Communication anomaly monitoring method and system based on big data

Abstract

The invention provides a communication anomaly monitoring method and system based on big data. The method comprises the following steps: performing health state monitoring on each monitoring node in target communication equipment; constructing a multi-dimensional feature space of the target communication equipment in the communication process based on the big data analysis platform, and establishing a communication behavior baseline of the target communication equipment through combining the multi-dimensional feature space with the health state of each monitoring node in the target communication equipment; determining the communication loss of the target communication equipment under each communication behavior based on the communication behavior baseline, extracting the communication characteristics of each communication behavior in the time dimension, and determining the confidence index when the target communication equipment performs communication according to the communication difference relationship among the communication characteristics in combination with all the communication losses; and generating a monitoring report of the target communication device based on the confidence index. According to the scheme, the monitoring report is generated based on the confidence index, and the key features representing the communication abnormality can be identified, so that the accuracy of communication abnormality monitoring is improved.

Description

Technical Field

[0001] The present application relates to the field of communication network monitoring technology, and more specifically, to a communication anomaly monitoring method and system based on big data. Background Art

[0002] With the rapid development of communication technology, communication networks are becoming increasingly complex. Their stability and security are crucial to the security of individuals, enterprises and countries. Communication health management has emerged to predict and identify potential health problems through real-time monitoring and analysis of network performance, so as to take preventive or repair measures in advance. Communication health management technology integrates cutting-edge technologies such as big data, artificial intelligence and machine learning. It can monitor and process massive communication data and improve network reliability and efficiency. The development of communication health management technology is of great significance to ensuring the stable operation of critical infrastructure and improving user experience.

[0003] In communication health management, traditional communication health management monitors network traffic and system logs in real time, and analyzes data based on fixed threshold methods to predict and identify abnormal behaviors in the network, so as to promptly discover and respond to potential security threats, thereby ensuring the stability and security of the communication network. However, in communication anomaly monitoring, the numerous data features are intertwined and mixed, making the manifestations of communication anomalies diverse (for example, signal strength anomalies, packet loss rate anomalies, delay anomalies, etc.), making it difficult for the monitoring system to focus on the key features that truly characterize communication anomalies, thereby reducing the accuracy of communication anomaly monitoring. Therefore, how to identify the key features that characterize communication anomalies and improve the accuracy of communication anomaly monitoring has become a difficult problem faced by the industry. Summary of the invention

[0004] The present application provides a communication anomaly monitoring method and system based on big data, which can identify key features characterizing communication anomalies, thereby improving the accuracy of communication anomaly monitoring.

[0005] In a first aspect, the present application provides a communication anomaly monitoring method based on big data, comprising the following steps: Perform health status monitoring on each monitoring node in the target communication device; Based on the big data analysis platform, a multi-dimensional feature space of the target communication device in the communication process is constructed, and a communication behavior baseline of the target communication device is established through the multi-dimensional feature space combined with the health status of each monitoring node in the target communication device, wherein the communication behavior baseline is composed of communication security reference values ​​under different communication behaviors; Mapping and analyzing the communication performance value of the current target communication device under different communication behaviors with the corresponding communication security reference value in the communication behavior baseline to obtain the communication loss of the target communication device under each communication behavior; Extract the communication characteristics of each communication behavior in the time dimension based on the monitoring time window preset by the target communication device, and determine the confidence index of the target communication device when communicating according to the communication difference relationship between each communication characteristic and all communication losses; A monitoring report of the target communication device is generated based on the confidence indicator.

[0006] In some embodiments, constructing a multi-dimensional feature space of a target communication device during a communication process based on a big data analysis platform specifically includes: Extract historical communication data of target communication devices from the big data analysis platform; Extracting multidimensional features of the target communication device from the preprocessed historical communication data, wherein the multidimensional features include communication throughput features, communication delay features, and communication packet loss rate features; A multidimensional feature space of the target communication device during the communication process is generated according to the extracted multidimensional features.

[0007] In some embodiments, establishing a communication behavior baseline of the target communication device by combining the health status of each monitoring node in the target communication device through the multi-dimensional feature space specifically includes: Perform health status monitoring on each monitoring node of the target communication device to obtain the health status of each monitoring node; Based on the health evaluation indicators preset by the target communication device, the health status of each monitoring node is quantitatively scored to obtain the health score of each monitoring node; Extracting multiple trusted monitoring nodes from all monitoring nodes based on the health score of each monitoring node; Extracting the multidimensional feature space of each confidence monitoring node under different communication behaviors, and for each communication behavior, determining the communication security reference value under each communication behavior according to all the multidimensional feature spaces corresponding to the communication behavior; A communication behavior baseline of the target communication device is generated based on all communication security baseline values.

