A computer intelligent service management system and method based on network big data

Abstract

The present invention discloses a computer intelligent service management system and method based on network big data, belonging to the field of computer network security technology. The system includes a computer operation data acquisition module, a computer device grouping module, a bandwidth threshold generation module, a potential anomaly identification module, and an anomaly reporting and computer management module. The computer operation data acquisition module collects real-time bandwidth data of computer devices under an enterprise during use based on the SNMP protocol. The present invention discloses a computer intelligent service management system and method based on network big data. Based on the architecture of different enterprises, the system can perform specific grouping of enterprise computer devices, establish real-time dynamic bandwidth thresholds, and compare dynamic bandwidth curves to monitor the security of computer devices within different secondary groups during workdays, holidays, and overtime, and identify potential computer security anomalies, thereby enhancing the practicality and functionality of the system.

Description

Technical Field

[0001] The present invention belongs to the technical field of computer network security, and specifically relates to a computer intelligent service management system and method based on network big data. Background Art

[0002] With the rapid development of information technology, computers have become an indispensable infrastructure for modern corporate offices. Consequently, the network security issues facing corporate computer equipment have become increasingly complex and severe. DDoS attacks on key corporate computers are common. During DDoS attacks, a large amount of device bandwidth is occupied, leading to bandwidth anomalies.

[0003] In existing enterprise computer management processes, computer security monitoring and management are typically based on fixed thresholds to assess the security of computer equipment. However, different enterprise departments have different work schedules, and computer usage patterns and bandwidth characteristics vary significantly during different time periods, such as weekdays, weekends, and overtime. Fixed thresholds are difficult to account for various situations, and are prone to misjudgments and missed judgments, leading to management confusion and low practicality. Furthermore, faced with increasingly complex security attack methods, especially low-intensity DDoS network attacks, traditional computer management systems struggle to effectively identify them, resulting in low functionality.

[0004] In response to the above, this case proposes a computer intelligent service management system and method based on network big data to solve the above technical problems. Summary of the Invention

[0005] The present invention aims to solve at least one of the technical problems existing in the prior art. To this end, the present invention proposes a computer intelligent service management system and method based on network big data, which solves the above technical problems by improving the detection and processing methods.

[0006] In order to achieve the above object, the present invention adopts the following technical solutions:

[0007] A computer intelligent service management system and method based on network big data, including a computer operation data acquisition module, a computer device grouping module, a bandwidth threshold generation module, a potential anomaly identification module, and an anomaly reporting and computer management module;

[0008] The computer runs a data collection module that collects real-time bandwidth data of the computer equipment under the enterprise during use based on the SNMP protocol, collects historical bandwidth data of the computer equipment under the enterprise and the affiliated departments of the computer equipment under the enterprise, and transmits the data to subsequent modules;

[0009] The computer device grouping module creates files and groups computer devices under the organizational structure based on the enterprise architecture based on InfluxDB. A computer device file is created in each group. The file includes the computer device number, affiliated department, current computer device historical bandwidth big data, current computer device real-time bandwidth data collected, and collection time. Secondary grouping is performed based on the historical bandwidth big data of the computer devices under its jurisdiction.

[0010] The bandwidth threshold generation module generates a dynamic bandwidth threshold based on the real-time bandwidth data of computer devices in the same secondary group, performs real-time monitoring of the bandwidth of computer devices in the same secondary group and network security assessment based on the dynamic bandwidth threshold, identifies computer devices with abnormal network security and generates an abnormal signal;

[0011] The potential anomaly identification module analyzes the network bandwidth change data of computer devices in the same secondary group to obtain a reference bandwidth change curve, identifies potential network security anomalies of the computer devices in the same secondary group based on the reference bandwidth change curve, and generates an anomaly signal;

[0012] The abnormality reporting and computer management module includes an audible and visual alarm, which sends out an alarm signal in the form of sound, light, and vibration based on the received abnormal signal to remind the on-duty personnel to carry out comprehensive management of the abnormal computer.

[0013] Furthermore, the computer device grouping module creates files and groups computer devices under the organizational structure based on the enterprise architecture based on InfluxDB, and creates a computer device file in each group. The file includes the computer device number, affiliated department, current computer device historical bandwidth big data, current computer device real-time collected bandwidth data, and collection time. Secondary grouping is performed based on the historical bandwidth big data of the subordinate computer devices, including the following steps:

[0014] Establish computer equipment files for each department, group them into first-level groups based on the departments to which they belong, and group computer equipment from the same department into the same department group. The computer equipment file in each group contains the device number and department to which it belongs.

[0015] Collect historical bandwidth big data of computer equipment in each department group, use K-means clustering to perform secondary grouping of computer equipment in the first-level group based on the historical bandwidth big data, and record real-time bandwidth data into the computer equipment archive.

