Multi-protocol data synchronous acquisition and analysis system and method based on big data

Abstract

The present invention discloses a multi-protocol data synchronous acquisition and analysis system and method based on big data, which relates to the field of big data technology, including: obtaining historical alarm records of computer equipment, extracting and analyzing the memory usage of each network protocol corresponding to the alarm record, and then extracting feature records from the alarm record; obtaining a target protocol combination, and obtaining the degree of influence of each network protocol on memory usage based on the target protocol combination and the feature record; generating corresponding monitoring records, and intercepting detection records from the monitoring records; obtaining the memory usage ratio of each network protocol corresponding to each acquisition moment in the detection record, and then judging whether to issue an early warning prompt for the target protocol combination. The present invention analyzes historical alarm records in combination with the current target protocol combination to judge whether the currently set acquisition strategy is reasonable, optimizes the acquisition and analysis of the current protocol, and effectively avoids the situation of unreasonable resource allocation.

Description

Technical Field

[0001] The present invention relates to the field of big data technology, and in particular to a system and method for synchronously collecting and analyzing multi-protocol data based on big data. Background Art

[0002] Currently, there are many types of protocols in the field of Internet of Things, the most common ones are HTTP, MQTT, CoAP, Modbus, etc. Various sensing devices transmit data to computer devices through different protocols. Accurately identifying and parsing these protocols, and collecting data on this basis, conducting real-time fusion and correlation analysis can deeply mine the value of data, provide comprehensive and in-depth data insights for Internet of Things applications, and significantly improve the ability of comprehensive data analysis.

[0003] However, when simultaneously collecting and processing data from multiple protocols, the system consumes a significant amount of memory resources. Improper resource allocation or a lack of effective optimization, such as excessive concentration of protocol collection and analysis tasks, can significantly degrade system performance and, in severe cases, even cause a system crash. Therefore, it's necessary to analyze the current collection strategy to determine its rationality and provide timely warnings regarding potential collection risks. Summary of the Invention

[0004] The purpose of the present invention is to provide a multi-protocol data synchronous acquisition and analysis system and method based on big data to solve the problems raised in the prior art.

[0005] To achieve the above object, the present invention provides the following technical solutions:

[0006] The multi-protocol data synchronous acquisition and analysis method based on big data includes the following steps:

[0007] Step S100: Acquire historical alarm records of the computer device. The alarm records are records of memory usage of the computer device being outside the normal range as monitored by a memory detection tool deployed on the computer device. The computer device and various sensing devices transmit data via different network protocols. The memory usage of each network protocol corresponding to the alarm records is extracted and analyzed, and feature records are extracted from the alarm records.

[0008] Step S200: A combination of various network protocols according to their respective set collection frequencies is used as a target protocol combination; based on the target protocol combination and the feature records, a data collection test is performed on each network protocol on the computer device, and based on the test results, the impact of each network protocol on memory usage is obtained;

[0009] Step S300: Generate a corresponding monitoring record based on the memory usage at each moment in history recorded by the memory detection tool; and extract a detection record from the monitoring record based on the alarm time corresponding to each alarm record in the monitoring record;

[0010] It should be noted that the purpose of intercepting detection records here is: since the target protocol combination is only in the stage of judging whether the collection strategy is reasonable, that is, it is only an estimate. In order to better illustrate the rationality of the current estimate, it is necessary to intercept records of reasonable duration and containing as many features as possible from historical monitoring records as detection records to increase the rationality of the current estimate.

[0011] Step S400: According to the memory detection tool, the memory occupancy ratio of each network protocol corresponding to each collection moment in the detection record is obtained, and the resource occupancy value of each collection moment is obtained according to the degree of impact, and according to the resource occupancy value, it is determined whether to issue an early warning prompt for the target protocol combination.

[0012] Furthermore, step S100 includes:

[0013] Step S110: Obtain the normal memory usage range [0, R], where R is the maximum memory usage ratio preset by the system; obtain several historical alarm records of the computer device, and capture the alarm time, memory usage ratio, and collection frequency corresponding to each network protocol corresponding to each alarm record;

[0014] Step S120: deploy a memory detection tool on the computer device, and use the memory detection tool to detect the memory ratio occupied by the computer device and the sensing devices corresponding to each network protocol for data transmission at the alarm time corresponding to a certain alarm record; add up each occupied memory ratio corresponding to a certain alarm record to obtain a total occupied ratio; if the total occupied ratio is greater than a preset ratio threshold, the certain alarm record is used as a feature record, and then all feature records are obtained.