[0008] In some embodiments, the health status of each monitoring node is quantitatively scored based on the health assessment index preset by the target communication device, and the health score of each monitoring node is obtained specifically including: Obtain preset health assessment indicators of the target communication device; Selecting a monitoring node as a selected monitoring node, comparing and analyzing the health status of the selected monitoring node with the health assessment index, and obtaining a health score of the selected monitoring node; Continue to determine the health scores of the remaining monitoring nodes, and then obtain the health score of each monitoring node.

[0009] In some embodiments, mapping and analyzing the communication performance value of the current target communication device under different communication behaviors with the corresponding communication security reference value in the communication behavior baseline to obtain the communication loss of the target communication device under each communication behavior specifically includes: Determine the communication performance value of the current target communication device under different communication behaviors; For each communication behavior, the difference between the communication performance value under the communication behavior and the corresponding communication security reference value in the communication behavior baseline is calculated, and the difference calculation result is used as the communication loss of the target communication device under the communication behavior, thereby obtaining the communication loss of the target communication device under each communication behavior.

[0010] In some embodiments, the target communication device is a full-duplex communication device.

[0011] In some embodiments, the monitoring report is divided into a communication abnormality report and a communication normal report.

[0012] In a second aspect, the present application provides a communication anomaly monitoring system based on big data, comprising: A monitoring module, used to monitor the health status of each monitoring node in the target communication device; A processing module, used to construct a multi-dimensional feature space of the target communication device in the communication process based on the big data analysis platform, and establish a communication behavior baseline of the target communication device through the multi-dimensional feature space combined with the health status of each monitoring node in the target communication device, wherein the communication behavior baseline is composed of communication security reference values ​​under different communication behaviors; The processing module is further used to map and analyze the communication performance value of the current target communication device under different communication behaviors with the corresponding communication security reference value in the communication behavior baseline to obtain the communication loss of the target communication device under each communication behavior; The processing module is further used to extract the communication characteristics of each communication behavior in the time dimension based on the monitoring time window preset by the target communication device, and determine the confidence index of the target communication device when communicating according to the communication difference relationship between each communication characteristic and all communication losses; An execution module is used to generate a monitoring report of the target communication device based on the confidence indicator.

[0013] In a third aspect, the present application provides a computer device, comprising a memory and a processor, wherein the memory stores a code, and the processor is configured to obtain the code and execute the above-mentioned communication anomaly monitoring method based on big data.

[0014] In a fourth aspect, the present application provides a computer-readable storage medium, which stores a computer program, and when the computer program is executed by a processor, it implements the above-mentioned communication anomaly monitoring method based on big data.

[0015] The technical solution provided by the embodiments disclosed in this application has the following beneficial effects: In the communication anomaly monitoring method and system based on big data provided by the present application, first, the health status of each monitoring node in the target communication device is monitored; secondly, a multi-dimensional feature space of the target communication device in the communication process is constructed based on the big data analysis platform, and a communication behavior baseline of the target communication device is established through the multi-dimensional feature space combined with the health status of each monitoring node in the target communication device, and the communication behavior baseline is composed of communication security reference values ​​under different communication behaviors; further, the communication performance value of the current target communication device under different communication behaviors is mapped and analyzed with the corresponding communication security reference value in the communication behavior baseline to obtain the communication loss of the target communication device under each communication behavior; then, based on the preset monitoring time window of the target communication device, the communication characteristics of each communication behavior in the time dimension are extracted, and the confidence index of the target communication device when communicating is determined according to the communication difference relationship between each communication characteristic combined with all communication losses; finally, a monitoring report of the target communication device is generated based on the confidence index.

[0016] It can be seen that the present application can identify key features that characterize communication anomalies, thereby improving the accuracy of communication anomaly monitoring; first, a multi-dimensional feature space of the target communication device in the communication process is constructed based on the big data analysis platform to comprehensively describe the communication status of the target device and evaluate the health level, thereby avoiding the difficulty in identifying communication anomalies caused by the interweaving of communication data features; secondly, a communication behavior baseline of the target communication device is established through the multi-dimensional feature space combined with the health status of each monitoring node in the target communication device to obtain a reference feature for communication anomaly identification, thereby effectively identifying the communication health status of the target communication device, thereby avoiding the deviation of communication anomaly identification and improving the communication quality of the target communication device; further, the communication loss of the target communication device under each communication behavior can effectively analyze the communication state characteristics of the target communication device when communicating; then, according to the communication feature relationship of each communication behavior in the time dimension combined with all communication losses, the confidence index of the target communication device when communicating is determined, so as to timely measure the abnormal behavior of the target communication device and avoid large-scale communication interruption or failure; finally, a monitoring report of the target communication device is generated based on the confidence index; in summary, the technical solution provided by the present application can identify key features that characterize communication anomalies, thereby improving the accuracy of communication anomaly monitoring. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1is an exemplary flow chart of a communication anomaly monitoring method based on big data according to some embodiments of the present application; Figure 2 is an exemplary flow chart of determining a multidimensional feature space according to some embodiments of the present application; Figure 3 is an exemplary flow chart of determining communication characteristics according to some embodiments of the present application; Figure 4 is a structural diagram of a communication anomaly monitoring system based on big data according to some embodiments of the present application; Figure 5 It is a structural diagram of a computer device for implementing a communication anomaly monitoring method based on big data as shown in some embodiments of the present application. DETAILED DESCRIPTION

