Method, device, equipment and storage medium for identifying abnormal nodes in computing power network

Abstract

The present invention relates to the field of network security technology, and discloses a method, device, equipment and storage medium for identifying abnormal nodes in a computing power network. The method for identifying abnormal nodes in a computing power network includes: constructing a network topology map based on the node information of each node and the link information of each link in the current computing power network; extracting the graph structure characteristics and communication behavior characteristics of the node to be tested based on the graph structure of the network topology map; obtaining a normal node feature distribution model, and calculating the deviation of the node to be tested based on the normal node feature distribution model, graph structure characteristics and communication behavior characteristics; identifying the node to be tested whose deviation is greater than a preset deviation threshold as an abnormal node. The present invention can effectively identify abnormal nodes in a computing power network through the fusion of graph structure modeling and multi-dimensional features, improves the accuracy and real-time performance of abnormal identification, provides a precise decision-making basis for abnormal node positioning and subsequent repair, and is conducive to ensuring the safe and stable operation of the computing power network.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a method, device, equipment and storage medium for identifying abnormal nodes in a computing power network. Background Art

[0002] Compute First Networking is a network architecture built on distributed computing resources. By distributing computing resources across various nodes in the network, it leverages collaboration and communication between nodes to achieve efficient computing and data processing. Each node possesses a certain level of computing power and storage capacity, allowing it to independently execute computing tasks. These nodes can be physical servers, virtual machines, containers, edge devices, or other computing resources, interconnected by high-speed networks, forming a highly dynamic and scalable computing environment.

[0003] However, during the operation of the computing network, due to the strong resource dependence of the services in the network nodes and the imbalance of the network nodes' own resource allocation, some nodes may experience anomalies due to factors such as hardware failure, software vulnerabilities, or malicious attacks. These abnormal nodes may spread erroneous data, consume excessive resources, or deny service, posing a serious threat to the normal operation of the computing network and causing a decline in the performance and reliability of the entire computing network. Therefore, timely and accurate identification of these abnormal nodes is crucial to maintaining the stability and security of the computing network.

[0004] At present, the identification of abnormal nodes in computing power networks usually adopts threshold detection, machine learning model detection, statistical analysis, log analysis or traffic monitoring. For example, the performance indicators of nodes in the network are used to detect anomalies by comparing performance indicators with preset thresholds; machine learning models are used to train and predict node behavior and identify abnormal patterns; statistical analysis methods are used to analyze the trends of node performance data and discover abnormal fluctuations; log analysis technology is used to mine abnormal information in node operation logs; and traffic monitoring means are used to monitor data transmission behavior between nodes in real time and identify abnormal traffic patterns. However, these methods do not effectively model the special behavioral characteristics of computing network nodes, such as dynamic characteristics such as resource allocation and task scheduling. Moreover, since most abnormal nodes are hidden or malicious, it is difficult to accurately identify anomalies through data packets and communication behaviors between nodes, resulting in insufficient adaptability to computing network scenarios. It is easy to lose dynamic interactive information such as real-time communication frequency and data transmission volume changes between nodes. The sensitivity to real-time load changes of nodes is low, anomaly identification has a lag, and it is difficult to detect sudden anomalies in a timely manner. In addition, these methods have limited generalization capabilities when dealing with nodes with more multi-dimensional heterogeneous characteristics, and the recognition accuracy of new anomaly patterns is also low. Summary of the Invention

[0005] The main purpose of the present invention is to provide a method, device, equipment and storage medium for identifying abnormal nodes in a computing power network, aiming to solve the technical problem of low accuracy in identifying abnormal nodes in a computing power network.

[0006] A first aspect of the present invention provides a method for identifying abnormal nodes in a computing power network, the method comprising: constructing a network topology diagram based on the node information of each node and the link information of each link in the current computing power network; extracting the graph structure features and communication behavior features of the node to be tested based on the graph structure of the network topology diagram; obtaining a normal node feature distribution model, and calculating the deviation of the node to be tested based on the normal node feature distribution model, the graph structure features and the communication behavior features; identifying the node to be tested whose deviation is greater than a preset deviation threshold as an abnormal node.

[0007] Optionally, in a first implementation method of the first aspect of the present invention, the network topology graph is constructed based on the node information of each node and the link information of each link in the current computing power network, including: after receiving periodic polling instructions and / or event-driven instructions, collecting the node information of each node and the link information of each link in the current computing power network; preprocessing the node information and the link information, and the preprocessing includes at least one of data cleaning, normalization and dimensionality reduction; creating a graph structure class, and storing the node information of each node and the associated link information through the graph structure class to obtain the graph structure; based on the graph structure, mapping each node to a vertex, and mapping each link to an edge to construct the network topology graph.

[0008] Optionally, in a second implementation method of the first aspect of the present invention, the graph structure characteristics include node degree, node centrality and node clustering coefficient, and the communication behavior characteristics include communication frequency, data transmission volume and response time; the graph structure based on the network topology graph is used to extract the graph structure characteristics and communication behavior characteristics of the node to be tested, including: counting the total number of adjacent nodes directly connected to the node to be tested in the network topology graph to obtain the node degree; calculating the influence weight of the node to be tested in the network topology graph to obtain the node centrality; counting the actual number of connection edges between all adjacent nodes of the node to be tested, and calculating the proportion of the actual number of connection edges to the maximum number of connectable edges between each adjacent node to obtain the node clustering coefficient; counting the number of communication interactions between the node to be tested and each adjacent node within a preset unit time to obtain the communication frequency; calculating the total number of data packets sent or received by the node to be tested within the preset unit time to obtain the data transmission volume; calculating the average delay time from receiving data to sending data of the node to be tested to obtain the response time.

[0009] Optionally, in a third implementation of the first aspect of the present invention, the obtaining of a normal node feature distribution model and the calculation of the deviation of the node to be tested based on the normal node feature distribution model, the graph structure features and the communication behavior features include: performing statistical analysis or machine learning analysis on historical normal nodes to obtain the normal node feature distribution model, the normal node feature distribution model including normal graph structure features and normal communication behavior features; generating a normal node feature vector based on the normal graph structure features and the normal communication behavior features; clustering the normal node feature vectors to obtain at least one cluster center of the historical normal node in the network topology graph; generating a feature vector of the node to be tested based on the graph structure features and the communication behavior features of the node to be tested; and calculating the distance between the feature vector of the node to be tested and the nearest cluster center to obtain the deviation.

[0010] Optionally, in the fourth implementation method of the first aspect of the present invention, after the node to be tested whose deviation is greater than the preset deviation threshold is identified as an abnormal node, it also includes: monitoring whether there is abnormal data in the real-time response event data, communication records and data flow data of the node to be tested, and if there is abnormal data, confirming that the node to be tested is an abnormal node; judging whether each adjacent node of the node to be tested is identified as an abnormal node, and if there is an adjacent node identified as an abnormal node, confirming that the node to be tested is an abnormal node; otherwise, marking the node to be tested as a normal node.

[0011] Optionally, in the fifth implementation of the first aspect of the present invention, after identifying the node to be tested whose deviation is greater than a preset deviation threshold as an abnormal node, it also includes: evaluating the abnormal score of the abnormal node based on the deviation of the abnormal node, the average network connectivity, the feature reference threshold and the abnormal association status of the adjacent nodes; judging the abnormal level of the abnormal node based on the score range in which the abnormal score is located; and configuring the response rules and response priority of the abnormal node based on the abnormal level.

[0012] Optionally, in the sixth implementation method of the first aspect of the present invention, after identifying the node to be tested whose deviation is greater than the preset deviation threshold as an abnormal node, it also includes: marking the abnormal pattern, abnormal type and countermeasures of the abnormal node to form a training data set or an abnormal node knowledge base, the abnormal pattern includes the graph structure characteristics and the communication behavior characteristics of the abnormal node; training a preset target recognition model based on the training data set, or connecting the abnormal node knowledge base to a preset retrieval enhancement generation model to obtain an abnormal location model for abnormal node identification based on the abnormal location model.

[0013] The second aspect of the present invention also provides a computing power network abnormal node identification device, the computing power network abnormal node identification device includes: a construction module, which is used to construct a network topology map based on the node information of each node and the link information of each link in the current computing power network; an extraction module, which is used to extract the graph structure characteristics and communication behavior characteristics of the node to be tested based on the graph structure of the network topology map; a calculation module, which is used to obtain a normal node feature distribution model, and calculate the deviation of the node to be tested based on the normal node feature distribution model, the graph structure characteristics and the communication behavior characteristics; a processing module, which is used to identify the node to be tested whose deviation is greater than a preset deviation threshold as an abnormal node.

[0014] The third aspect of the present invention also provides a computer device, which includes: a memory and at least one processor, wherein the memory stores instructions; the at least one processor calls the instructions in the memory so that the computer device executes the method for identifying abnormal nodes in the computing power network as described above.

[0015] A fourth aspect of the present invention further provides a computer-readable storage medium having instructions stored thereon, which, when executed by a processor, implement the method for identifying abnormal nodes in a computing power network as described above.

