Traffic analysis method and device, electronic equipment and storage medium

Abstract

The invention discloses a traffic analysis method and device, electronic equipment and a storage medium. The method comprises the following steps: receiving a data packet sent by at least one piece of transmission equipment; determining a sampling protocol type of the data packet according to the data packet sent by the transmission equipment; according to an analysis strategy corresponding to the sampling protocol type of the data packet, analyzing the data packet to obtain flow analysis information of the data packet; and performing traffic aggregation according to the traffic analysis information of the data packet to obtain traffic feature information corresponding to a target network private line to which the transmission equipment belongs. According to the method, the corresponding analysis strategy is configured for each sampling protocol, so that accurate extraction of key fields in data packets obtained by various sampling protocols can be ensured, and the reliability of subsequent flow analysis can be improved.

Description

Technical Field

[0001] The present disclosure relates to the field of network monitoring technology, and in particular to a traffic analysis method, device, electronic device, and storage medium. Background Art

[0002] As networks continue to expand and business complexity continues to rise, network traffic monitoring and analysis are crucial for optimizing bandwidth resource allocation and achieving cost management. However, in large-scale networks, the complexities of the devices used in network lines can lead to low accuracy in analyzing network traffic flowing through these devices in existing technologies. Summary of the Invention

[0003] Embodiments of the present application provide a traffic analysis method, device, electronic device, and storage medium to solve the problem of low accuracy in network traffic monitoring.

[0004] In a first aspect, an embodiment of the present application provides a traffic analysis method, the method comprising:

[0005] receiving a data packet sent by at least one transmission device;

[0006] Determining a sampling protocol type of the data packet according to the data packet sent by the transmission device;

[0007] Parsing the data packet according to a parsing strategy corresponding to a sampling protocol type of the data packet to obtain flow parsing information of the data packet;

[0008] Traffic aggregation is performed based on the traffic analysis information of the multiple data packets to obtain traffic feature information corresponding to the target network dedicated line to which the transmission device belongs.

[0009] In a second aspect, an embodiment of the present application provides a flow analysis device, the device comprising:

[0010] A receiving module, configured to receive a data packet sent by at least one transmission device;

[0011] a determination module, configured to determine a sampling protocol type of the data packet according to the data packet sent by the transmission device;

[0012] a parsing module, configured to parse the data packet according to a parsing strategy corresponding to a sampling protocol type of the data packet to obtain flow parsing information of the data packet;

[0013] The aggregation module is used to perform traffic aggregation based on the traffic analysis information of multiple data packets to obtain traffic feature information corresponding to the target network dedicated line to which the transmission device belongs.

[0014] In a third aspect, an embodiment of the present application further provides an electronic device, comprising a memory storing a plurality of instructions; a processor loading instructions from the memory to execute the steps of any traffic analysis method provided in the embodiment of the present application.

[0015] In a fourth aspect, an embodiment of the present application further provides a computer-readable storage medium, which stores a plurality of instructions suitable for loading by a processor to execute the steps of any traffic analysis method provided in an embodiment of the present application.

[0016] In a fifth aspect, an embodiment of the present application further provides a computer program product, including a computer program or instructions, which, when executed by a processor, implements the steps of any traffic analysis method provided in the embodiment of the present application.

[0017] By adopting the solution of the embodiment of the present application, by configuring a corresponding parsing strategy for each sampling protocol, it is possible to ensure that key fields (such as source IP address, destination IP address, port identifier, protocol type, number of bytes, etc.) in the data packets obtained by various sampling protocols are accurately extracted, which helps to improve the reliability of subsequent traffic analysis; according to the traffic parsing information, the data packets are aggregated, and the traffic characteristic information of the target network dedicated line is calculated, such as bandwidth utilization, total traffic, peak traffic, etc. By considering multiple classification dimensions, a more fine-grained traffic analysis can be provided, thereby improving the real-time and accuracy of bandwidth collection and analysis of dedicated lines in the network. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0019] Figure 1 This is a flow chart of an embodiment of the flow analysis method provided in the embodiments of the present application;

[0020] Figure 2 This is a schematic diagram of an embodiment of the process of parsing a data packet provided in the embodiment of the present application;

[0021] Figure 3 This is a schematic diagram of another embodiment of the process of parsing a data packet provided in the embodiments of the present application;

[0022] Figure 4 This is a flow chart of an embodiment of obtaining traffic characteristic information corresponding to a target network dedicated line provided in an embodiment of the present application;

[0023] Figure 5Schematic diagram of the structure of the flow analysis device provided in the embodiment of the present application;

[0024] Figure 6 It is a structural diagram of the electronic device provided in the embodiment of the present application. DETAILED DESCRIPTION

[0025] The technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all of the embodiments. According to the embodiments in the present application, all other embodiments obtained by those skilled in the art without making creative work are within the scope of protection of this application. At the same time, in the description of the embodiments of the present application, the terms "first", "second", etc. are only used to distinguish the descriptions and cannot be understood as indicating or implying relative importance. Thus, the features defined as "first" and "second" may explicitly or implicitly include one or more features. In the description of the embodiments of the present application, the meaning of "multiple" is two or more, unless otherwise clearly and specifically defined.

[0026] Currently, the leasing cost of dedicated network lines is high, and there are significant differences in the degree and frequency of use of dedicated network lines among various business departments. To achieve cost sharing, it is necessary to distinguish the actual ownership of the traffic on the dedicated network lines. In addition, in the daily work of maintaining dedicated network lines, it is difficult for users to clearly understand the traffic demand of different time periods and different businesses. When making decisions on network line expansion, it is easy to over-expand due to lack of data support, resulting in waste of resources. Moreover, public cloud dedicated lines rely on network flow logs provided by cloud providers for analysis, which not only increases management complexity but also generates additional service costs. During network operation, sudden large traffic may be caused by malicious attacks, business abnormalities, etc. At present, when sudden traffic occurs on dedicated network lines, there is a problem of not being able to quickly locate the abnormal source and destination IP and not being able to limit the abnormal traffic in time, which in turn affects the stable operation of other businesses on the dedicated line.

[0027] In view of this, the present application proposes a traffic analysis method, in which the collector receives data packets with different formats from different types of transmission equipment, converts the data packets into traffic analysis information in a unified format, and pushes it to the Kafka message queue; the server obtains the traffic analysis information from the Kafka message queue, and queries the RMS (resource management system) for matching, determines the business department to which the source and destination IP of each traffic analysis information belongs, the transmission equipment it passes through, the network dedicated line it runs, and other information, performs aggregate calculation of the traffic rate by minute, and summarizes it according to different classification dimensions (such as project ownership, traffic direction, traffic type, etc.). Calculate the traffic rate per minute; push the calculated traffic rate value and its corresponding information tag to the time series database for subsequent query and analysis; and execute a scheduled task every day to calculate the 95% peak bandwidth of the target network dedicated line under different separation dimensions based on a daily or monthly time period. For example, after sorting the traffic rates within a certain time range and removing the largest 5% of traffic rates, the maximum value in the remaining data is the 95% peak value. Through real-time monitoring and historical data analysis, it can provide immediate network performance feedback, and can also track and optimize the utilization of network dedicated lines over the long term, improving the efficiency of network dedicated line operation and maintenance and reducing costs.

[0028] Embodiments of the present application provide a traffic analysis method, apparatus, electronic device, and computer-readable storage medium.

[0029] Specifically, this embodiment will be described from the perspective of a traffic analysis device, which can be integrated into an electronic device. That is, the traffic analysis method of the embodiment of the present application can be performed by an electronic device. Optionally, the electronic device can include a terminal device. The terminal device can be a mobile phone, tablet computer, smart Bluetooth device, laptop computer, game console, or personal computer (PC).

[0030] The traffic analysis method provided in the embodiments of the present application can be applied, for example, to a traffic analysis system. The traffic analysis system may include a player terminal device and a server. The terminal device may include both receiving and transmitting hardware, i.e., a device with receiving and transmitting hardware capable of performing bidirectional communication over a bidirectional communication link. The player terminal device and the server may communicate bidirectionally via a network.

[0031] Optionally, the server may be a standalone server, or a server network or server cluster consisting of servers, including but not limited to a computer, a network host, a single network server, a set of multiple network servers, or a cloud server consisting of multiple servers. A cloud server is composed of a large number of computers or network servers based on cloud computing.

