Data detection method, device, equipment, medium and product

Abstract

The invention discloses a data detection method, device and equipment, a medium and a product. The method comprises the following steps: when first signaling data is received, updating a network element signaling information table based on the first signaling data; the network element signaling information table comprises at least one first network element pair and a first data transmission attribute corresponding to the first equipment under the first network element pair; when a preset detection condition is satisfied, determining a second data transmission attribute corresponding to the first device under each third network element pair based on interactive network element data and / or a network element signaling information table; and when it is detected that the second data transmission attribute reaches a preset transmission abnormal condition, sending the second data transmission attribute reaching the preset transmission abnormal condition and the corresponding third network element pair to the first device, so that the first device processes a data transmission missing event based on the received third network element pair and the second data transmission attribute. While efficient and large-range continuous data detection is realized, the accuracy of subsequent deep packet detection is ensured.

Description

Technical Field

[0001] The present invention relates to the field of computer processing technologies, and in particular, to a data detection method, apparatus, device, medium, and product. Background Art

[0002] Currently, for Deep Packet Inspection (DPI), it is usually necessary to access the signaling data of the 5G core network and perform deep packet inspection on it. These signaling data are usually mirrored by the core network switch and transmitted to the deep packet inspection device through the aggregation and diversion device. During the data transmission process, there is a certain data loss situation, and at this time, it is necessary to perform integrity detection on the input signaling data.

[0003] The traditional data detection method usually exports the signaling data to a file in a preset format, opens the file using existing data analysis tools, and analyzes the data in the file. This data detection method not only has low detection efficiency but also has the problem of detection lag. Summary of the Invention

[0004] The present invention provides a data detection method, apparatus, device, medium, and product to achieve efficient and large-scale continuous data detection while ensuring the accuracy of subsequent deep packet inspection.

[0005] According to one aspect of the present invention, a data detection method is provided. The method is applied to a deep packet inspection device, and the deep packet inspection device is connected to at least one switch; different network elements communicate with each other based on the switch; the method includes:

[0006] When receiving the first signaling data, updating the network element signaling information table based on the first signaling data; wherein, the first signaling data is the data processed by the first device on the second signaling data; the second signaling data is generated when two of the network elements communicate with each other; the network element signaling information table includes at least one first network element pair and the first data transmission attribute corresponding to the first device under the first network element pair; the first network element pair includes two communicating network elements;

[0007] When a preset detection condition is met, obtaining the interactive network element data, and determining the second data transmission attribute corresponding to the first device under each third network element pair based on the interactive network element data and / or the network element signaling information table; wherein, the interactive network element data includes at least one second network element pair; the third network element pair is the network element pair in the first network element pair and / or the second network element pair;

[0008] When it is detected that the second data transmission attribute reaches a preset transmission exception condition, the second data transmission attribute that reaches the preset transmission exception condition and its corresponding third network element pair are sent to the first device, so that the first device processes a data transmission missing event based on the received third network element pair and the second data transmission attribute;

[0009] Wherein, the first device includes the switch and / or a device for transmitting and processing the second signaling data between the switch and the deep packet detection device.

[0010] According to another aspect of the present invention, a data detection device is provided. The device is configured in a deep packet detection device, and the deep packet detection device is connected to at least one switch; different network elements communicate based on the switch; the device includes:

[0011] An information table update module, configured to update a network element signaling information table based on the first signaling data when the first signaling data is received; wherein, the first signaling data is data processed by a first device on second signaling data; the second signaling data is generated when two of the network elements communicate; the network element signaling information table includes at least one first network element pair and a first data transmission attribute corresponding to the first device under the first network element pair; the first network element pair includes two communicating network elements;

[0012] A second data transmission attribute determination module, configured to obtain interactive network element data when a preset detection condition is met, and determine a second data transmission attribute corresponding to the first device under each third network element pair based on the interactive network element data and / or the network element signaling information table; wherein, the interactive network element data includes at least one second network element pair; the third network element pair is a network element pair in the first network element pair and / or the second network element pair;

[0013] An exception detection module, configured to send the second data transmission attribute that reaches the preset transmission exception condition and its corresponding third network element pair to the first device when it is detected that the second data transmission attribute reaches the preset transmission exception condition, so that the first device processes a data transmission missing event based on the received third network element pair and the second data transmission attribute;

[0014] Wherein, the first device includes the switch and / or a device for transmitting and processing the second signaling data between the switch and the deep packet detection device.

[0015] According to another aspect of the present invention, an electronic device is provided, and the electronic device includes:

[0016] At least one processor; and a memory communicatively connected to the at least one processor; wherein,

[0017] The memory stores a computer program executable by the at least one processor, and when the computer program is executed by the at least one processor, the at least one processor is enabled to execute the data detection method according to any embodiment of the present invention.

[0018] According to another aspect of the present invention, there is provided a computer-readable storage medium storing computer instructions for causing a processor to implement the data detection method according to any embodiment of the present invention when executed.

[0019] According to another aspect of the present invention, there is provided a computer program product including a computer program which, when executed by a processor, implements the data detection method according to any embodiment of the present invention.