[0016] An embodiment of the present invention provides a method, apparatus, device and storage medium for identifying abnormal nodes in a computing power network. The method first constructs a network topology map based on the node information of each node and the link information of each link in the current computing power network, and then extracts the graph structure characteristics and communication behavior characteristics of the node to be tested based on the graph structure of the network topology map. The graph structure characteristics and communication behavior characteristics are combined with the obtained normal node feature distribution model to calculate the deviation of the node to be tested. Finally, the node to be tested whose deviation is greater than a preset deviation threshold is identified as an abnormal node. In this way, the present invention can effectively model the multi-dimensional dynamic characteristics of the computing power network nodes, and the constructed network topology map can provide an intuitive network behavior analysis method, more comprehensively reflect the structural characteristics and behavior patterns of the nodes in the network, improve the processing and generalization capabilities of high-dimensional heterogeneous features in the computing power network, and make abnormality identification more accurate and real-time. At the same time, by quantifying the degree of anomaly through deviation, real-time and accurate detection of anomalies such as hardware failures and malicious attacks is also achieved. The quantified deviation results are more convenient for locating and handling abnormal events, and provide accurate decision-making basis for abnormal node positioning and subsequent network optimization and security protection. It can shorten the recognition lag, improve network operation and maintenance efficiency, avoid network performance degradation and security issues caused by abnormal nodes, and help ensure the safe and stable operation of the computing power network. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1This is a flow chart of an embodiment of a method for identifying abnormal nodes in a computing power network according to an embodiment of the present invention;

[0018] Figure 2 for Figure 1 A schematic flow chart of an embodiment of step 101 in the embodiment;

[0019] Figure 3 for Figure 1 A schematic flow chart of an embodiment of step 102 in the embodiment;

[0020] Figure 4 for Figure 1 A schematic flow chart of an embodiment of step 103 in the embodiment;

[0021] Figure 5 for Figure 1 A schematic flow chart of the first embodiment after step 104 in the embodiment;

[0022] Figure 6 for Figure 1 A schematic flow chart of a second embodiment after step 104 in the embodiment;

[0023] Figure 7 for Figure 1 A schematic flow chart of a third embodiment after step 104 in the embodiment;

[0024] Figure 8 This is a functional module diagram of an embodiment of a device for identifying abnormal nodes in a computing power network according to an embodiment of the present invention;

[0025] Figure 9 This is a schematic diagram of the functional modules of a computer device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0026] The terms "first," "second," "third," "fourth," and so forth (if any) in the description and claims of the present invention and in the accompanying drawings are used to distinguish similar items and are not necessarily used to describe a particular order or precedence. It should be understood that the terms used in this manner are interchangeable where appropriate, so that the embodiments described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "including" or "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product, or apparatus that includes a series of steps or elements is not necessarily limited to those steps or elements expressly listed, but may include other steps or elements not expressly listed or inherent to such process, method, product, or apparatus.

[0027] For ease of understanding, the specific process of the method for identifying abnormal nodes in a computing network according to an embodiment of the present invention is described below. Figure 1 , Figure 1 This is a flow chart of a first embodiment of a method for identifying abnormal nodes in a computing power network according to an embodiment of the present invention. In this embodiment, the method for identifying abnormal nodes in a computing power network includes:

[0028] 101. Based on the node information of each node and the link information of each link in the current computing power network, a network topology diagram is constructed;

[0029] In this embodiment, the current computing network is the network environment of current concern and requires abnormal node identification. The computing network includes multiple nodes and communication links connecting these nodes. Each node and link is interconnected, forming a complex network structure. Among them, each node includes a series of node information, which can specifically cover basic attributes such as node identity, node type and hardware configuration, status attributes such as processor utilization, memory occupancy, load status and online time, as well as business attributes such as the type of service carried, task scheduling priority, computing frequency and processed data volume. The link information of each link involves connection attributes such as the link identity, source node identity, destination node identity and link physical type, performance attributes such as bandwidth, latency, packet loss rate and transmission rate, and traffic attributes such as the amount of data flowing upstream or downstream per unit time and the direction of data flow in one direction or two directions. This information can be provided by the node's built-in or external network management system (NMS), distributed monitoring system (DMS), etc., or can be obtained through technologies such as traffic mirroring, network flow sampling or network management protocol, or calculated through communication pattern analysis methods such as traffic statistics and time series analysis. Only part of the node information and link information associated with the node to be detected is needed to construct a network topology diagram (Network Topology) and subsequent anomaly analysis.

[0030] In this embodiment, the location and basic properties of nodes in the computing network can be determined based on node information, while the connection relationship and communication status between nodes can be determined based on link information. Therefore, based on the node and link information, the nodes are abstracted as graph nodes in the network topology graph, and the links are abstracted as graph edges, thus constructing a visual network topology graph. This network topology graph can intuitively display the complex interactions between nodes, facilitating subsequent analysis of the graph structure characteristics of the network topology graph to further analyze a series of graph structure characteristics and communication behavior characteristics of nodes and between nodes.

[0031] Optionally, see Figure 2 In some embodiments, a network topology diagram is constructed based on the node information of each node and the link information of each link in the current computing power network, specifically including:

[0032] 1011. After receiving the periodic polling instruction and / or the event-driven instruction, collect the node information of each node and the link information of each link in the current computing power network;

[0033] 1012. Preprocess the node information and link information, where the preprocessing includes at least one of data cleaning, normalization, and dimensionality reduction.

[0034] 1013. Create a graph structure class, and use the graph structure class to store node information and associated link information of each node to obtain a graph structure;

[0035] 1014. Based on the graph structure, each node is mapped as a vertex and each link is mapped as an edge to construct a network topology graph.

[0036] In this optional embodiment, the construction of the network topology map can be specifically triggered periodically or driven by events. Among them, when periodic triggering is adopted, the periodic rotation training instructions can be issued at preset time intervals, such as every 5 minutes, every hour, and every day. It can also be adjusted in combination with the task scheduling strategy, such as triggering at different preset frequencies at different times, or dynamically adjusting the frequency of the periodic rotation training according to the network load to achieve normalized monitoring of the computing power network. When event-driven, it can be triggered in real time according to specific events in the network, such as node failures, sudden increases in traffic, etc., to ensure real-time updates of the network topology map to reflect the current network status and ensure that node information and link information in abnormal states can be captured in a timely manner.

[0037] In this optional embodiment, after obtaining the node information and link information, since this information usually contains noise or redundant data, such as missing values, outliers or duplicate data, if it is directly used for subsequent feature extraction and anomaly analysis, it may affect the accuracy and efficiency of the analysis. Therefore, before constructing the network topology diagram, it is necessary to preprocess the node information and link information to improve the data quality and reduce the complexity of subsequent calculations. The specific operation of the preprocessing can be selected according to the actual situation of the data. For example, for missing values, the missing values ​​can be supplemented by methods such as mean filling, median filling, mode filling, front and back filling or Lagrange interpolation; for outliers, they can be identified and eliminated by methods such as box plot analysis, 3σ principle analysis or Z score analysis; for duplicate data, deduplication processing can be used. In addition, normalization can be performed, such as using the Min-Max normalization algorithm to scale the data to a uniform scale. Dimensionality reduction methods such as Principal Components Analysis (PCA) or Linear Discriminant Analysis (LDA) can be used to reduce feature dimensions and computational complexity. This preprocessing step can effectively improve the accuracy and reliability of subsequent network topology construction and abnormal node identification.

[0038] In this optional embodiment, after the preprocessing is completed, the corresponding node information and link information will be stored in the graph structure class, and the graph structure will be obtained by instantiating the graph structure class. Among them, the graph structure class is used to define the data structure and operation methods of the graph structure, such as the attributes of nodes and links and their associations. At the same time, in order to support flexible management operations on nodes and classes, the graph structure class can also define methods such as adding node vertices, adding link edges, querying adjacent nodes, calculating node degrees, updating node status or link traffic, so as to efficiently manage and access node information and its associated link information. By instantiating the graph structure class, a graph structure reflecting the current node and related link status can be constructed. Since the graph structure is an instantiation of the graph structure class, it can effectively reflect the detailed information and associations of specific nodes and links in the current computing power network.

[0039] In this optional embodiment, based on the obtained graph structure, nodes can be mapped to vertices in the network topology graph, and links can be mapped to edges connecting vertices. For example, a computing power network includes nodes A1, A2, and A3, and links L1 and L2 connecting these nodes, where node A1 is connected to node A2 via link L1, and node A2 is connected to node A3 via link L2. In the graph structure, nodes A1, A2, and A3 can be mapped to vertices V1, V2, and V3, respectively, and links L1 and L2 can be mapped to edges E1 connecting vertices V1 and V2, and edges E2 connecting vertices V2 and V3, respectively, thereby obtaining a network topology graph that intuitively reflects the relationship between each node and link. To further reflect the properties and status of nodes and links, network topology diagrams can also use graphical elements of different colors, shapes, or sizes to represent nodes and links. For example, different colors can represent different node states, different shapes can represent different node types, and different sizes can represent link traffic levels. The edges corresponding to each link can be directed or undirected, thick or thin, solid or dashed, to reflect characteristics such as the link's connection direction, transmission rate, and data flow. Furthermore, network topology diagrams can further incorporate dynamic data on nodes and links, such as real-time traffic and latency jitter, using animation or dynamic updates to intuitively present the dynamic interactions between nodes and links in the computing network. This provides operations and maintenance personnel with a more comprehensive and intuitive view of the network status, helping to promptly identify and address potential abnormal node and link issues. The resulting network topology diagram can then be used to further analyze a series of graph structural features and communication behavior characteristics of nodes and between nodes, providing an important basis for subsequent identification of abnormal nodes.

[0040] 102. Based on the graph structure of the network topology, extract the graph structure features and communication behavior features of the nodes to be tested;

[0041] In this embodiment, because the graph structure in the network topology diagram fully records the multi-dimensional information of nodes and links, it is possible to systematically mine the structural and behavioral characteristics of the nodes under test based on this graph structure. In addition to the node attributes (such as node type and hardware configuration) and link attributes (such as bandwidth and latency) that can be directly derived from the graph structure, after obtaining the network topology diagram, it is also possible to further analyze the multi-dimensional characteristics of the current computing power network based on the node connection relationships, adjacency information, and dynamic properties in each graph structure, namely the graph structure characteristics and communication behavior characteristics.

[0042] In this embodiment, the graph structure feature refers to the structural properties of the node in the network topology, reflecting its connection pattern and importance in the network, such as the node degree index that reflects the number of edges directly connected to the node and other nodes, the node centrality indexes such as degree centrality and betweenness centrality that reflect the core status of the node, and the clustering coefficient index that reflects the closeness of the connection between adjacent nodes. These graph structure features can be obtained based on topological information such as adjacency relationships, node connections, and shortest paths in the graph structure. By extracting these graph structure features, the structural importance of nodes in the network can be quantified, and core nodes or edge nodes in the computing power network can be identified, which is conducive to the accurate positioning and abnormal association of nodes and links, and provides a structural basis for abnormal identification.