[0015] In the prior art, some sensing device manufacturers typically provide corresponding APIs that allow users to obtain relevant device information, including the memory occupied during data transmission. By calling these APIs, developers can write programs to obtain memory usage information for data transmission between a specific sensing device and a computer device and calculate the corresponding ratio. This is not specifically presented in this embodiment. Feature records are alarm records determined to be caused by multi-protocol data collection. Feature records are also obtained to eliminate the impact of other applications on the computer device that also occupy memory.

[0016] Furthermore, step S200 includes:

[0017] Step S210: extracting the acquisition frequency corresponding to each network protocol in the target protocol combination; based on the acquisition frequency corresponding to each network protocol in the target protocol combination and the acquisition frequency corresponding to each network protocol in a certain historical feature record F, the network protocols with different acquisition frequencies are selected as detection protocols;

[0018] Step S220: The acquisition frequency corresponding to a certain detection protocol A in the target protocol combination is taken as H1, and the acquisition frequency corresponding to a certain feature record F is taken as H2; based on the acquisition frequency H1, the acquisition interval D1 between two adjacent acquisition points is obtained, and based on the acquisition frequency H2, the acquisition interval D2 between two adjacent acquisition points is obtained;

[0019] A collection frequency of a certain detection protocol A on a computer device is configured to be H1, and a collection duration is configured to be an integer multiple of D1. All applications and other network protocols on the computer device are stopped, and a first data collection test is performed on the certain detection protocol A on the computer device. A memory usage ratio at each moment in each collection cycle during the test is obtained, and for each collection cycle, an average value of the memory usage ratio is calculated at corresponding moments within the cycle. A first line graph of the memory usage ratio changing over time is created based on the average values.

[0020] Similarly, based on the acquisition frequency H2 and acquisition duration D2 corresponding to a certain detection protocol A, a second data acquisition test is performed on a certain detection protocol A on a computer device; and a second line graph of the memory usage ratio changing over time is created;

[0021] Step S230: The maximum memory usage ratio in the first line graph is used as the characteristic value T1, and the maximum memory usage ratio in the second line graph is used as the characteristic value T2, and then the influence degree of network protocol A on memory usage in a certain characteristic record F is obtained: W F A =1-T1 / T2, and according to the corresponding impact of network protocol A in each feature record, calculate the average value to obtain the impact of network protocol A on memory usage W A ; And then get the impact of each network protocol on memory usage.

[0022] The purpose of testing here is to analyze the protocols with multiple historical feature records, summarize the experience, make the impact degree more representative and convincing, better analyze the impact of each network protocol on memory usage, and provide valuable experience for setting more reasonable collection strategies in the future.

[0023] Furthermore, step S300 includes:

[0024] Step S310: The minimum acquisition frequency corresponding to the historical network protocol is set as H3, and the acquisition interval D3 between two adjacent acquisition points is obtained based on the acquisition frequency H3; the minimum acquisition frequency in the network protocol corresponding to the target protocol combination is set as H4, and the acquisition interval D4 between two adjacent acquisition points is obtained based on the acquisition frequency H4;

[0025] Step S320: Set the feature duration to D = K*(D3+D4), where K is the feature coefficient, and K>1; randomly select M sub-monitoring records with a duration equal to D from the historical monitoring records, each sub-monitoring record contains several feature records, and the sub-monitoring record containing the largest number of feature records is used as the detection record.

[0026] Furthermore, step S400 includes:

[0027] Step S410: Obtain the memory usage ratio of each network protocol corresponding to each collection moment in the detection record using the memory detection tool; obtain the memory usage ratio of each network protocol corresponding to a certain collection moment, and obtain the resource usage value at a certain collection moment based on the impact level of each network protocol: Where N is the number of network protocols, B n is the memory usage ratio of the nth network protocol at a certain collection moment, W n is the impact degree corresponding to the nth network protocol, and then the resource occupancy value at each collection moment in the detection record is obtained;

[0028] Step S420: If there are several consecutive resource occupancy values ​​in the detection record that are all outside the normal occupancy range, the several resource occupancy values ​​are regarded as an abnormal combination. If the number of abnormal combinations is greater than the quantity threshold, an early warning prompt is issued for the target protocol combination, and relevant personnel are prompted to redefine the collection strategy.