[0020] In the technical solution of the embodiment of the present invention, when receiving the first signaling data, the signaling information table of the network element is updated based on the first signaling data; the first signaling data is the data processed by the first device based on the second signaling data; the second signaling data is generated when two network elements communicate with each other; the signaling information table of the network element includes at least one first network element pair and the first data transmission attribute corresponding to the first device under the first network element pair; when the preset detection condition is satisfied, the interactive network element data is obtained, and based on the interactive network element data and / or the signaling information table of the network element, the second data transmission attribute corresponding to the first device under each third network element pair is determined; the interactive network element data includes at least one second network element pair; the third network element pair is the network element pair in the first network element pair and / or the second network element pair; when it is detected that the second data transmission attribute reaches the preset transmission abnormal condition, the second data transmission attribute that reaches the preset transmission abnormal condition and its corresponding third network element pair are sent to the first device, so that the first device processes the data transmission missing event based on the received third network element pair and the second data transmission attribute, solving the problems of low detection efficiency and detection lag in the prior art when using a data analysis tool to analyze the signaling data in a file, and realizing that when receiving the first signaling data sent by the first device, the signaling information table of the network element is updated based on the first signaling data; the signaling information table of the network element includes at least one first network element pair and the first data transmission attribute corresponding to the first device under the first network element pair. Furthermore, when the preset detection condition is satisfied, based on the interactive network element data and / or the signaling information table of the network element, the second data transmission attribute corresponding to the first device under each third network element pair is determined, realizing the improvement of the accuracy and comprehensiveness of the data transmission quality detection. When it is detected that the second data transmission attribute reaches the preset transmission abnormal condition, the second data transmission attribute that reaches the preset transmission abnormal condition and its corresponding third network element pair are sent to the first device, realizing efficient, large-scale and continuous data transmission quality detection, and at the same time, the first device can be notified in time to process the data transmission missing event when an abnormality is detected, so as to ensure the accuracy of subsequent deep packet detection.

[0021] It should be understood that the content described in this part is not intended to identify the key or important features of the embodiments of the present invention, nor is it used to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following will briefly introduce the drawings required for the description of the embodiments. Obviously, the following drawings are only some embodiments of the present invention. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative efforts.

[0023] Figure 1It is a flowchart of a data detection method provided according to Embodiment 1 of the present invention;

[0024] Figure 2 It is an architecture diagram for characterizing the deployment of a deep packet detection device provided according to Embodiment 1 of the present invention;

[0025] Figure 3 It is a schematic flowchart of a data detection method provided according to Embodiment 2 of the present invention;

[0026] Figure 4 It is a schematic structural diagram of a data detection device provided according to Embodiment 3 of the present invention;

[0027] Figure 5 It is a schematic structural diagram of an electronic device for implementing the data detection method of the embodiments of the present invention. Detailed implementation manners

[0028] In order to enable those skilled in the art to better understand the solution of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

[0029] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and do not necessarily need to be used to describe a specific order or sequence. It should be understood that such data can be interchanged under appropriate circumstances so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "comprising" and "having" and any variations thereof are intended to cover non-exclusive inclusion. For example, a process, method, system, product or device comprising a series of steps or units does not necessarily have to be limited to those steps or units clearly listed, but may include other steps or units not clearly listed or inherent to these processes, methods, products or devices.

[0030] Embodiment 1

[0031] Figure 1It is a flowchart of a data detection method provided by Embodiment 1 of the present invention. This embodiment is applicable to the situation of quality verification of signaling data transmitted from a switch. This method can be executed by a data detection device, which can be implemented in the form of hardware and / or software. The data detection device can be configured in a deep packet inspection device, and the deep packet inspection device is connected to at least one switch; different network elements communicate based on the switch, and the network elements are deployed in a communication network. Among them, the communication network can be a core network, and the network element refers to a network device used to provide different functions in the communication network. A variety of different network elements cooperate to form the core network. As Figure 1 shown, the method includes:

[0032] S110. When receiving the first signaling data, update the network element signaling information table based on the first signaling data. The network element signaling information table includes at least one first network element pair and the first data transmission attribute corresponding to the switch under the first network element pair.

[0033] Among them, the first signaling data is the data processed from the second signaling data based on the first device. The first device includes a switch and / or a device for transmitting and processing the second signaling data between the switch and the deep packet inspection device, such as an optical splitter device or an aggregation and diversion device, etc. The second signaling data is generated when two network elements communicate. The second signaling data can be the single or multiple signaling data during the information interaction between network elements. For example, in a communication network, a network element A sends a request to another network element B, and the other network element B will return response data to network element A after processing the request. This request and response are called a signaling, and the request data and response data can be expressed as network element signaling data. The second signaling data can be the request data of the network element, or the response data of the network element for the request data, or a combination of these two types of data. The first network element pair includes two communicating network elements. The network element can be identified by the network element name, network element IP, etc. The first data transmission attribute can be used to characterize the transmission attribute of the first device in the process of transmitting the signaling data generated between the two communicating network elements in the first network element pair to the deep packet inspection device, such as the total number of signals, the number of successful transmissions, the transmission rate, the bandwidth, the transmission delay, the transmission jitter, the packet loss rate, etc. It should be noted that in the process of the first device transmitting the signaling data to the deep packet inspection device, it may be a complete data transmission, or there may be a certain data transmission loss.

[0034] In this embodiment, when it is detected that the signaling transmission between two network elements meets the preset signaling end condition, the signaling data generated between the two network elements can be used as the second signaling data. For example, the preset signaling end condition can be that when a preset signaling end flag message is received, it can be considered that the signaling ends; or, when a signaling end status code is received, it can be considered that the requested signaling ends; or, when a network element sends a request and receives a response from another network element, it is considered that the signaling for this time ends; or, if no expected response data is received after a certain period of time after sending signaling request data, it can be considered that the signaling times out, that is, the signaling ends. Further, the first device can process the second signaling data, such as mirroring processing, aggregation processing, etc., and then transmit the processed second signaling data to the deep packet detection device. When the deep packet detection device receives the data processed by the first device based on the second signaling data, it can be considered that the first signaling data is received. At this time, the deep packet detection device can update the first data transmission attribute of the network element pair in the network element signaling information table based on the first signaling data. For example, if it is detected that there is a data transmission loss in the first signaling data, the data transmission loss rate in the first data transmission attribute can be increased.