[0043] In this embodiment, communication behavior characteristics refer to the dynamic properties of the traffic load and communication stability of a node's interactions with other nodes, such as the communication frequency (reflecting the number of interactions a node has with neighboring nodes per unit time), the average data transmission volume (reflecting the average amount of data transmitted per unit time), the data volume variance (reflecting the degree of data volume fluctuation), the average delay (reflecting the average delay in communication between a node and its neighbors), and the delay variance (reflecting the degree of delay fluctuation). These communication behavior characteristics can be derived based on the link's traffic attributes (such as the input data volume, output data volume, data flow direction, traffic ratio, and traffic change rate per unit time) and performance attributes (such as latency, packet loss rate, and transmission rate). For example, the communication frequency can be calculated by combining the data volume transmitted per unit time with the data packet size, and the average delay and variance can be calculated using multiple sampled delay values. By extracting these communication behavior characteristics, node communication stability and traffic load anomalies can be effectively analyzed, and behaviors such as burst traffic (such as a sudden increase in data volume variance) or abnormal delay (such as an average delay exceeding a threshold) can be captured, providing a dynamic behavioral basis for anomaly identification.

[0044] This embodiment, through the extraction of multi-dimensional feature data such as graph structure features and communication behavior features, can provide strong support for the subsequent accurate identification of abnormal nodes. Graph structure features focus on revealing the importance and connection patterns of nodes in the network from the perspective of static topology, while communication behavior features focus on reflecting the node's business load and communication stability from the perspective of dynamic interaction. The two complement each other, comprehensively depicting the role positioning and behavior patterns of nodes in the network, and together constitute a comprehensive and in-depth feature description of the nodes. This facilitates the subsequent calculation of the deviation of the tested node from the normal pattern by constructing a normal node feature distribution model, thereby accurately identifying nodes with abnormal structures or behaviors.

[0045] Optionally, see Figure 3In some embodiments, graph structure features include node degree, node centrality, and node clustering coefficient, and communication behavior features include communication frequency, data transmission volume, and response time. Based on the graph structure of the network topology graph, the graph structure features and communication behavior features of the node to be tested are extracted, specifically including:

[0046] 1021. Count the total number of adjacent nodes directly connected to the node under test in the network topology graph to obtain the node degree;

[0047] 1022. Calculate the influence weight of the node to be tested in the network topology graph to obtain the node centrality;

[0048] 1023. Count the actual number of connected edges between all adjacent nodes of the node to be tested, and calculate the ratio of the actual number of connected edges to the maximum number of connectable edges between each adjacent node to obtain the node clustering coefficient;

[0049] 1024. Count the number of communication interactions between the node to be tested and each adjacent node within a preset unit time to obtain a communication frequency;

[0050] 1025. Calculate the total amount of data packets sent or received by the node under test within a preset unit time to obtain the data transmission volume;

[0051] 1026. Calculate the average delay time from receiving data to sending data of the node under test to obtain the response time.

[0052] In this optional embodiment, the graph structure features are further specified to include node degree, node centrality, and node clustering coefficient, and the communication behavior features include communication frequency, data transmission volume, and response time.

[0053] In this optional embodiment, the node degree is an indicator that measures the number of edges connected to a node in the network topology. It directly reflects the direct connection of the node. The larger the value, the more direct connections the node has with other nodes, and the more important the node is in the network. The specific calculation formula can be: ,in, and are the numbers of the two nodes, used to uniquely identify the corresponding nodes. for The node degree of the node, is the adjacency matrix between nodes, when the node and nodes When directly connected, the adjacency matrix The value is 1, and when the two nodes are not directly connected, the adjacency matrix value is 0. Node , calculate its relationship with node The node degree can be obtained by accumulating the adjacency matrix of the nodes. The calculation of the node degree can quantify the degree of direct connection of the nodes in the network and provide a basis for identifying key nodes in the network.

[0054] In this optional embodiment, node centrality further considers the indirect connection of the node in the network. By calculating the influence weight of the node in the network topology, the core position of the node in the network can be evaluated. The larger the value, the greater the influence of the node in the network and the more likely it is to be a core node in the network. The node centrality indicators include degree centrality, betweenness centrality and closeness centrality. This embodiment provides a specific calculation formula for node centrality, which is specifically: ,in, is the damping factor, which is generally set to 0.85. is the total number of nodes, For nodes The set of adjacent nodes of For nodes The number of outgoing links, and The nodes are and nodes The importance score of Value and The values ​​are , implemented a PageRank algorithm that makes the node centrality determined by the importance of the adjacent nodes pointing to it and the number of outbound links, by repeatedly iterating the importance score of each node until the The algorithm tends to a stable value, which is used as the quantitative value of the node centrality. By quantifying the indirect influence relationship between nodes, this algorithm overcomes the limitation of degree centrality that only focuses on direct connections. It more comprehensively reflects the core influence of nodes in the network topology and provides a more accurate basis for the subsequent identification of key abnormal nodes in the network.

[0055] In this optional embodiment, the node clustering coefficient is used to measure the tightness of the connection between the adjacent nodes of the node to be tested. The larger the value, the tighter the connection between the adjacent nodes and the more stable the local structure of the node in the network. The calculation steps are as follows: Count the number of actual connecting edges between all the adjacent nodes of the node to be tested (denoted as ), and calculate the ratio of the actual number of edges to the maximum number of edges that can be connected between adjacent nodes. The maximum number of edges that can be connected between adjacent nodes is determined by the number of adjacent nodes of the node to be tested. If the node to be tested The number of adjacent nodes, that is, the node degree, is , then the maximum number of nodes that can be connected to each other is There are at most one edge between every two adjacent nodes. Therefore, the calculation formula of the node clustering coefficient can be specifically ,in, For nodes The clustering coefficient, For the node to be tested The node degree is the total number of directly connected adjacent nodes. For the node to be tested The actual number of edges between adjacent nodes. By extracting the node clustering coefficient, the connectivity characteristics of the node's local neighborhood can be quantified. Because the clustering coefficient of normal nodes is generally stable, and because abnormal nodes may experience significant deviations from the normal range due to sudden changes in the connectivity between adjacent nodes, such as malicious disconnection or abnormal addition of new connections, this approach can effectively identify potential abnormal nodes in the network structure, providing a basis for anomaly identification at the local structural level.

[0056] In this optional embodiment, communication frequency is used to quantify the level of interaction activity between the node under test and its neighboring nodes per unit time. It is a core indicator reflecting the stability of node communication behavior. Specifically, within a preset unit time window (e.g., 1 minute, 5 minutes, etc., which can be adjusted based on the actual network scale and monitoring accuracy), the number of communication interactions (e.g., request-response pairs, data transmission sessions, etc.) completed between the node under test and each neighboring node is counted. The number of interactions for all neighboring nodes is then accumulated to obtain the node's communication frequency. For example, if node A under test interacts with neighboring node B 8 times and with neighboring node C 5 times within 1 minute, its communication frequency is 13 times / minute. The statistics of this communication frequency need to be combined with the actual operating characteristics of the network. For example, for nodes that undertake core tasks, their communication frequency is generally high and stable, while the communication frequency of edge nodes or redundant nodes may be lower but less volatile.

[0057] In this optional embodiment, the communication frequency of an abnormal node may exhibit two extremes: one is a sudden increase in frequency (e.g., from a normal 10 times / minute to 200 times / minute) due to a DDoS (Distributed Denial of Service) attack or malicious scanning; the other is a sudden drop in frequency (e.g., from a normal 15 times / minute to 0 times / minute) due to a hardware failure or link interruption. By comparing the communication frequency of the node under test with the historical average and fluctuation range of normal nodes (e.g., calculating the mean and standard deviation through a sliding window), abnormal behavior can be quickly identified. For example, if the communication frequency of a node exceeds the normal mean by 3σ (σ is the standard deviation), it is determined to be an abnormally active node. If the communication frequency is less than 20% of the normal mean in multiple consecutive time windows, it is determined to be an abnormally silent node. Furthermore, communication frequency can be combined with other features, such as node degree and clustering coefficient, for analysis. For example, if a node has a high degree but a very low communication frequency, it may indicate that, despite extensive connections, it is not actually participating in effective interactions, indicating idle resources or link failures. On the other hand, if a node has a low degree but a very high communication frequency, it may indicate a data concentration attack or abnormal data aggregation. This multi-feature fusion analysis can significantly improve the accuracy of anomaly identification and avoid misjudgments based on a single feature.

[0058] In this optional embodiment, data transmission volume is used to quantify the amount of data processed by the node under test per unit time. It is a key indicator reflecting the node's actual business load and resource consumption. Specifically, this can be achieved by summing the total size of packets sent and received by the node under test within a preset unit time window (e.g., 1 minute, 30 seconds, etc., which can be adjusted based on network traffic characteristics) to obtain the node's total data transmission volume. The distribution of this data transmission volume is closely related to the node's functional positioning. For example, core computing nodes typically have high data transmission volumes due to their large-scale data processing, and this fluctuation is synchronized with the task scheduling cycle. Storage node data transmission volumes may exhibit periodic peaks but are relatively stable during daily operation. Edge nodes, on the other hand, have lower data transmission volumes, primarily involving short-term, small data packet interactions.

[0059] In this optional embodiment, in order to improve the accuracy of anomaly identification, the data transmission volume can also be analyzed in conjunction with other features. For example, when combined with the communication frequency, if the node communication frequency is normal but the transmission volume is extremely low, it may be judged to be an invalid heartbeat packet or a malicious probe, and if the communication frequency is low but the transmission volume is extremely high, it may be judged to be an abnormally large file transfer. When combined with the node centrality, since the abnormal transmission volume of high-centrality nodes will directly affect the performance of the entire network, the alarm can be triggered first, and since the abnormal transmission volume of low-centrality nodes may only affect local business, the alarm can be triggered later. In addition, the abnormal pattern of data transmission volume is also worthy of in-depth analysis, such as sudden increase and decrease, periodic fluctuations, etc. These patterns may be associated with specific types of network attacks or business anomalies, providing additional clues for anomaly identification. Through multi-feature correlation analysis, node behavior deviations caused by business anomalies, attacks or failures in the computing power network can be effectively identified, providing data support for subsequent anomaly isolation and repair.