[0032] The traffic analysis method in one embodiment of the present disclosure can be run on a local terminal device or a server. When the traffic analysis method is run on a server, the method can be implemented and executed based on a cloud interaction system, wherein the cloud interaction system includes a server and a client device.

[0033] The following is a detailed description of each step in conjunction with the accompanying drawings. In this embodiment, the execution subject is a terminal device. It should be noted that the order in which the following embodiments are described does not limit the preferred order of the embodiments. Although the flowcharts illustrate a logical order, in some cases, the steps shown or described may be performed in a different order than that shown in the accompanying drawings.

[0034] The traffic analysis method of this embodiment, by configuring a corresponding parsing strategy for each sampling protocol, can ensure the accurate extraction of key fields (such as source IP address, destination IP address, port identifier, protocol, number of bytes, number of packets, etc.) in various types of sampled data packets, which helps to improve the reliability of subsequent traffic analysis; according to the traffic parsing information, the data packets are aggregated to calculate the traffic characteristic information of the target network dedicated line, such as bandwidth utilization, total traffic, peak traffic, etc. By considering multiple classification dimensions, more fine-grained traffic analysis can be provided, thereby improving the real-time and accuracy of bandwidth collection and analysis of dedicated lines in the network.

[0035] Please refer to Figure 1 The specific process of the traffic analysis method may be as follows: Steps 110 to 140, wherein:

[0036] Step 110: Receive a data packet sent by at least one transmission device.

[0037] Transmission equipment refers to equipment used to transmit, forward, and process data in the network, such as routers, switches, terminal devices (such as computers, servers, mobile devices, etc.), etc.

[0038] A data packet is a unit of data transmitted during network communications. For example, a data packet may contain information such as a header and a payload. Header information includes, but is not limited to, the source address, destination address, and protocol type. The payload is the actual content being transmitted. The payload may include, but is not limited to, HTTP request content, video stream clips, and email body text.

[0039] In some embodiments, multiple data packets may form sequence data, and the collection intervals for each data packet in the sequence data may be evenly spaced. For example, the sequence data may include a combination of data packets acquired at the 1st second, 2nd second, ..., and 10th second. In some embodiments, the collection intervals may also be unevenly spaced, for example, transmission equipment may not collect data packets during nighttime hours. The collection intervals may be determined by system default or manually preset.

[0040] In some embodiments, a terminal device may obtain corresponding data packets through multiple transmission devices. For example, in some embodiments, data packets may be collected by a transmission device and uploaded to the terminal device via a network periodically or in real time. In some embodiments, data packets may be collected by a transmission device and uploaded to a storage device in real time, and the terminal device may read sensor data from the storage device periodically or in real time.

[0041] Step 120: Determine the sampling protocol type of the data packet according to the data packet sent by the transmission device.

[0042] A sampling protocol is the protocol used by transmission devices to collect and transmit data packets. Examples of sampling protocols include, but are not limited to, SFlow, NetFlow, and IPFIX. Different sampling protocols have different data formats and fields.

[0043] In some embodiments, one or more traffic sampling protocols may be configured on a transmission device, and the network sampling protocol of the transmission device may be flexibly configured according to different requirements and application scenarios.

[0044] In some embodiments, multiple transmission devices (such as switches and routers) are configured with corresponding traffic collection protocols (such as SFlow, NetFlow, IPFIX, etc.). The transmission devices can periodically or event-drivenly collect traffic data and generate data packets, and push the collected data packets to a unified (Virtual IP Address, VIP) virtual IP address. The virtual IP address is configured with a load balancer (such as a hardware load balancer or a software load balancer). The load balancer is responsible for distributing the received data packets to multiple physical servers through preset strategies (such as weighted polling strategies, etc.), performing traffic analysis, and determining the traffic characteristic information corresponding to the target network dedicated line to which the transmission device belongs.

[0045] Step 130 , parse the data packet according to the parsing strategy corresponding to the sampling protocol type of the data packet to obtain flow parsing information of the data packet.

[0046] Parsing strategies refer to the pre-defined parsing rules and methods based on the sampling protocol type.

[0047] Traffic parsing information is various information related to a data packet. For example, traffic parsing information can reflect information such as the content, structure, transmission path, and protocol type of the data packet. In some embodiments, traffic parsing information can include the source IP address, destination IP address, protocol type, source port, destination port, number of bytes in the data packet, number of data packets, and timestamp.

[0048] In some embodiments, the sampling protocol type may be determined by checking header information of a data packet.

[0049] Different transmission devices can use different types of sampling protocols. For example, the specific content of the SFlow protocol data packet can be read in a fixed format; for another example, for the NetFlow sampling protocol data packet, the template information in the header information can be parsed first, and the data payload of the data packet can be parsed based on the corresponding template information. Template information is used to describe the field content and format of the data flow record. The template information in the NetFlow sampling protocol data packet includes field description information, such as the source IP address, destination IP address, transmission protocol type, and other fields, as well as information such as the order and length of the fields. The fields are variable, and different network environments and monitoring requirements may require the collection of different traffic information.

[0050] After receiving a NetFlow sampling protocol packet, the terminal device can parse the packet according to the field contents defined in the template information. For example, the template defines the field order as source IP address (4 bytes) -> destination IP address (4 bytes) -> transport protocol (1 byte). When parsing the packet, the terminal device can extract the corresponding field values according to this order and length.

[0051] Step 140 , performing traffic aggregation based on the traffic analysis information of the multiple data packets to obtain traffic characteristic information corresponding to the target network dedicated line to which the transmission device belongs.

[0052] Traffic characteristic information is quantitative data used to reflect the traffic characteristics of the target network dedicated line. For example, traffic characteristic information may include total traffic, average traffic, peak traffic, traffic distribution, etc.

[0053] Classification dimensions are different standards or attributes used to group traffic for statistics. Classification dimensions can be a combination of one or more dimensions.

[0054] In some embodiments, the classification dimensions include: source IP address / destination IP address, protocol type, port identifier or application identifier, business department, time period (hour, day, week, etc.), geographic location, etc. Exemplarily, the classification dimension is a five-tuple (source IP address, destination IP address, source port address, destination port address, protocol type).

[0055] It should be noted that transmission devices (such as routers and switches) are access points for network dedicated lines and are responsible for sending data packets from the local network to the target network dedicated line. A single transmission device can be connected to multiple network dedicated lines. For example, a company's headquarters router can be connected to multiple MPLS dedicated lines, each leading to a different branch office or data center. Alternatively, multiple transmission devices can be connected to the same network dedicated line. For example, routers at multiple branch offices can converge onto a single MPLS dedicated line through their own connections. Alternatively, multiple transmission devices can be connected to multiple network dedicated lines. For example, multiple branch offices can connect to multiple MPLS dedicated lines through their own routers, forming a complex network topology. The correspondence between transmission devices and network dedicated lines can be dynamically adjusted based on network status.

[0056] In some embodiments, the data packets under a certain target network dedicated line can be merged together, and statistical values such as the total number of bytes and the number of packets can be calculated to obtain the traffic characteristic information of the target network dedicated line. Alternatively, multiple data packets under the same classification dimension can be merged together, and statistical values such as the total number of bytes and the number of packets can be calculated to determine the traffic characteristic information of the target network dedicated line under multiple classification dimensions.

[0057] In some embodiments, SFLowExporter / NetFlow Exporter can be configured at the designated port of the transmission device at one end of the target network dedicated line, so that the transmission device can actively push data packets to the terminal device according to established rules. Taking into account the stability and efficiency of data collection, multiple physical servers are pointed to as collectors through VIP (virtual IP) addresses to achieve load balancing and ensure efficient and uninterrupted data collection. The collector will process the data packets and convert data packets of different formats into structured data that can be processed by downstream modules (such as JSON, CSV, database records, etc.), and push them to the message queue (such as Kafka message queue).

[0058] By collecting traffic analysis information, aggregating traffic, classifying it by multiple dimensions, and generating dedicated line traffic indicators, we can ensure efficient analysis and utilization of network traffic data, detect abnormal traffic, and rationally allocate network resources.

