network segment information of the N nodes, and determining the network segment information of the abnormal nodes based on the network segment information of the N nodes; determining the fault information of the N nodes based on the network information of the N nodes and the network segment information of the N nodes, and processing the abnormal nodes based on the fault information of the N nodes, thereby solving the problem that the network operation and maintenance relies on customer complaints, and then performs operation and maintenance investigation and emergency processing based on customer feedback, which makes the operation and maintenance efficiency low, resulting in the technical problem of potential risks in the network.

[0128] By deploying monitoring nodes (first nodes) in prefecture-level cities across the country and actively sending network requests to the target node (second node), and using a preset timing algorithm for anomaly detection, it is possible to quickly identify abnormal nodes when a fault just occurs or performance begins to deteriorate. Compared with relying on customer complaints or post-analysis, it greatly improves the fault response speed, effectively shortens the fault handling time, and improves service quality. At the same time, by combining the anomaly detection results to determine the network segment information of the abnormal node, the specific location of the network fault can be more accurately located, whether it is an access network, a backbone network or an internal network of a data center, which significantly improves the efficiency and accuracy of fault location, reduces the troubleshooting workload of operation and maintenance personnel, avoids possible blindness and inefficiency in the troubleshooting process, and achieves the effect of improving the efficiency and accuracy of network operation and maintenance, and further achieves the effect of comprehensively improving the stability and quality of network services.

[0129] It can be understood by those skilled in the art that Figure 8 The structure shown is for illustration only, and the electronic device may also be a smart phone (such as an Android phone, an iOS phone, etc.), a tablet computer, a PDA, a mobile Internet device (Mobile Internet Devices, MID), a PAD, and other terminal devices. Figure 8 The structure of the electronic device is not limited. Figure 8 More or fewer components (such as network interfaces, display devices, etc.) shown in, or having Figure 8 Different configurations are shown.

[0130] A person of ordinary skill in the art can understand that all or part of the steps in the various methods of the above embodiments can be completed by instructing the hardware related to the terminal device through a program, and the program can be stored in a computer-readable storage medium, and the storage medium may include: a flash drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0131] Example 4

[0132] The embodiment of the present application further provides a storage medium. Optionally, in this embodiment, the storage medium can be used to store the program code executed by the network operation and maintenance method based on end-to-end detection provided in the first embodiment.

[0133] Optionally, in this embodiment, the above storage medium may be located in any computer terminal in a computer terminal group in a computer network, or in any mobile terminal in a mobile terminal group.

[0134] The present application also provides a computer program product, which, when executed on a data processing device, is suitable for executing the program steps of the network operation and maintenance method based on end-to-end detection.

[0135] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0136] In the above embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0137] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0138] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0139] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0140] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, in essence, or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or optical disk and other media that can store program codes.

[0141] The above is only a preferred implementation of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A network operation and maintenance method based on end-to-end detection, characterized in that: include: Collecting network information of N nodes in each area, wherein the network information of the N nodes at least includes: network information of a first node and network information of a second node, the first node represents a node that sends a request, the second node represents a node that receives a request, and N is a positive integer; Using a preset time series algorithm to perform anomaly detection on the network information of the N nodes to obtain abnormal nodes among the N nodes; Acquire the network segment information of the N nodes, and determine the network segment information of the abnormal node according to the network segment information of the N nodes; The fault information of the N nodes is determined according to the network information of the N nodes and the network segment information of the N nodes, and the abnormal node is processed according to the fault information of the N nodes.

2. The method according to claim 1, characterized in that Determining fault information of the N nodes according to the network information of the N nodes and the network segment information of the N nodes includes: Calculating the number of successes and the number of failures of each request path respectively according to the network information of the N nodes, wherein the request path represents a routing path between the first node and the second node; Calculating the network information of the N nodes by a tomography algorithm to determine the failure probability of each of the N nodes; Calculate the forwarding success rate of each network segment based on the network segment information of the N nodes, the number of successes of each request path, and the number of failures of each request path based on the Markov Monte Carlo algorithm; The fault information of the N nodes is determined according to the number of successes of each request path, the number of failures of each request path, the forwarding success rate of each network segment and the failure probability of each node.

3. The method according to claim 2, characterized in that Processing the abnormal node according to the fault information of the N nodes includes: Locating a faulty network segment with a fault according to the forwarding success rate of each network segment, wherein the faulty network segment includes a faulty node with a fault; Determine the network segment type of the faulty network segment according to the fault information of the N nodes; The forwarding success rate of each network segment, the faulty network segment, the network segment type of the faulty network segment and the network information of the abnormal node are sent to a target device, wherein the abnormal node and the faulty node are processed by the target device.

4. The method according to claim 1, characterized in that: Determining the network segment information of the abnormal node according to the network segment information of the N nodes includes: Acquire routing information of the N nodes according to the network information of the N nodes through a preset tool, wherein the routing information at least includes: routing information between the first node and the second node; Determine the network segment information of each request path according to the routing information of the N nodes and the network segment information of the N nodes; The network segment information of the abnormal node is located according to the network segment information of each request path and the network information corresponding to the abnormal node.

5. The method according to claim 1, characterized in that Collect network information of N nodes in each area, including: Sending a network request to the second node among the N nodes through the first node among the N nodes in each area, and receiving response data returned by the second node; Determine the original data of the N nodes according to the response data returned by the second node, wherein the network information at least includes: request path, IP information of the first node, IP information of the second node, and indicator data; The original data of the N nodes are aggregated to obtain network information of the N nodes.

6. The method according to claim 5, characterized in that Aggregating the original data of the N nodes to obtain network information of the N nodes includes: Classifying the original data of the N nodes according to the request time of the network request to obtain a first classification result; Classify the original data of the N nodes according to the region to which the node sending the network request belongs, to obtain a second classification result; Classifying the original data of the N nodes according to the indicator information of the network request to obtain a third classification result; The network information of the N nodes is constructed according to the first classification result, the second classification result and the third classification result.

7. The method according to claim 1, characterized in that Obtaining the network segment information of the N nodes, including: Parsing a return code in the response data returned by the second node; extracting normal data and abnormal data from the response data returned by the second node according to the return code, and storing the normal data and the abnormal data; Performing data preprocessing on the normal data and the abnormal data respectively to obtain processed data; A preset query algorithm is used to query the network segment information of the first node and the network segment information of the second node in the processed data respectively to obtain the network segment information of the N nodes.

8. A network operation and maintenance device based on end-to-end detection, characterized in that: include: A collection unit, configured to collect network information of N nodes in each area, wherein the network information of the N nodes includes at least: network information of a first node and network information of a second node, wherein the first node represents a node that sends a request, and the second node represents a node that receives a request, and N is a positive integer; A detection unit, configured to perform anomaly detection on the network information of the N nodes using a preset timing algorithm to obtain abnormal nodes among the N nodes; An acquisition unit, used to acquire the network segment information of the N nodes, and determine the network segment information of the abnormal node according to the network segment information of the N nodes; A processing unit is used to determine the fault information of the N nodes according to the network information of the N nodes and the network segment information of the N nodes, and process the abnormal node according to the fault information of the N nodes.

9. An electronic device, characterized in that: include: A memory storing an executable program; A processor, configured to run the program, wherein the program executes the method according to any one of claims 1 to 7 when running.

10. A computer program product comprising computer instructions, characterized in that: When the computer instructions are executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images