[0029] A multi-protocol data synchronous acquisition and analysis system based on big data, including a feature record extraction module, an impact degree determination module, a detection record interception module, and an early warning prompt module;

[0030] Feature Record Extraction Module: This module is used to obtain historical alarm records of computer devices. Alarm records are records of computer devices' memory usage being outside the normal range, as detected by memory detection tools deployed on the computer devices. The computer devices and various sensing devices transmit data via different network protocols. The module extracts and analyzes the memory usage of each network protocol corresponding to the alarm records, and then extracts feature records from the alarm records.

[0031] Impact Degree Determination Module: This module is used to determine the target protocol combination, formed by combining various network protocols according to their respective set collection frequencies. Based on the target protocol combination and feature records, it performs data collection tests on each network protocol on the computer device, and obtains the impact of each network protocol on memory usage based on the test results.

[0032] Detection record interception module: used to generate corresponding monitoring records based on the memory usage at each moment in history recorded by the memory detection tool; intercept detection records from the monitoring records according to the alarm time corresponding to each alarm record in the monitoring records;

[0033] Early warning prompt module: used to obtain the memory usage ratio of each network protocol corresponding to each collection moment in the detection record based on the memory detection tool, and obtain the resource usage value of each collection moment based on the degree of impact, and determine whether to issue an early warning prompt for the target protocol combination based on the resource usage value.

[0034] Furthermore, the impact degree determination module includes a detection protocol determination unit, a line graph establishment unit, and an impact degree determination unit;

[0035] Detection protocol determination unit: used to extract the acquisition frequency corresponding to each network protocol in the target protocol combination; based on the acquisition frequency corresponding to each network protocol in the target protocol combination and the acquisition frequency corresponding to each network protocol in the historical feature record, the network protocol with different acquisition frequencies is used as the detection protocol;

[0036] A line graph establishing unit is used to establish a first line graph showing changes in the memory usage ratio over time based on the acquisition frequency corresponding to the detection protocol in the target protocol combination; and to establish a second line graph showing changes in the memory usage ratio over time based on the acquisition frequency corresponding to the detection protocol in the feature record;

[0037] The impact degree determination unit is used to analyze the maximum memory usage ratio in the first line graph and the second line graph to obtain the impact degree of each network protocol on the memory usage.

[0038] Furthermore, the early warning prompt module includes a resource occupancy value calculation unit and an early warning prompt unit;

[0039] Resource occupancy value calculation unit: used to obtain the memory occupancy ratio of each network protocol corresponding to each collection moment in the detection record according to the memory detection tool, and obtain the resource occupancy value of each collection moment according to the impact degree;

[0040] Early warning prompt unit: used to determine whether to issue an early warning prompt for the target protocol combination based on the resource occupancy value.

[0041] Compared with the prior art, the beneficial effects of the present invention are as follows: the present invention provides a multi-protocol data synchronous acquisition and analysis system and method based on big data, including: obtaining historical alarm records of computer equipment, extracting and analyzing the memory usage of each network protocol corresponding to the alarm record, and then extracting feature records from the alarm record; obtaining the target protocol combination, and obtaining the degree of influence of each network protocol on memory usage based on the target protocol combination and the feature record; generating corresponding monitoring records, and intercepting detection records from the monitoring records; obtaining the memory usage ratio of each network protocol corresponding to each acquisition moment in the detection record, and then judging whether to issue an early warning prompt for the target protocol combination. The present invention judges whether the currently set acquisition strategy is reasonable by analyzing the historical alarm records in combination with the current target protocol combination, and optimizes the acquisition and analysis of the current protocol, effectively avoiding the situation of unreasonable resource allocation. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 Schematic diagram of the process of the multi-protocol data synchronous acquisition and analysis method based on big data of the present invention;

[0043] Figure 2 This is a structural diagram of the multi-protocol data synchronization acquisition and analysis system based on big data of the present invention. DETAILED DESCRIPTION

[0044] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0045] Example: Figure 1 As shown, the present invention provides a technical solution for a multi-protocol data synchronous acquisition and analysis method based on big data, comprising the following steps:

[0046] Step S100: Obtain historical alarm records of the computer device, where the alarm records are records of the computer device's memory usage being outside the normal range, monitored by a memory detection tool deployed on the computer device; data is transmitted between the computer device and a variety of sensing devices through different network protocols, and the memory usage of each network protocol corresponding to the alarm record is extracted and analyzed, and then feature records are extracted from the alarm records.