[0059] When using Multiprotocol Label Switching (MPLS) forwarding technology, since MPLS forwarding operates between the network layer and the data link layer, it requires the introduction of labels to improve packet forwarding efficiency. The SFlow sampling protocol collects information from the data link layer, network layer, transport layer, and application layer, so MPLS packets are also collected by transmission devices. By analyzing the MPLS packet format and basing it on the SFlow protocol specification, full compatibility is achieved. In classic SFlow packets, the IP protocol data follows the data link layer data frame. The inclusion of MPLS forwarding technology prevents SFlow parsing rules from matching the IP protocol data and, consequently, correctly parsing the corresponding SFlow packet. In the MPLS data structure, 0x8847 represents the MPLS start position in the data link layer, followed by one or more MPLS headers. By cyclically reading the header information until a label matching the bottom of the stack (e.g., "Bottom of LabelStack") is found, the traffic parsing information corresponding to the SFlow packet can be obtained. Similar parsing methods are used for other forwarding technologies.

[0060] Please refer to Figure 2 The specific process of parsing the data packet may be as follows: Steps 210 to 220, wherein:

[0061] In some embodiments, the sampling protocol type includes a first sampling protocol type, and parsing the data packet according to a parsing strategy corresponding to the sampling protocol type of the data packet to obtain traffic parsing information of the data packet includes:

[0062] Step 210: Determine an encapsulation protocol indication parameter of a data packet of a first sampled protocol type.

[0063] The first sampling protocol type is one of multiple sampling protocols. For example, the first sampling protocol type may be an SFLow sampling protocol.

[0064] The encapsulation protocol indicator parameter refers to a field or parameter in a data packet that identifies the encapsulation protocol. For example, the encapsulation protocol indicator parameter can indicate various forwarding technologies or tunneling protocols, such as MPLS (Multiprotocol Label Switching), VXLAN (Virtual eXtensible Local Area Network), and GRE (Generic Routing Encapsulation). By encapsulating and forwarding data packets within the network, specific network functions such as virtualization, isolation, and optimized transmission are implemented.

[0065] In some embodiments, the encapsulation protocol indication parameter of the data packet may be determined based on header information in the data packet.

[0066] Step 220: When the encapsulation protocol indication parameter is a specified encapsulation protocol indication parameter, query the target field in the data packet, parse the content in the target field, and obtain the flow parsing information corresponding to the data packet.

[0067] The specified encapsulation protocol indication parameter refers to a specific parameter value in the encapsulation protocol indication parameter, which is used to identify a specific encapsulation protocol or forwarding technology. For example, the specified encapsulation protocol indication parameter may be MPLS.

[0068] The target field is a specific field in a packet that is associated with a specific encapsulation protocol parameter and is used to extract traffic parsing information. For example, by querying the target field, you can extract key fields in the packet, such as the MPLS label, source IP address, destination IP address, and port identifier.

[0069] Exemplarily, in an SFlow data packet, the encapsulation protocol indication parameter can be a field with a specific identifier, such as a "protocol" field; by comparing the value of the encapsulation protocol indication parameter with a predefined specified encapsulation protocol indication parameter (MPLS), such as the specified encapsulation protocol indication parameter is "MPLS", the "protocol" field value of the current data packet is "MPLS", and the content of the target field is searched in the data packet to obtain the traffic parsing information corresponding to the data packet.

[0070] In some embodiments, the encapsulation protocol indication parameter is specified to indicate that the data packet is encapsulated based on the multi-protocol label switching technology, querying the target field in the data packet, parsing the content in the target field, and obtaining traffic parsing information corresponding to the data packet, including:

[0071] The field following multiple preset tags in the data packet is used as the target field;

[0072] Parse the content in the target field to obtain the traffic parsing information corresponding to the data packet.

[0073] A preset label is one or more labels added to a data packet based on Multi-Protocol Label Switching (MPLS). For example, a preset set of labels such as "ethernet_header," "mpls_label," and "ip_header" indicates that the Ethernet header and MPLS label header should be skipped, and the fields after the IP header should be used as the target fields.

[0074] The target field refers to the field content that appears after the position represented by the preset tag. In other words, multiple preset tags are the encapsulation structure of the data packet, and the target field includes the actual data carried after the multiple preset tags.

[0075] In some embodiments, in an MPLS-encapsulated data packet, the preset label includes an MPLS label field.

[0076] Please refer to Figure 3 The specific process of parsing the data packet may be as follows: Steps 310 to 330, wherein:

[0077] In some embodiments, the sampling protocol type includes a second sampling protocol type, and the data packet of the second sampling protocol type is sent by the transmission device based on a sampling rate corresponding to the second sampling protocol type;

[0078] Parse the data packet according to the parsing strategy corresponding to the sampling protocol type of the data packet to obtain the data packet traffic parsing information, including:

[0079] Step 310: Determine the sampling indication parameter in the data packet and obtain the template information and sampling rate corresponding to the sampling indication parameter.

[0080] The template information includes description information of multiple fields in the data packet.

[0081] The second sampling protocol type is one of multiple sampling protocols. For example, the second sampling protocol type may be the NetFlow v9 sampling protocol or the IPFIX sampling protocol.

[0082] The sampling indication parameter may be a field or parameter in a data packet used to identify the sampling information of the transmission device. The sampling information may include information such as the sampling rate, sampling period, sampling method, etc.

[0083] In some embodiments, the data packet sent by the transmission device is configured with sampling configuration parameters. Based on the sampling configuration parameters in the current data packet sent by the transmission device, and the mapping relationship between the preset sampling indication parameters and the preset template configuration parameters, the terminal device can determine the template configuration parameters corresponding to the current sampling indication parameters by looking up the table, determine the corresponding template information based on the current template configuration parameters, and parse the data packet based on the template information and the sampling rate to obtain traffic parsing information. The template indication parameter can be a field or parameter in the data packet used to identify the template. Alternatively, based on the sampling configuration parameters in the current data packet sent by the transmission device, and the mapping relationship between the preset sampling indication parameters and the preset template information and preset sampling information, the terminal device can determine the template information and sampling information corresponding to the current sampling indication parameters by looking up the table.

[0084] In some embodiments, one template configuration parameter corresponds to one template information, and the corresponding relationship can be determined based on experiments or experience.

[0085] In some embodiments, a sampling configuration parameter corresponds to a sampling information (eg, sampling rate), and the corresponding relationship can be determined based on experiments or experience. In some embodiments, the corresponding sampling information can be determined based on a sampling indication parameter in a current data packet.

[0086] In some embodiments, a data packet sent from a transmission device is configured with sampling configuration parameters and template configuration parameters. The terminal device may search a preset database based on the sampling configuration parameters and template configuration parameters in the current data packet sent by the transmission device to determine whether there are matching sampling configuration parameters and matching template configuration parameters. If so, the terminal device may determine the corresponding sampling information and template information based on the sampling configuration parameters and template configuration parameters in the current data packet.

[0087] Exemplarily, a search vector may be constructed based on the sampling configuration parameters and template configuration parameters in the current data packet, and a search may be performed in a preset database based on the search vector to determine a target vector that meets the matching conditions.

[0088] The preset database is used to store, index, and query vectors. It can store multiple reference vectors. Reference vectors can be constructed from historical data or manually preset.

[0089] In some embodiments, a preset database may be constructed based on multiple reference vectors, using each preset sampling indication parameter and the corresponding preset template configuration parameter as a reference vector.

[0090] A matching condition may refer to a judgment condition used to determine a target vector. The matching condition may include, for example, a vector distance from a search vector being less than a threshold. There are various methods for calculating vector distance, such as Euclidean distance and cosine distance. The first distance may be a system preset value, a system default value, or the like.

[0091] In some embodiments, the template information corresponding to the preset template configuration parameters in the target vector may be used as the template information for parsing the data packet.

[0092] In some embodiments, if the sampling indication parameters and template configuration parameters in the current data packet do not have a matching target vector in the preset data block, it indicates that there is a data anomaly or potential risk, and the data packet is discarded.

[0093] For example, the terminal device may maintain a mapping relationship between the sampling indication parameter and the template configuration parameter. When receiving a data packet, the terminal device may find the corresponding sampling rate according to the sampling indication parameter and find the corresponding field definition according to the template configuration parameter.

[0094] If a mismatch is found between the two, the data can be determined to be erroneous. For example, if a data packet is received that is marked with a first sampling indication parameter, and in a locally stored preset database, the first sampling indication parameter corresponds to a first template configuration parameter, but the template indication parameter in the current data packet is a second template configuration parameter, the data packet can be marked as abnormal and further checked.

[0095] In some embodiments of this specification, the preset database allows for rapid retrieval and matching, which can reduce unnecessary calculations and improve the processing efficiency of the system.