[0016] Furthermore, the historical bandwidth big data of computer devices in each department group is collected, and K-means clustering is used to perform secondary grouping of computer devices in the primary group based on the historical bandwidth big data. The specific steps are as follows:

[0017] Collect the historical bandwidth big data of each computer device in the first-level group as the feature vector, including the average bandwidth of the computer device, the peak bandwidth of the computer device, and the bandwidth standard deviation, and establish a multidimensional vector x i ={x i1 ,x i2 ,x i3}, where x i1 、x i2 、x i3 Respectively represent the average bandwidth, peak bandwidth, and bandwidth standard deviation of the i-th computer device;

[0018] The computer devices in the first-level group are divided into low, medium and high bandwidth usage intensity, and the number of clusters is set to υ = 3;

[0019] Randomly select the feature vectors of F computer devices from the data set as the initial centroids μ1, μ2, ..., μ F , for each computer device’s feature vector x i , based on the Euclidean distance algorithm, it is calculated with each centroid μ F distance, place the computer device x i Assigned to the cluster C corresponding to the nearest centroid F At the same time, for each cluster C F , recalculate its center of mass μ F , and its algorithm formula is:

[0020]

[0021] Among them, μ Fj The value of the centroid of the Fth cluster in the jth dimension, |C F | represents sample C in the Fth cluster F Quantity, x ij Represents the value of the i-th computer device in the j-th dimension;

[0022] Calculate the sum of the Euclidean distances D between the new and old centroids and compare them with the convergence threshold η:

[0023] When D < η, it means that the current algorithm converges and the clustering process ends. All computer devices in each first-level group are divided into different clusters to complete the second-level grouping. Each group is named low-bandwidth group, medium-bandwidth group, and high-bandwidth group.

[0024] When D≥η, it means that the current algorithm has not converged, and the Euclidean distance algorithm is used to calculate the distance between each centroid μ F distance, place the computer device x i Assigned to the cluster C corresponding to the nearest centroid FThe centroid is recalculated and the convergence threshold is compared and determined until the algorithm converges or the maximum number of iterations N is reached.

[0025] Furthermore, the bandwidth threshold generation module generates a dynamic bandwidth threshold based on the real-time bandwidth data of computer devices in the same secondary group, performs real-time monitoring of the bandwidth of computer devices in the same secondary group and network security determination based on the dynamic bandwidth threshold, identifies abnormal computer devices with network security, and generates abnormal signals. The specific steps are as follows:

[0026] For the same secondary group, including low-bandwidth group, medium-bandwidth group, and high-bandwidth group, real-time data extraction is performed on the computer device files in each secondary group to obtain the real-time bandwidth data of different computer devices in the current group and generate a real-time dynamic bandwidth threshold;

[0027] Based on the real-time dynamic bandwidth threshold, the bandwidth of computer devices in the same secondary group is monitored in real time and network security is determined. Computer devices with abnormal network security are identified and abnormal signals are generated, which are then sent to the abnormal reporting and computer management module.

[0028] Furthermore, for the same secondary group, including the low-bandwidth group, the medium-bandwidth group, and the high-bandwidth group, real-time data extraction is performed on the computer device files in each secondary group to obtain the real-time bandwidth data of different computer devices in the current group and generate a real-time dynamic bandwidth threshold. The specific steps are as follows:

[0029] At each time t, collect the real-time bandwidth data of each computer device in the secondary group Where i represents the computer device number in group K, e represents the data collection time in time period t, and the mean value ε of the bandwidth data of group K in time period t is calculated. K , and its algorithm formula is:

[0030]

[0031] Where N is the number of computer devices in group K, M is the number of data collection points in time period t, and based on the mean ε K Calculate the standard deviation σ K , obtain the real-time dynamic bandwidth threshold θ K =ε K +kσ K .

[0032] Furthermore, based on the real-time dynamic bandwidth threshold, the bandwidth of computer devices in the same secondary group is monitored in real time and network security is determined, computer devices with abnormal network security are identified and abnormal signals are generated, and the abnormal signals are sent to the abnormal reporting and computer management module. The specific steps are as follows:

[0033] In the next time period t, continue to collect real-time bandwidth data of computer devices in group K Represents the real-time bandwidth of computer device i at the new time l. Combined with the real-time dynamic bandwidth threshold, network security anomaly determination is performed on the computer devices in the current group. The steps are:

[0034] when When , it means that there is a network security anomaly in computer device i, the device number is extracted from the computer device file, and the anomaly signal is transmitted to the anomaly reporting and computer management module;

[0035] when When the real-time bandwidth data of each computer device in the secondary group is collected based on The real-time dynamic bandwidth threshold in the next time period t is calculated, and based on the real-time dynamic bandwidth threshold in the next time period t, a network security anomaly determination is made for the real-time bandwidth data in the next time period t.