[0060] In this optional embodiment, the response time is used to quantify the delay from receiving data to sending data at the node under test, and is an important indicator reflecting the communication efficiency and link quality of the node. Specifically, it can be achieved by recording the time when the node under test receives the request and the time when it sends the response in a preset communication task, and taking the difference between the two as the response time of the communication. In practical applications, in order to improve the accuracy of the measurement, the response time of multiple communications can be counted, and the average or median can be calculated as the response time indicator of the node. The distribution of the response time is closely related to the processing power of the node, the link bandwidth and the network congestion. For example, high-performance computing nodes usually have a lower response time, while network bottleneck nodes or overloaded nodes may show a higher response time.

[0061] In this optional embodiment, the response time of the abnormal node may show the characteristics of significant extension or abnormal fluctuation. For example, when the processing capacity is reduced due to network attack or resource contention, the response time of the node will be significantly extended; and when the data transmission is interrupted due to link instability or equipment failure, the response time may fluctuate abnormally. By comparing the response time of the node to be tested with the historical average value and fluctuation range of normal nodes, potential abnormal nodes with communication delays can be quickly identified. In addition, the response time can also be analyzed in conjunction with other features, such as data transmission volume, node degree, etc., to more comprehensively evaluate the communication performance and status of the node. For example, if the response time of a node is prolonged and the data transmission volume increases abnormally, it may indicate that it is under data attack; if the response time is prolonged and the node degree decreases, it may indicate that it is isolated from the network due to link failure. This multi-feature fusion analysis can further improve the accuracy and comprehensiveness of anomaly identification.

[0062] This optional embodiment can construct a comprehensive node feature vector by extracting the above-mentioned graph structure features and communication behavior features. This vector not only includes the node's direct connection information (such as node degree), but also covers the node's indirect influence (such as node centrality) and the degree of local connection density (such as node clustering coefficient). At the same time, it combines multi-dimensional information such as the node's communication activity (such as communication frequency), actual business load (such as data transmission volume) and communication efficiency (such as response time). In practical applications, these features can be flexibly selected and combined according to the specific situation of the network and the needs of anomaly detection to achieve more efficient and accurate abnormal node identification. These features complement each other and jointly depict a comprehensive portrait of the node in the network, providing a rich and accurate data foundation for the subsequent construction of anomaly detection models. Subsequently, by training or comparing the node's multi-dimensional feature vectors, it is possible to achieve automatic detection and rapid positioning of abnormal nodes, providing key technical support for the intelligent operation and maintenance and security protection of the computing power network.

[0063] 103. Obtain a normal node feature distribution model, and calculate the deviation of the node to be tested based on the normal node feature distribution model, graph structure characteristics, and communication behavior characteristics;

[0064] In this embodiment, the normal node feature distribution model refers to a mathematical model that reflects the distribution patterns of normal node features, established through statistical analysis or machine learning methods based on node feature data collected during the normal operation of the computing power network. This model can provide a quantifiable benchmark for determining whether a node is normal, and is used for subsequent abnormality identification of nodes under test. The abnormal state of the node under test can be quantitatively evaluated using deviation. By converting the difference between the multi-dimensional features of the node under test and the normal node feature distribution model into a comparable numerical value, an objective determination of the abnormal state can be achieved. Therefore, the deviation can be calculated based on the normal node feature distribution model and the graph structure features and communication behavior features of the node under test. Specifically, it can be calculated based on methods such as statistical distance, probability deviation, or similarity measurement between features. For example, distance metrics such as Euclidean distance, Manhattan distance, or Mahalanobis distance can be used to calculate the distance between the feature vector of the node under test and the center point of the feature distribution of normal nodes. A larger distance indicates that the node under test has deviated further from normal. Alternatively, probability deviation metrics such as KL divergence (Kullback-Leibler Divergence) and JS divergence (Jensen-Shannon Divergence) can be used to assess the difference between the feature distribution of the node under test and that of normal nodes. Alternatively, similarity metrics such as cosine similarity and Pearson correlation coefficient can be used to measure the similarity between the feature vector of the node under test and that of normal nodes. The selection and application of these methods should be determined based on network characteristics, data scale, and the specific needs of anomaly detection to ensure the accuracy and efficiency of anomaly identification.

[0065] Optionally, see Figure 4 In some embodiments, obtaining a normal node feature distribution model and calculating the deviation of the node to be tested based on the normal node feature distribution model, graph structure features, and communication behavior features specifically includes:

[0066] 1031. Perform statistical analysis or machine learning analysis on historical normal nodes to obtain a normal node feature distribution model, where the normal node feature distribution model includes normal graph structure features and normal communication behavior features.

[0067] 1032. Generate a normal node feature vector based on normal graph structure features and normal communication behavior features;

[0068] 1033. Cluster the normal node feature vectors to obtain at least one cluster center of the historical normal node in the network topology graph;

[0069] 1034. Generate a feature vector of the node to be tested based on the graph structure characteristics and communication behavior characteristics of the node to be tested;

[0070] 1035. Calculate the distance between the feature vector of the node to be tested and the nearest cluster center to obtain the deviation.

[0071] In this optional embodiment, a method for obtaining a normal node feature distribution model and calculating deviation is provided. Specifically, the normal node feature distribution model is obtained based on statistical analysis or machine learning analysis of historical normal nodes. Among them, historical normal nodes refer to nodes with no abnormal behavior records during the normal operation of the computing power network. Their data is used as a benchmark for establishing a normal node feature distribution model. Specifically, a sufficient number of historical normal nodes can be selected, and it is ensured that the data of these historical normal nodes covers various node types, operating states and periodic characteristics in the network, so as to ensure that the normal node distribution model obtained by subsequent training has better generalization ability and accuracy.

[0072] In this optional embodiment, the statistical analysis method can specifically be to establish a single-feature or multi-feature statistical distribution model by calculating the mean, standard deviation, quantile and other statistics of the graph structure characteristics and communication behavior characteristics of historical normal nodes, and the machine learning analysis method can specifically be to learn the joint distribution law between features, such as the coordinated change pattern of multiple features, by adopting algorithms such as K-means (K-means) clustering, Gaussian Mixture Model (GMM) or Bayesian network. By processing historical nodes through one of the two methods, a mathematical model reflecting the distribution law of normal node features can be constructed. The normal node feature distribution model obtained by the above two methods can accurately characterize the "structure-behavior" two-dimensional feature pattern of normal nodes, has good generalization and dynamic adaptability, can effectively adapt to different types of nodes and match changes in network operation scenarios, and the normal node feature distribution model also has feature data of both graph structure and communication behavior. Among them, the normal graph structure feature can reflect the position and connection relationship of the node in the network topology, and the normal communication behavior feature can effectively reflect the dynamic behavior pattern of data exchange between nodes. The two normal features can complement each other to describe the "static structure-dynamic behavior" dual attributes of the node, serve as the benchmark for abnormal judgment of the node to be tested, and provide a comprehensive reference basis for deviation calculation.

[0073] In this optional embodiment, a feature vector is specifically used to characterize the graph structure characteristics and communication behavior characteristics of the node. The construction of the feature vector is based on the multiple node features extracted as described above, including but not limited to node degree, clustering coefficient, centrality, communication frequency, data transmission volume and response time. These features are standardized or normalized to ensure that different features are numerically comparable, and then combined into a multidimensional vector that comprehensively reflects the characteristics of the node. The design of the feature vector fully considers the structural characteristics and behavioral characteristics of the node, and includes both the connection information of the node and the communication behavior data of the node, so that the feature vector can comprehensively and accurately depict the state and behavior pattern of the node in the network. For example, the feature vector of a normal node can concentrate on reflecting the typical characteristic pattern of a historical normal node, while the feature vector of the node to be tested can effectively reflect the current "structure-behavior" state of the node to be tested.

[0074] In this optional embodiment, based on the construction of feature vectors, cluster analysis can be further utilized, such as by using K-means clustering, density-based spatial clustering of applications with noise (DBSCAN) algorithm clustering, hierarchical clustering, etc., to process the feature vectors of historically normal nodes to identify cluster centers of normal nodes in the network. Cluster centers represent the typical distribution pattern of feature vectors of normal nodes and serve as an important reference for subsequent anomaly identification. Due to the existence of multiple types or operating modes of historically normal nodes (such as core computing nodes, edge transmission nodes, storage nodes, etc.), there may be one or more cluster centers. These cluster centers can reflect the feature templates of different types of normal nodes (for example, the feature mean of a certain type of center corresponds to the normal features of a typical core node). Therefore, by comparing these cluster centers with the feature vectors of the node under test, the difference between the node under test and the normal mode can be accurately located, such as determining which type of normal template the node under test is closer to or whether it deviates completely from all templates.

[0075] In this optional embodiment, the deviation of the node to be tested can be obtained by calculating the distance between the feature vector of the node to be tested and the nearest cluster center. Among them, the distance can be specifically calculated by Euclidean distance, Manhattan distance or cosine distance. When calculating the deviation, it is necessary to select a suitable distance measurement method to ensure the accuracy of abnormality discrimination. Different distance measurement methods may have different effects on the recognition effect of abnormal nodes. Therefore, it is necessary to select methods and adjust parameters according to the specific needs of network characteristics, data scale and abnormality detection. This method of calculating the deviation can convert abstract anomalies into quantifiable numerical indicators, which can intuitively reflect the degree of deviation of the node to be tested from the normal mode, which is conducive to the automatic identification and hierarchical disposal of anomalies.

[0076] Optionally, in some embodiments, the aforementioned normal node feature distribution model may include multiple sub-models, each sub-model being used to model and analyze different features. For example, independent sub-models may be established for key features such as node degree, node centrality, communication frequency, data transmission volume, and response time, so as to deeply characterize the distribution patterns and changing trends of each feature under normal conditions. Each sub-model focuses on capturing the normal behavior patterns of specific features, thereby providing more refined anomaly detection capabilities. For example, for the node degree feature, a sub-model can be established to analyze the distribution of historical normal node degrees, such as obtaining the mean, standard deviation, and other statistical quantities of the node degree through statistical analysis, and setting the node degree as When , the node's node degree is considered abnormal, where μ is the mean of the normal node degree, σ is the standard deviation, and k is the threshold coefficient. Similarly, for features such as node centrality and node clustering coefficient, additional sub-models can be constructed to characterize the typical value range and variation trend of these feature data in normal nodes. These sub-models can operate independently or collaborate to form a complete model of normal node feature distribution.