[0096] Step 320: Parse the data packet according to the template information to obtain initial parsing information of the data packet.

[0097] The initial parsed information of a data packet refers to the original field information set related to the content of the data packet, reflecting the basic properties and structure of a single data packet. For example, the initial parsed information of a data packet may include the flow rate of the data packet.

[0098] In some embodiments, the data packet can be parsed based on the field definition, field order, etc. in the template information to obtain the data packet's traffic size, network address, and port identifier as initial parsing information of the data packet.

[0099] Step 330: Adjust the initial parsing information based on the sampling rate to obtain traffic parsing information of the data packet.

[0100] Data packet traffic parsing information refers to traffic flow information generated by adjusting and processing the sampling rate and other related parameters. Data packet traffic parsing information only reflects the content of a single packet and also infers the characteristics of the entire network traffic through statistical methods.

[0101] In some embodiments, the initial parsing information can be adjusted based on the sampling rate in various ways to obtain the traffic parsing information of the data packet. For example, based on the initial parsing information of the data packet and the sampling rate, the traffic parsing information within the sampling period can be obtained as the traffic parsing information of the data packet.

[0102] In some embodiments, based on a weighted average algorithm, a weighted summation may be performed on data packets of the second sampling protocol type within multiple sampling periods to obtain a flow size within a preset time period, where the preset time period may include multiple collection periods.

[0103] Exemplarily, the weighted average algorithm is: m=(k1*a1+k2*a2+k3*a3+....+kn*an);

[0104] Among them, k represents the weight, a represents the traffic size in different collection cycles within the preset time period, and m represents the total traffic volume within the preset time period.

[0105] The weights k1, k2, k3, ..., kn may be determined based on the sampling rates of the corresponding data packets. For example, the weight of a certain data packet may be determined based on the sampling rate and the proportional coefficient of the data packet.

[0106] The proportional coefficient can be a system preset value or a manually preset value. In some embodiments, the proportional coefficient is negatively correlated with the time interval between the time point when the data packet is collected and the current time point. For example, the larger the time interval, the smaller the proportional coefficient. For another example, the proportional coefficient can be 1.

[0107] In some embodiments, the traffic parsing information includes at least one of a transmission device identifier, traffic size, number of packets, network address, and port identifier.

[0108] The transmission device ID is used to identify the transmission device that generates traffic data, such as a unique identifier of a router, switch, or server.

[0109] The traffic size may be the traffic size of a data packet, or the traffic size within a collection period, and may be in bytes.

[0110] The number of packets indicates the number of data packets that pass through the transmission device within a specific time period (such as a collection period, or a time period corresponding to multiple collection periods).

[0111] In some embodiments, the total amount of traffic within the collection period can be determined based on the product of the traffic size of the data packets and the sampling rate.

[0112] The network address indicates the source address and destination address of the data packet. For example, the source IP address or the destination IP address.

[0113] The port identifier indicates the source port number and destination port number of the data packet and is used to identify a specific application or service.

[0114] Please refer to Figure 4 The specific process of obtaining the traffic characteristic information corresponding to the target network dedicated line may be as follows: Steps 410 to 440, wherein:

[0115] In some embodiments, traffic aggregation is performed based on traffic parsing information of multiple data packets to obtain traffic characteristic information corresponding to the target network dedicated line to which the transmission device belongs, including:

[0116] Step 410: Determine the transmission device information corresponding to the data packet according to the mapping relationship between the transmission device identifier and the transmission device information.

[0117] The dedicated line ID is a unique identifier used to identify the dedicated line of the target network.

[0118] In some embodiments, the transmission device identifier extracted from the data packet can be used as a query key to search in the RMS, and the RMS returns the transmission device information corresponding to the transmission device identifier, such as the device name (for example, "core router 01"), device type (for example, "router"), location (for example, "Data Center Area A"), etc.

[0119] Among them, RMS (Resource Management System) refers to the resource management system, which stores the metadata of transmission equipment (such as the name of the transmission equipment, the model of the transmission equipment, the location of the transmission equipment, the department to which it belongs, etc.), port status, link usage, etc.

[0120] Step 420: Determine the port information corresponding to the data packet according to the mapping relationship between the port identifier and the port information.

[0121] The port identifier can be a source port identifier or a destination port identifier. A dedicated network line is a dedicated communication link for an enterprise or operator.

[0122] In some embodiments, a query can be performed in SNMP data based on the port identifier extracted from the data packet, and the SNMP data returns the port name corresponding to the port identifier, such as "Ethernet Interface 0" or "Optical Port 1". The port identifier is used to identify the specific port where the data packet enters or leaves the transmission device.

[0123] Among them, SNMP (Simple Network Management Protocol) is a transmission equipment monitoring protocol that queries port information through OID (Object Identifier).

[0124] Transmission device information is information related to the transmission device. For example, this information may include the name of the transmission device and the computer room to which the transmission device belongs. Port information is information related to the port. For example, this information may include the source port name and the destination port name.

[0125] Step 430: Determine the target network dedicated line corresponding to the data packet based on the transmission device information and port information.

[0126] In some embodiments, the correspondence between different combinations of preset transmission device information and preset port information and different preset dedicated line identifiers can be determined based on historical data or manual presets to obtain a preset table. By querying the preset table, the dedicated line identifier corresponding to the combination of transmission device information and port information of the current data packet can be determined. The preset table can be maintained by a network management platform and is used to associate physical transmission devices with logical network dedicated lines.

[0127] In some embodiments, the RMS may be searched for a dedicated line identifier that matches the transmission device name and port name in the data packet. For example, if the transmission device name and port name in the data packet are "core router 01" and "Ethernet interface 0," the RMS may be searched for a dedicated line identifier corresponding to the network dedicated line associated with the transmission device and port.

[0128] Step 440 , based on the traffic parsing information of the plurality of data packets corresponding to the target network dedicated line, traffic characteristic information corresponding to the target network dedicated line is aggregated and obtained.

[0129] The traffic characteristic information corresponding to the target network dedicated line may be traffic indicator information of the target network dedicated line at a certain time point or time period, or traffic indicator information of the target network dedicated line under different classification dimensions.

[0130] In some embodiments, the corresponding traffic parsing information (such as source IP address, destination IP address, protocol type, port identifier, number of bytes of the data packet, number of packets, and other fields) can be classified under the corresponding target network dedicated line according to the dedicated line identifier to which each data packet belongs, and the data packets under the target network dedicated line can be grouped and summarized according to one or more classification dimensions such as time, source IP address, and destination IP address (for example, summarizing data packets within a period of time), thereby generating traffic characteristic information of the target network dedicated line under different classification dimensions.

[0131] In some embodiments, traffic feature information of each network dedicated line under different classification dimensions can be determined in a similar manner as described above.

[0132] In some embodiments, traffic feature information corresponding to the target network dedicated line is obtained by aggregating traffic parsing information of multiple data packets corresponding to the target network dedicated line, including:

[0133] Determine the classification dimensions corresponding to the target network dedicated line, which include network address and ownership information.

[0134] Determine the attribution information corresponding to the multiple network addresses based on the network addresses in the traffic parsing information of the multiple data packets under the target network dedicated line;

[0135] Based on the network address and ownership information of the data packets, the traffic analysis information of multiple data packets is aggregated to obtain the traffic feature information under the classification dimension.

[0136] Attribution information refers to the business, department, project, or other organizational unit to which a network address belongs and is used to classify and manage traffic. For example, a network address might belong to a company's sales department or a specific cloud service project. Another example is that there are multiple projects, each with multiple IP addresses. You need to query the project to which an IP address belongs, such as the project code or the cost center to which the project belongs (the same cost center may have multiple project codes).

[0137] In some embodiments, the attribution information may be stored in an IP database (IPDB), and information such as the attribution item, cost attribution item, and corresponding network segment of the IP address may be obtained by querying the IPDB.

[0138] IPDB (IP Address Database) is a network address attribution information database that stores the mapping relationship between IP addresses and projects, cost centers, and network segments.

[0139] In some embodiments, the source and destination IP addresses in a data packet can be used to query an IPDB. The IPDB returns information such as the project to which the network address belongs (e.g., "Project A"), the cost attribution project (e.g., "Cost Center X"), and the corresponding network segment (e.g., "192.168.1.0 / 24").