[0035] In this embodiment, updating the network element signaling information table based on the first signaling data includes: based on the network element pair information in the first signaling data, searching in the network element signaling information table to find whether there is a network element pair corresponding to the first signaling data; if so, updating the first data transmission attribute of the found network element pair based on the network element communication data in the first signaling data; if not, creating a new node in the network element signaling information table, taking the network element pair information as the new network element pair in the new node, and updating the first data transmission attribute of the new network element pair based on the network element communication data in the first signaling data.

[0036] Among them, the network element pair information includes the relevant information of the two communicating network elements in the first signaling data, such as the network element identifiers of the two network elements. The network element identifier is the unique information used to identify the network element. For example, the network element identifier can be the IP address of the network element, the port number, the network element ID, etc. The network element signaling information table can be a data structure based on key-value pairs. A node can be understood as the key in the data structure, and the new network element pair and the first data transmission attribute of the new network element pair in the node can be understood as the values in the data structure. The network element communication data can refer to the communication data between two network elements in the signaling data transmitted by the first device.

[0037] In this embodiment, by parsing the network element pair information in the first signaling data and using a matching algorithm or an index search method, it is possible to search in the network element signaling information table to find out whether there is a network element pair corresponding to the network element pair information. If it exists, based on the network element communication data in the first signaling data, the first data transmission attribute corresponding to the found network element pair can be updated. The way to update the first data transmission attribute corresponding to the found network element pair can be: perform an increment processing on the total number of signaling times in the first data transmission attribute of the found network element pair, such as adding 1 to the total number of signaling times; when the network element communication data in the first signaling data includes a request message and a response message, perform an increment processing on the number of successful signaling times in the first data transmission attribute of the found network element pair, such as adding 1 to the number of successful signaling times, and the processed first data transmission attribute is the updated first data transmission attribute. It should be noted that when the network element communication data includes a request message and a response message, it indicates that the first signaling data transmitted by the first device is complete and there is no data loss during transmission; when the network element communication data only includes one of the request message or the response message, it indicates that there is data loss in the first signaling data transmitted by the first device. If there is no network element pair corresponding to the network element pair information in the network element signaling information table, it means that the network element signaling information table does not record the data transmission attribute of the first device under the network element pair information. At this time, a new node can be created in the network element signaling information table according to the network element pair information in the first signaling data, and the newly added node is the key. Use the network element pair information as the newly added network element pair in the newly added node. At this time, the first data transmission attribute of the newly added network element pair is empty, and the first data transmission attribute of the newly added network element pair can be determined according to the network element communication data in the first signaling data.

[0038] In this embodiment, the method for updating the first data transmission attribute of the newly added network element pair based on the network element communication data in the first signaling data may be: increasing the total number of signaling in the first data transmission attribute of the newly added network element pair, and when the network element communication data in the first signaling data includes a request message and a response message, increasing the number of successful signaling in the first data transmission attribute of the newly added network element pair, so as to obtain an updated network element signaling information table. The total number of signaling refers to the cumulative number of all signaling interactions between a network element pair (i.e., two network elements), regardless of success or failure. For example, whenever a signaling interaction occurs between a network element pair, the total number of signaling increases. The number of successful signaling refers to the number of successfully completed signaling interactions between a network element pair, which also refers to the situation where both the request and the response are completed normally. For example, when the signaling data contains both a request message and a response message, the number of successful signaling increases. It should be noted that during the actual communication between network elements, both the request and the response are completed normally, that is, the generated second signaling data contains request data and response data. After generating the second signaling data, the first device will transmit the second signaling data to the deep packet inspection device. At this time, the first signaling data received by the deep packet inspection device may, due to various factors (such as network factors or other factors), result in data transmission loss during the data transmission process.

[0039] In this embodiment, the method for creating a new node in the network element signaling information table may be: performing a hash process on the network element pair information to obtain first hash data; using the first hash data as the node name of the new node, so that when receiving the first signaling data, based on the network element pair information in the first signaling data, determining second hash data, and based on the second hash data, searching in the network element signaling information table to find whether there is a network element pair corresponding to the first signaling data.

[0040] Specifically, a hash algorithm may be used to perform a hash process on the network element pair information in the first signaling data, and the obtained hash value is used as the first hash data. Further, the first hash data may be used as the node name of the new node. In this way, when receiving new first signaling data, a hash algorithm may be used to perform a hash process on the network element pair information in the first signaling data, and the obtained hash value is used as the second hash data. It is possible to search in the network element signaling information table based on the second hash data to find whether there is a node name consistent with the second hash data. If it exists, the network element pair in the node corresponding to the node name consistent with the second hash data is used as the found network element pair. So as to update the first data transmission attribute corresponding to the found network element pair based on the received new first signaling data. By mapping the key-value pair to the position in the table, the subsequent data search speed can be improved.

[0041] S120. When a preset detection condition is met, obtain interactive network element data, and based on the interactive network element data and / or the network element signaling information table, determine the second data transmission attributes corresponding to the first device under each third network element pair.

