Monitoring information full-link analysis method and system based on network message

Abstract

The invention provides a monitoring information full-link analysis method and system based on a network message, and belongs to the technical field of network monitoring, and the method comprises the steps: collecting an original message flow through a non-intrusive probe, carrying out the analysis in combination with a dynamically updated protocol fingerprint database, and employing an online random forest model and a multi-dimensional matching rule for protocol recognition; a mixed clock source is utilized to generate a time sequence metadata pipeline, and a space-time diagram convolutional network constructs a service dependence topology containing throughput and delay jitter, and an interactive link map of a final network layer, a service layer and a security three-dimensional index. The corresponding system comprises an intelligent load balance acquisition module, a stream batch integrated analysis engine and a visual platform, and the visual platform realizes multi-level permission isolation based on an SGX technology. According to the method, the problems of protocol identification lagging and weak topological relevance of a traditional monitoring system are solved, the full-link view can be dynamically constructed in real time, the operation and maintenance analysis precision and efficiency are improved, and the method is suitable for service quality monitoring and safety management and control in a complex network environment.

Description

Technical Field

[0001] The present invention relates to the field of network monitoring technology, and in particular to a method and system for full-link analysis of monitoring information based on network messages. Background Art

[0002] When the substation is operating normally, the monitoring information at the plant and station end needs to be connected to the dispatching master station so that the dispatching master station can monitor and control the normal operation of various equipment in the plant and station.

[0003] Before a substation goes into operation, the protection backend manufacturer conducts point-to-point debugging of monitoring information (both at the master station and at the backend), verifying the normal exchange of monitoring information between the dispatching master station and the substation through four remote point-to-point verifications. After the substation is operational, if a device or link in the communication link between the dispatching end and the substation fails, the monitoring data obtained by the dispatching end will become abnormal, affecting the dispatching end's normal monitoring and control of the substation. Currently, there is no full-link monitoring and analysis method to identify specific problems in the monitoring information link.

[0004] Based on this, the present invention proposes a full-link analysis method and system for monitoring information based on network messages. The invention aims to capture the network messages of each link segment of the monitoring information at the plant end and the dispatching end, and parse the network messages to determine the specific meaning of the network messages of each link segment. Through the set strategies and conditions, a comprehensive judgment is made to determine the problems in the link and send an early warning message.

[0005] Pain points of existing technologies: Traditional monitoring relies on application-layer logs, which leads to data collection blind spots and log tampering risks; network device-level monitoring lacks business semantic relevance, making it difficult to achieve end-to-end link restoration; sampling detection leads to missed reports of key events, and insufficient real-time performance affects fault response efficiency; message parsing is incomplete in multi-protocol mixed scenarios, making it difficult to model link node relationships.

[0006] Typical comparative literature

[0007] CN20181012345.6 "Network Fault Location Method Based on Log Analysis": Relies on application layer logs and cannot identify intermediate node anomalies that are not logged.

[0008] US2020 / 0367892A1 "Network Packet Sampling for Performance Monitoring": Uses fixed-ratio sampling, resulting in missed detection of low-frequency, high-damage attacks. Summary of the Invention

[0009] In order to make up for the above shortcomings, the present invention provides a full-link analysis method and system for monitoring information based on network messages, aiming to improve the problems of incomplete message parsing and difficulty in modeling link node relationships.

[0010] The present invention provides a full-link analysis method for monitoring information based on network messages:

[0011] a) Deploy non-intrusive collection probes to obtain original network message flows;

[0012] b) Build a protocol fingerprint library and perform dynamic analysis of multi-layer protocol stacks;

[0013] c) Generate metadata pipeline with time sequence markers;

[0014] d) Apply graph neural networks to build service dependency topology;

[0015] e) Output an interactive three-dimensional link map including QoS indicators.

[0016] In one embodiment of the present invention, the protocol fingerprint library (step b) contains the following rules:

[0017] Dynamic update mechanism: Automatically identify unknown protocol features based on online learning models (such as online random forest);

[0018] Multi-dimensional matching fields: including protocol header flags, payload signatures, and session interaction timing patterns.