[0077] In this optional embodiment, when performing anomaly detection on the node to be tested, each sub-model will evaluate the corresponding features of the node to be tested to determine whether it deviates from the normal range. Finally, by combining the evaluation results of each sub-model, a more comprehensive and accurate abnormality judgment conclusion can be obtained. For example, in the process of constructing a normal node feature distribution model, the normalized feature set (such as the aforementioned node degree, node centrality, node clustering coefficient, communication frequency, data transmission volume and response time) can be statistically analyzed first, and then these features can be subjected to independent element test or skewness and kurtosis test to establish a feature distribution model. Usually, these data will obey the normal distribution, so its probability density function can be determined as ,in is the mean, is the standard deviation, is the corresponding feature set.

[0078] In this optional embodiment, the correlation coefficient can also be used Calculate the deviation score of each sub-model separately to obtain an overall anomaly score, where is the correlation coefficient, and They correspond to the characteristic values ​​of the graph structure characteristics and communication behavior characteristics of the node to be tested and the normal node, and is the mean of the feature values ​​of the tested node and the normal node. The higher the score, the further the tested node deviates from the normal state and the greater the possibility of abnormality. On this basis, each feature can be judged individually to determine whether it is abnormal. For example, an abnormal threshold can be set. , the threshold can be determined based on the data distribution and clustering of normal features to ensure its optimality. Subsequently, a variety of graph structure features of the nodes to be tested can be extracted, including degree features, node centrality features, clustering coefficient features, and normalized communication features. These features fully reflect the structure and behavior attributes of the nodes in the computing network. Next, the correlation coefficient between the degree features of the nodes to be tested and the probability model of the degree distribution of the normal node set is calculated. and with the threshold For comparison, if Less than , then the node is directly determined to be an abnormal point. Not less than , we can further calculate the probability correlation coefficient of the centrality characteristics, clustering coefficient characteristics and communication characteristics of the tested node and the normal node set in turn 、 、 , and then with the threshold Only when all correlation coefficients are not less than the threshold Only then is the node under test finally determined to be a normal node. This process achieves accurate identification of abnormal nodes in the computing power network through gradually in-depth feature comparison and threshold judgment. In addition, statistical methods such as T-test or F-test can be used to perform significance tests on the characteristics of the node under test and the mean or variance of the normal node feature distribution model to further verify whether the node under test has significantly deviated from the normal state. If one or more feature values ​​of the node under test are significantly different from the corresponding feature values ​​of the normal node feature distribution model, it can be determined that the node under test is abnormal. This method can provide statistically significant evidence, enhancing the credibility and persuasiveness of anomaly identification. On this basis, combined with the deviation calculation and sub-model evaluation results, a multi-level, multi-dimensional anomaly detection system can be constructed to achieve comprehensive and accurate identification of abnormal nodes in the computing power network.

[0079] In this optional embodiment, the above-mentioned method not only improves the accuracy of anomaly detection, but also enhances the flexibility and scalability of the system, so that the system can adapt to different network environments and changes in anomaly detection needs. At the same time, since each sub-model focuses on the analysis of specific features, it can provide more specific diagnostic information for different types of abnormal behaviors, which helps operation and maintenance personnel to quickly locate problems and take corresponding measures. The normal node feature distribution model coupled by multiple sub-models can improve the accuracy of anomaly detection, more accurately capture the normal behavior pattern of the feature, and better adapt to the change pattern of different features. It is also conducive to improving the interpretability of anomaly identification, making it easier for operation and maintenance personnel to understand the basis and process of anomaly detection.

[0080] 104. Identify the node to be tested whose deviation is greater than a preset deviation threshold as an abnormal node.

[0081] In this embodiment, after determining the deviation of the node to be tested through the above steps, the node to be tested can be judged as abnormal based on the size of the deviation. Specifically, this embodiment uses a threshold determination method to identify abnormal nodes. The preset deviation threshold is set based on an in-depth analysis of the characteristic distribution of historical normal nodes, aiming to distinguish normal fluctuations from potential anomalies. For example, the preset deviation threshold can be determined based on the maximum deviation of historical normal nodes, the confidence interval of the statistical distribution, or dynamic adjustment based on business needs. It is worth noting that the setting of the preset deviation threshold needs to comprehensively consider multiple factors, including the characteristic distribution of historical normal nodes, the scale and complexity of the network, the sensitivity and false alarm rate requirements of anomaly detection, etc., to ensure the rationality and applicability of the threshold. In addition, as the network operates and data accumulates, the preset deviation threshold can also be dynamically adjusted and optimized according to actual conditions to adapt to changes in network status and the development of anomaly detection needs, thereby continuously improving the accuracy and efficiency of anomaly identification. When the deviation of the node to be tested exceeds this threshold, it is considered that it exhibits characteristics that are significantly different from the normal state and has a high probability of abnormal behavior, so it is identified as an abnormal node. This step realizes the transformation from feature analysis to anomaly recognition. The obtained anomaly recognition results have high accuracy and reliability, providing strong support for subsequent anomaly processing.

[0082] Optionally, in some embodiments, anomaly identification can be performed by performing anomaly detection on the feature matrix using other anomaly detection algorithms, and anomaly values ​​corresponding to each node can be obtained through anomaly detection. This can be implemented in the following steps:

[0083] (1) Constructing the feature matrix: In the computing network, in order to fully capture the attribute characteristics of the nodes and their mutual relationships, we first set the number of nodes to , the graph structure feature of each node is set to For example, in one implementation, you can set The value is 3, representing the three key features of node degree, node centrality and node clustering coefficient. Based on these features, the node degree set can be constructed , node centrality set and node clustering coefficient set The characteristic matrix of is expressed as: node degree matrix ,in Representation node With node degree relationship between them; node centrality matrix ,in Representation node With node The clustering relationship between nodes; node clustering coefficient matrix ,in Representation node With node These matrices can fully reflect the connection relationships and attribute characteristics between nodes in the computing power network, providing a data basis for subsequent anomaly detection.

[0084] (2) Feature matrix normalization: To eliminate the influence of different dimensions between features and enable the subsequent anomaly detection algorithm to more accurately identify abnormal nodes, the feature matrix is ​​normalized. Expressed as ,in represents the normalized eigenvalue.

[0085] (3) Anomaly detection using anomaly detection algorithm: A possible anomaly detection algorithm includes the following steps: First, from the feature matrix Extract several column vectors and calculate the entropy of each column vector. The entropy value reflects the degree of disorder of the information in the vector. The lower the entropy value, the more ordered the information in the vector is, and the more likely it is to be used as an abnormal threshold. Select the column vector with the lowest entropy value as the initial abnormal threshold column vector .

[0086] (4) Generate candidate anomaly threshold matrix: As the abnormal threshold, the feature matrix All column vectors in Sort the values ​​​​to generate a sorted vector , and get the vector Then, select the sort vector The first three column vectors of are used as candidate anomaly threshold matrices and These candidate anomaly threshold matrices will be used for subsequent deviation threshold determination.

[0087] (5) Determine the deviation threshold and identify abnormal nodes: According to the candidate abnormal threshold matrix and , determine the deviation threshold Then, let the feature matrix Each value in the matrix Compare the minimum values ​​of all row vectors in to get the deviation of each node .like Less than the minimum deviation , it means that the node is an abnormal node.

[0088] In this optional embodiment, to further improve the accuracy and reliability of anomaly detection, the structure and interaction patterns of the computing network can be combined to further identify abnormal behavior characteristics by analyzing the interaction patterns between abnormal nodes and other nodes, such as interaction frequency and interaction data volume. Based on these analysis results, an anomaly report is generated and an alert is issued for the abnormal node. This approach effectively identifies abnormal nodes in the computing network by constructing a feature matrix, using an anomaly detection algorithm to detect anomalies in the feature matrix, and conducting a comprehensive analysis based on the structure and interaction patterns of the computing network, providing strong support for subsequent anomaly handling and network optimization.

[0089] Optionally, see Figure 5 In some embodiments, after identifying a node to be tested whose deviation is greater than a preset deviation threshold as an abnormal node, the method further includes:

[0090] 1051. Monitor whether there is abnormal data in the real-time response event data, communication records, and data flow data of the node under test. If abnormal data exists, confirm that the node under test is an abnormal node;

[0091] 1052. Determine whether each adjacent node of the node to be tested is identified as an abnormal node. If any adjacent node is identified as an abnormal node, then confirm that the node to be tested is an abnormal node.

[0092] 1053. Otherwise, mark the node to be tested as a normal node.

[0093] In this optional embodiment, after initially determining that a node under test may be an anomaly based on deviation, a multi-dimensional verification method is provided to avoid misjudgments due to data fluctuations or single indicators, thereby ensuring the accuracy and robustness of the identification results. Specifically, for initially identified anomaly nodes, real-time monitoring of their response event data (e.g., logs of node processing tasks or requests, task receipt time, processing start time, and completion time), communication records (e.g., communication frequency, packet size), and data flow (e.g., target nodes and paths for data transmission / reception) can be performed. If abnormal characteristics such as significantly prolonged response time (e.g., significantly exceeding twice the historical average), abnormally high or low frequency interactions in communication records (e.g., communications typically occurring 10 times per hour but currently increasing to 200 times per hour), or data flow deviations from normal paths (e.g., data that should have been sent to core computing nodes suddenly flowing in large quantities to unauthorized edge nodes) are detected, the node can be further confirmed as an anomaly. By comparing real-time behavior with historical patterns, it is verified whether the initially identified anomaly is caused by genuine abnormal behavior rather than accidental data fluctuations, thus achieving anomaly verification based on real-time data.

[0094] In this optional embodiment, it is also possible to check whether there are any nodes in the adjacent nodes of the node to be tested that are the same as the identified abnormal node based on the graph structure characteristics of the computing power network, that is, the nodes are connected through communication links to form a topological relationship. If there is an adjacent node marked as abnormal, it means that the node to be tested may be in the abnormal propagation path, or the two share the same abnormal root cause, thereby further confirming that the node to be tested is an abnormal node. This step utilizes the "correlation of network topology" to assist in verifying the authenticity of the abnormality of the node to be tested through the status of adjacent nodes, avoiding misjudgments caused by isolated judgments.