[0042] Among them, the preset detection condition can be a condition for triggering the execution of data detection. The interactive network element data can refer to the standard data of network element pairs that communicate with each other in a communication network. The interactive network element data includes at least one second network element pair; the third network element pair is a network element pair in the first network element pair and / or the second network element pair. That is to say, the third network element pair can be a network element pair in the second network element pair or a network element pair in the first network element pair. It should be noted that there may be duplicate network element pairs in the first network element pair and the second network element pair. The third network element pair can be a network element pair in the union of the first network element pair and the second network element pair. The second data transmission attribute can be used to characterize the transmission attribute of the first device in the process of transmitting signaling data generated between two communicating network elements in the third network element pair to the deep packet detection device.

[0043] In this embodiment, the preset detection condition can be pre-configured. Optionally, the preset detection condition can be a timing task based on a preset time interval (such as checking every 5 minutes), or a signaling event (such as when the total number of signaling reaches a certain threshold, when receiving the first signaling data), or a trigger detection control. In this way, when it is detected that the preset detection condition is met, the interactive network element data can be obtained from a preset location, a network device, or a management system. Further, the interactive network element data and / or the network element signaling information table can be combined to analyze the data transmission situation corresponding to the first device transmitting signaling data of different third network element pairs. According to the data transmission situation, determine the second data transmission attributes corresponding to the first device under each third network element pair. So as to help the first device better perform data transmission, optimize data transmission performance, and quickly respond to potential problems.

[0044] It should be noted that there are at least two ways to determine the second data transmission attributes corresponding to the first device under each third network element pair based on the interactive network element data and / or the network element signaling information table:

[0045] One way can be: The first data transmission attribute includes the total number of signaling and the number of successful signaling; for each first network element pair in the network element signaling information table, based on the total number of signaling and the number of successful signaling in the first data transmission attribute of the first network element pair, determine the data transmission success rate, and use the data transmission success rate as the second data transmission attribute corresponding to the first device under the third network element pair corresponding to the first network element pair.

[0046] In this embodiment, the quotient of the number of successful signaling and the total number of signaling in the first data transmission attribute of the first network element pair can be calculated, and the quotient value can be used as the data transmission success rate. The first network element pair is a third network element pair, and the data transmission success rate can be used as the second data transmission attribute corresponding to the first device under the third network element pair corresponding to the first network element pair.

[0047] Another way can be: perform a difference processing on at least one first network element pair in the network element signaling information table and at least one second network element pair in the interactive network element data. In the case of the existence of a differential network element pair, determine the data transmission loss rate corresponding to the differential network element pair; use the data transmission loss rate as the second data transmission attribute corresponding to the first device under the third network element pair corresponding to the differential network element pair.

[0048] Among them, the differential network element pair refers to the network element pair with inconsistencies in the network element signaling information table and the interactive network element data. The differential network element pair can be the second network element pair. That is to say, the differential network element pair exists in the second network element pair and does not exist in the first network element pair. The data transmission loss rate can refer to the proportion of data packets lost during the data transmission process of the first device in the differential network element pair.

[0049] In this embodiment, a comparative analysis can be performed on each first network element pair in the network element signaling information table and each second network element pair in the interactive network element data to identify whether there is a differential network element pair. If so, the data transmission loss rate of each differential network element pair can be determined as a preset threshold (for example, the preset threshold is 100%). Further, use the data transmission loss rate as the second data transmission attribute corresponding to the first device under the third network element pair corresponding to the differential network element pair. By comparing the network element signaling information table and the interactive network element data, identifying the differential network element pair, and calculating its data transmission loss rate, it can effectively and quickly determine which signaling data between network element pairs the first device has completely lost.

[0050] S130. When it is detected that the second data transmission attribute reaches the preset transmission anomaly condition, send the second data transmission attribute that reaches the preset transmission anomaly condition and its corresponding third network element pair to the first device, so that the first device processes the data transmission loss event based on the received third network element pair and the second data transmission attribute.

[0051] Among them, the preset transmission anomaly condition can be a predefined threshold or rule for determining whether the data transmission is abnormal. For example, the data transmission loss rate reaches a preset first threshold, the data transmission success rate is less than a preset second threshold, etc.

[0052] In this embodiment, the second data transmission attributes of the network element pairs can be checked in real time or periodically to determine whether they meet the preset transmission exception conditions. When one or more of the second data transmission attributes meet the preset transmission exception conditions, all the second data transmission attributes that meet the preset transmission exception conditions and their corresponding third network element pairs can be sent to the first device, so that when the first device receives the abnormal third network element pairs and their second data transmission attributes sent by the deep packet inspection device, it can process the data transmission loss event based on a preset method. For example, the methods for processing the data transmission loss event can include: reallocating bandwidth, adjusting the route, repairing the link, sending an alarm notification, and so on.

[0053] In this embodiment, in response to a data transmission normal event, the deep packet inspection device can also receive the network element transmission data sent by the first device and perform deep packet inspection on the network element transmission data to obtain a detection result.

[0054] Among them, a deep packet inspection (DPI) device is used to analyze and process the network element transmission data sent by the first device to ensure the normality of data transmission. For example, it can identify and block network attacks, track set behaviors, block malware, and monitor network traffic. A data transmission normal event refers to a good communication state between network elements without detecting any abnormal situations. Network element transmission data refers to the actual data packets transmitted between network element pairs, such as user data (such as data of protocols like HTTP, FTP, VoIP, etc.), control signaling data (such as SIP, RTP, etc.), or other network traffic data. The detection result refers to the output result after the deep packet inspection device analyzes the network element transmission data.