[0047] Step S110: Obtain the normal memory usage range [0, R], where R is the maximum memory usage ratio preset by the system; obtain several historical alarm records of the computer device, and capture the alarm time, memory usage ratio, and collection frequency corresponding to each network protocol corresponding to each alarm record;

[0048] Step S120: deploy a memory detection tool on the computer device, and use the memory detection tool to detect the memory ratio occupied by the computer device and the sensing devices corresponding to each network protocol for data transmission at the alarm time corresponding to a certain alarm record; add up each occupied memory ratio corresponding to a certain alarm record to obtain a total occupied ratio; if the total occupied ratio is greater than a preset ratio threshold, the certain alarm record is used as a feature record, and then all feature records are obtained.

[0049] In the prior art, some sensing device manufacturers typically provide corresponding APIs that allow users to obtain relevant device information, including the memory occupied during data transmission. By calling these APIs, developers can write programs to obtain memory usage information for data transmission between a specific sensing device and a computer device and calculate the corresponding ratio. This is not specifically presented in this embodiment. Feature records are alarm records determined to be caused by multi-protocol data collection. Feature records are also obtained to eliminate the impact of other applications on the computer device that also occupy memory.

[0050] Step S200: A combination of various network protocols according to their respective set collection frequencies is used as a target protocol combination; based on the target protocol combination and feature records, a data collection test is performed on each network protocol on the computer device, and based on the test results, the degree of impact of each network protocol on memory usage is obtained.

[0051] Step S210: extracting the acquisition frequency corresponding to each network protocol in the target protocol combination; based on the acquisition frequency corresponding to each network protocol in the target protocol combination and the acquisition frequency corresponding to each network protocol in a certain historical feature record F, the network protocols with different acquisition frequencies are selected as detection protocols;

[0052] Step S220: The acquisition frequency corresponding to a certain detection protocol A in the target protocol combination is taken as H1, and the acquisition frequency corresponding to a certain feature record F is taken as H2; based on the acquisition frequency H1, the acquisition interval D1 between two adjacent acquisition points is obtained, and based on the acquisition frequency H2, the acquisition interval D2 between two adjacent acquisition points is obtained;

[0053] A collection frequency of a certain detection protocol A on a computer device is configured to be H1, and a collection duration is configured to be an integer multiple of D1. All applications and other network protocols on the computer device are stopped, and a first data collection test is performed on the certain detection protocol A on the computer device. A memory usage ratio at each moment in each collection cycle during the test is obtained, and for each collection cycle, an average value of the memory usage ratio is calculated at corresponding moments within the cycle. A first line graph of the memory usage ratio changing over time is created based on the average values.

[0054] Similarly, according to the collection frequency H2 and collection duration D2 corresponding to a certain detection protocol A, a second data collection test is performed on a certain detection protocol A on a computer device; and a second line graph showing the memory usage ratio changing over time is established.

[0055] Step S230: The maximum memory usage ratio in the first line graph is used as the characteristic value T1, and the maximum memory usage ratio in the second line graph is used as the characteristic value T2, and then the influence degree of network protocol A on memory usage in a certain characteristic record F is obtained: W F A =1-T1 / T2, and according to the corresponding impact of network protocol A in each feature record, calculate the average value to obtain the impact of network protocol A on memory usage W A ; And then get the impact of each network protocol on memory usage.

[0056] The purpose of testing here is to analyze the protocols with multiple historical feature records, summarize the experience, make the impact degree more representative and convincing, better analyze the impact of each network protocol on memory usage, and provide valuable experience for setting more reasonable collection strategies in the future.

[0057] Step S300: Generate corresponding monitoring records based on the memory usage at each historical moment recorded by the memory detection tool; and extract detection records from the monitoring records according to the alarm time corresponding to each alarm record in the monitoring records.