[0095] In this optional embodiment, if no abnormality is found in the above two-step verification, that is, the real-time data of the node to be tested has no abnormal characteristics and all its adjacent nodes are normal nodes, then it means that the deviation exceeded the standard in the preliminary judgment may be caused by short-term data fluctuations or calculation errors. Therefore, the node to be tested is marked as a normal node, which realizes the filtering of non-real abnormalities, significantly reduces the misjudgment rate, and can ensure that the final judgment result only retains highly credible abnormal nodes, which is conducive to further improving the reliability of abnormal node identification in the computing power network.

[0096] In this optional embodiment, the verification process can be further optimized by combining the quantitative analysis of graph structure characteristic indicators. For example, by setting a threshold And calculate the graph structure feature deviation of the node ,in is the coefficient of the relationship between the node and the threshold), the abnormal degree of the node can be graded: when the deviation is greater than the threshold but less than 2 times the threshold, it is marked as a "node to be observed"; when it is greater than 2 times the threshold, it is marked as a "suspected abnormal node", triggering the verification of the above steps; if the deviation is less than the threshold, it is directly judged as a normal node. At the same time, through the node and the abnormal node set Relationship function ( Indicates that the node is isolated and has no connection abnormal node. Indicates that the node is connected to the abnormal node set), which can assist the above-mentioned adjacency verification, that is, when When checking the abnormal event characteristics of the N nodes connected to the node to be tested (such as task interruption rate, abnormal communication frequency), if there is an abnormality, reverse confirmation of the abnormality of the node to be tested is made, further improving the verification efficiency.

[0097] Optionally, see Figure 6 In some embodiments, after identifying a node to be tested whose deviation is greater than a preset deviation threshold as an abnormal node, the method further includes:

[0098] 1061. Based on the deviation degree of the abnormal node, the average network connectivity, the feature reference threshold and the abnormal correlation status of the adjacent nodes, the abnormal score of the abnormal node is evaluated;

[0099] 1062. Determine the abnormality level of the abnormal node based on the score range in which the abnormality score falls;

[0100] 1063. Based on the abnormality level, configure the response rules and response priority of the abnormal node.

[0101] In this optional embodiment, after the node to be tested is preliminarily identified as an abnormal node, in order to achieve accurate assessment and targeted disposal of abnormal threats, a progressive decision-making process from "quantitative scoring-level determination-response configuration" is designed. This process converts the abstract degree of abnormality into an operational operation and maintenance indicator by integrating the node's own characteristics, network topology characteristics and abnormal correlation information, significantly improving the efficiency and rationality of abnormality handling. Among them, the abnormality score needs to comprehensively consider the degree of deviation of the node's own characteristics from the normal state, the overall connection density of the network, the pre-set feature reference value and the abnormal correlation state of the adjacent nodes, that is, the deviation of the abnormal node, the average network connectivity, the feature reference threshold and the abnormal correlation state of the adjacent nodes. For example, if indicators such as the number of node connections and data processing efficiency are significantly beyond the normal range, it means that the risk of abnormality is higher; if the connections between nodes in the entire network are generally tight, the abnormality of a single node may spread faster and require a higher assessment; if the average response time of normal nodes is 50ms, this value is used as a benchmark to measure deviations; if the node has a communication link with a confirmed abnormal node, its abnormality may be caused by network-level risks and requires additional weighting. These four factors work together to ultimately produce a quantitative score that can reflect the severity of the abnormality.

[0102] In this optional embodiment, the abnormality score can be calculated by a preset scoring model, trained by a machine learning algorithm, or multiplied and summed by weight coefficients set based on expert experience and various evaluation indicators. For example, in a specific implementation process, the specific calculation of the abnormality score can be obtained by formula Implementation. Among them, represents the abnormality score, It is the average number of connections among all nodes in the network, reflecting the overall connection density of the network. is the deviation multiple of the node feature from the normal threshold. For example, if the normal threshold is 100 and the node feature value is 150, then =1.5, is a pre-set normal feature benchmark value (such as the average number of connections of normal nodes), Is the adjacency anomaly correlation factor, which is 1 if the node is connected to an abnormal node, otherwise it is 0. This formula integrates the above four factors through mathematical relationships to ensure that the score can fully reflect the potential threat of the anomaly. The higher the anomaly score obtained, the greater the potential threat of the abnormal node to the computing power network, and more urgent and in-depth disposal measures need to be taken. Alternatively, the deviation score can also be obtained by combining scores from multiple dimensions, such as according to the node degree, through the formula The node degree deviation is calculated, where is the node degree deviation of the abnormal node, is the node degree of the abnormal node, is the average node degree of normal nodes, is the standard deviation of the node degree of normal nodes. The higher the score, the greater the deviation of the node degree from the normal range. Similarly, the normalized quantitative indicators of the anomaly can be calculated separately for the characteristics such as node degree, clustering coefficient, centrality, communication frequency, data transmission volume and response time. Finally, the anomaly score of the abnormal node can be obtained by combining the anomaly indicators of each dimension.

[0103] In this optional embodiment, based on the anomaly score, anomaly levels are further classified to distinguish the degree of threat. The score ranges are dynamically adjusted based on historical network data and security requirements. For example, a low score indicates that the anomaly is likely caused by short-term fluctuations or calculation errors, posing a limited threat, and is classified as "low risk." A medium score indicates that the node exhibits clear anomaly characteristics and requires significant attention, and is classified as "medium risk." A high score indicates that the node anomaly is severe and may cause network-level failures, requiring urgent attention, and is classified as "high risk." This grading approach avoids simplistic, one-size-fits-all judgments and ensures that anomaly handling is more tailored to actual risks. The specific quantitative value ranges for each range can be dynamically set based on historical network data, security policies, and business requirements, ensuring that the anomaly level classification is both realistic and effectively guides subsequent anomaly handling. For example, if historical data shows that a certain type of anomaly causes network failures with a high frequency and a wide impact, the score range that triggered this anomaly can be set as "high risk." This allows for rapid identification and priority handling when similar anomalies recur on the network.

[0104] In this optional embodiment, for abnormal nodes of different levels, corresponding response rules and response priorities are configured to ensure efficient and targeted abnormal handling. Among them, the response rules and response priorities strictly correspond to the abnormality level to achieve rapid response and precise policy implementation for abnormal handling. For example, for abnormal nodes of the "low-risk" level, due to their low potential threat, relatively loose response rules such as regular monitoring and logging can be adopted, and the response priority is relatively low, allowing for appropriate delay in handling without affecting the overall operation of the network; for abnormal nodes of the "medium-risk" level, vigilance should be increased, and response rules such as increasing monitoring frequency and activating early warning mechanisms should be adopted, with a moderate response priority to ensure timely intervention before the abnormality develops further and effectively control risks; and for abnormal nodes of the "high-risk" level, emergency disposal measures should be taken immediately, such as isolating the abnormal node and initiating emergency recovery processes, with the highest response priority, aiming to quickly cut off the abnormal propagation path and ensure the overall security and stable operation of the computing power network. This step, by closely linking the abnormality level with the response strategy, realizes the refinement and intelligence of the abnormal handling process, which can significantly improve the efficiency and effectiveness of abnormal handling and provide a strong guarantee for the safe operation and maintenance of the computing power network.

[0105] In this optional embodiment, the response rules can also be determined based on the impact scope of the abnormal node. For example, if the abnormal node primarily affects local data processing efficiency and has not spread to the entire network, a more local response strategy can be adopted, such as isolating only the node or adjusting the resource allocation of its surrounding nodes. If the abnormal node's impact is widespread and has caused serious consequences such as overall network performance degradation or data loss, a more global response strategy is required, such as initiating a network-wide abnormality investigation and recovery process. For example, the response decision can be refined based on the ratio of the number of abnormal nodes to the total number of network nodes, such as by setting a ratio threshold P. When the number of abnormal nodes N exceeds a set ratio of the currently identified abnormal node set M, i.e., N>M×P, it is determined to be a localized, small-scale abnormality. In this case, no active response is required, and only continuous observation is required. When the number of abnormal nodes N further exceeds a set ratio of the total number of network nodes Q, i.e., N>Q×P, it is determined to be a larger-scale abnormality, requiring immediate response processing. By distinguishing between the "internal proportion of anomalies" and the "global proportion of the network," this rule avoids misjudging local fluctuations in anomalies as global crises while promptly capturing large-scale anomalies that could impact the entire network, further balancing operational efficiency and network security. Furthermore, response rules must consider the type of anomaly node, such as core computing nodes, edge transmission nodes, or storage nodes. Different types of nodes play different roles in the network, and their response strategies should also be differentiated to ensure accurate and effective responses.

[0106] Through the above steps, this optional embodiment comprehensively considers the multi-dimensional characteristics of the abnormal node, such as the abnormality score, threat level, impact range, node type and abnormality ratio, to determine the response rules and response priority of its response. It can achieve precise, dynamic and scenario-adaptive abnormality handling, make abnormality handling more in line with the actual situation of the network, and help to improve the pertinence and efficiency of abnormality handling, avoiding excessive intervention in low-risk abnormalities and ensuring the rapid containment of high-risk abnormalities, which can effectively protect the safe and stable operation of the computing power network.

[0107] Optionally, see Figure 7 In some embodiments, after identifying a node to be tested whose deviation is greater than a preset deviation threshold as an abnormal node, the method further includes:

[0108] 1071. Label the abnormal patterns, abnormal types, and countermeasures of abnormal nodes to form a training data set or abnormal node knowledge base. The abnormal patterns include the graph structure characteristics and communication behavior characteristics of abnormal nodes.

[0109] 1072. Train a preset target recognition model based on the training data set, or connect the abnormal node knowledge base to the preset retrieval enhancement generation model to obtain an abnormal location model for abnormal node identification based on the abnormal location model.

[0110] In this optional embodiment, in the process of identifying and handling abnormal nodes, not only can current abnormal events be focused on, but a long-term abnormality management tool can also be further constructed based on the current abnormal situation. By systematically labeling and organizing the detailed information of the identified abnormal nodes, including their abnormal patterns (such as abnormal connection patterns and clustering feature deviations in the structural features, and abnormal communication frequency and packet size changes in the communication behavior features), the abnormality type (such as hardware failure, software vulnerability, and malicious attack), and the response measures taken for the abnormality (such as hardware repair, software update, data isolation, data backup, data migration, etc., and may also include an estimated processing process covering information such as recovery process, recovery time, and estimated cost), a valuable training data set or abnormal node knowledge base is formed. This data and knowledge not only records historical abnormal cases, but also provides rich learning materials for abnormality identification, enabling subsequently trained models to more accurately identify and handle abnormal nodes.