[0019] In one embodiment of the present invention, it is characterized in that the graph neural network (step d) adopts a spatiotemporal graph convolutional network (ST-GCN), the node attributes include message throughput, delay jitter, and error bit rate, and the edge weight is dynamically calculated by the service call frequency.

[0020] In one embodiment of the present invention, the QoS indicators of the three-dimensional link graph (step e) include:

[0021] Network layer indicators: packet loss rate, bandwidth utilization;

[0022] Business-level metrics: transaction success rate, API response time percentile (P99);

[0023] Security indicators: abnormal traffic ratio, encryption protocol compliance.

[0024] In one embodiment of the present invention, the timing marking (step c) adopts a hybrid clock source synchronization mechanism, including:

[0025] Hardware-level clock: nanosecond-level time synchronization based on the PTP protocol;

[0026] Logical clock: Lamport logical clock is used to ensure the orderliness of events across nodes.

[0027] The present invention provides a full-link analysis system for monitoring information based on network messages, comprising:

[0028] Intelligent load balancing acquisition module (including hardware acceleration unit);

[0029] Stream-batch integrated analysis engine (integrated machine learning model);

[0030] A visual control platform that supports multi-user isolation.

[0031] In another embodiment of the present invention, the intelligent load balancing acquisition module supports a dynamic resource scheduling strategy, including:

[0032] Probe load prediction algorithm based on traffic entropy value;

[0033] The hardware acceleration unit integrates a programmable NP chip and supports protocol parsing offload.

[0034] In another embodiment of the present invention, the machine learning model of the stream-batch integrated analysis engine is a hybrid architecture, including:

[0035] Real-time detection layer: streaming classification model based on LightGBM;

[0036] Offline training layer: uses the Transformer architecture to generate traffic baseline features.

[0037] In another embodiment of the present invention, the multi-user isolation control platform implements the following functions:

[0038] Data sandbox: a trusted execution environment based on Intel SGX technology;

[0039] Permission grading: Dynamically allocate graph access granularity (global topology → business subgraph → single-hop node) based on user roles.

[0040] The beneficial effects of this invention are as follows: The present invention, through the above-mentioned design, provides a full-link analysis method and system for monitoring information based on network messages. This method utilizes non-intrusive network message collection, dynamic protocol parsing, time series metadata generation, graph neural network modeling, and 3D visualization technology to achieve full-link analysis of network monitoring information and construct service dependency topology. The core goal of this system is to provide high-precision, low-latency link quality assessment and anomaly detection capabilities for network operations and maintenance.

[0041] Full data acquisition at the network packet level; deep semantic analysis of the protocol stack; and spatiotemporal multi-dimensional modeling technology form a panoramic monitoring capability covering from physical networks to business logic, providing accurate diagnostic tools for complex scenarios such as 5G and the Internet of Things. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the embodiments. It should be understood that the following drawings only illustrate certain embodiments of the present invention and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other relevant drawings can be obtained based on these drawings without paying any creative work.

[0043] Figure 1 This is a flow chart of a full-link analysis method for monitoring information based on network messages provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0044] To make the purpose, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0045] Example

[0046] Please refer to Figure 1 , The present invention provides a technical solution: a full-link analysis method for monitoring information based on network messages.

[0047] The present invention provides a full-link analysis method for monitoring information based on network messages:

[0048] a) Deploy non-intrusive collection probes to obtain original network message flows;

[0049] b) Build a protocol fingerprint library and perform dynamic analysis of multi-layer protocol stacks;

[0050] c) Generate metadata pipeline with time sequence markers;

[0051] d) Apply graph neural networks to build service dependency topology;

[0052] e) Output an interactive 3D link map including QoS indicators.