[0036] Furthermore, the potential anomaly identification module analyzes the network bandwidth change data of computer devices in the same secondary group to obtain a baseline bandwidth change curve, identifies potential network security anomalies of the computer devices in the same secondary group based on the baseline bandwidth change curve, and generates an anomaly signal. The specific steps are as follows:

[0037] In each time interval [t0, t1], based on the computer device archives within the same secondary group, the real-time bandwidth data of the device during operation is extracted, and the bandwidth change curves of different computer devices in the group are calculated separately. The specific steps are as follows:

[0038] For the same secondary group G, the computer equipment in the group is H p , p=1,2,3,...,n, where n is the number of computer devices in the current group. In the time interval [t0,t1], the number of computer devices H p At time t ε The real-time bandwidth data under B p (t ε ), at time t ε The horizontal axis is the real-time bandwidth data B p (t ε ) is the vertical axis, and the bandwidth change curve y=B of each device is drawn. p (t ε );

[0039] Based on the bandwidth change curves of different computer devices in the group, at the end of each time interval [t0, t1], a similarity comparison is performed on the bandwidth change curves under the current time interval [t0, t1] to identify potential abnormal computer devices and determine network security anomalies.

[0040] Furthermore, based on the bandwidth change curves of different computer devices in the group, at the end of each time interval [t0, t1], a similarity comparison is performed on the bandwidth change curves in the current time interval [t0, t1] to identify potential abnormal computer devices and determine network security anomalies. The specific steps are as follows:

[0041] By using the Euclidean distance method, calculate the device H p With H q The Euclidean distance d of the bandwidth variation curve in the time interval [t0, t1] pq , and its algorithm formula is:

[0042]

[0043] For each device H in the group p , calculate the Euclidean distance between it and other computer devices respectively, and judge the Euclidean distance based on the similarity distance threshold θ. When the Euclidean distance is greater than θ, it means that the bandwidth change curves of the two computer devices are not similar;

[0044] When the device H p With the current group When the results of the Euclidean distance judgment of the computer devices are all greater than θ, the device H p A computer device marked as potentially abnormal indicates a network security anomaly. The device number is extracted from the computer device file and the abnormal signal is transmitted to the abnormality reporting and computer management module.

[0045] A computer intelligent service management method based on network big data includes the following steps:

[0046] S1. Collect real-time bandwidth data from the use of computer devices under the enterprise using the SNMP protocol. Collect historical bandwidth data from the enterprise's computer devices and the departments to which they belong. Create archives and group computer devices under the current enterprise organizational structure using InfluxDB.

[0047] S2. Create a computer device profile in each group. The profile includes the computer device number, department, current computer device historical bandwidth data, current computer device real-time bandwidth data, and collection time. Secondary grouping is performed based on the historical bandwidth data of the computer devices under the jurisdiction.

[0048] S3. Generate a dynamic bandwidth threshold based on the real-time bandwidth data of computer devices within the same secondary group. Perform real-time monitoring and network security assessment on the bandwidth of computer devices within the same secondary group based on the dynamic bandwidth threshold. Identify computer devices with abnormal network security and generate abnormal signals.

[0049] S4. Analyze the network bandwidth change data of computer devices in the same secondary group to obtain a baseline bandwidth change curve, identify potential network security anomalies of the computer devices in the same secondary group based on the baseline bandwidth change curve, and generate an anomaly signal;

[0050] S5. Based on the received abnormal signals of the computer equipment under the jurisdiction of the enterprise, an alarm signal is issued to display the abnormal computer equipment under the jurisdiction of the enterprise to remind the on-duty personnel to carry out comprehensive management of the abnormal computers.

[0051] Compared with the prior art, the present invention has the following beneficial effects:

[0052] 1. In the present invention, a bandwidth threshold generation module is provided to obtain real-time bandwidth data within the same group in a first time period and calculate a real-time dynamic bandwidth threshold to perform computer network security determinations on different devices within the same group in a second time period. The real-time dynamic bandwidth threshold is then continuously updated based on the real-time bandwidth data obtained in the second time period to perform network security determinations on different computer devices within the same group in a third time period. This cycle is repeated to achieve continuous real-time monitoring and management of the bandwidth of computer devices within the same group, thereby improving the accuracy of computer security determinations.

[0053] 2. In the present invention, the real-time dynamic bandwidth threshold is continuously updated through a rolling time window, which can promptly adapt to changes in different computer network environments and avoid the limitations of fixed thresholds. At the same time, the real-time dynamic threshold value is determined based on the real-time operation status of computer devices within the same secondary group. This can meet the computer security assessment and management requirements in different situations such as weekdays, weekends, and overtime. When the network environment changes, the real-time dynamic threshold is updated to quickly adjust to new usage patterns, thereby enhancing the functionality of the system.