[0111] In this optional embodiment, if the method of organizing abnormal node information into a training dataset is chosen, a preset target recognition model can be trained using a machine learning algorithm, such as supervised learning, support vector machines, random forests, or deep learning networks. The preset target recognition model can specifically be a convolutional neural network (CNN), a recurrent neural network (RNN), or a graph neural network (GNN). This allows the preset target recognition model to learn the characteristic patterns of abnormal nodes from the training dataset and output a prediction result on whether the node is abnormal based on input information such as the abnormal node's graph structure characteristics and communication behavior characteristics, thereby gradually enabling the model to identify similar anomalies. With the continuous accumulation of training data and continuous iteration of the model, the recognition accuracy and generalization ability of the target recognition model will continue to improve, and the resulting anomaly localization model can achieve more accurate and efficient real-time identification of abnormal nodes. If anomaly node information is organized into an anomaly node knowledge base and integrated into a pre-set Retrieval Augmented Generation (RAG) model or a Large Language Model (LLM) integrated with the RAG model, an anomaly localization model can be generated. This anomaly localization model can quickly locate the possible causes and solutions for the current anomaly node by searching similar cases in the knowledge base, enabling case-based reasoning for anomaly identification and resolution. This approach is particularly suitable for handling anomalies with similar historical occurrences, significantly shortening response time and improving resolution efficiency.

[0112] In this optional embodiment, whether it is to improve the model recognition ability through the training data set or to enhance the model positioning accuracy through the abnormal node knowledge base, it is possible to effectively build a sustainable learning and optimization abnormal management system. This system can not only respond to current abnormal events, but also learn from history and continuously improve its own abnormal identification and handling capabilities, providing a strong guarantee for the long-term safe operation of the computing power network, realizing the closed loop of "data precipitation-model optimization", and further improving the accuracy and adaptability of abnormal identification. The abnormal location model obtained can be directly applied to subsequent abnormal node identification tasks, realizing the automation and intelligence of abnormal identification, and significantly improving the efficiency of abnormal identification. In actual application, when new node data to be tested is input, the abnormal location model can quickly analyze the node's graph structure characteristics, communication behavior characteristics and other information, and compare them with the abnormal patterns in the knowledge base or training data set, so as to accurately determine whether the node is abnormal and give corresponding abnormal type and response measures. This process greatly shortens the time of abnormal identification, improves the efficiency and accuracy of abnormal handling, and provides strong support for real-time monitoring and rapid response of the computing power network. At the same time, as new abnormal cases are constantly identified and sorted out, the abnormal node knowledge base and training data set will continue to be enriched, further promoting the optimization and upgrading of the abnormal location model, forming a virtuous circle, and improving the generalization ability of the abnormal location model and its sensitivity to identifying various abnormal situations, ensuring that the safe operation and maintenance capabilities of the computing power network keep pace with the times and effectively resist various potential network risks.

[0113] Optionally, in some embodiments, after identifying the node to be tested whose deviation is greater than a preset deviation threshold as an abnormal node, it also includes: isolating the abnormal node; wherein, isolating the abnormal node specifically includes: predicting the recovery time of the isolated normal node, and adjusting the network structure according to the predicted time to ensure the normal operation of the network; optimizing the isolation efficiency of the minimum cut set to reduce the isolation cost and reduce the number of isolated nodes; repairing and replacing the isolated node: predicting the recovery time of the isolated node, and adjusting the network structure according to the predicted time to ensure the normal operation of the network.

[0114] In this optional embodiment, a method for ensuring computing power network security by isolating abnormal nodes is provided. This method includes a series of refined operations designed to efficiently and securely isolate abnormal nodes and minimize the impact of isolation operations on the network. Before implementing isolation, it is necessary to predict the recovery time of isolated normal nodes to provide a key basis for adjusting the network structure, ensuring that the network can maintain normal operation of basic functions during the isolation period, avoiding the risks of idle resources and waste caused by too long recovery time, or the risk of abnormal nodes reconnecting to the network prematurely due to too short recovery time, and ensuring the rationality and effectiveness of network isolation. On this basis, a graph optimization algorithm can be used to optimize the isolation efficiency of the minimum cut set to reduce the isolation cost and the number of isolated nodes, thereby achieving precise isolation. The minimum cut set is a node set in the network topology that uses the least number of normal node connections to effectively isolate the abnormal node. The graph optimization algorithm can specifically be a maximum flow minimum cut algorithm, a minimum degree first algorithm, or a heuristic search algorithm. During the optimization process, the optimal isolation strategy can be achieved through algorithm iteration and parameter adjustment. During the isolation implementation process, it is necessary to continuously monitor the status of isolated nodes, dynamically adjust isolation strategies, and make corresponding adjustments to the network structure based on the predicted recovery time of isolated nodes. This can be achieved by real-time monitoring of key indicators such as network traffic, node status, and communication patterns to ensure stable network operation. In addition, the selection of isolated nodes always follows the "minimum cut set" principle, that is, selecting normal nodes that have the least impact on network connectivity and can effectively block the propagation of anomalies for isolation. This can block the propagation of anomalies while minimizing the impact on the overall network performance. Finally, after the abnormal node is isolated, it is necessary to comprehensively consider the network anomaly prediction results and the node isolation status, evaluate the recoverability of the isolated abnormal node, develop a detailed recovery plan, and re-evaluate the network status after the node is restored, adjust the network structure, and ensure smooth and efficient network operation.

[0115] Optionally, in some embodiments, after identifying a node to be tested whose deviation is greater than a preset deviation threshold as an abnormal node, it also includes: evaluating and predicting the overall security and stability of the network based on the abnormal node identification and network anomaly prediction results; proposing optimization measures to improve the security of the network based on the network security evaluation results; issuing early warnings for network security threats so that measures can be taken in advance to ensure the security of the network; predicting the effectiveness of network anomaly handling measures and evaluating the feasibility of the effects to help decision makers evaluate the effectiveness of various measures; optimizing and allocating resources in the network based on the network anomaly handling effect evaluation results to improve the utilization rate of network resources.

[0116] This optional embodiment provides a comprehensive follow-up process for network anomaly management. After identifying and isolating abnormal nodes, this method further strengthens the management and optimization of the overall network status. Specifically, the results of abnormal node identification and network anomaly prediction can be used to conduct in-depth assessments and predictions of network security and stability, providing solid data support and decision-making basis for subsequent network security optimization. Subsequently, based on the assessment results, targeted optimization measures are formulated and implemented, such as updating security algorithms, strengthening security protocols, and upgrading data encryption technology, to comprehensively enhance network security. Simultaneously, through multi-dimensional early warning criteria, potential security threats are promptly identified and addressed, ensuring timely network protection. Furthermore, the ability to predict and evaluate the effectiveness of network anomaly handling can assist decision-makers in accurately assessing the actual effectiveness of various measures, accumulating valuable experience for future network management. Finally, based on the evaluation results of network anomaly handling, network resources are optimally allocated to ensure efficient utilization. This step may involve increasing the allocation of resources with significant anomaly handling effects and reducing or eliminating resources with poor handling effects, thereby achieving rational allocation and maximizing network resource utilization.

[0117] In order to execute the corresponding steps in the above method embodiment and each possible implementation method, the following provides an implementation method of an abnormal node identification device for a computing power network. Figure 8 , Figure 8 This is a functional module diagram of an embodiment of a computing power network abnormal node identification device according to an embodiment of the present invention. In this embodiment, the computing power network abnormal node identification device includes: a construction module 201 for constructing a network topology map based on the node information of each node and the link information of each link in the current computing power network; an extraction module 202 for extracting the graph structure features and communication behavior features of the node to be tested based on the graph structure of the network topology map; a calculation module 203 for obtaining a normal node feature distribution model and calculating the deviation of the node to be tested based on the normal node feature distribution model, the graph structure features, and the communication behavior features; and a processing module 204 for identifying a node to be tested whose deviation exceeds a preset deviation threshold as an abnormal node.

[0118] Optionally, in some embodiments, the construction module 201 is further specifically used to: after receiving periodic polling instructions and / or event-driven instructions, collect node information of each node and link information of each link in the current computing power network; preprocess the node information and link information, and the preprocessing includes at least one of data cleaning, normalization processing and dimensionality reduction processing; create a graph structure class, and store the node information of each node and the associated link information through the graph structure class to obtain a graph structure; based on the graph structure, map each node to a vertex, and map each link to an edge to construct a network topology graph.

[0119] Optionally, in some embodiments, the graph structure features include node degree, node centrality and node clustering coefficient, and the communication behavior features include communication frequency, data transmission volume and response time.

[0120] Optionally, in some embodiments, the extraction module 202 is further specifically used to: count the total number of adjacent nodes directly connected to the node to be tested in the network topology diagram to obtain the node degree; calculate the influence weight of the node to be tested in the network topology diagram to obtain the node centrality; count the actual number of connection edges between all adjacent nodes of the node to be tested, and calculate the ratio of the actual number of connection edges to the maximum number of connectable edges between each adjacent node to obtain the node clustering coefficient; count the number of communication interactions between the node to be tested and each adjacent node within a preset unit time to obtain the communication frequency; calculate the total number of data packets sent or received by the node to be tested within a preset unit time to obtain the data transmission volume; calculate the average delay time from receiving data to sending data by the node to be tested to obtain the response time.

[0121] Optionally, in some embodiments, the computing module 203 is further specifically used to: perform statistical analysis or machine learning analysis on historical normal nodes to obtain a normal node feature distribution model, the normal node feature distribution model including normal graph structure features and normal communication behavior features; generate a normal node feature vector based on the normal graph structure features and normal communication behavior features; cluster the normal node feature vectors to obtain at least one cluster center of the historical normal nodes in the network topology graph; generate a feature vector of the node to be tested based on the graph structure features and communication behavior features of the node to be tested; calculate the distance between the feature vector of the node to be tested and the nearest cluster center to obtain the deviation.