[0053] Among them, non-invasive collection probe deployment (step a),

[0054] Hardware configuration:

[0055] A switch (such as the Cisco Nexus series) or a TAP device (such as the Gigamon HD-4) that supports port mirroring is used to mirror the original traffic.

[0056] Acquisition server: Intel Xeon Silver 4210 (10 cores, 2.2 GHz), 64 GB DDR4 memory, 1 TB NVMe SSD storage, equipped with a multi-port 10 Gbps NIC (such as Intel X710-DA2).

[0057] Deployment strategy:

[0058] Probes are deployed on core switches and key business nodes to cover north-south and east-west traffic.

[0059] Use DPDK (Data Plane Development Kit) to accelerate packet capture, bypassing the kernel protocol stack and achieving microsecond latency.

[0060] In one embodiment of the present invention, the protocol fingerprint library (step b) contains the following rules:

[0061] Dynamic update mechanism: Automatically identify unknown protocol features based on online learning models (such as online random forest); Algorithm parameters: Online random forest model (sklearn library), set n_estimators = 200, max_depth = 15, incremental learning step size learning_rate = 0.01.

[0062] Multi-dimensional matching fields: including protocol header flags, payload signatures, and session interaction timing patterns.

[0063] Feature extraction:

[0064] Protocol header flags: Extract fields such as Flags and Window Size from the IP / TCP / UDP header.

[0065] Payload signature: Generates a 64-bit fingerprint of the payload content using the SimHash algorithm.

[0066] Timing mode: Matches the timing of conversation interactions based on the DTW (Dynamic Time Warping) algorithm.

[0067] Storage architecture: Redis cluster is used to cache high-frequency protocol features, and Elasticsearch is used to persistently store the full fingerprint library.

[0068] In one embodiment of the present invention, the timing marking (step c) adopts a hybrid clock source synchronization mechanism, including:

[0069] Hardware-level clock: nanosecond-level time synchronization based on the PTP protocol;

[0070] Logical clock: Lamport logical clock is used to ensure the orderliness of events across nodes.

[0071] Time series metadata pipeline generation (step c),

[0072] Hybrid clock synchronization mechanism:

[0073] Hardware clock (PTP): Adopts the IEEE 1588v2 protocol, and the master clock source uses a GPS-synchronized atomic clock (such as EndRun Tempus LX), achieving nanosecond-level accuracy (±50ns).

[0074] Logical Clock (Lamport): Assigns logical timestamps to cross-node events to ensure causal consistency.

[0075] Hybrid clock synchronization enhancement mechanism:

[0076] 1. Hierarchical clock architecture

[0077] Physical layer: A dual-redundant Grandmaster architecture is used, with EndRun Tempus LX and Microchip TimeProvider 4100 deployed as hot standby devices.

[0078] Protocol layer: Extends the PTPv2 protocol, adds a quantum noise compensation algorithm (QNC-Algorithm), and uses the Kalman filter to optimize clock deviation prediction.

[0079] Application layer: Dynamically adjust the Lamport clock granularity and design a hybrid timestamp format: |physical time (64 bits) |logical sequence number (32 bits) |region code (16 bits)|.

[0080] 2. Fault Tolerance Mechanism

[0081] A three-mode redundant voting system is implemented, which automatically switches to the Beidou + Galileo dual-star joint timing mode when the GPS signal fails.

[0082] Develop a clock health evaluation model (CHEM): HEALT_SCORE = α(1-Δf / f0)+β(SNR / 10)+γ*(1-PacketLoss).

[0083] 3. Time and space consistency guarantee

[0084] Introduce Einstein synchronization correction factor: t'=t+(x / c)*cosθ.

[0085] Deploy an NTP-PTP hybrid gateway to achieve a smooth μs-level transition from the traditional NTP system.

[0086] Develop a causal path tracing algorithm to automatically construct an event correlation graph.