[0140] In some embodiments, traffic data can be classified according to the target network dedicated line, source IP address, and destination IP address. Within a time window per unit time, multiple data packets under each classification dimension are aggregated and calculated to obtain the traffic rate of the classification dimension. The traffic rate can be expressed in bit rate (such as Mbps). One unit time can include one or more sampling periods. The sum of the traffic sizes within multiple sampling periods corresponding to all data packets under the classification dimension is divided by the length of the time window to obtain the traffic rate.

[0141] In some embodiments, the network address includes a source address and a destination address, and the attribution information includes source attribution information and destination attribution information;

[0142] Source attribution information is determined based on the source address;

[0143] The destination attribution information is determined based on the destination address.

[0144] In some embodiments, the multiple classification dimensions include an IP binary classification dimension and a project binary classification dimension.

[0145] The IP binary classification dimension is based on the combination of the source and destination IP addresses and is used to uniquely identify the sender and receiver of a packet. For example, if a packet is sent from IP address 192.168.1.100 to IP address 192.168.1.200, the corresponding IP binary classification dimension is (192.168.1.100, 192.168.1.200). The IP binary tuple helps analyze traffic between specific hosts.

[0146] The project binary classification dimension is a classification dimension determined based on the combination of the source project and the destination project. It is used to identify the business, project, or cost center to which the traffic belongs. For example, if a data packet is sent from "Project A" to "Project B," the corresponding project binary classification dimension is (Project A, Project B).

[0147] In some embodiments, the total traffic and average traffic of a certain IP binary classification dimension (192.168.1.100, 192.168.1.200) within 1 minute can be calculated as traffic feature information of the IP binary classification dimension.

[0148] In some embodiments, the total flow of a binary classification dimension of a certain project (project A, project B) within 1 minute and the average flow can be calculated as the flow feature information of the binary classification dimension of the project.

[0149] In some embodiments, the traffic feature information based on the IP binary classification dimension and the project binary classification dimension can be an aggregation of the traffic parsing information of each of the two, or an aggregation of traffic parsing information of different IP binary classification dimensions subdivided under the project binary classification dimension, which can be used flexibly according to needs.

[0150] For example, under the binary classification dimension of a specific project, traffic feature information of different IP binary classification dimensions is counted.

[0151] For example, under the binary classification dimension of project (Project A, Project B):

[0152] The total traffic of the IP binary classification dimension (192.168.1.100, 192.168.1.200) is 500MB, and the average traffic rate is 8.33Mbps.

[0153] The total traffic of the IP binary classification dimension (192.168.1.101, 192.168.1.201) is 300MB, and the average traffic rate is 5Mbps.

[0154] In some embodiments, determining the attribution information corresponding to the data packet based on the network address corresponding to the data packet includes:

[0155] When the network address corresponding to the data packet is a network address within a preset network segment, the attribution information corresponding to the data packet is determined according to the network address corresponding to the data packet.

[0156] A preset network segment is a predefined range of IP addresses used to identify a specific network area or subnet.

[0157] By presetting network segments, you can quickly determine whether a data packet belongs to a specific network area, so as to perform corresponding management and analysis.

[0158] In some embodiments, the source IP address and destination IP address in a data packet can be compared with a preset network segment to determine whether the network address belongs to the preset network segment. For example, if the preset network segment is 192.168.1.0 / 24, the source IP address of the data packet is 192.168.1.100, and the destination IP address is 192.168.1.200, the comparison shows that both belong to the preset network segment.

[0159] In some embodiments, if it is confirmed that the network address in the data packet belongs to a preset network segment, its ownership information (such as the project, department, cost center, etc.) can be determined based on the configuration of the preset network segment.

[0160] When processing large-scale network traffic data, high throughput places a high load on downstream systems. For example, there are a large number of IP addresses and a high query frequency; some public IP addresses or IP addresses in uncontrolled network segments do not need to participate in attribution matching; IP attribution information is frequently updated dynamically and cache consistency needs to be maintained.

[0161] For the processing of transmission equipment and network dedicated lines, since the data volume is relatively small and the update frequency is low, in some embodiments, a local memory cache can be used to store the information of the queried transmission equipment and network dedicated lines. The queried transmission equipment and network dedicated lines in the cache are configured with corresponding expiration times, for example, 30 seconds to 5 minutes, to ensure that the cached data has a certain timeliness.

[0162] In some embodiments, when processing IP attribution queries, a network whitelist can be set up to filter out IP addresses not managed by the IPDB. For example, public IP addresses outside the company typically do not require detailed attribution queries. The whitelist mechanism can directly filter out IP address query requests, reducing query pressure on the IPDB and improving system response speed.

[0163] In some embodiments, IPDB update events, including virtual IP changes and network segment adjustments, can be monitored in real time. Upon detecting an update event, the relevant cache is invalidated and the latest data is retrieved from the IPDB. This ensures the accuracy of traffic attribution information and avoids errors caused by outdated cached data.

[0164] In some embodiments, when recording traffic data, in order to avoid duplicate traffic recording, the actual collection port of the data packet can be identified and only one of the inbound port or outbound port can be selected for matching the network dedicated line, thereby improving the accuracy and reliability of the data.

[0165] In some embodiments, the method further comprises:

[0166] Determine the planning information of the target network dedicated line based on the traffic characteristic information of the target network dedicated line and / or the relationship between the traffic characteristic information of the target network dedicated line under multiple classification dimensions and the preset indicator threshold.

[0167] The planning information includes at least one of expansion information and reduction information.

[0168] The traffic feature information under multiple classification dimensions may be real-time traffic feature information or historical traffic feature information.

[0169] Preset indicator thresholds can be used to determine the threshold conditions for the size of traffic characteristic information. Preset thresholds are set based on historical data, business needs, and network planning goals.

[0170] Expansion information is information related to capacity expansion. Capacity expansion can be achieved by adding a target network dedicated line or increasing the capacity of the target network dedicated line.

[0171] The scaling information is information related to scaling. Scaling can be achieved by reducing a dedicated network line or reducing the capacity of the dedicated network line.

[0172] The collected traffic characteristics can be compared with preset indicator thresholds. For example, the traffic characteristics include utilization. If the utilization exceeds 80%, it indicates that the target network dedicated line may be facing bandwidth shortages and needs to be expanded. If the utilization is less than 20%, it indicates that the target network dedicated line has excess resources and can be reduced.

[0173] For example, the bandwidth cap (e.g., 10Gbps) of the target network dedicated line when purchased from the operator can be used as a preset indicator threshold. If the bandwidth cap is exceeded, data packets on the target network dedicated line will be lost. The actual traffic rate on the target network dedicated line per minute can be calculated from the collected data packets, which serves as the actual operating bandwidth of the target network dedicated line. By comparing the bandwidth cap and the actual operating bandwidth, it is decided whether to purchase (increase) or terminate (reduce) a dedicated line. For example, in the same direction (e.g., Hangzhou -> Beijing), two target network dedicated lines are usually used for redundancy, and the failure of one of the dedicated lines will not cause any impact. When the utilization rate of a network dedicated line is low and the acceptable failure risk (inability to communicate for a short period of time) is less than or equal to the preset risk threshold, it can be chosen to merge (reduce one line).

[0174] Acceptable failure risk refers to the system or business's tolerance for communication interruption when a network link fails (such as a dedicated line outage). For example, acceptable failure risk can include the duration of the interruption and the scope of impact.

[0175] In some embodiments, the acceptable failure risk after dedicated line merging can be quantified based on a quantitative risk assessment model.

[0176] In some embodiments, the quantitative risk assessment model can be a machine learning model, a preset algorithm, or a formula. For example, the inputs to the quantitative risk assessment model can include the historical failure rate of the dedicated line, the weight of the affected business value, and the expected recovery time, and the output of the quantitative risk assessment model can include an acceptable failure risk.

[0177] In some embodiments, the quantitative risk assessment model can be a preset formula. For example, acceptable failure risk = w1*Pf+w2*Is+w3*Rt, where:

[0178] Pf is the historical failure rate of the dedicated line (e.g., 0.01 times / year), Is is the weight of the affected business value, Rt is the expected recovery time, and w1, w2, and w3 are the weights of each dimension. If the calculated acceptable failure risk is lower than the preset risk threshold, a determination is made as to whether the target network dedicated line can be merged.