[0055] Specifically, when it is detected that none of the second data transmission attributes meet the preset transmission exception conditions and it is considered that the data transmission of the network element pair is normal, a data transmission normal event can be triggered. The deep packet inspection device receives the network element transmission data sent by the first device, and then performs deep packet inspection on the network element transmission data. The inspection includes, but is not limited to, various inspections such as the content of the data packet (such as protocol type, application layer data), the structure of the data packet (such as header information, payload size), and the transmission status of the data packet (such as source address, destination address, port number, etc.), so as to obtain a detection result. The detection result includes, but is not limited to, the protocol type and application layer information of the data packet, whether there is abnormal traffic (such as malware, attacks, etc.), the integrity and compliance of data transmission, etc. By analyzing the network element transmission data under normal data transmission conditions, the deep packet inspection device can ensure the normality and integrity of the processed data, thereby improving the reliability and security of the network.

[0056] Exemplarily, refer to Figure 2, the deep packet inspection device can be deployed in parallel with the actual communication network, access communication traffic (i.e., network element transmission data) through devices such as optical splitting and aggregation and shunting (i.e., the first device), deeply analyze the packet information in the communication traffic, and output a communication detail list (i.e., the detection result).

[0057] In the technical solution of this embodiment, when receiving the first signaling data, the network element signaling information table is updated based on the first signaling data; the first signaling data is the data processed by the first device on the second signaling data; the second signaling data is generated when two network elements communicate; the network element signaling information table includes at least one first network element pair and the first data transmission attribute corresponding to the first device under the first network element pair; when the preset detection condition is satisfied, the interactive network element data is obtained, and based on the interactive network element data and / or the network element signaling information table, the second data transmission attribute corresponding to the first device under each third network element pair is determined; the interactive network element data includes at least one second network element pair; the third network element pair is the network element pair in the first network element pair and / or the second network element pair; when it is detected that the second data transmission attribute reaches the preset transmission anomaly condition, the second data transmission attribute that reaches the preset transmission anomaly condition and its corresponding third network element pair are sent to the first device, so that the first device processes the data transmission missing event based on the received third network element pair and the second data transmission attribute, solving the problems of low detection efficiency and detection lag in the prior art when using a data analysis tool to analyze the signaling data in a file. When receiving the first signaling data sent by the first device, the network element signaling information table is updated based on the first signaling data; the network element signaling information table includes at least one first network element pair and the first data transmission attribute corresponding to the first device under the first network element pair. Furthermore, when the preset detection condition is satisfied, based on the interactive network element data and / or the network element signaling information table, the second data transmission attribute corresponding to the first device under each third network element pair is determined, realizing the improvement of the accuracy and comprehensiveness of data transmission quality detection. When it is detected that the second data transmission attribute reaches the preset transmission anomaly condition, the second data transmission attribute that reaches the preset transmission anomaly condition and its corresponding third network element pair are sent to the first device, realizing efficient, large-scale, and continuous data transmission quality detection, and at the same time, the first device can be notified in time to process the data transmission missing event when an anomaly is detected, so as to ensure the accuracy of subsequent deep packet inspection.

[0058] Embodiment 2

[0059] As an optional embodiment of the above embodiment, in order to make those skilled in the art further clear the technical solution of the embodiment of the present invention, a specific application scenario example is given. Specifically, the following specific content can be referred to.

[0060] In this embodiment, a network element signaling information table (hash table) can be created to store the data transmission attributes corresponding to the first device under different network element pairs. The network element signaling information table contains several nodes. The key of each node is the IPs of the two network elements in the network element pair (i.e., the network element identifiers), such as Network Element 1-IP and Network Element 2-IP; the value is the data transmission attribute, which can include the number of successful signaling times (signal-success) and the total number of signaling times (signal-total).

[0061] Each time a signaling is completed (successfully or timed out), the information of this signaling (i.e., the second signaling data) can be sent to the deep packet inspection device. The signaling data received by the deep packet inspection device is the first signaling data. Assume that the first signaling data is the signaling data between Network Element 1 and Network Element 2, and Network Element 1 and Network Element 2 represent the two network elements of a signaling communication. For example, for the signaling data of an N11 interface, then Network Element 1 and Network Element 2 are the AMF and SMF respectively; for the signaling data of the N4 interface, Network Element 1 and Network Element 2 are the SMF and UPF respectively. The first signaling data includes Network Element 1-IP and Network Element 2-IP (i.e., the network element pair information) and signal-status (signaling status).

[0062] See Figure 3 , the network element 1-IP and network element 2-IP can be used to query whether there is a corresponding node in the network element signaling information table. For example, the hash value (i.e., the hashed data) is calculated using the network element 1-IP and network element 2-IP, and the hashed data is used to query whether there is a corresponding node in the network element signaling information table, that is, to query whether there is a network element pair corresponding to the first signaling data. If the node is found, the value of the node is directly updated; the signal-total of the value is incremented by 1, representing that the total number of signaling times is incremented by 1; if the signal-status (i.e., the signaling status) is the success status, the signal-success is incremented by 1, representing that the number of successful signaling times is incremented by 1. If the node is not found, a new node (i.e., a newly added node) is created using the network element 1-IP and network element 2-IP, the key of the node is filled with the network element 1-IP and network element 2-IP, inserted into the network element signaling information table, and the value of the node is updated. At this time, the total number of signaling times is 1.

[0063] Exemplarily, the network element signaling information table can be seen in Table 1.