[0058] It should be noted that the purpose of intercepting the detection records here is: since the target protocol combination is only in the stage of judging whether the collection strategy is reasonable, that is, it is only an estimate, and in order to better illustrate the rationality of the current estimate, it is necessary to intercept a reasonable length of time from the historical monitoring records and contain as many feature records as possible as detection records, so as to increase the rationality of the current estimate.

[0059] Step S310: The minimum acquisition frequency corresponding to the historical network protocol is set as H3, and the acquisition interval D3 between two adjacent acquisition points is obtained based on the acquisition frequency H3; the minimum acquisition frequency in the network protocol corresponding to the target protocol combination is set as H4, and the acquisition interval D4 between two adjacent acquisition points is obtained based on the acquisition frequency H4;

[0060] Step S320: Set the feature duration to D = K*(D3+D4), where K is the feature coefficient, and K>1; randomly select M sub-monitoring records with a duration equal to D from the historical monitoring records, each sub-monitoring record contains several feature records, and the sub-monitoring record containing the largest number of feature records is used as the detection record.

[0061] In this solution, the interception time reasonably indicates that the length of the detection record should not be too long or too short. If it is too long, the calculation of the data may be too troublesome, and if it is too short, the data may be unrepresentative and not convincing enough. Instead, it should include as many feature records as possible. This is mainly because the memory usage is generally high in the detection records with many feature records. The following calculation resource usage values ​​can be used to analyze whether early warning prompts are given for the target protocol combination, providing strong data support.

[0062] Step S400: According to the memory detection tool, the memory occupancy ratio of each network protocol corresponding to each collection moment in the detection record is obtained, and the resource occupancy value of each collection moment is obtained according to the degree of impact, and according to the resource occupancy value, it is determined whether to issue an early warning prompt for the target protocol combination.

[0063] Step S410: Obtain the memory usage ratio of each network protocol corresponding to each collection moment in the detection record using the memory detection tool; obtain the memory usage ratio of each network protocol corresponding to a certain collection moment, and obtain the resource usage value at a certain collection moment based on the impact level of each network protocol: Where N is the number of network protocols, B n is the memory usage ratio of the nth network protocol at a certain collection moment, W n is the impact degree corresponding to the nth network protocol, and then the resource occupancy value at each collection moment in the detection record is obtained;

[0064] Step S420: If there are several consecutive resource occupancy values ​​in the detection record that are all outside the normal occupancy range, the several resource occupancy values ​​are regarded as an abnormal combination. If the number of abnormal combinations is greater than the quantity threshold, an early warning prompt is issued for the target protocol combination, and relevant personnel are prompted to redefine the collection strategy.

[0065] This solution also provides a multi-protocol data synchronous acquisition and analysis system based on big data, including a feature record extraction module, an impact degree determination module, a detection record interception module, and an early warning prompt module;

[0066] Feature Record Extraction Module: This module is used to obtain historical alarm records of computer devices. Alarm records are records of computer devices' memory usage being outside the normal range, as detected by memory detection tools deployed on the computer devices. The computer devices and various sensing devices transmit data via different network protocols. The module extracts and analyzes the memory usage of each network protocol corresponding to the alarm records, and then extracts feature records from the alarm records.

[0067] Impact Degree Determination Module: This module is used to determine the target protocol combination, formed by combining various network protocols according to their respective set collection frequencies. Based on the target protocol combination and feature records, it performs data collection tests on each network protocol on the computer device, and obtains the impact of each network protocol on memory usage based on the test results.

[0068] Detection record interception module: used to generate corresponding monitoring records based on the memory usage at each moment in history recorded by the memory detection tool; intercept detection records from the monitoring records according to the alarm time corresponding to each alarm record in the monitoring records;

[0069] Early warning prompt module: used to obtain the memory usage ratio of each network protocol corresponding to each collection moment in the detection record based on the memory detection tool, and obtain the resource usage value of each collection moment based on the degree of impact, and determine whether to issue an early warning prompt for the target protocol combination based on the resource usage value.

[0070] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above and that the invention can be embodied in other specific forms without departing from the spirit or essential characteristics of the invention. Therefore, the embodiments should be considered in all respects as illustrative and non-restrictive, and the scope of the invention is defined by the appended claims, not the foregoing description, and all variations within the meaning and range of equivalents of the claims are intended to be included therein. Any reference sign in a claim should not be construed as limiting the claim to which it relates.