[0054] 3. In the present invention, by setting up a potential anomaly identification module in conjunction with a bandwidth threshold generation module, bandwidth change curves are established for computer devices in the same secondary group within the same time interval, and pairwise comparisons are performed to identify and judge DDoS network attacks of low intensity, thereby identifying potential computer security anomalies and enhancing the practicality of the system;

[0055] 4. In the present invention, by combining historical bandwidth big data based on the enterprise architecture to divide computer devices under the same architecture into two levels, it is convenient to calculate the real-time dynamic bandwidth threshold within the two-level grouping under different circumstances, thereby realizing group monitoring and analysis of computer security under the enterprise architecture, and enhancing the accuracy of computer security anomaly identification;

[0056] The entire computer intelligent service management system and method based on network big data can specifically group enterprise computer equipment based on the architecture of different enterprises, establish real-time dynamic bandwidth thresholds, and compare dynamic bandwidth curves to monitor the security of computer equipment in different secondary groups on weekdays, holidays, and overtime, and identify potential computer security anomalies, thereby enhancing the practicality and functionality of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] Figure 1 This is a block diagram of a computer intelligent service management system based on network big data of the present invention;

[0058] Figure 2 This is a flow chart of a computer intelligent service management method based on network big data of the present invention. DETAILED DESCRIPTION

[0059] The technical solutions of the present invention will be clearly and completely described below in conjunction with the embodiments. Obviously, the embodiments described are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0060] Example 1:

[0061] like Figure 1 As shown, a computer intelligent service management system based on network big data includes a computer operation data acquisition module, a computer device grouping module, a bandwidth threshold generation module, a potential anomaly identification module, and an anomaly reporting and computer management module;

[0062] The computer operation data collection module collects real-time bandwidth data of the computer equipment under the enterprise during use based on the SNMP protocol, collects historical bandwidth data of the computer equipment under the enterprise and the affiliated departments of the computer equipment, and transmits the data to subsequent modules;

[0063] The computer equipment grouping module creates files and groups computer equipment under the organizational structure based on the enterprise architecture using InfluxDB. A computer equipment file is created in each group. The file includes the computer equipment number, affiliated department, current computer equipment historical bandwidth big data, current computer equipment real-time bandwidth data collected, and collection time. Secondary grouping is performed based on the historical bandwidth big data of the subordinate computer equipment, including the following steps:

[0064] Establish computer equipment files for each department, group them into first-level groups based on the departments to which they belong, and group computer equipment from the same department into the same department group. The computer equipment file in each group contains the device number and department to which it belongs.

[0065] Collect historical bandwidth big data of computer devices in each department group, use K-means clustering to group computer devices in the first-level group into second-level groups based on the historical bandwidth big data, and record real-time bandwidth data into the computer device archive;

[0066] Collect historical bandwidth data of devices in each department group. Based on this historical bandwidth data, use K-means clustering to group the devices in the first-level group into the second-level group. The specific steps are as follows:

[0067] Collect the historical bandwidth big data of each computer device in the first-level group as the feature vector, including the average bandwidth of the computer device, the peak bandwidth of the computer device, and the bandwidth standard deviation, and establish a multidimensional vector x i ={x i1 ,x i2 ,x i3}, where x i1 、x i2 、x i3 Respectively represent the average bandwidth, peak bandwidth, and bandwidth standard deviation of the i-th computer device;

[0068] The computer devices in the first-level group are divided into low, medium and high bandwidth usage intensity, and the number of clusters is set to υ = 3;

[0069] Randomly select the feature vectors of F computer devices from the data set as the initial centroids μ1, μ2, ..., μ F , for each computer device’s feature vector x i , based on the Euclidean distance algorithm, it is calculated with each centroid μ F distance, place the computer device x i Assigned to the cluster C corresponding to the nearest centroid F At the same time, for each cluster C F , recalculate its center of mass μ F , and its algorithm formula is:

[0070]

[0071] Among them, μ Fj The value of the centroid of the Fth cluster in the jth dimension, |C F | represents sample C in the Fth cluster F Quantity, x ij Represents the value of the i-th computer device in the j-th dimension;

[0072] It should be noted that the Euclidean distance is calculated with each centroid μ F The distance, the algorithm formula is:

[0073]

[0074] x i Assigned to the cluster C corresponding to the nearest centroid F In, that is, when When x i ∈C u .

[0075] Calculate the sum of the Euclidean distances D between the new and old centroids and compare them with the convergence threshold η:

[0076] When D < η, it means that the current algorithm converges and the clustering process ends. All computer devices in each first-level group are divided into different clusters to complete the second-level grouping. Each group is named low-bandwidth group, medium-bandwidth group, and high-bandwidth group.