[0018] In order to better understand the technical solution of the present application, the technical solution of the present application will be described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0019] refer to Figure 1 , which is an exemplary flow chart of a communication anomaly monitoring method based on big data according to some embodiments of the present application. The communication anomaly monitoring method 100 based on big data mainly includes the following steps: In step 101, health status monitoring is performed on each monitoring node in the target communication device.

[0020] In specific implementation, the health status of each monitoring node in the target communication device is monitored through the distributed data acquisition module in the target communication device, and the health status data of each monitoring node is obtained in real time to provide comprehensive data support for health status monitoring. The distributed data acquisition module in the target communication device refers to a module that is distributedly deployed inside the target communication device and is used to collect and transmit various communication data and device status information.

[0021] It should be noted that the target communication device in this application refers to a device used to transmit, receive and process information. The target communication device is a full-duplex communication device, that is, the target communication device can perform multiple communication behaviors simultaneously, such as communication transmission and communication reception at the same time.

[0022] In step 102, a multidimensional feature space of the target communication device during the communication process is constructed based on the big data analysis platform, and a communication behavior baseline of the target communication device is established through the multidimensional feature space combined with the health status of each monitoring node in the target communication device. The communication behavior baseline is composed of communication security benchmark values ​​under different communication behaviors.

[0023] In some embodiments, reference Figure 2As shown, this figure is an exemplary flow chart of determining a multidimensional feature space according to some embodiments of the present application. In this embodiment, constructing a multidimensional feature space of a target communication device during a communication process based on a big data analysis platform can be implemented by the following steps: First, in step 1021, historical communication data of the target communication device is extracted from the big data analysis platform; Then, in step 1022, multi-dimensional features of the target communication device are extracted from the pre-processed historical communication data, wherein the multi-dimensional features include communication throughput features, communication delay features, and communication packet loss rate features; Finally, in step 1023, a multi-dimensional feature space of the target communication device during the communication process is generated according to the extracted multi-dimensional features.

[0024] In specific implementation, a distributed processing framework (such as Hadoop) in a big data analysis platform is used to extract historical communication data in the target communication device from a distributed storage module. The historical communication data is the historical communication data of the target communication device under different communication behaviors, for example, historical communication data under data sending behavior and historical communication data under data receiving behavior. The historical communication data includes multiple types of communication data, such as communication throughput data, communication delay data, and communication packet loss rate data. It should be noted that the historical communication data in this embodiment refers to the communication data of the target communication device during the historical communication process.

[0025] In a specific implementation, the multidimensional features of the target communication device are extracted from the preprocessed historical communication data, namely: first, the preprocessing of the historical communication data is completed by the standard deviation elimination method, that is, by calculating the mean and standard deviation of each type of communication data in the historical communication data, and eliminating the abnormal points in each type of communication data that exceed the mean ±3 times the standard deviation, thereby obtaining the preprocessed historical communication data; then the mean of each type of preprocessed communication data is used as the communication feature of this type of communication data, and the communication features are respectively characterized by the communication throughput feature, the communication delay feature, and the communication packet loss rate feature, and the communication throughput feature, the communication delay feature, and the communication packet loss rate feature are combined to obtain the multidimensional features of the target communication device. In this embodiment, the communication feature represents the communication behavior characteristics exhibited by the target communication device during the communication process. In this embodiment, the multidimensional feature represents a combination of communication features under multiple dimensions, and the multidimensional feature includes multiple communication features.

[0026] In specific implementation, a multidimensional feature space of a target communication device in a communication process is generated based on the extracted multidimensional features, that is, the multidimensional features are processed by principal component analysis to obtain a multidimensional feature space of the target communication device in a communication process, and the principal component analysis processes the multidimensional features as follows: the communication throughput feature, the communication delay feature, and the communication packet loss rate feature are standardized and the standardized covariance matrix is ​​calculated, and then the covariance matrix is ​​subjected to eigenvalue decomposition to extract the eigenvector with the largest variance as the principal component, a preset number of principal components are selected and the original class features are projected onto these principal components to obtain a multidimensional feature space of the target communication device in a communication process, and the multidimensional feature space contains a plurality of communication dimensionality reduction features, namely, the communication throughput feature, the communication delay feature, and the communication packet loss rate feature after dimensionality reduction by principal component analysis.