[0179] In some embodiments, relevant information and association relationships of the target network dedicated line are obtained, and the relevant information and association relationships of the target network dedicated line are processed based on a traffic prediction model to determine the traffic characteristic information of the target network dedicated line in a target time period after a target time point. Based on the relationship between the traffic characteristic information of the target time period and a preset indicator threshold, the planning information of the target network dedicated line is determined.

[0180] In some embodiments, the relevant information may be data and / or information that directly or indirectly reflects the traffic flow of the dedicated line during the target time period. In some embodiments, the relevant information may include traffic-related information for multiple dedicated lines during a historical time period prior to the target time point. The target time point may be a current or future time point, and the historical time period may be a time period prior to the target time point.

[0181] In some embodiments, the relevant information may include at least one of dedicated line type, evaluated information, traffic characteristic information of a historical time period, and traffic characteristic information of a current time period. The current time period may be a period of time before and / or after the current time point.

[0182] In some embodiments, the dedicated line type can be determined according to the bandwidth of the dedicated line (such as high speed, medium speed, low speed) and the service level agreement (SLA) (such as high guarantee, standard guarantee, basic guarantee).

[0183] In some embodiments, the evaluated information may be user comments on the target network dedicated line. For example, the evaluated information may be user evaluation or rating information on the dedicated line performance, stability, service quality, etc.

[0184] In some embodiments, the historical time period may be a past time period corresponding to the target time period. For example, if the current time is 9:00 AM Beijing time on Tuesday, the target time period is 5:00-6:00 PM Beijing time on Tuesday, and the historical time period is 5:00-6:00 PM Beijing time on Monday. The traffic feature information of the historical time period may refer to the statistical features of the traffic feature information within the historical time period (e.g., maximum value, minimum value, median, mean, etc.).

[0185] In some embodiments, the traffic characteristic information for the current time may be the total traffic volume at the current time. In some embodiments, the traffic characteristic information for a historical time period may be the total traffic volume within the historical time period. The traffic characteristic information for the current time period and the traffic characteristic information for the historical time period can largely reflect the total traffic volume of the dedicated line in a certain time period in the future. For example, if the target time period is the peak period of this Saturday, and the peak period of the previous Saturday is used as the historical time period, the traffic volume in the historical time period can largely reflect the traffic volume in the target time period.

[0186] In some embodiments, the association relationship may include multiple traffic-related relationships of the target network dedicated line (for example, between the source IP address and the destination IP address, and between the business project to which the source IP address belongs and the business project to which the destination IP address belongs).

[0187] In some embodiments, the association relationship includes a business relationship between multiple source and destination IP addresses of the target network dedicated line. The business relationship includes business similarity and / or business inheritance.

[0188] In some embodiments, the service similarity can be the degree of similarity between different services or projects under the target network dedicated line. The service similarity can reflect the mutual influence of traffic between different services or projects to a certain extent.

[0189] In some embodiments, the traffic prediction model can be a trained machine learning model used to predict dedicated line traffic for a specific time period in the future. The traffic prediction model can be built based on a variety of machine learning models, such as the Long Short-Term Memory (LSTM) model, the Gate Recurrent Unit (GRU) model, and the Graph Neural Network (GNN) model.

[0190] In some embodiments, the traffic prediction model may include a traffic layer and a prediction layer.

[0191] In some embodiments, the traffic layer can be used to process relevant information and associations and extract traffic characteristics of multiple dedicated lines. In some embodiments, the input of the traffic layer can be feature data obtained by preprocessing the relevant information and associations (for example, normalization, discretization, etc.), and the output of the traffic layer can be the traffic characteristics of the dedicated line in vector form. The traffic layer can be constructed based on a variety of machine learning models. In some embodiments, the traffic layer may include but is not limited to: Long Short-Term Memory (LSTM) model, Gate Recurrent Unit (GRU) model and Graph Neural Networks (GNN) model, etc.

[0192] In some embodiments, the prediction layer can determine the traffic of the target network dedicated line in the target time period after the target time point based on the traffic characteristics of the target network dedicated line extracted by the traffic layer. In some embodiments, the input of the prediction layer can be the traffic characteristics of the target network dedicated line, and the output of the prediction layer can be the traffic characteristic information of the target network dedicated line in the target time period after the target time point. The traffic characteristic information output by the prediction layer can be represented in a variety of ways. For example, a level can be used to represent the traffic. The prediction layer can be built based on a variety of machine learning models. In some embodiments, the prediction layer can include but is not limited to: decision tree (Decision Tree), random forest (Random Forest, RF) and support vector machine (Support Vector Machine, SVM), etc.

[0193] In some embodiments, the prediction layer may be a fully connected layer that can predict the traffic of the target network dedicated line in a target time period after a target time point based on the traffic characteristics of the target network dedicated line extracted by the traffic layer.

[0194] The methods described in some embodiments of this specification not only consider information about the target dedicated network line itself when predicting traffic flow on the target dedicated network line, but also consider the interactions between source and destination addresses within the dedicated network line, thereby making the prediction more accurate. In some embodiments, a machine learning model is used to process information about the dedicated network line and the relationships between source and destination addresses within the dedicated network line, thereby achieving more accurate results with higher processing efficiency.

[0195] In some embodiments, the traffic layer in the traffic prediction model is a GNN model, which uses multiple dedicated lines as graph nodes and associations as graph edges. For ease of description, in one or more embodiments of this specification, the graph corresponding to this GNN model is referred to as a dedicated line traffic graph.

[0196] A dedicated line traffic graph includes multiple nodes (for example, Node 1, Node 2, etc.), where Node 1 and Node 2 represent the source IP address or destination IP address in a network address. The dedicated line traffic graph also includes multiple edges (for example, Edge 1, Edge 2, etc.), where an edge represents the relationship between multiple network addresses.

[0197] In some embodiments, the node characteristics of the dedicated line traffic graph may include relevant information.

[0198] In some embodiments, the terminal device can pre-process the relevant information and use it as node features in the dedicated line traffic graph. For example, the terminal device can use one-hot encoding to digitize the dedicated line type, evaluated information, etc. In some embodiments, the edge features of the dedicated line traffic graph can be association relationships.

[0199] In some embodiments, the terminal device may pre-process the association relationship and use it as an edge feature of the dedicated line traffic graph. For example, the terminal device may use one-hot encoding to digitize the service relationship.

[0200] The methods described in some embodiments of this specification use a GNN model to process relevant information and associations of the target network dedicated line, so that the traffic features extracted by the traffic layer fully integrate the impact of the traffic of the associated dedicated line on the traffic of the target network dedicated line, thereby making the traffic prediction results of the target network dedicated line more accurate.

[0201] In some embodiments, the method further comprises:

[0202] According to the traffic feature information under different classification dimensions, the traffic feature information under each classification dimension is sorted to obtain a sorting result, and the sorting result is displayed on the user interface.

[0203] In some embodiments, based on a preset time point (e.g., early in the morning every day), yesterday's traffic feature information and the traffic feature information from the first day of the month to the present can be pulled from the time series database according to classification dimensions such as the computer room type classification dimension, the project classification dimension, the cost center classification dimension, and the IP classification dimension. For the original traffic feature information pulled from each classification dimension, if there is a traffic rate missing at a time point (corresponding to no traffic information at that time point), the point is filled with a zero value. Afterwards, the data is sorted according to the traffic rate, and after removing the top 5% of the data, the maximum value of the traffic rate is obtained as the 95-peak value. Among them, the 95-peak value can be compared with the preset indicator threshold to determine the size of the dedicated line peak traffic and determine whether the dedicated line needs to be expanded or reduced.

[0204] The data center type classification dimension aggregates data based on the data center type (e.g., core data center, edge node) to which the recipient belongs. The project classification dimension aggregates data based on the business project to which the IP belongs (e.g., "R&D Department," "Marketing Department"). The cost center classification dimension categorizes data based on the cost accounting unit corresponding to the IP address for financial allocation. The IP classification dimension analyzes traffic based on individual IP addresses for fine-grained monitoring.

[0205] In some embodiments, the traffic characteristic information includes at least one of traffic rate, number of packets, traffic size, packet loss rate, and utilization rate within a period of time.

[0206] Traffic rate refers to the amount of data transmitted by a dedicated network line per unit time, which can be expressed in bit rate, such as Mbps (megabits per second) or Gbps (gigabits per second).

[0207] The number of packets refers to the number of data packets that pass through the network dedicated line within a period of time.

[0208] Traffic size refers to the total amount of data transmitted by a dedicated network line within a period of time, which can be expressed in bytes or multiples (such as KB, MB, GB).