[0077] When D≥η, it means that the current algorithm has not converged, and the Euclidean distance algorithm is used to calculate the distance between each centroid μ F distance, place the computer device x i Assigned to the cluster C corresponding to the nearest centroid F The centroid is recalculated and the convergence threshold is compared and determined until the algorithm converges or the maximum number of iterations N is reached.

[0078] It should be noted that in the K-means clustering algorithm, the centroid is the center of each cluster and is used to represent the location of the cluster. F | is an integer used to calculate the average value. The convergence threshold η is generally set to 0.01, and can also be set through empirical methods according to actual usage needs. The maximum number of iterations N is set to 15, and can also be increased or decreased according to actual usage.

[0079] Example 2:

[0080] The bandwidth threshold generation module generates a dynamic bandwidth threshold based on the real-time bandwidth data of computer devices in the same secondary group. Based on the dynamic bandwidth threshold, the bandwidth of computer devices in the same secondary group is monitored in real time and network security is determined. The module identifies abnormal computer devices with network security and generates abnormal signals. The specific steps are as follows:

[0081] For the same secondary group, including low-bandwidth group, medium-bandwidth group, and high-bandwidth group, real-time data extraction is performed on the computer device files in each secondary group to obtain the real-time bandwidth data of different computer devices in the current group and generate a real-time dynamic bandwidth threshold. The specific steps are as follows:

[0082] At each time t, collect the real-time bandwidth data of each computer device in the secondary group Where i represents the computer device number in group K, e represents the data collection time in time period t, and the mean value ε of the bandwidth data of group K in time period t is calculated. K , and its algorithm formula is:

[0083]

[0084] Where N is the number of computer devices in group K, M is the number of data collection points in time period t, and based on the mean ε K Calculate the standard deviation σ K , obtain the real-time dynamic bandwidth threshold θ K =ε K +kσ K .

[0085] It should be noted that, at the dynamic bandwidth threshold θ K =ε K +kσ K The value of k is set to 1.5. By adjusting the value of k, the degree of flexibility of the dynamic bandwidth threshold can be controlled. The time period t needs to be set according to the working hours of various departments of the relevant enterprise. It is usually set to 5 minutes and can be adjusted according to actual conditions.

[0086] Based on the real-time dynamic bandwidth threshold, the bandwidth of computer devices in the same secondary group is monitored in real time and network security is determined. Computer devices with network security anomalies are identified and anomaly signals are generated. The anomaly signals are sent to the anomaly reporting and computer management module. The specific steps are as follows:

[0087] In the next time period t, continue to collect real-time bandwidth data of computer devices in group K Represents the real-time bandwidth of computer device i at the new time l. Combined with the real-time dynamic bandwidth threshold, network security anomaly determination is performed on the computer devices in the current group. The steps are:

[0088] when When , it means that there is a network security anomaly in computer device i, the device number is extracted from the computer device file, and the anomaly signal is transmitted to the anomaly reporting and computer management module;

[0089] when When the real-time bandwidth data of each computer device in the secondary group is collected based on The real-time dynamic bandwidth threshold in the next time period t is calculated, and based on the real-time dynamic bandwidth threshold in the next time period t, a network security anomaly determination is made for the real-time bandwidth data in the next time period t.

[0090] It should be noted that by obtaining real-time bandwidth data within the same group in the first time period t and calculating the real-time dynamic bandwidth threshold, network security determination is performed on different devices in the same group in the second time period t. The real-time dynamic bandwidth threshold is further updated based on the real-time bandwidth data obtained in the second time period t to perform network security determination on different devices in the same group in the third time period t. This cycle is repeated to achieve continuous real-time monitoring of the bandwidth of devices in the same group, thereby improving the accuracy of network security determination. In addition, based on the working conditions of enterprises in different situations, the operating devices in the same secondary group on weekdays, weekends, and during department overtime are used as the benchmark conditions for generating the real-time dynamic threshold, thereby adapting to different actual usage conditions.

[0091] Example 3:

[0092] The potential anomaly identification module analyzes the network bandwidth change data of computer devices in the same secondary group to obtain a baseline bandwidth change curve. Based on the baseline bandwidth change curve, the module identifies potential network security anomalies of computer devices in the same secondary group. The specific steps are as follows:

[0093] In each time interval [t0, t1], based on the computer device archives within the same secondary group, the real-time bandwidth data of the device during operation is extracted, and the bandwidth change curves of different computer devices in the group are calculated separately. The specific steps are as follows:

[0094] For the same secondary group G, the computer equipment in the group is H p , p=1,2,3,...,n, where n is the number of computer devices in the current group. In the time interval [t0,t1], the number of computer devices H p At time t ε The real-time bandwidth data under B p (t ε ), at time t ε The horizontal axis is the real-time bandwidth data B p(t ε ) is the vertical axis, and the bandwidth change curve y=B of each device is drawn. p (t ε );