[0064] Table 1

[0065]

[0066] According to the statistical examples of the data transmission attributes of each network element pair in Table 1, it can be known that

[0067] The signaling success rate (i.e., data transmission success rate) between network element 10.0.0.1 and network element 20.0.0.1 is 100%, indicating that the traffic is complete. The signaling success rate (i.e., data transmission success rate) between network element 10.0.0.2 and network element 20.0.0.2 is 80%, which indicates that there is traffic loss (i.e., data transmission loss). The signaling success rate (i.e., data transmission success rate) between network element 10.0.0.3 and network element 20.0.0.3 is 0%, which means that the deep packet inspection device only accesses the traffic of a single network element transmitted by the first device.

[0068] When it is assumed that there are also network elements 10.0.0.4 and 20.0.0.4 in the interactive network element data provided by the operator, but the IPs of these two network elements are not in the network element signaling information table, it means that the signaling data of these two network elements (i.e., the differential network element pair) is not accessed into the system, and the signaling loss rate is 100% (i.e., the data transmission loss rate is 100%). Further, the IPs of the network elements with data transmission loss can be fed back to upstream aggregation and diversion, traffic mirroring and other devices (i.e., the first device), and the first device is used to solve the problem of data transmission loss.

[0069] The technical solution of this embodiment updates the network element signaling information table based on the first signaling data when receiving the first signaling data sent by the first device; the network element signaling information table includes at least one first network element pair and the first data transmission attribute corresponding to the first device under the first network element pair. Furthermore, when the preset detection conditions are met, based on the interactive network element data and / or the network element signaling information table, the second data transmission attribute corresponding to the first device under each third network element pair is determined, so as to improve the accuracy and comprehensiveness of data transmission quality detection. When it is detected that the second data transmission attribute reaches the preset transmission exception condition, the second data transmission attribute that reaches the preset transmission exception condition and its corresponding third network element pair are sent to the first device, so as to realize efficient, large-scale and continuous data transmission quality detection, and at the same time, the first device can be notified in time to process the data transmission loss event when an exception is detected, so as to ensure the accuracy of subsequent deep packet inspection.

[0070] Embodiment III

[0071] Figure 4 It is a schematic structural diagram of a data detection device provided according to Embodiment III of the present invention. As Figure 4 shown, the device is configured in a deep packet inspection device, and the deep packet inspection device is connected to at least one switch; different network elements communicate based on the switch; the device includes: an information table update module 210, a second data transmission attribute determination module 220, and an exception detection module 230.

[0072] Among them, the information table update module 210 is configured to update the network element signaling information table based on the first signaling data when the first signaling data is received; wherein, the first signaling data is data processed by a first device on second signaling data; the second signaling data is generated when two of the network elements communicate with each other; the network element signaling information table includes at least one first network element pair and first data transmission attributes corresponding to the first device under the first network element pair; the first network element pair includes two communicating network elements; the second data transmission attribute determination module 220 is configured to obtain interactive network element data when a preset detection condition is met, and determine second data transmission attributes corresponding to the first device under each third network element pair based on the interactive network element data and / or the network element signaling information table; wherein, the interactive network element data includes at least one second network element pair; the third network element pair is a network element pair in the first network element pair and / or the second network element pair; the anomaly detection module 230 is configured to send the second data transmission attribute that reaches the preset transmission anomaly condition and its corresponding third network element pair to the first device when it is detected that the second data transmission attribute reaches the preset transmission anomaly condition, so that the first device processes a data transmission missing event based on the received third network element pair and the second data transmission attribute; wherein, the first device includes the switch and / or a device for transmitting and processing the second signaling data between the switch and the deep packet detection device.

[0073] In the technical solution of this embodiment, when receiving the first signaling data, the network element signaling information table is updated based on the first signaling data; the first signaling data is the data processed by the first device from the second signaling data; the second signaling data is generated when two network elements communicate with each other; the network element signaling information table includes at least one first network element pair and the first data transmission attribute corresponding to the first device under the first network element pair; when the preset detection condition is satisfied, the interactive network element data is obtained, and based on the interactive network element data and / or the network element signaling information table, the second data transmission attribute corresponding to the first device under each third network element pair is determined; the interactive network element data includes at least one second network element pair; the third network element pair is the network element pair in the first network element pair and / or the second network element pair; when it is detected that the second data transmission attribute reaches the preset transmission abnormal condition, the second data transmission attribute that reaches the preset transmission abnormal condition and its corresponding third network element pair are sent to the first device, so that the first device processes the data transmission missing event based on the received third network element pair and the second data transmission attribute, which solves the problems of low detection efficiency and detection lag in the prior art when using a data analysis tool to analyze the signaling data in a file. When receiving the first signaling data sent by the first device, the network element signaling information table is updated based on the first signaling data; the network element signaling information table includes at least one first network element pair and the first data transmission attribute corresponding to the first device under the first network element pair. Furthermore, when the preset detection condition is satisfied, based on the interactive network element data and / or the network element signaling information table, the second data transmission attribute corresponding to the first device under each third network element pair is determined, so as to improve the accuracy and comprehensiveness of data transmission quality detection. When it is detected that the second data transmission attribute reaches the preset transmission abnormal condition, the second data transmission attribute that reaches the preset transmission abnormal condition and its corresponding third network element pair are sent to the first device, which can realize efficient, large-scale and continuous data transmission quality detection, and can timely notify the first device to process the data transmission missing event when detecting an abnormality, so as to ensure the accuracy of subsequent deep packet detection.

[0074] Based on the above device, optionally, the information table update module 210 includes:

[0075] An information table update unit, configured to search in the network element signaling information table whether there is a network element pair corresponding to the first signaling data based on the network element pair information in the first signaling data; if so, update the first data transmission attribute of the found network element pair based on the network element communication data in the first signaling data; if not, create a new node in the network element signaling information table, use the network element pair information as the new network element pair in the new node, and update the first data transmission attribute of the new network element pair based on the network element communication data in the first signaling data.