[0087] Metadata format:

[0088] {

[0089] "timestamp":"2023-10-01T12:34:56.789012345Z",

[0090] "src_ip":"192.168.1.1",

[0091] "dst_ip":"10.0.0.2",

[0092] "protocol":"HTTP / 2",

[0093] "payload_hash":"a1b2c3d4e5",

[0094] "latency_ns":123456

[0095] }

[0096] Enhanced metadata schema

[0097] 1. Security Enhancement Module

[0098] Quantum-safe hashing: Uses the XMSS algorithm to generate quantum-resistant payload hashes.

[0099] Dynamic metadata encryption: Lattice-based FHE homomorphic encryption scheme.

[0100] Trusted Execution Environment: Handling Sensitive Fields in Intel SGX.

[0101] 2. Intelligent analysis extension

[0102] Network situational awareness matrix: [time deviation rate, packet entropy, protocol compliance, path credibility].

[0103] Anomaly detection model: LSTM-Attention network analyzes time series features in real time.

[0104] Knowledge graph association engine: supports IP-ASN-Geo-Protocol multi-dimensional association analysis.

[0105] 3. Performance optimization design

[0106] Compression encoding scheme: Use Facebook Zstandard + custom TLV encoding format.

[0107] Fast retrieval index: Build a spatiotemporal joint index based on FST (Finite State Transducer).

[0108] Streaming processing interface: implements the gRPC+QUIC dual-channel transmission protocol.

[0109] 1. Joint spatiotemporal coding method

[0110] Proposed STC-Encoding algorithm to map physical time and logical time to Hilbert space curve

[0111] Achieve total ordering of events with nanosecond precision while preserving causal relationships.

[0112] 2. Adaptive clock synchronization mechanism

[0113] Developed a dynamic accuracy adjustment algorithm (DAA): enabled nanosecond-level synchronization when bandwidth > 1 Gbps, and switched to microsecond-level power-saving mode when bandwidth < 100 Mbps.

[0114] Design a hybrid clock drift compensation model: Δt = k1T_phy + k2T_log + ε.

[0115] 3. Trusted Verification System

[0116] Blockchain anchoring mechanism: metadata Merkle Root is written to Ethereum every 60 seconds.

[0117] Zero-knowledge proof verification: Achieving verifiability of cross-domain time synchronization.

[0118] Trusted Execution Chain: Build a complete trust chain from the clock source to the application based on TEE.

[0119] In one embodiment of the present invention, it is characterized in that the graph neural network (step d) adopts a spatiotemporal graph convolutional network (ST-GCN), the node attributes include message throughput, delay jitter, and error bit rate, and the edge weight is dynamically calculated by the service call frequency.

[0120] Specifically, the spatiotemporal graph convolutional network (ST-GCN),

[0121] Network structure:

[0122] Input layer: Node attributes (throughput, delay jitter, bit error rate) are normalized into 32-dimensional vectors.

[0123] Spatiotemporal convolutional layer: 3 layers of ST-GCN, with 64, 128, and 256 channels per layer, and GELU activation function.

[0124] Edge weight calculation: Dynamically updated based on business call frequency, the formula is:

[0125]

[0126] Training parameters:

[0127] Optimizer: AdamW, initial learning rate 3e-4, weight decay 0.01.

[0128] Loss function: topology reconstruction error (MAE) + edge weight prediction cross entropy.

[0129] Hardware acceleration: Using NVIDIA A100 GPU (80GB of video memory) to accelerate training, a single epoch takes about 15 minutes (on a scale of 1 million nodes).

[0130] The experimental design is as follows:

[0131] 1. Comparison of topological modeling accuracy

[0132] Comparing models and datasets

[0133] Baseline model:

[0134] Static graph model: GCN, GAT (based on a fixed adjacency matrix).

[0135] Dynamic graph models: T-GCN (temporal graph convolutional network), DynGNN (dynamic graph neural network).

[0136] Dataset:

[0137] The simulation generates dynamic service call data of 1 million nodes. Node attributes include throughput, latency jitter, and error rate. Edge weights are dynamically generated by call frequency (sliced by hour).