[0095] Based on the bandwidth change curves of different computer devices in the group, at the end of each time interval [t0, t1], the bandwidth change curves at the current time interval [t0, t1] are compared for similarity to identify potential abnormal computer devices and determine network security anomalies. The specific steps are as follows:

[0096] By using the Euclidean distance method, calculate the device H p With H q The Euclidean distance d of the bandwidth variation curve in the time interval [t0, t1] pq , and its algorithm formula is:

[0097]

[0098] For each device H in the group p , calculate the Euclidean distance between it and other computer devices respectively, and judge the Euclidean distance based on the similarity distance threshold θ. When the Euclidean distance is greater than θ, it means that the bandwidth change curves of the two computer devices are not similar;

[0099] When the device H p With the current group When the results of the Euclidean distance judgment of the computer devices are all greater than θ, the device H p A computer device marked as potentially abnormal indicates a network security anomaly. The device number is extracted from the computer device file and the abnormal signal is transmitted to the abnormality reporting and computer management module.

[0100] It should be noted that if the bandwidth change curves of one or more devices in the same time interval differ significantly from those of most devices in the current time interval, this indicates that the current device may be under a low-intensity DDOS network attack. This device will be marked as an abnormal device to identify potential network security anomalies. The similarity distance threshold θ needs to be set based on experience and consultation with experts in related fields, combined with the current department's device and software usage.

[0101] The abnormality reporting and computer management module includes an audible and visual alarm, which sends out alarm signals in the form of sound, light, and vibration based on the received abnormal signals to remind the on-duty personnel to carry out comprehensive management of the abnormal computers.

[0102] Example 4:

[0103] like Figure 2As shown, a computer intelligent service management method based on network big data includes the following steps:

[0104] S1. Collect real-time bandwidth data from the use of computer devices under the enterprise using the SNMP protocol. Collect historical bandwidth data from the enterprise's computer devices and the departments to which they belong. Create archives and group computer devices under the current enterprise organizational structure using InfluxDB.

[0105] S2. Create a computer device profile in each group. The profile includes the computer device number, department, current computer device historical bandwidth data, current computer device real-time bandwidth data, and collection time. Secondary grouping is performed based on the historical bandwidth data of the computer devices under the jurisdiction.

[0106] S3. Generate a dynamic bandwidth threshold based on the real-time bandwidth data of computer devices within the same secondary group. Perform real-time monitoring and network security assessment on the bandwidth of computer devices within the same secondary group based on the dynamic bandwidth threshold. Identify computer devices with abnormal network security and generate abnormal signals.

[0107] S4. Analyze the network bandwidth change data of computer devices in the same secondary group to obtain a baseline bandwidth change curve, identify potential network security anomalies of the computer devices in the same secondary group based on the baseline bandwidth change curve, and generate an anomaly signal;

[0108] S5. Based on the received abnormal signals of the computer equipment under the jurisdiction of the enterprise, an alarm signal is issued to display the abnormal computer equipment under the jurisdiction of the enterprise to remind the on-duty personnel to carry out comprehensive management of the abnormal computers.

[0109] In the embodiments provided by the present invention, it should be understood that the disclosed devices, apparatuses, and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative. For example, the module division is merely a logical functional division, and other division methods may be used in actual implementation. The modules described as separate components may or may not be physically separate, and the components displayed as modules may or may not be physical units, that is, they may be located in one place or distributed across multiple network elements. Some or all of the modules may be selected according to actual needs to achieve the purpose of the method of this embodiment.

[0110] The above embodiments are only used to illustrate the technical method of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical method of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical method of the present invention.