[0122] Optionally, in some embodiments, the processing module 204 is further specifically used to: monitor whether there is abnormal data in the real-time response event data, communication records and data flow data of the node to be tested; if abnormal data exists, confirm that the node to be tested is an abnormal node; determine whether each adjacent node of the node to be tested is identified as an abnormal node; if there is an adjacent node identified as an abnormal node, confirm that the node to be tested is an abnormal node; otherwise, mark the node to be tested as a normal node.

[0123] Optionally, in some embodiments, the processing module 204 is further specifically used to: evaluate the abnormality score of the abnormal node based on the deviation of the abnormal node, the average network connectivity, the feature reference threshold and the abnormal association status of the adjacent nodes; determine the abnormality level of the abnormal node based on the score range in which the abnormal score is located; and configure the response rules and response priority of the abnormal node based on the abnormality level.

[0124] Optionally, in some embodiments, the processing module 204 is further specifically used to: mark the abnormal patterns, abnormal types and countermeasures of abnormal nodes to form a training data set or an abnormal node knowledge base, where the abnormal patterns include the graph structure characteristics and communication behavior characteristics of the abnormal nodes; train a preset target recognition model based on the training data set, or connect the abnormal node knowledge base to a preset retrieval enhancement generation model to obtain an abnormal location model for abnormal node identification based on the abnormal location model.

[0125] Optionally, in some embodiments, the processing module 204 is further used to: isolate abnormal nodes; wherein, isolating abnormal nodes specifically includes: predicting the recovery time of isolated normal nodes, and adjusting the network structure according to the predicted time; optimizing the isolation efficiency of the minimum cut set to reduce isolation costs and reduce the number of isolated nodes; repairing and replacing isolated nodes: predicting the recovery time of isolated nodes, and adjusting the network structure according to the predicted time.

[0126] Optionally, in some embodiments, the processing module 204 is further specifically used to: evaluate and predict the overall security and stability of the network based on abnormal node identification and network anomaly prediction results; propose optimization measures based on network security evaluation results; issue early warnings for network security threats; predict the effectiveness of network anomaly handling measures and evaluate the feasibility of the effects; and optimize and allocate resources in the network based on the network anomaly handling effect evaluation results.

[0127] Since the embodiments of the device part correspond to the embodiments of the above-mentioned method, please refer to the above-mentioned method embodiments for the introduction of the computing power network abnormal node identification device provided by the embodiment of the present invention. The embodiment of the present invention will not be repeated here, and it has the same beneficial effects as the above-mentioned computing power network abnormal node identification method.

[0128] The present invention also provides a computer device, which includes a memory and a processor. The memory stores computer-readable instructions. When the computer-readable instructions are executed by the processor, the processor executes the above-mentioned method for identifying abnormal nodes in a computing power network. Figure 9This is a schematic diagram of the functional modules of a computer device provided in an embodiment of the present invention. Computer device 300 may vary significantly depending on configuration or performance. It may include one or more processors (Central Processing Units, CPUs) 310 (e.g., one or more processors), memory 320, and one or more storage media 330 (e.g., one or more mass storage devices) storing application programs 333 or data 332. Memory 320 and storage media 330 may be either transient or persistent storage. The program stored in storage media 330 may include one or more modules (not shown), each of which may include a series of instructions operating on computer device 300. Furthermore, processor 310 may be configured to communicate with storage medium 330 to execute the series of instructions stored in storage medium 330 on computer device 300.

[0129] The computer device 300 may further include one or more power supplies 340, one or more wired or wireless network interfaces 350, one or more input and output interfaces 360, and / or one or more operating systems 331, such as Windows Server, Mac OS X, Unix, Linux, FreeBSD, etc. It will be appreciated by those skilled in the art that Figure 9 The illustrated computer device structure does not limit the computer device and may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently.

[0130] The present invention also provides a computer-readable storage medium, which may be a non-volatile computer-readable storage medium or a volatile computer-readable storage medium. The computer-readable storage medium stores instructions, which, when executed on a computer, enable the computer to execute the above-mentioned method for identifying abnormal nodes in a computing power network.

[0131] Those skilled in the art will clearly understand that, for ease and brevity of description, the specific operating processes of the apparatus described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here. If the integrated modules or units are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the portion that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions for causing a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the various methods of the present invention. The aforementioned storage media include various media capable of storing program code, such as USB flash drives, mobile hard drives, read-only memories (ROMs), random access memories (RAMs), magnetic disks, or optical disks.

[0132] As described above, the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that the technical solutions described in the above embodiments can still be modified, or some of the technical features thereof can be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for identifying abnormal nodes in a computing network, characterized in that: include: Build a network topology based on the node information of each node and the link information of each link in the current computing power network; Extracting graph structure features and communication behavior features of the nodes to be tested based on the graph structure of the network topology graph; Obtaining a normal node feature distribution model, and calculating the deviation of the node to be tested based on the normal node feature distribution model, the graph structure feature, and the communication behavior feature; The node to be tested whose deviation is greater than a preset deviation threshold is identified as an abnormal node.

2. The method for identifying abnormal nodes in a computing power network according to claim 1, characterized in that: The network topology diagram is constructed based on the node information of each node and the link information of each link in the current computing power network, including: After receiving the periodic polling instruction and / or the event-driven instruction, collecting the node information of each node and the link information of each link in the current computing power network; Preprocessing the node information and the link information, wherein the preprocessing includes at least one of data cleaning, normalization, and dimensionality reduction; Creating a graph structure class, and storing the node information of each node and the associated link information through the graph structure class to obtain the graph structure; Based on the graph structure, each node is mapped as a vertex, and each link is mapped as an edge to construct the network topology graph.

3. The method for identifying abnormal nodes in a computing power network according to claim 1, characterized in that: The graph structure characteristics include node degree, node centrality and node clustering coefficient, and the communication behavior characteristics include communication frequency, data transmission volume and response time; The extracting of graph structure features and communication behavior features of the node to be tested based on the graph structure of the network topology graph includes: Counting the total number of adjacent nodes directly connected to the node to be tested in the network topology graph to obtain the node degree; Calculate the influence weight of the node to be tested in the network topology graph to obtain the node centrality; Counting the actual number of connected edges between all adjacent nodes of the node to be tested, and calculating the ratio of the actual number of connected edges to the maximum number of connectable edges between adjacent nodes, to obtain the node clustering coefficient; Counting the number of communication interactions between the node to be tested and each adjacent node within a preset unit time to obtain the communication frequency; Calculating the total amount of data packets sent or received by the node to be measured within the preset unit time to obtain the data transmission volume; The average delay time from receiving data to sending data of the node to be tested is calculated to obtain the response time.

4. The method for identifying abnormal nodes in a computing power network according to claim 1, characterized in that: The obtaining of a normal node feature distribution model and calculating the deviation of the node to be tested based on the normal node feature distribution model, the graph structure feature, and the communication behavior feature includes: Performing statistical analysis or machine learning analysis on historical normal nodes to obtain the normal node feature distribution model, wherein the normal node feature distribution model includes normal graph structure features and normal communication behavior features; Generating a normal node feature vector based on the normal graph structure feature and the normal communication behavior feature; Clustering the normal node feature vectors to obtain at least one cluster center of the historical normal node in the network topology graph; Generating a feature vector of the node to be measured based on the graph structure feature and the communication behavior feature of the node to be measured; The distance between the feature vector of the node to be measured and the nearest cluster center is calculated to obtain the deviation.

5. The method for identifying abnormal nodes in a computing power network according to claim 1, characterized in that: After identifying the node to be tested whose deviation is greater than a preset deviation threshold as an abnormal node, the method further includes: Monitoring whether there is abnormal data in the real-time response event data, communication records, and data flow data of the node to be tested, and if abnormal data exists, confirming that the node to be tested is an abnormal node; Determine whether each adjacent node of the node to be tested is identified as an abnormal node, and if there is an adjacent node identified as an abnormal node, confirm that the node to be tested is an abnormal node; Otherwise, the node to be tested is marked as a normal node.

6. The method for identifying abnormal nodes in a computing power network according to claim 1, characterized in that: After identifying the node to be tested whose deviation is greater than a preset deviation threshold as an abnormal node, the method further includes: Based on the deviation degree, average network connectivity, feature reference threshold and abnormal association status of the abnormal node, an abnormal score of the abnormal node is evaluated; Determining the abnormality level of the abnormal node based on the score interval in which the abnormality score falls; Based on the abnormality level, the response rules and response priority of the abnormal node are configured.

7. The method for identifying abnormal nodes in a computing power network according to claim 1, characterized in that: After identifying the node to be tested whose deviation is greater than a preset deviation threshold as an abnormal node, the method further includes: Annotating the abnormal pattern, abnormal type, and countermeasures of the abnormal node to form a training data set or an abnormal node knowledge base, wherein the abnormal pattern includes the graph structure features and the communication behavior features of the abnormal node; The preset target recognition model is trained based on the training data set, or the abnormal node knowledge base is connected to the preset retrieval enhancement generation model to obtain an abnormal location model for abnormal node identification based on the abnormal location model.

8. A computing power network abnormal node identification device, characterized in that: The computing power network abnormal node identification device includes: A construction module is used to construct a network topology based on the node information of each node and the link information of each link in the current computing power network; An extraction module, configured to extract graph structure features and communication behavior features of the node to be tested based on the graph structure of the network topology graph; A calculation module, configured to obtain a normal node feature distribution model, and calculate the deviation of the node to be tested based on the normal node feature distribution model, the graph structure feature, and the communication behavior feature; The processing module is configured to identify the node to be tested whose deviation is greater than a preset deviation threshold as an abnormal node.

9. A computer device, characterized in that: The computer device includes: a memory and at least one processor, wherein instructions are stored in the memory; The at least one processor calls the instructions in the memory so that the computer device executes the method for identifying abnormal nodes in a computing power network according to any one of claims 1 to 7.

10. A computer-readable storage medium having instructions stored thereon, characterized in that: When the instruction is executed by the processor, the method for identifying abnormal nodes in a computing power network according to any one of claims 1 to 7 is implemented.

Images