[0138] The dataset is divided into training set (70%), validation set (15%), and test set (15%), and the split is in chronological order to preserve temporal dependencies.

[0139] Evaluation indicators

[0140] Edge prediction performance: Precision, Recall, and F1-Score.

[0141] Edge weight prediction error: MAE (continuous value regression) + classification accuracy (discretized weight bucketing).

[0142] Node feature reconstruction error: MAE (reconstruction error of throughput, delay jitter, and bit error rate).

[0143] Experimental results

[0144]

[0145] Key conclusions:

[0146] ST-GCN performs best in dynamic edge weight modeling, with an F1 improvement of more than 4.6%, verifying the effectiveness of spatiotemporal joint modeling.

[0147] The node feature reconstruction error is reduced by 20%, indicating that the high-order spatiotemporal feature extraction capability is stronger.

[0148] The dynamic edge weight update mechanism makes the model sensitive to changes in call frequency, outperforming the baseline with a fixed graph structure.

[0149] Ablation experiments

[0150]

[0151] Dynamic edge weights contribute significantly (F1+7.3%), and GELU improves smoothness and reduces gradient disappearance compared to ReLU.

[0152] 2. Latency Optimization Rate

[0153] Experimental scenario

[0154] Deploy the topology predicted by ST-GCN to the simulated microservice cluster and dynamically adjust the resource allocation strategy:

[0155] Baseline strategy: round-robin load balancing + fixed fault tolerance threshold.

[0156] ST-GCN strategy: Priority scheduling based on predicted edge weights (more resources are allocated to services with high call frequency).

[0157] Performance indicators

[0158]

[0159] Key conclusions:

[0160] By dynamically sensing service dependency hotspots, the ST-GCN strategy significantly reduces latency (optimization by 30.9%) while improving system robustness.

[0161] The bit error rate dropped by 66%, verifying that topology modeling can accurately capture abnormal propagation paths.

[0162] 3. Training efficiency and scalability

[0163] Hardware configuration: single-card NVIDIA A100 (80GB), PyTorch-Geometric + DGL hybrid acceleration.

[0164] Scalability testing:

[0165]

[0166]

[0167] The memory usage increases approximately linearly with the number of nodes, and approaches the memory limit at 1 million nodes. It needs to be expanded to a larger scale through graph partitioning or subgraph sampling.

[0168] Distributed training (4 A100 cards) can achieve linear acceleration, taking 21 minutes / epoch for 2 million nodes.

[0169] In one embodiment of the present invention, the QoS indicators of the three-dimensional link graph (step e) include:

[0170] Network layer indicators: packet loss rate, bandwidth utilization;

[0171] Business-level metrics: transaction success rate, API response time percentile (P99);

[0172] Security indicators: abnormal traffic ratio, encryption protocol compliance.

[0173] Specifically, QoS indicator definition,

[0174] Network layer:

[0175] Packet loss rate:

[0176] Bandwidth utilization: calculated based on switch port counters collected through SNMP.

[0177] Business layer:

[0178] Transaction success rate: Statistics HTTP status code (2xx / 3xx ratio).

[0179] API response time P99: percentile calculated by the HdrHistogram library.

[0180] Safety indicators:

[0181] Abnormal traffic ratio: Real-time detection is performed using the Isolation Forest algorithm (contamination = 0.01).

[0182] Visualization tool: Uses the Unity3D engine to render interactive graphs, supporting drill-down by QoS indicator heat map level.

[0183] The present invention provides a full-link analysis system for monitoring information based on network messages, comprising:

[0184] Intelligent load balancing acquisition module (including hardware acceleration unit);

[0185] Stream-batch integrated analysis engine (integrated machine learning model);

[0186] A visual control platform that supports multi-user isolation.

[0187] In another embodiment of the present invention, the intelligent load balancing acquisition module supports a dynamic resource scheduling strategy, including:

[0188] Probe load prediction algorithm based on traffic entropy value;

[0189] The hardware acceleration unit integrates a programmable NP chip and supports protocol parsing offload.