Claims

1. A multi-protocol data synchronous acquisition and analysis method based on big data, characterized in that: The following steps are involved: Step S100: Acquire historical alarm records of the computer device. The alarm records are records of memory usage of the computer device being outside the normal range as monitored by a memory detection tool deployed on the computer device. The computer device and various sensing devices transmit data via different network protocols. The memory usage of each network protocol corresponding to the alarm records is extracted and analyzed, and feature records are extracted from the alarm records. Step S200: A combination of various network protocols according to their respective set collection frequencies is used as a target protocol combination; based on the target protocol combination and the feature records, a data collection test is performed on each network protocol on the computer device, and based on the test results, the impact of each network protocol on memory usage is obtained; Step S300: Generate a corresponding monitoring record based on the memory usage at each moment in history recorded by the memory detection tool; and extract a detection record from the monitoring record based on the alarm time corresponding to each alarm record in the monitoring record; Step S400: According to the memory detection tool, the memory occupancy ratio of each network protocol corresponding to each collection moment in the detection record is obtained, and according to the impact degree, the resource occupancy value of each collection moment is obtained, and according to the resource occupancy value, it is determined whether to issue an early warning prompt for the target protocol combination.

2. The multi-protocol data synchronous acquisition and analysis method based on big data according to claim 1 is characterized in that: Step S100 includes: Step S110: Obtain the normal memory usage range [0, R], where R is the maximum memory usage ratio preset by the system; obtain several historical alarm records of the computer device, and capture the alarm time, memory usage ratio, and collection frequency corresponding to each network protocol corresponding to each alarm record; Step S120: deploy a memory detection tool on the computer device, and use the memory detection tool to detect the memory ratio occupied by the computer device and the perception devices corresponding to each network protocol for data transmission at the alarm time corresponding to a certain alarm record; add up each occupied memory ratio corresponding to the certain alarm record to obtain a total occupied ratio; if the total occupied ratio is greater than a preset ratio threshold, the certain alarm record is used as a feature record, and then all feature records are obtained.

3. The multi-protocol data synchronous acquisition and analysis method based on big data according to claim 1 is characterized in that: Step S200 includes: Step S210: extracting the acquisition frequency corresponding to each network protocol in the target protocol combination; based on the acquisition frequency corresponding to each network protocol in the target protocol combination and the acquisition frequency corresponding to each network protocol in a certain historical feature record F, the network protocols with different acquisition frequencies are selected as detection protocols; Step S220: The acquisition frequency corresponding to a certain detection protocol A in the target protocol combination is taken as H1, and the acquisition frequency corresponding to the certain feature record F is taken as H2; based on the acquisition frequency H1, the acquisition interval D1 between two adjacent acquisition points is obtained, and based on the acquisition frequency H2, the acquisition interval D2 between two adjacent acquisition points is obtained; A collection frequency of a certain detection protocol A on a computer device is configured to be H1, and a collection duration is configured to be an integer multiple of D1. All applications and other network protocols on the computer device are stopped, and a first data collection test is performed on the certain detection protocol A on the computer device. A memory usage ratio at each moment in each collection cycle during the test is obtained, and for each collection cycle, an average value of the memory usage ratio is calculated at corresponding moments within the cycle. A first line graph of the memory usage ratio changing over time is created based on the average values. Similarly, based on the acquisition frequency H2 and acquisition duration D2 corresponding to a certain detection protocol A, a second data acquisition test is performed on a certain detection protocol A on a computer device; and a second line graph of the memory usage ratio changing over time is created; Step S230: The maximum memory usage ratio in the first line graph is used as the characteristic value T1, and the maximum memory usage ratio in the second line graph is used as the characteristic value T2, and then the influence degree of network protocol A on memory usage in a certain characteristic record F is obtained: W F A =1-T1 / T2, and according to the corresponding impact degree of network protocol A in each feature record, calculate the average value to obtain the impact degree W of the network protocol A on memory usage A ; And then get the impact of each network protocol on memory usage.