[0027] In this application, the multidimensional feature space represents the combined space of various communication features of the communication device during the communication process. In the communication health monitoring of the target communication device, the determination of the multidimensional feature space plays an important role and significance. The core lies in that by determining the multidimensional feature space, the communication status of the device can be comprehensively described, the health level can be evaluated, and anomalies can be identified.

[0028] It should also be noted that in the present application, one monitoring node corresponds to a multi-dimensional feature space under different communication behaviors, that is, each monitoring node corresponds to multiple multi-dimensional feature spaces, which will not be repeated here.

[0029] In some embodiments, the communication behavior baseline of the target communication device is established by combining the health status of each monitoring node in the target communication device through the multi-dimensional feature space, and the following steps can be specifically adopted, namely: Perform health status monitoring on each monitoring node of the target communication device to obtain the health status of each monitoring node; Based on the health evaluation indicators preset by the target communication device, the health status of each monitoring node is quantitatively scored to obtain the health score of each monitoring node; Extracting multiple trusted monitoring nodes from all monitoring nodes based on the health score of each monitoring node; Extracting the multidimensional feature space of each confidence monitoring node under different communication behaviors, and for each communication behavior, determining the communication security reference value under each communication behavior according to all the multidimensional feature spaces corresponding to the communication behavior; A communication behavior baseline of the target communication device is generated based on all communication security baseline values.

[0030] In specific implementation, the health status of each monitoring node of the target communication device is monitored to obtain the health status of each monitoring node, that is, the number of times each monitoring node successfully processes business requests in the previous monitoring cycle and the number of all business requests received are obtained. For each monitoring node, the node health value of the monitoring node is determined by the ratio of the number of successful business requests processed in the previous monitoring cycle to the number of all business requests received, and the health status of the monitoring node is characterized by the node health value, thereby obtaining the health status of each monitoring node. In addition, in other embodiments, other calculation methods can be used to calculate the health status of each monitoring node, which is not limited here. In this embodiment, the node health value represents an indicator value for evaluating the health status of the monitoring node, that is, the larger the node health value, the greater the health level of the monitoring node, and vice versa.

[0031] In some embodiments, the health status of each monitoring node is quantitatively scored based on the health assessment index preset by the target communication device, and the health score of each monitoring node can be obtained by the following steps, namely: Obtain preset health assessment indicators of the target communication device; Selecting a monitoring node as a selected monitoring node, comparing and analyzing the health status of the selected monitoring node with the health assessment index, and obtaining a health score of the selected monitoring node; Continue to determine the health scores of the remaining monitoring nodes, and then obtain the health score of each monitoring node.

[0032] In the specific implementation, first, the preset health assessment indicators of the target communication equipment are obtained through the communication anomaly monitoring database, and the health assessment indicators represent the standards for evaluating the health status of the monitoring nodes. The health assessment indicators are pre-set according to actual needs and are not limited here; then, a monitoring node is selected as the selected monitoring node, and the health status of the selected monitoring node is compared and analyzed with the health assessment indicators to obtain the health score of the selected monitoring node, that is: the node health value corresponding to the health status is calculated with the health assessment indicator, and the difference calculation result is used as the health score of the selected monitoring node; finally, the health scores of the remaining monitoring nodes are continued to be determined, and then the health scores of each monitoring node are obtained. It should be noted that the health score in this embodiment represents an indicator for measuring the reliability of the monitoring node.

[0033] In the specific implementation, multiple trusted monitoring nodes are extracted from all monitoring nodes based on the health score of each monitoring node, that is, the monitoring nodes corresponding to the positive health scores are extracted, and the extracted monitoring nodes are used as trusted monitoring nodes, thereby obtaining multiple trusted monitoring nodes. In this embodiment, the trusted monitoring nodes represent trustworthy monitoring nodes.

[0034] In specific implementation, the communication security baseline value under the communication behavior is determined according to all multidimensional feature spaces corresponding to the communication behavior, that is: all multidimensional feature spaces corresponding to the communication behavior are extracted, and for each multidimensional feature space, all communication dimensionality reduction features in the multidimensional feature space are weighted summed, and the weighted summation result is used as the feature fusion value, thereby obtaining the feature fusion value of each multidimensional feature space, all feature fusion values ​​are averaged, and the average calculation result is used as the communication security baseline value under the communication behavior, wherein all communication dimensionality reduction features in the multidimensional feature space are weighted summed, and the weights of the communication dimensionality reduction features can be set according to actual needs, which is not limited here. In addition, in other embodiments, other calculation methods can also be used to calculate the communication security baseline value under the communication behavior, which will not be repeated here.