[0190] In another embodiment of the present invention, the machine learning model of the stream-batch integrated analysis engine is a hybrid architecture, including:

[0191] Real-time detection layer: streaming classification model based on LightGBM;

[0192] Offline training layer: uses the Transformer architecture to generate traffic baseline features.

[0193] In another embodiment of the present invention, the multi-user isolation control platform implements the following functions:

[0194] Data sandbox: a trusted execution environment based on Intel SGX technology;

[0195] Permission grading: Dynamically allocate graph access granularity (global topology → business subgraph → single-hop node) based on user roles.

[0196] The system deployment architecture is as follows:

[0197] Edge layer: Collection probes are deployed in each network partition and upload metadata to the central cluster through Kafka.

[0198] Computational layer:

[0199] Real-time processing: Flink cluster (10 nodes, 32 cores / 128GB / 2TB SSD) handles timing marking and protocol parsing.

[0200] Offline training: The Kubernetes cluster runs the ST-GCN model and updates the topology regularly.

[0201] Storage layer: Ceph distributed storage system stores historical metadata, and Prometheus+Grafana monitors real-time indicators.

[0202] The performance indicators are as follows:

[0203] Throughput: A single probe supports 10Gbps line-speed acquisition (packet loss rate <0.001%).

[0204] Latency: End-to-end processing latency ≤ 50ms (from message capture to graph update).

[0205] Scalability: Supports horizontal expansion to 1,000 nodes, with a topology update cycle of ≤5 minutes.

[0206] Specifically, the working principle of the full-link analysis method and system for monitoring information based on network packets: The overall working principle of this solution can be summarized as the coordinated operation of the following six core stages:

[0207] 1. Intelligent data collection stage

[0208] A cluster of non-intrusive probes (supporting NP chip hardware acceleration) deployed at key network nodes captures raw packets using a combination of traffic mirroring and dynamic sampling. The probes implement intelligent load balancing based on a traffic entropy prediction algorithm. When burst traffic is detected, FPGA hardware parsing acceleration is automatically enabled, ensuring line-speed processing even in 10G network environments.

[0209] 2. Protocol intelligent analysis stage

[0210] A hybrid parsing engine uses a pre-installed syntax tree template for over 2,000 known protocols for rapid matching, while simultaneously analyzing unknown traffic characteristics in real time using an online random forest model. The parsing process deeply correlates quintuples, payload fingerprints (such as the TLS SNI field), and interaction timing (such as the DNS query-response interval), dynamically updating the protocol fingerprint library to achieve an application-layer recognition accuracy of over 92% for encrypted traffic.

[0211] 3. Spatiotemporal metadata construction stage

[0212] Based on nanosecond-level PTP clock synchronization, Lamport logical clocks are used to causally order events across data centers. This generates a metadata stream containing timestamps, protocol types, service endpoints, and QoS vectors, using the Apache Arrow columnar storage format to achieve time-series storage of millions of events per second.

[0213] 4. Topology dynamic modeling stage

[0214] The Spatiotemporal Graph Convolutional Network (ST-GCN) performs sliding analysis over a 15-minute time window. Node embedding vectors incorporate real-time throughput (smoothed by EWMA) and latency percentile statistics. Edge weights are calculated using a modified PageRank algorithm to dynamically identify implicit dependencies. The model is incrementally trained hourly to automatically discover unusual call chain patterns within microservice architectures.

[0215] 5. Multi-dimensional indicator integration stage

[0216] We perform tensor fusion on network layer metrics (such as TCP retransmission rate), business metrics (REST API P99 latency), and security metrics (such as TLS 1.2 compliance) to construct a three-dimensional feature space. We use the t-SNE dimensionality reduction algorithm to project high-dimensional QoS data into a three-dimensional coordinate system, preserving over 80% of the original data variance.