[0209] The packet loss rate refers to the ratio of data packets lost during network dedicated line transmission to the total number of data packets sent.

[0210] Utilization rate refers to the ratio of the actual bandwidth used by the network dedicated line to the total bandwidth of the network dedicated line within a certain period of time, which can be expressed as a percentage.

[0211] In some embodiments, in order to reduce the storage cost of the time series database and further save resource consumption, the data pulled during calculation can be compressed and serialized according to certain conversion rules and stored in a relational database. It is determined that when the user query is completely unaffected, not only the memory and hard disk resource usage of the time series database is reduced, but also the query performance of the time series database is improved. For example, a specific compression algorithm (such as Gzip, Snappy, LZ4, etc.) is applied to the data pulled from the time series database to reduce the data volume; the compressed data is converted into a format that is easy to store and transmit (such as JSON, Protobuf, Avro, etc.). The original time series data is still retained in the time series database for real-time query, and the compressed data can be stored in a lower-cost relational database as a backup or historical record. For the most recently or frequently accessed data, read from the time series data. For older or less frequently accessed historical data, the compressed data can be read from the relational database and returned to the user after decompression to ensure that the response speed is not affected.

[0212] This embodiment also provides a flow analysis device, which can be integrated into a terminal device. Figure 5 As shown, the flow analysis device may include:

[0213] Receiving module 501, configured to receive a data packet sent by at least one transmission device;

[0214] A determination module 502 is configured to determine a sampling protocol type of a data packet sent by the transmission device;

[0215] The parsing module 503 is configured to parse the data packet according to a parsing strategy corresponding to the sampling protocol type of the data packet to obtain flow parsing information of the data packet;

[0216] The aggregation module 504 is configured to perform traffic aggregation based on the traffic analysis information of the plurality of data packets to obtain traffic characteristic information corresponding to the target network dedicated line to which the transmission device belongs.

[0217] By adopting the solution of the embodiment of the present application, by configuring a corresponding parsing strategy for each sampling protocol, it is possible to ensure that key fields (such as source IP address, destination IP address, port identifier, protocol type, number of bytes, etc.) in the data packets obtained by various sampling protocols are accurately extracted, which helps to improve the reliability of subsequent traffic analysis; according to the traffic parsing information, the data packets are aggregated, and the traffic characteristic information of the target network dedicated line is calculated, such as bandwidth utilization, total traffic, peak traffic, etc. By considering multiple classification dimensions, a more fine-grained traffic analysis can be provided, thereby improving the real-time and accuracy of bandwidth collection and analysis of dedicated lines in the network.

[0218] Accordingly, an embodiment of the present application further provides an electronic device, which may be a terminal, such as a smartphone, a tablet computer, a laptop computer, a touch screen, a game console, a personal computer (PC), a personal digital assistant (PDA), or the like. Alternatively, the electronic device may be a server.

[0219] like Figure 6 As shown, Figure 6 Schematic diagram of the structure of an electronic device provided in an embodiment of the present application. The electronic device 600 includes a processor 601 having one or more processing cores, a memory 602 having one or more computer-readable storage media, and a computer program stored in the memory 602 and executable on the processor. The processor 601 is electrically connected to the memory 602. It will be understood by those skilled in the art that the electronic device structure shown in the figure does not constitute a limitation of the electronic device, and may include more or fewer components than shown, or combine certain components, or arrange the components differently.

[0220] The processor 601 is the control center of the electronic device 600. It connects the various parts of the entire electronic device 600 using various interfaces and lines. By running or loading software programs and / or units stored in the memory 602 and calling data stored in the memory 602, it executes various functions of the electronic device 600 and processes data, thereby monitoring the entire electronic device 600. The processor 601 can be a central processing unit (CPU), a graphics processing unit (GPU), a network processor (NP), etc., and can implement or execute the various methods, steps, and logic blocks disclosed in the embodiments of this application.

[0221] In the embodiment of the present application, the processor 601 in the electronic device 600 loads instructions corresponding to one or more application processes into the memory 602 according to the following steps, and the processor 601 runs the application stored in the memory 602 to implement various functions, such as:

[0222] receiving a data packet sent by at least one transmission device;

[0223] Determining a sampling protocol type of the data packet according to the data packet sent by the transmission device;

[0224] Parsing the data packet according to a parsing strategy corresponding to a sampling protocol type of the data packet to obtain flow parsing information of the data packet;

[0225] Traffic aggregation is performed based on the traffic analysis information of the multiple data packets to obtain traffic feature information corresponding to the target network dedicated line to which the transmission device belongs.

[0226] By adopting the solution of the embodiment of the present application, by configuring a corresponding parsing strategy for each sampling protocol, it is possible to ensure that key fields (such as source IP address, destination IP address, port identifier, protocol type, number of bytes, etc.) in the data packets obtained by various sampling protocols are accurately extracted, which helps to improve the reliability of subsequent traffic analysis; according to the traffic parsing information, the data packets are aggregated, and the traffic characteristic information of the target network dedicated line is calculated, such as bandwidth utilization, total traffic, peak traffic, etc. By considering multiple classification dimensions, a more fine-grained traffic analysis can be provided, thereby improving the real-time and accuracy of bandwidth collection and analysis of dedicated lines in the network.

[0227] The specific implementation of the above operations can be found in the previous embodiments and will not be repeated here.

[0228] Optional, such as Figure 6 As shown, the electronic device 600 further includes: a touch screen 603, a radio frequency circuit 604, an audio circuit 605, an input unit 606, and a power supply 607. Among them, the processor 601 is electrically connected to the touch screen 603, the radio frequency circuit 604, the audio circuit 605, the input unit 606, and the power supply 607 respectively. Those skilled in the art will understand that Figure 6 The electronic device structure shown in the figure does not constitute a limitation to the electronic device, and may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently.

[0229] The touch display screen 603 can be used to display a graphical user interface and receive user operations generated by the graphical user interface. The touch display screen 603 may include a display panel and a touch panel. Among them, the display panel may be used to display information input by the user or information provided to the user and various graphical user interfaces of the electronic device, and these graphical user interfaces may be composed of graphics, text, icons, videos and any combination thereof. Optionally, a liquid crystal display (LCD), an organic light emitting diode (OLED) or the like may be used to configure the display panel. The touch panel may be used to collect user touch operations thereon or near the touch panel (such as operations performed by the user using any suitable object or accessory such as a finger, stylus or the like on the touch panel or near the touch panel), and generate corresponding operation instructions, and the operation instructions execute corresponding programs. Optionally, the touch panel may include two parts: a touch detection device and a touch controller. Among them, the touch detection device detects the user's touch direction, detects the signal brought by the touch operation, and transmits the signal to the touch controller; the touch controller receives the touch information from the touch detection device, converts it into the touch point coordinates, and then sends it to the processor 601, and can receive the command sent by the processor 601 and execute it. The touch panel can cover the display panel. When the touch panel detects a touch operation on or near it, it is transmitted to the processor 601 to determine the type of touch event, and then the processor 601 provides a corresponding visual output on the display panel according to the type of touch event. In an embodiment of the present application, the touch panel and the display panel can be integrated into the touch display screen 603 to realize input and output functions. However, in some embodiments, the touch panel and the touch panel can be used as two independent components to realize input and output functions. That is, the touch display screen 603 can also be used as part of the input unit 606 to realize the input function.

[0230] The RF circuit 604 may be used to transmit and receive RF signals, so as to establish wireless communication with a transmission device or other electronic devices through wireless communication, and to transmit and receive signals with the transmission device or other electronic devices.

[0231] The audio circuit 605 can be used to provide an audio interface between the user and the electronic device through a speaker and microphone. The audio circuit 605 can convert the received audio data into an electrical signal and transmit it to the speaker, which then converts it into a sound signal for output. On the other hand, the microphone converts the collected sound signal into an electrical signal, which is received by the audio circuit 605 and converted into audio data. The audio data is then output to the processor 601 for processing, and then sent to another electronic device through the radio frequency circuit 604, or the audio data is output to the memory 602 for further processing. The audio circuit 605 may also include an earphone jack to provide communication between external headphones and the electronic device.

[0232] The input unit 606 may be configured to receive input digital, character information, or user feature information (such as fingerprint, iris, or facial information), and to generate keyboard, mouse, joystick, optical, or trackball signal inputs related to user settings and function control.