[0035] It should be noted that the feature fusion value in this embodiment represents the value obtained by fusing multiple communication features, and the communication security reference value in this application represents the standard value for ensuring network communication security. By determining the communication security reference value, risk assessment and management can be better performed to provide support for security decisions.

[0036] In specific implementation, a communication behavior baseline of a target communication device is generated based on all communication security reference values, that is, all communication security reference values ​​are arranged in sequence on a reference line to obtain a communication behavior baseline of the target communication device.

[0037] It should be noted that the communication behavior baseline in the present application refers to the communication behavior characteristics used as a reference for describing the target communication device under normal operating conditions. The communication behavior baseline provides a reference line for the health management of the target communication device, which is used to identify and detect abnormal behaviors in the network. Any behavior that deviates from the baseline may indicate a security threat or system failure. Therefore, by determining the communication behavior baseline, the communication health status of the target communication device can be effectively identified, thereby improving the communication quality of the target communication device.

[0038] In step 103, the communication performance values ​​of the current target communication device under different communication behaviors are mapped and analyzed with the corresponding communication security reference values ​​in the communication behavior baseline to obtain the communication loss of the target communication device under each communication behavior.

[0039] In some embodiments, mapping and analyzing the communication performance value of the current target communication device under different communication behaviors with the corresponding communication security reference value in the communication behavior baseline to obtain the communication loss of the target communication device under each communication behavior can be achieved by the following steps, namely: Determine the communication performance value of the current target communication device under different communication behaviors; For each communication behavior, the difference between the communication performance value under the communication behavior and the corresponding communication security reference value in the communication behavior baseline is calculated, and the difference calculation result is used as the communication loss of the target communication device under the communication behavior, thereby obtaining the communication loss of the target communication device under each communication behavior.

[0040] In some embodiments, the communication performance value of the current target communication device under different communication behaviors may be determined by the following steps, namely: Obtain the communication throughput, communication delay, and communication packet loss rate of the current target communication device under different communication behaviors; For each communication behavior, the communication throughput, communication delay, and communication packet loss rate corresponding to the communication behavior are weighted and summed, and the result of the weighted summation is used as the communication performance value of the target communication device under the communication behavior to obtain the communication performance value of the target communication device under the communication behavior.

[0041] In the specific implementation, first, the communication throughput, communication delay, and communication packet loss rate of the current target communication device under different communication behaviors are obtained from the communication anomaly monitoring database in the target communication device; then, for each communication behavior, the communication throughput, communication delay, and communication packet loss rate corresponding to the communication behavior are weighted and summed, and the result of the weighted summation is used as the communication performance value of the target communication device under the communication behavior, to obtain the communication performance value of the target communication device under each communication behavior, wherein the weights of the communication throughput, the communication delay, and the communication packet loss rate can be set between 0 and 1 according to the degree of influence on the target communication device, and are not limited here. In this embodiment, the communication performance value represents a comprehensive performance indicator for measuring the target communication device during communication.

[0042] It should be noted that the mapping analysis in the present application represents the process of comparing the communication performance value with the corresponding communication security reference value in the communication behavior baseline, wherein the communication performance value of the current target communication device under different communication behaviors is mapped and analyzed with the corresponding communication security reference value in the communication behavior baseline, that is: determining the communication performance value of the current target communication device under different communication behaviors; for each communication behavior, calculating the difference between the communication performance value under the communication behavior and the corresponding communication security reference value in the communication behavior baseline, and using the difference calculation result as the communication loss of the target communication device under the communication behavior, and then obtaining the communication loss of the target communication device under each communication behavior, that is, completing the mapping analysis of the communication performance value of the current target communication device under different communication behaviors and the corresponding communication security reference value in the communication behavior baseline.

[0043] It should be noted that the communication loss in the present application represents the communication attenuation index of the target communication device during the communication process, that is, the degree of difference between the actual communication performance value caused by the attenuation of the communication signal and the communication safety reference value, that is, the greater the communication loss, the greater the difference between the actual communication performance value and the communication safety reference value, and the greater the communication attenuation of the target communication device during the communication process; the smaller the communication loss, the smaller the difference between the actual communication performance value and the communication safety reference value, and the smaller the communication attenuation of the target communication device during the communication process. The communication loss is used to measure the degree of deviation of the communication performance value from the communication safety reference value. By determining the communication loss, the communication health status of the target communication device during communication can be effectively analyzed.

[0044] In step 104, the communication characteristics of each communication behavior in the time dimension are extracted based on the monitoring time window preset by the target communication device, and the confidence index of the target communication device when communicating is determined according to the communication difference relationship between each communication characteristic and all communication losses.