Claims

1. A computer intelligent service management system based on network big data, characterized by: It includes computer operation data acquisition module, computer equipment grouping module, bandwidth threshold generation module, potential anomaly identification module, anomaly reporting and computer management module; The computer runs a data collection module that collects real-time bandwidth data of the computer equipment under the enterprise during use based on the SNMP protocol, collects historical bandwidth data of the computer equipment under the enterprise and the affiliated departments of the computer equipment under the enterprise, and transmits the data to subsequent modules; The computer device grouping module creates files and groups computer devices under the organizational structure based on the enterprise architecture based on InfluxDB. A computer device file is created in each group. The file includes the computer device number, affiliated department, current computer device historical bandwidth big data, current computer device real-time bandwidth data collected, and collection time. Secondary grouping is performed based on the historical bandwidth big data of the computer devices under its jurisdiction. The bandwidth threshold generation module generates a dynamic bandwidth threshold based on the real-time bandwidth data of computer devices in the same secondary group, performs real-time monitoring of the bandwidth of computer devices in the same secondary group and network security assessment based on the dynamic bandwidth threshold, identifies computer devices with abnormal network security and generates an abnormal signal; The potential anomaly identification module analyzes the network bandwidth change data of computer devices in the same secondary group to obtain a baseline bandwidth change curve, identifies potential network security anomalies of the computer devices in the same secondary group based on the baseline bandwidth change curve, and generates an anomaly signal. The specific steps are as follows: In each time interval [t0, t1], based on the computer device archives within the same secondary group, the real-time bandwidth data of the device during operation is extracted, and the bandwidth change curves of different computer devices in the group are calculated separately. The specific steps are as follows: For the same secondary group G, the computer equipment in the group is H p , p=1,2,3,...,n, where n is the number of computer devices in the current group. In the time interval [t0,t1], the number of computer devices H p At time t ε The real-time bandwidth data under B p (t ε ), at time t ε The horizontal axis is the real-time bandwidth data B p (t ε ) is the vertical axis, and the bandwidth change curve y=B of each device is drawn. p (t ε ); Based on the bandwidth change curves of different computer devices in the group, at the end of each time interval [t0, t1], the bandwidth change curves at the current time interval [t0, t1] are compared for similarity to identify potential abnormal computer devices and determine network security anomalies; The abnormality reporting and computer management module includes an audible and visual alarm, which sends out an alarm signal in the form of sound, light, and vibration based on the received abnormal signal to remind the on-duty personnel to carry out comprehensive management of the abnormal computer.

2. A computer intelligent service management system based on network big data according to claim 1, characterized in that: The computer device grouping module creates files and groups computer devices under the organizational structure based on the enterprise architecture using InfluxDB. A computer device file is created in each group. The file includes the computer device number, affiliated department, current computer device historical bandwidth big data, current computer device real-time bandwidth data collected, and collection time. Secondary grouping is performed based on the historical bandwidth big data of the subordinate computer devices, including the following steps: Establish computer equipment files for each department, group them into first-level groups based on the departments to which they belong, and group computer equipment from the same department into the same department group. The computer equipment file in each group contains the device number and department to which it belongs. Collect historical bandwidth big data of computer equipment in each department group, use K-means clustering to perform secondary grouping of computer equipment in the first-level group based on the historical bandwidth big data, and record real-time bandwidth data into the computer equipment archive.

3. A computer intelligent service management system based on network big data according to claim 2, characterized in that: The historical bandwidth big data of computer devices in each department group is collected, and K-means clustering is used to perform secondary grouping of computer devices in the primary group based on the historical bandwidth big data. The specific steps are as follows: Collect the historical bandwidth big data of each computer device in the first-level group as the feature vector, including the average bandwidth of the computer device, the peak bandwidth of the computer device, and the bandwidth standard deviation, and establish a multidimensional vector x i ={x i1 ,x i2 ,x i3 }, where x i1 、x i2 、x i3 Respectively represent the average bandwidth, peak bandwidth, and bandwidth standard deviation of the i-th computer device; The computer devices in the first-level group are divided into low, medium and high bandwidth usage intensity, and the number of clusters is set to υ = 3; Randomly select the feature vectors of F computer devices from the data set as the initial centroids μ1, μ2, ..., μ F , for each computer device x i The feature vector is calculated based on the Euclidean distance algorithm between it and each centroid μ F distance, place the computer device x i Assigned to the cluster C corresponding to the nearest centroid F At the same time, for each cluster C F , recalculate its center of mass μ F , and its algorithm formula is: Among them, μ Fj The value of the centroid of the Fth cluster in the jth dimension, |C F | represents sample C in the Fth cluster F Quantity, x ij Represents the value of the i-th computer device in the j-th dimension; Calculate the sum of the Euclidean distances D between the new and old centroids and compare them with the convergence threshold η: When D < η, it means that the current algorithm converges and the clustering process ends. All computer devices in each first-level group are divided into different clusters to complete the second-level grouping. Each group is named low-bandwidth group, medium-bandwidth group, and high-bandwidth group. When D≥η, it means that the current algorithm has not converged, and the Euclidean distance algorithm is used to calculate the distance between each centroid μ F distance, place the computer device x i Assigned to the cluster C corresponding to the nearest centroid F The centroid is recalculated and the convergence threshold is compared and determined until the algorithm converges or the maximum number of iterations N is reached.

4. The computer intelligent service management system based on network big data according to claim 2, characterized in that: The bandwidth threshold generation module generates a dynamic bandwidth threshold based on the real-time bandwidth data of computer devices in the same secondary group. Based on the dynamic bandwidth threshold, the bandwidth of computer devices in the same secondary group is monitored in real time and network security is determined. The module identifies abnormal computer devices with network security and generates abnormal signals. The specific steps are as follows: For the same secondary group, including low-bandwidth group, medium-bandwidth group, and high-bandwidth group, real-time data extraction is performed on the computer device files in each secondary group to obtain the real-time bandwidth data of different computer devices in the current group and generate a real-time dynamic bandwidth threshold; Based on the real-time dynamic bandwidth threshold, the bandwidth of computer devices in the same secondary group is monitored in real time and network security is determined. Computer devices with abnormal network security are identified and abnormal signals are generated, which are then sent to the abnormal reporting and computer management module.