[0076] Based on the above device, optionally, the information table update unit includes:

[0077] A first hash data determination unit, configured to perform hash processing on the network element pair information to obtain first hash data;

[0078] A node creation unit, configured to use the first hash data as the node name of the newly added node, and when receiving the first signaling data, determine second hash data based on the network element pair information in the first signaling data, and based on the second hash data, search in the network element signaling information table to find whether there is a network element pair corresponding to the first signaling data.

[0079] Based on the above device, optionally, the information table update unit includes:

[0080] A data transmission attribute adjustment unit, configured to increase the total number of signaling times in the first data transmission attribute of the newly added network element pair, and when the network element communication data in the first signaling data includes a request message and a response message, increase the number of successful signaling times in the first data transmission attribute of the newly added network element pair, so as to obtain an updated network element signaling information table.

[0081] Based on the above device, optionally, the first data transmission attribute includes the total number of signaling times and the number of successful signaling times, and the second data transmission attribute determination module 220 includes:

[0082] A first unit for determining the second data transmission attribute, configured to, for each first network element pair in the network element signaling information table, determine the data transmission success rate based on the total number of signaling times and the number of successful signaling times in the first data transmission attribute of the first network element pair, and use the data transmission success rate as the second data transmission attribute corresponding to the first device under the third network element pair corresponding to the first network element pair.

[0083] Based on the above device, optionally, the second data transmission attribute determination module 220 includes:

[0084] A data transmission missing rate determination unit, configured to perform difference processing on at least one first network element pair in the network element signaling information table and at least one second network element pair in the interactive network element data, and determine the data transmission missing rate corresponding to the difference network element pair in the case of the existence of the difference network element pair;

[0085] A second unit for determining the second data transmission attribute, configured to use the data transmission missing rate as the second data transmission attribute corresponding to the first device under the third network element pair corresponding to the difference network element pair; wherein, the difference network element pair is the second network element pair.

[0086] Based on the above device, optionally, the device further includes:

[0087] A deep packet detection unit, configured to, in response to a normal data transmission event, receive element transmission data sent by a first device based on the deep packet detection device, and perform deep packet detection on the element transmission data to obtain a detection result.

[0088] The data detection device provided by the embodiments of the present invention can execute the data detection method provided by any embodiment of the present invention, and has function modules and beneficial effects corresponding to the execution of the method.

[0089] Embodiment 4

[0090] Figure 5 It is a schematic structural diagram of an electronic device for implementing the data detection method of the embodiments of the present invention. The electronic device is intended to represent various forms of digital computers, such as, laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as, personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are only examples and are not intended to limit the implementation of the present invention described and / or claimed herein.

[0091] As Figure 5 shown, the electronic device 10 includes at least one processor 11, and a memory communicatively connected to at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc. Among them, the memory stores a computer program executable by at least one processor. The processor 11 can execute various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 into the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. The input / output (I / O) interface 15 is also connected to the bus 14.

[0092] Multiple components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disc, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0093] The processor 11 can be various general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as the data detection method.

[0094] In some embodiments, the data detection method can be implemented as a computer program tangibly embodied in a computer-readable storage medium, such as the storage unit 18. In some embodiments, part or all of the computer program can be loaded and / or installed onto the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the data detection method described above can be executed. Alternatively, in other embodiments, the processor 11 can be configured to execute the data detection method by any other suitable means (e.g., by means of firmware).

[0095] The various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-chip (SOCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special or general-purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit the data and instructions to the storage system, the at least one input device, and the at least one output device.

[0096] The computer program for implementing the method of the present invention can be written in any combination of one or more programming languages. These computer programs can be provided to the processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when the computer program is executed by the processor, the functions / operations specified in the flowchart and / or block diagram are implemented. The computer program can be executed entirely on the machine, partially on the machine, as a stand-alone software package partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0097] In the context of the present invention, a computer-readable storage medium can be a tangible medium that can contain or store a computer program for use by or in connection with an instruction execution system, apparatus, or device. The computer-readable storage medium can include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. Alternatively, the computer-readable storage medium can be a machine-readable signal medium. More specific examples of the machine-readable storage medium would include an electrical connection based on one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0098] To provide for interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or a trackball) by which the user can provide input to the electronic device. Other kinds of devices can also be used to provide for interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, speech input, or tactile input).

[0099] The systems and techniques described herein can be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer having a graphical user interface or a web browser through which the user can interact with an implementation of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0100] A computing system may include a client and a server. The client and the server are generally far from each other and usually interact via a communication network. The relationship between the client and the server is generated by computer programs running on respective computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or a cloud host, which is a host product in the cloud computing service system, and solves the defects of difficult management and weak business scalability existing in traditional physical hosts and VPS services.

[0101] An embodiment of the present invention also provides a computer program product, including a computer program which, when executed by a processor, implements the data detection method provided in any embodiment of the present invention.

[0102] In the process of implementing the computer program product, computer program code for performing the operations of the present invention can be written in one or more programming languages or combinations thereof. The programming languages include object-oriented programming languages such as Java, Smalltalk, C++, and also include conventional procedural programming languages such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, executed as an independent software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer can be connected to the user's computer through any type of network - including a local area network (LAN) or a wide area network (WAN) - or can be connected to an external computer (for example, by using an Internet service provider to connect through the Internet).