[0045] In some embodiments, reference Figure 3 As shown, this figure is an exemplary flow chart of determining communication features according to some embodiments of the present application. In this embodiment, the communication features of each communication behavior in the time dimension are extracted based on the monitoring time window preset by the target communication device, which can be implemented by the following steps: First, in step 1041, a monitoring time window preset by the target communication device is obtained; Secondly, in step 1042, the communication process of the target communication device is divided into a plurality of continuous time intervals based on the monitoring time window; Then, in step 1043, a communication behavior is selected as the selected communication behavior, the communication behavior data of the selected communication behavior in each time interval is extracted, and feature extraction is performed on all the communication behavior data to obtain the communication features of the selected communication behavior in the time dimension; Finally, in step 1044, the communication characteristics of the remaining communication behaviors in the time dimension are continuously determined, thereby obtaining the communication characteristics of each communication behavior in the time dimension.

[0046] In the specific implementation, first, a preset monitoring time window of the target communication device is obtained through a communication anomaly monitoring database; secondly, the time axis of the target communication device in the communication process is divided by the monitoring time window to generate multiple continuous time intervals; further, a communication behavior is selected as the selected communication behavior, and the communication behavior data of the selected communication behavior in each time interval is extracted from the historical communication data of the target communication device, and a statistical analysis method is used to perform feature extraction on all the extracted communication behavior data, for example, the change rate of the communication behavior data is extracted as the communication feature of the communication behavior in the time dimension, and then the communication feature of the selected communication behavior in the time dimension is obtained; finally, the above steps are repeated for the remaining communication behaviors of the target communication device in turn, and the communication features of the remaining communication behaviors in the time dimension are extracted one by one, and then the communication features of each communication behavior in the time dimension are obtained.

[0047] It should be noted that the monitoring time window in the present application represents a fixed time period used to divide the time series. By reasonably setting the monitoring time window, the timeliness and accuracy of the communication behavior data analysis can be improved, while reducing the overhead of redundant data processing; the communication feature in the present application represents an indicator that reflects the communication performance of the target communication device, that is, the larger the communication feature, the better the communication performance of the target communication device, and vice versa. By extracting these communication features from different communication behaviors, the performance of the target communication device in each time interval can be comprehensively evaluated, thereby helping to detect abnormal situations or predict potential communication problems.

[0048] In some embodiments, the following steps may be used to determine the confidence index of the target communication device when communicating based on the communication difference relationship between the various communication features combined with all communication losses, namely: Calculating communication feature difference values ​​between the various communication features, and using the communication feature difference values ​​to represent the communication difference relationship between the communication features; Constructing a communication feature difference matrix of the target communication device according to all communication feature difference values; Calculating the associated weights of each communication loss through the communication feature difference matrix; A confidence index of the target communication device when communicating is determined based on each communication loss and its corresponding associated weight.

[0049] In the specific implementation, first, the communication feature difference value between each communication feature is calculated by Euclidean distance, and the communication feature difference value is used to characterize the communication difference relationship between the communication features. In addition, other calculation methods can also be used to calculate the communication feature difference value between each communication feature, such as Manhattan distance, which is not limited here; secondly, a communication feature difference matrix of the target communication device is constructed according to all communication feature difference values, that is: each communication feature difference value is arranged in order as a matrix element in the form of a symmetric matrix to obtain the communication feature difference matrix of the target communication device, where each element in the matrix represents the difference between two communication features, that is, the communication feature difference value, and the communication feature Each row element in the difference matrix corresponds to a communication behavior, and a reference communication behavior corresponds to a communication loss, then a row element also corresponds to a communication loss; then, the associated weights of each communication loss are calculated through the communication feature difference matrix, that is: the elements in the communication feature difference matrix are normalized, the standard deviation of each row element in the normalized communication feature difference matrix is ​​calculated, and the standard deviation calculation result is used as the associated weight of the communication loss corresponding to each row element, thereby obtaining the associated weight of each communication loss; finally, according to each communication loss and its corresponding associated weight, the confidence index of the target communication device when communicating is obtained by weighted sum.

[0050] It should be noted that, in this embodiment, the communication feature difference value represents the difference value between different communication features; in this embodiment, the communication feature difference matrix represents a matrix composed of multiple communication feature difference values; in this embodiment, the associated weight represents the weight value of the influence of the communication loss on the communication of the target communication device, and the weight of each communication loss reflects the contribution of the communication loss to the communication quality and performance. Generally, the communication loss with a larger weight value represents that it has a more significant impact on the communication quality of the target communication device; in this application, the confidence index represents a trust index for measuring the target communication device during the communication process, that is, the larger the confidence index, the greater the trust of the target communication device during the communication process, and the smaller the confidence index, the smaller the trust of the target communication device during the communication process. The determination of the confidence index can provide a real-time monitoring function for the communication device. When the confidence index of the device is low, it means that there is a problem with the communication performance or security of the device. By continuously monitoring and evaluating the confidence index, abnormal behavior of the device, such as communication performance degradation, failure or security vulnerability, can be discovered in time, so as to give early warning and take corresponding repair measures to avoid large-scale communication interruption or failure.