5. A computer intelligent service management system based on network big data according to claim 4, characterized in that: For the same secondary group, including the low-bandwidth group, the medium-bandwidth group, and the high-bandwidth group, real-time data extraction is performed on the computer device files in each secondary group to obtain the real-time bandwidth data of different computer devices in the current group and generate a real-time dynamic bandwidth threshold. The specific steps are as follows: At each time t, collect the real-time bandwidth data of each computer device in the secondary group Where i represents the computer device number in group K, e represents the data collection time in time period t, and the mean value ε of the bandwidth data of group K in time period t is calculated. K , and its algorithm formula is: Where N is the number of computer devices in group K, M is the number of data collection points in time period t, and based on the mean ε K Calculate the standard deviation σ K , obtain the real-time dynamic bandwidth threshold θ K =ε K +kσ K .

6. A computer intelligent service management system based on network big data according to claim 5, characterized in that: Based on the real-time dynamic bandwidth threshold, the bandwidth of computer devices in the same secondary group is monitored in real time and network security is determined. Computer devices with abnormal network security are identified and abnormal signals are generated. The abnormal signals are sent to the abnormal reporting and computer management module. The specific steps are as follows: In the next time period t, continue to collect real-time bandwidth data of computer devices in group K Represents the real-time bandwidth of computer device i at the new time l. Combined with the real-time dynamic bandwidth threshold, network security anomaly determination is performed on the computer devices in the current group. The steps are: when When , it means that there is a network security anomaly in computer device i, the device number is extracted from the computer device file, and the anomaly signal is transmitted to the anomaly reporting and computer management module; when When the real-time bandwidth data of each computer device in the secondary group is collected based on The real-time dynamic bandwidth threshold in the next time period t is calculated, and based on the real-time dynamic bandwidth threshold in the next time period t, a network security anomaly determination is made for the real-time bandwidth data in the next time period t.

7. The computer intelligent service management system based on network big data according to claim 1, characterized in that: Based on the bandwidth change curves of different computer devices in the group, at the end of each time interval [t0, t1], a similarity comparison is performed on the bandwidth change curves in the current time interval [t0, t1] to identify potential abnormal computer devices and determine network security anomalies. The specific steps are: By using the Euclidean distance method, calculate the device H p With H q The Euclidean distance d of the bandwidth variation curve in the time interval [t0, t1] pq , and its algorithm formula is: For each device H in the group p , calculate the Euclidean distance between it and other computer devices respectively, and judge the Euclidean distance based on the similarity distance threshold θ. When the Euclidean distance is greater than θ, it means that the bandwidth change curves of the two computer devices are not similar; When the device H p With the current group When the results of the Euclidean distance judgment of the computer devices are all greater than θ, the device H p A computer device marked as potentially abnormal indicates a network security anomaly. The device number is extracted from the computer device file and the abnormal signal is transmitted to the abnormality reporting and computer management module.

8. A computer intelligent service management method based on network big data, characterized in that: The method adopts the computer intelligent service management system based on network big data according to any one of claims 1 to 7, comprising the following steps: S1. Collect real-time bandwidth data from the use of computer devices under the enterprise using the SNMP protocol. Collect historical bandwidth data from the enterprise's computer devices and the departments to which they belong. Create archives and group computer devices under the current enterprise organizational structure using InfluxDB. S2. Create a computer device profile in each group. The profile includes the computer device number, department, current computer device historical bandwidth data, current computer device real-time bandwidth data, and collection time. Secondary grouping is performed based on the historical bandwidth data of the computer devices under the jurisdiction. S3. Generate a dynamic bandwidth threshold based on the real-time bandwidth data of computer devices within the same secondary group. Perform real-time monitoring and network security assessment on the bandwidth of computer devices within the same secondary group based on the dynamic bandwidth threshold. Identify computer devices with abnormal network security and generate abnormal signals. S4. Analyze the network bandwidth change data of computer devices in the same secondary group to obtain a baseline bandwidth change curve, identify potential network security anomalies of the computer devices in the same secondary group based on the baseline bandwidth change curve, and generate an anomaly signal; S5. Based on the received abnormal signals of the computer equipment under the jurisdiction of the enterprise, an alarm signal is issued to display the abnormal computer equipment under the jurisdiction of the enterprise to remind the on-duty personnel to carry out comprehensive management of the abnormal computers.

Images