[0233] Power supply 607 is used to supply power to various components of electronic device 600. Optionally, power supply 607 can be logically connected to processor 601 via a power management system, thereby enabling the power management system to manage charging, discharging, and power consumption. Power supply 607 can also include one or more DC or AC power supplies, a recharging system, a power failure detection circuit, a power converter or inverter, a power status indicator, and other arbitrary components.

[0234] although Figure 6 Not shown in the figure, the electronic device 600 may further include a camera, a sensor, a wireless fidelity module, a Bluetooth module, etc., which will not be described in detail here.

[0235] In the above embodiments, the description of each embodiment has its own focus. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0236] Those skilled in the art will appreciate that all or part of the steps in the various methods of the above embodiments may be accomplished by instructions, or by controlling related hardware through instructions. The instructions may be stored in a computer-readable storage medium and loaded and executed by a processor.

[0237] To this end, an embodiment of the present application provides a computer-readable storage medium storing a plurality of computer programs, which can be loaded by a processor to execute any of the traffic analysis methods provided in the embodiments of the present application. The computer program can execute the following steps of the traffic analysis method:

[0238] receiving a data packet sent by at least one transmission device;

[0239] Determining a sampling protocol type of the data packet according to the data packet sent by the transmission device;

[0240] Parsing the data packet according to a parsing strategy corresponding to a sampling protocol type of the data packet to obtain flow parsing information of the data packet;

[0241] Traffic aggregation is performed based on the traffic analysis information of the multiple data packets to obtain traffic feature information corresponding to the target network dedicated line to which the transmission device belongs.

[0242] By adopting the solution of the embodiment of the present application, by configuring a corresponding parsing strategy for each sampling protocol, it is possible to ensure that key fields (such as source IP address, destination IP address, port identifier, protocol type, number of bytes, etc.) in the data packets obtained by various sampling protocols are accurately extracted, which helps to improve the reliability of subsequent traffic analysis; according to the traffic parsing information, the data packets are aggregated, and the traffic characteristic information of the target network dedicated line is calculated, such as bandwidth utilization, total traffic, peak traffic, etc. By considering multiple classification dimensions, a more fine-grained traffic analysis can be provided, thereby improving the real-time and accuracy of bandwidth collection and analysis of dedicated lines in the network.

[0243] The specific implementation of the above operations can be found in the previous embodiments and will not be repeated here.

[0244] The computer-readable storage medium may include a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0245] Since the computer program stored in the computer-readable storage medium can execute any of the traffic analysis methods provided in the embodiments of the present application, the beneficial effects that can be achieved by any of the traffic analysis methods provided in the embodiments of the present application can be achieved. Please refer to the previous embodiments for details and will not be repeated here.

[0246] According to one aspect of the present application, a computer program product or computer program is also provided, the computer program product or computer program including computer instructions stored in a computer-readable storage medium. A processor of an electronic device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the electronic device to perform the methods provided in various optional implementations of the above embodiments.

[0247] In the above-described embodiments of the flow analysis device, computer-readable storage medium, electronic device, and computer program product, the descriptions of each embodiment have different focuses. For portions not described in detail in a particular embodiment, reference can be made to the relevant descriptions of other embodiments. Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes and beneficial effects of the flow analysis device, computer-readable storage medium, computer program product, electronic device, and their corresponding units described above can be referred to in the description of the flow analysis method in the above embodiments, and will not be further elaborated here.

[0248] The above is a detailed introduction to a traffic analysis method, device, electronic device, computer-readable storage medium and computer program product provided in the embodiments of the present application. Specific examples are used herein to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea; at the same time, for technical personnel in this field, based on the ideas of the present application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A flow analysis method, characterized in that: The method comprises: receiving a data packet sent by at least one transmission device; Determining a sampling protocol type of the data packet according to the data packet sent by the transmission device; Parsing the data packet according to a parsing strategy corresponding to a sampling protocol type of the data packet to obtain flow parsing information of the data packet; Traffic aggregation is performed based on the traffic analysis information of the multiple data packets to obtain traffic feature information corresponding to the target network dedicated line to which the transmission device belongs.

2. The method according to claim 1, characterized in that The sampling protocol type includes a first sampling protocol type, and parsing the data packet according to a parsing strategy corresponding to the sampling protocol type of the data packet to obtain flow parsing information of the data packet includes: Determining an encapsulation protocol indication parameter of a data packet of the first sampling protocol type; When the encapsulation protocol indication parameter is a specified encapsulation protocol indication parameter, a target field is searched in the data packet, and the content in the target field is parsed to obtain flow parsing information corresponding to the data packet.

3. The method according to claim 2, characterized in that The designated encapsulation protocol indication parameter is used to indicate that the data packet is encapsulated based on the multi-protocol label switching technology, and the querying of the target field in the data packet and parsing the content in the target field to obtain the traffic parsing information corresponding to the data packet include: Using the field after the plurality of preset tags in the data packet as the target field; The content in the target field is parsed to obtain flow parsing information corresponding to the data packet.

4. The method according to claim 1, wherein The sampling protocol type includes a second sampling protocol type, and the data packet of the second sampling protocol type is sent by the transmission device based on a sampling rate corresponding to the second sampling protocol type; The step of parsing the data packet according to the parsing strategy corresponding to the sampling protocol type of the data packet to obtain the flow parsing information of the data packet includes: Determining a sampling indication parameter in the data packet and obtaining template information and a sampling rate corresponding to the sampling indication parameter; Parsing the data packet according to the template information to obtain initial parsing information of the data packet; Adjusting the initial parsing information based on the sampling rate to obtain flow parsing information of the data packet; The template information includes description information of multiple fields in the data packet.

5. The method according to claim 1, characterized in that The traffic analysis information includes at least one of a transmission device identifier, traffic size, packet quantity, network address, and port identifier.

6. The method according to claim 5, characterized in that The performing traffic aggregation based on the traffic analysis information of the plurality of data packets to obtain traffic characteristic information corresponding to the target network dedicated line to which the transmission device belongs includes: Determining the transmission device information corresponding to the data packet according to the mapping relationship between the transmission device identifier and the transmission device information; Determining the port information corresponding to the data packet according to the mapping relationship between the port identifier and the port information; Determining a target network dedicated line corresponding to the data packet based on the transmission device information and the port information; Traffic feature information corresponding to the target network dedicated line is obtained by aggregating traffic analysis information of multiple data packets corresponding to the target network dedicated line.

7. The method according to claim 6, characterized in that The aggregating the traffic characteristic information corresponding to the target network dedicated line based on the traffic parsing information of the multiple data packets corresponding to the target network dedicated line includes: Determine a classification dimension corresponding to the target network dedicated line, where the classification dimension includes a network address dimension and an attribution information dimension; Determining attribution information corresponding to a plurality of network addresses according to network addresses in traffic parsing information of a plurality of data packets under the target network dedicated line; Based on the network address of the data packet and the attribution information, the traffic analysis information of the plurality of data packets is aggregated to obtain traffic feature information under the classification dimension.

8. The method according to claim 7, characterized in that The network address includes a source address and a destination address, and the attribution information includes source attribution information and destination attribution information; The source attribution information is determined based on the source address; The destination attribution information is determined according to the destination address.

9. The method according to claim 1, characterized in that The method further comprises: Determine planning information for the target network dedicated line based on traffic characteristic information of the target network dedicated line and / or the relationship between traffic characteristic information of the target network dedicated line under multiple classification dimensions and preset indicator thresholds; The planning information includes at least one of expansion information and reduction information.

10. A flow analysis device, characterized in that: The device comprises: A receiving module, configured to receive a data packet sent by at least one transmission device; a determination module, configured to determine a sampling protocol type of the data packet according to the data packet sent by the transmission device; a parsing module, configured to parse the data packet according to a parsing strategy corresponding to a sampling protocol type of the data packet to obtain flow parsing information of the data packet; The aggregation module is used to perform traffic aggregation based on the traffic analysis information of multiple data packets to obtain traffic feature information corresponding to the target network dedicated line to which the transmission device belongs.

11. An electronic device, characterized in that: The system comprises a processor and a memory, wherein the memory stores a plurality of instructions; the processor loads instructions from the memory to execute the steps of the traffic analysis method according to any one of claims 1 to 9.

12. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a plurality of instructions, and the instructions are suitable for being loaded by a processor to execute the steps of the traffic analysis method according to any one of claims 1 to 9.

Images