[0051] In step 105, a monitoring report of the target communication device is generated based on the confidence indicator.

[0052] It should be noted that the monitoring reports in this application are divided into communication abnormality reports and communication normal reports.

[0053] In some embodiments, generating a monitoring report of a target communication device based on the confidence indicator may specifically adopt the following steps, namely: The confidence index is compared with a confidence index threshold, and when the confidence index is greater than the confidence index threshold, a communication normal report of the target communication device is generated, otherwise a communication abnormality report of the target communication device is generated.

[0054] It should be noted that the confidence indicator threshold in this embodiment represents a pre-set standard confidence indicator, which is used to determine the communication health status of the target communication device, and can be set according to actual needs and is not limited here.

[0055] In addition, in another aspect of the present application, in some embodiments, the present application provides a communication anomaly monitoring system based on big data, referring to Figure 4 , which is a schematic diagram of the structure of a communication anomaly monitoring system based on big data according to some embodiments of the present application. The communication anomaly monitoring system based on big data 200 includes: a monitoring module 201, a processing module 202 and an execution module 203, which are described as follows: Monitoring module 201, in this application, the monitoring module 201 is mainly used to monitor the health status of each monitoring node in the target communication device; Processing module 202, in this application, processing module 202 is mainly used to construct a multi-dimensional feature space of the target communication device in the communication process based on the big data analysis platform, and establish a communication behavior baseline of the target communication device through the multi-dimensional feature space combined with the health status of each monitoring node in the target communication device, wherein the communication behavior baseline is composed of communication security reference values ​​under different communication behaviors; The processing module 202 is further used to map and analyze the communication performance value of the current target communication device under different communication behaviors with the corresponding communication security reference value in the communication behavior baseline to obtain the communication loss of the target communication device under each communication behavior; In addition, the processing module 202 is also used to extract the communication characteristics of each communication behavior in the time dimension based on the monitoring time window preset by the target communication device, and determine the confidence index of the target communication device when communicating according to the communication difference relationship between each communication characteristic and all communication losses; Execution module 203, in the present application, the execution module 203 is mainly used to generate a monitoring report of the target communication device based on the confidence indicator.

[0056] In addition, the present application also provides a computer device, which includes a memory and a processor, the memory stores a code, and the processor is configured to obtain the code and execute the above-mentioned communication anomaly monitoring method based on big data.

[0057] In some embodiments, reference Figure 5 , which is a schematic diagram of the structure of a computer device for implementing a communication anomaly monitoring method based on big data according to some embodiments of the present application. The communication anomaly monitoring method based on big data in the above embodiment can be Figure 5 The computer device 300 shown in the figure is implemented, and the computer device 300 includes at least one processor 301, a communication bus 302, a memory 303 and at least one communication interface 304.

[0058] The processor 301 can be a general-purpose central processing unit (CPU), or an application-specific integrated circuit (ASIC) or one or more for controlling the execution of the communication anomaly monitoring method based on big data in the present application.

[0059] The communication bus 302 may be used to transmit information between the above-mentioned components.

[0060] The memory 303 may be a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, a random access memory (RAM) or other types of dynamic storage devices that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CDROM) or other optical disc storage, optical disc storage (including compressed optical disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), a magnetic disk or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory 303 may exist independently and be connected to the processor 301 through the communication bus 302. The memory 303 may also be integrated with the processor 301.

[0061] Among them, the memory 303 is used to store the program code for executing the solution of the present application, and the execution is controlled by the processor 301. The processor 301 is used to execute the program code stored in the memory 303. The program code may include one or more software modules. The determination of the communication anomaly monitoring method based on big data in the above embodiment can be implemented by the processor 301 and one or more software modules in the program code in the memory 303.

[0062] The communication interface 304 uses any transceiver or other device for communicating with other devices or communication networks, such as Ethernet, radio access network (RAN), wireless local area networks (WLAN), etc.

[0063] In a specific implementation, as an embodiment, a computer device may include multiple processors, each of which may be a single-core (singleCPU) processor or a multi-core (multiCPU) processor. The processor here may refer to one or more devices, circuits, and / or processing cores for processing data (such as computer program instructions).

[0064] The above-mentioned computer device may be a general-purpose computer device or a special-purpose computer device. In a specific implementation, the computer device may be a desktop computer, a portable computer, a network server, a personal digital assistant (PDA), a mobile phone, a tablet computer, a wireless terminal device, a communication device or an embedded device. The embodiment of the present application does not limit the type of computer device.

[0065] In addition, the present application also provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, it implements the above-mentioned communication anomaly monitoring method based on big data.