4. The multi-protocol data synchronous acquisition and analysis method based on big data according to claim 3 is characterized in that: Step S300 includes: Step S310: The minimum acquisition frequency corresponding to the historical network protocol is set as H3, and the acquisition interval D3 between two adjacent acquisition points is obtained based on the acquisition frequency H3; the minimum acquisition frequency in the network protocol corresponding to the target protocol combination is set as H4, and the acquisition interval D4 between two adjacent acquisition points is obtained based on the acquisition frequency H4; Step S320: Set the feature duration to D = K*(D3+D4), where K is the feature coefficient, and K>1; randomly select M sub-monitoring records with a duration equal to D from the historical monitoring records, each sub-monitoring record contains several feature records, and the sub-monitoring record containing the largest number of feature records is used as the detection record.

5. The multi-protocol data synchronous acquisition and analysis method based on big data according to claim 4 is characterized in that: Step S400 includes: Step S410: Obtain the memory usage ratio of each network protocol corresponding to each collection moment in the detection record using the memory detection tool; obtain the memory usage ratio of each network protocol corresponding to a certain collection moment, and obtain the resource usage value of the certain collection moment based on the impact level of each network protocol: Where N is the number of network protocols, B n is the memory usage ratio of the nth network protocol at the certain acquisition moment, W n is the impact degree corresponding to the nth network protocol, and then the resource occupancy value at each collection moment in the detection record is obtained; Step S420: If there are several consecutive resource occupancy values ​​in the detection record that are all outside the normal occupancy range, the several resource occupancy values ​​are regarded as an abnormal combination. If the number of abnormal combinations is greater than the quantity threshold, an early warning prompt is issued for the target protocol combination, and relevant personnel are prompted to redefine the collection strategy.

6. A multi-protocol data synchronous acquisition and analysis system, configured to execute the multi-protocol data synchronous acquisition and analysis method based on big data according to any one of claims 1 to 5, characterized in that: The system includes a feature record extraction module, an impact degree determination module, a detection record interception module and an early warning prompt module; Feature record extraction module: used to obtain historical alarm records of computer devices. The alarm records are records of computer device memory usage not being within the normal range, as monitored by memory detection tools deployed on the computer devices. The computer devices and various sensing devices transmit data via different network protocols. The module extracts and analyzes the memory usage of each network protocol corresponding to the alarm records, and then extracts feature records from the alarm records. Impact Degree Determination Module: This module is used to determine the target protocol combination, formed by combining various network protocols according to their respective set collection frequencies. Based on the target protocol combination and feature records, it performs data collection tests on each network protocol on the computer device, and obtains the impact of each network protocol on memory usage based on the test results. Detection record interception module: used to generate corresponding monitoring records based on the memory usage at each moment in history recorded by the memory detection tool; intercept detection records from the monitoring records according to the alarm time corresponding to each alarm record in the monitoring records; Early warning prompt module: used to obtain the memory occupancy ratio of each network protocol corresponding to each collection moment in the detection record based on the memory detection tool, and obtain the resource occupancy value of each collection moment based on the impact degree, and determine whether to issue an early warning prompt for the target protocol combination based on the resource occupancy value.

7. The multi-protocol data synchronous acquisition and analysis system according to claim 6, characterized in that: The impact degree determination module includes a detection protocol determination unit, a line graph establishment unit and an impact degree determination unit; Detection protocol determination unit: used to extract the acquisition frequency corresponding to each network protocol in the target protocol combination; based on the acquisition frequency corresponding to each network protocol in the target protocol combination and the acquisition frequency corresponding to each network protocol in the historical feature record, the network protocol with different acquisition frequencies is used as the detection protocol; A line graph establishing unit is used to establish a first line graph showing changes in the memory usage ratio over time based on the acquisition frequency corresponding to the detection protocol in the target protocol combination; and to establish a second line graph showing changes in the memory usage ratio over time based on the acquisition frequency corresponding to the detection protocol in the feature record; The impact degree determination unit is used to analyze the maximum memory usage ratio in the first line graph and the second line graph to obtain the impact degree of each network protocol on the memory usage.

8. The multi-protocol data synchronous acquisition and analysis system according to claim 7, characterized in that: The early warning prompt module includes a resource occupancy value calculation unit and an early warning prompt unit; A resource occupancy value calculation unit is configured to obtain, based on the memory detection tool, the memory occupancy ratio of each network protocol corresponding to each collection moment in the detection record, and obtain the resource occupancy value of each collection moment based on the impact degree; Early warning prompt unit: used to determine whether to issue an early warning prompt for the target protocol combination based on the resource occupancy value.

Images