[0217] 6. Interactive situation presentation stage

[0218] The visualization engine uses WebGL to render dynamic topology maps, supporting multi-granularity exploration. A global view displays the service mesh across availability zones, while drilling down into a business subgraph reveals a gRPC call heat map. Node-level details display a real-time flame graph. Combined with Intel SGX for multi-tenant data isolation, operations personnel can only view the topology subgraphs within their authorized scope.

[0219] Through a closed-loop "collection-parsing-modeling-presentation" process, the system achieves intelligent mapping from physical network packets to business logic topology while maintaining zero network intrusion. Its core technological breakthroughs include: 1) the dynamic adaptability of online learning protocol fingerprints; 2) the deep mining of hidden service dependencies using spatiotemporal graph neural networks; and 3) the precise alignment of the three-dimensional QoS metric space with business semantics. In a typical scenario, a faulty link across five microservice nodes can be located within three seconds, achieving a sixfold improvement in diagnostic efficiency compared to traditional APM tools.

[0220] The foregoing description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Those skilled in the art will readily appreciate that various modifications and variations are possible. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of the present invention are intended to be within the scope of protection of the present invention.

Claims

1. A full-link analysis method for monitoring information based on network messages, characterized in that: include: a) Deploy non-intrusive collection probes to obtain original network message flows; b) Build a protocol fingerprint library and perform dynamic analysis of multi-layer protocol stacks; c) Generate metadata pipeline with time sequence markers; d) Apply graph neural networks to build service dependency topology; e) Output an interactive three-dimensional link map including QoS indicators.

2. A method for full-link analysis of monitoring information based on network messages according to claim 1, characterized in that: The protocol fingerprint library (step b) contains the following rules: Dynamic update mechanism: Automatically identify unknown protocol features based on online learning models (such as online random forest); Multi-dimensional matching fields: including protocol header flags, payload signatures, and session interaction timing patterns.

3. A method for full-link analysis of monitoring information based on network messages according to claim 1 or 2, characterized in that: The graph neural network (step d) adopts a spatiotemporal graph convolutional network (ST-GCN), and the node attributes include message throughput, delay jitter, and error bit rate. The edge weight is dynamically calculated by the service call frequency.

4. A method for full-link analysis of monitoring information based on network messages according to claim 1, characterized in that: The QoS indicators of the three-dimensional link map (step e) include: Network layer indicators: packet loss rate, bandwidth utilization; Business-level metrics: transaction success rate, API response time percentile (P99); Security indicators: abnormal traffic ratio, encryption protocol compliance.

5. A method for full-link analysis of monitoring information based on network messages according to claim 1, characterized in that: The timing mark (step c) adopts a hybrid clock source synchronization mechanism, including: Hardware-level clock: nanosecond-level time synchronization based on the PTP protocol; Logical clock: Lamport logical clock is used to ensure the orderliness of events across nodes.

6. A full-link monitoring information analysis system based on network messages that implements the method of claim 1, comprising: Intelligent load balancing acquisition module (including hardware acceleration unit); Stream-batch integrated analysis engine (integrated machine learning model); A visual control platform that supports multi-user isolation.

7. A full-link analysis system for monitoring information based on network messages according to claim 6, characterized in that: The intelligent load balancing acquisition module supports dynamic resource scheduling strategies, including: Probe load prediction algorithm based on traffic entropy value; The hardware acceleration unit integrates a programmable NP chip and supports protocol parsing offload.

8. A full-link analysis system for monitoring information based on network messages according to claim 6, characterized in that: The machine learning model of the integrated stream-batch analysis engine is a hybrid architecture, including: Real-time detection layer: streaming classification model based on LightGBM; Offline training layer: uses the Transformer architecture to generate traffic baseline features.

9. A monitoring information full-link analysis system based on network messages according to claim 6, characterized in that: The multi-user isolation control platform realizes the following functions: Data sandbox: a trusted execution environment based on Intel SGX technology; Permission grading: Dynamically allocate graph access granularity (global topology → business subgraph → single-hop node) based on user roles.

Images