[0066] Although the preferred embodiments of the present application have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0067] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A communication anomaly monitoring method based on big data, characterized in that: The steps include: Perform health status monitoring on each monitoring node in the target communication device; Based on the big data analysis platform, a multi-dimensional feature space of the target communication device in the communication process is constructed, and a communication behavior baseline of the target communication device is established through the multi-dimensional feature space combined with the health status of each monitoring node in the target communication device, wherein the communication behavior baseline is composed of communication security reference values ​​under different communication behaviors; Mapping and analyzing the communication performance value of the current target communication device under different communication behaviors with the corresponding communication security reference value in the communication behavior baseline to obtain the communication loss of the target communication device under each communication behavior; Extract the communication characteristics of each communication behavior in the time dimension based on the monitoring time window preset by the target communication device, and determine the confidence index of the target communication device when communicating according to the communication difference relationship between each communication characteristic and all communication losses; A monitoring report of the target communication device is generated based on the confidence indicator.

2. The method according to claim 1, characterized in that The multi-dimensional feature space of the target communication device in the communication process is constructed based on the big data analysis platform, including: Extract historical communication data of target communication devices from the big data analysis platform; Extracting multidimensional features of the target communication device from the preprocessed historical communication data, wherein the multidimensional features include communication throughput features, communication delay features, and communication packet loss rate features; A multidimensional feature space of the target communication device during the communication process is generated according to the extracted multidimensional features.

3. The method according to claim 1, characterized in that Establishing the communication behavior baseline of the target communication device by combining the health status of each monitoring node in the target communication device through the multidimensional feature space specifically includes: Perform health status monitoring on each monitoring node of the target communication device to obtain the health status of each monitoring node; Based on the health evaluation indicators preset by the target communication device, the health status of each monitoring node is quantitatively scored to obtain the health score of each monitoring node; Extracting multiple trusted monitoring nodes from all monitoring nodes based on the health score of each monitoring node; Extracting the multidimensional feature space of each confidence monitoring node under different communication behaviors, and for each communication behavior, determining the communication security reference value under each communication behavior according to all the multidimensional feature spaces corresponding to the communication behavior; A communication behavior baseline of the target communication device is generated based on all communication security baseline values.

4. The method according to claim 3, characterized in that The health status of each monitoring node is quantitatively scored based on the health assessment indicators preset by the target communication device. The health scores of each monitoring node include: Obtain preset health assessment indicators of the target communication device; Selecting a monitoring node as a selected monitoring node, comparing and analyzing the health status of the selected monitoring node with the health assessment index, and obtaining a health score of the selected monitoring node; Continue to determine the health scores of the remaining monitoring nodes, and then obtain the health score of each monitoring node.

5. The method according to claim 1, characterized in that The communication performance value of the current target communication device under different communication behaviors is mapped and analyzed with the corresponding communication security reference value in the communication behavior baseline, and the communication loss of the target communication device under each communication behavior is obtained, which specifically includes: Determine the communication performance value of the current target communication device under different communication behaviors; For each communication behavior, the difference between the communication performance value under the communication behavior and the corresponding communication security reference value in the communication behavior baseline is calculated, and the difference calculation result is used as the communication loss of the target communication device under the communication behavior, thereby obtaining the communication loss of the target communication device under each communication behavior.

6. The method according to claim 1, characterized in that The target communication device is a full-duplex communication device.

7. The method according to claim 1, characterized in that The monitoring report is divided into a communication abnormality report and a communication normal report.

8. A communication anomaly monitoring system based on big data, characterized in that: include: A monitoring module, used to monitor the health status of each monitoring node in the target communication device; A processing module, used to construct a multi-dimensional feature space of the target communication device in the communication process based on the big data analysis platform, and establish a communication behavior baseline of the target communication device through the multi-dimensional feature space combined with the health status of each monitoring node in the target communication device, wherein the communication behavior baseline is composed of communication security reference values ​​under different communication behaviors; The processing module is further used to map and analyze the communication performance value of the current target communication device under different communication behaviors with the corresponding communication security reference value in the communication behavior baseline to obtain the communication loss of the target communication device under each communication behavior; The processing module is further used to extract the communication characteristics of each communication behavior in the time dimension based on the monitoring time window preset by the target communication device, and determine the confidence index of the target communication device when communicating according to the communication difference relationship between each communication characteristic and all communication losses; An execution module is used to generate a monitoring report of the target communication device based on the confidence indicator.

9. A computer device, characterized in that: The computer device includes a memory and a processor, the memory stores codes, and the processor is configured to obtain the codes and execute the communication anomaly monitoring method based on big data as described in any one of claims 1 to 7.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the communication anomaly monitoring method based on big data as described in any one of claims 1 to 7 is implemented.

Images