[0103] It should be understood that various forms of the processes shown above can be used, with steps reordered, added, or deleted. For example, the steps recited in the present invention can be executed in parallel, sequentially, or in a different order, as long as the desired results of the technical solution of the present invention can be achieved, and no limitation is imposed herein.

[0104] The above specific embodiments do not constitute a limitation to the protection scope of the present invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principle of the present invention shall be included within the protection scope of the present invention.

Claims

1. A data detection method, characterized in that: Applied to a deep packet inspection device, the deep packet inspection device is connected to at least one switch; Different network elements communicate with each other based on the switch; The method comprises: When receiving first signaling data, updating the network element signaling information table based on the first signaling data; wherein the first signaling data is data based on the first device processing the second signaling data; the second signaling data is generated when two network elements communicate with each other; the network element signaling information table includes at least one first network element pair and a first data transmission attribute corresponding to the first device under the first network element pair; the first network element pair includes two communicating network elements; When a preset detection condition is met, the interactive network element data is obtained, and based on the interactive network element data and / or the network element signaling information table, the second data transmission attribute corresponding to the first device in each third network element pair is determined; wherein the interactive network element data includes at least one second network element pair; the third network element pair is a network element pair in the first network element pair and / or the second network element pair; When it is detected that the second data transmission attribute reaches a preset transmission abnormality condition, the second data transmission attribute that reaches the preset transmission abnormality condition and the corresponding third network element pair are sent to the first device, so that the first device processes the data transmission missing event based on the received third network element pair and the second data transmission attribute; The first device includes the switch and / or a device between the switch and the deep packet inspection device for transmitting and processing the second signaling data.

2. The method according to claim 1, characterized in that The updating of the network element signaling information table based on the first signaling data includes: Based on the network element pair information in the first signaling data, searching from a network element signaling information table whether there is a network element pair corresponding to the first signaling data; If so, updating the first data transmission attribute of the found network element pair based on the network element communication data in the first signaling data; If not, a new node is created in the network element signaling information table, and the network element pair information is used as the new network element pair in the new node, and the first data transmission attribute of the new network element pair is updated based on the network element communication data in the first signaling data.

3. The method according to claim 2, characterized in that The creating a new node in the network element signaling information table includes: Performing hash processing on the network element pair information to obtain first hash data; The first hash data is used as the node name of the newly added node, so that when the first signaling data is received, the second hash data is determined based on the network element pair information in the first signaling data, and based on the second hash data, a search is performed from the network element signaling information table to determine whether there is a network element pair corresponding to the first signaling data.

4. The method according to claim 2, characterized in that: The updating of the first data transmission attribute of the newly added network element pair based on the network element communication data in the first signaling data includes: The total number of signaling times in the first data transmission attribute of the newly added network element pair is increased, and when the network element communication data in the first signaling data includes request information and response information, the number of signaling success times in the first data transmission attribute of the newly added network element pair is increased to obtain an updated network element signaling information table.

5. The method according to claim 1, characterized in that The first data transmission attribute includes a total number of signaling times and a number of successful signaling times, and the determining, based on the interactive network element data and / or the network element signaling information table, a second data transmission attribute corresponding to the first device in each third network element pair, includes: For each first network element pair in the network element signaling information table, the data transmission success rate is determined based on the total number of signaling times and the number of signaling successes in the first data transmission attribute of the first network element pair, and the data transmission success rate is used as the second data transmission attribute corresponding to the first device in the third network element pair corresponding to the first network element pair.

6. The method according to claim 1, characterized in that The determining, based on the interactive network element data and / or the network element signaling information table, the second data transmission attribute corresponding to the first device in each third network element pair, includes: Process at least one first network element pair in the network element signaling information table and at least one second network element pair in the interactive network element data differently, and if there is a different network element pair, determine a data transmission loss rate corresponding to the different network element pair; The data transmission loss rate is used as a second data transmission attribute corresponding to the first device in a third network element pair corresponding to the difference network element pair; wherein the difference network element pair is the second network element pair.

7. The method according to claim 1, characterized in that The method further comprises: In response to a normal data transmission event, the deep packet inspection device receives the network element transmission data sent by the first device, and performs deep packet inspection on the network element transmission data to obtain a detection result.

8. A data detection device, characterized in that: Configured in a deep packet inspection device, the deep packet inspection device is connected to at least one switch; Different network elements communicate with each other based on the switch; The device comprises: An information table updating module is used to update a network element signaling information table based on the first signaling data when receiving the first signaling data; wherein the first signaling data is based on data processed by the first device on the second signaling data; the second signaling data is generated when two network elements communicate with each other; the network element signaling information table includes at least one first network element pair and a first data transmission attribute corresponding to the first device under the first network element pair; the first network element pair includes two communicating network elements; A second data transmission attribute determination module is used to obtain interactive network element data when a preset detection condition is met, and determine the second data transmission attribute corresponding to the first device under each third network element pair based on the interactive network element data and / or the network element signaling information table; wherein the interactive network element data includes at least one second network element pair; the third network element pair is a network element pair in the first network element pair and / or the second network element pair; an anomaly detection module, configured to, when detecting that the second data transmission attribute reaches a preset transmission anomaly condition, send the second data transmission attribute that reaches the preset transmission anomaly condition and the corresponding third network element pair to the first device, so that the first device processes a data transmission missing event based on the received third network element pair and the second data transmission attribute; The first device includes the switch and / or a device between the switch and the deep packet inspection device for transmitting and processing the second signaling data.

9. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory in communication with the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can perform the data detection method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the data detection method according to any one of claims 1 to 7 when executed.

Images