Server-oriented automatic security operation and maintenance method and device and electronic equipment

Abstract

The invention relates to the technical field of server data processing, in particular to a server-oriented automatic security operation and maintenance method and device and electronic equipment, and the method comprises the steps: 1, obtaining a traffic change curve of a target server; 2, setting a flow rising interval according to the flow change curve; 3, setting a data set based on the peak point, and calculating a characteristic change curve of the data set; 4, identifying a growth curve of the real-time flow data, and performing combined analysis on the growth curve and the characteristic change curve to determine a flow predicted value; according to the traffic prediction value of the target server, resource planning is carried out on the target server in advance, resource allocation is adjusted in time or network setting is optimized in time, the service smoothness can be guaranteed, and the user satisfaction degree is improved.

Description

Technical Field

[0001] The present invention relates to the field of server data processing technology, and in particular to a server-oriented automated security operation and maintenance method, device, and electronic equipment. Background Art

[0002] A server is a specialized computer system designed to provide services, resources, or data to other computers (usually called clients) through network requests.

[0003] Prior art CN116170302A discloses a server operation and maintenance method, apparatus, operation and maintenance server, and server operation and maintenance system, comprising: obtaining registration information corresponding to a program generated by a program server when detecting that a program on the program server itself has been started, storing the registration information in a preset registration information database, obtaining operating parameter information of the program corresponding to the registration information in the program server for any registration information stored in the preset registration information database, and sending all the operating parameter information to a client; However, during the operation of the server, the server resources are limited. If the server traffic data increases during a certain period of time, when the traffic data is too large, it may occupy a large amount of bandwidth, causing the server response to slow down, thereby reducing the user experience. Summary of the Invention

[0004] The purpose of the present invention is to solve the problems in the background technology and to propose a server-oriented automated security operation and maintenance method, device and electronic equipment.

[0005] In order to achieve the above object, the present invention adopts the following technical solutions: An automated secure operation and maintenance method for servers, which specifically includes the following steps: Step 1: Collect historical traffic data of the target server and mark it in a two-dimensional plane coordinate system to obtain a traffic change curve; Step 2: Based on the curve function of the flow change curve, identify the peak point in the flow change curve, and set the flow increase range according to the peak point; Step 3: Based on the peak points, the flow rate increase intervals corresponding to the peak points with the same value are integrated into a data set. The flow rate increase intervals in each data set are analyzed to obtain the characteristic change curve of the data set. Step 4: Monitor the real-time data traffic of the target server, and identify the growth status of the real-time traffic data during the monitoring process. When the growth status is detected, obtain the growth curve of the real-time traffic data, calculate the similarity value between the growth curve and the characteristic change curve, identify the maximum value among the similar values, and determine the traffic prediction value of the target server based on the maximum value of the similar values.

[0006] As a further solution of the present invention, a method for obtaining a flow change curve includes: Obtain historical traffic data of a target server within a validity period, where the validity period is a threshold; Set time as the horizontal coordinate and flow data as the vertical coordinate to establish a two-dimensional plane coordinate system. Then, mark the historical flow data within the validity period in the two-dimensional plane coordinate system. At the same time, fit the marked points into a curve and mark them as the flow change curve.

[0007] As a further solution of the present invention, a method for obtaining a flow increase interval includes: Identify the peak point in the flow change curve and mark it as Fj. Take the adjacent peak points, identify the minimum value between the adjacent peak points, and mark this minimum value as the dividing point; Identify the dividing point and set the flow increase interval based on the dividing point and the peak point. The left endpoint value of the specific flow increase interval is the dividing point, and the right endpoint value of the flow increase interval is the peak point. In a flow increase interval, the dividing point corresponding to the left endpoint and the peak point corresponding to the right endpoint are adjacent positions.

[0008] As a further solution of the present invention, a method for determining a peak point in a flow change curve includes: Get the curve function of the flow change curve and mark it as f(x). Then calculate the first-order derivative of the curve function f(x) and mark it as ; The first-order derivative Set to 0, that is, , and calculate to obtain several extreme points Di, i represents different extreme points, where extreme points include maximum and minimum values; Then for the first-order derivative Further derivative calculation is performed to obtain the second-order derivative, which is marked as , then substitute the extreme point into the second-order derivative The operation is performed in , and the result of the operation is marked as the secondary operation value Yi; The quadratic operation value Yi is compared with the threshold coefficient X1, and the extreme value point corresponding to the quadratic operation value Yi being greater than the threshold coefficient X1 is marked as a maximum value.

[0009] As a further solution of the present invention, a specific method of comparing the secondary operation value Yi with the threshold coefficient X1 includes: If Yi>X1, the corresponding extreme point Di is marked as the minimum value. Otherwise, if Yi>X1, the corresponding extreme point Di is marked as the maximum value. If Yi=0, the first-order derivatives on the left and right sides of the corresponding extreme point Di are obtained respectively. If the first-order derivatives on the left and right sides of the extreme point Di have the same sign, the extreme point Di is deleted. >0, <0, then the corresponding extreme point Di is marked as the maximum value. Otherwise, if <0, > 0, then the corresponding extreme point Di is marked as the minimum value, where Represents the first-order derivative value to the left of the extreme point Di, Indicates the first-order derivative value to the right of the extreme point Di, and the first-order derivative with the same sign indicates and Both are greater than 0 or both are less than 0.

[0010] As a further solution of the present invention, a method for determining a characteristic change curve includes: The peak points are obtained again and classified according to specific values to obtain several data sets, wherein one data set corresponds to a peak point of a specific value, and in one data set, the elements of the data set are the flow increase intervals corresponding to the peak point; Arbitrarily select a data set and mark it as the target analysis set. Extract all the flow rate increase intervals in the target analysis set, and express the curve segments in each flow rate increase interval using a function. At the same time, mark the function of the curve segment as Fn, where n represents the different flow rate increase intervals in the target analysis set. Perform a derivative operation on the function Fn to obtain the slope expression Bn; According to the slope expression, a slope change curve is drawn in a two-dimensional coordinate system, where one slope expression corresponds to one slope change curve. Then, multiple slope change curves are integrated to obtain one curve, and this curve is marked as the comprehensive change curve of the target analysis set; The comprehensive change curve is set as the change characteristic curve of the corresponding peak point of the target analysis set.

[0011] As a further solution of the present invention, a method for determining a traffic prediction value of a target server includes: The real-time data traffic in the target server is monitored. When the real-time data traffic is identified as increasing, the growth curve of the real-time traffic data is obtained. Then, the similarity value of the growth curve of the real-time traffic data is calculated with the comprehensive change curve of each data set to obtain the curve similarity; Identify the maximum value of the similarity value, obtain the comprehensive characteristic curve corresponding to the maximum value, and mark the peak point corresponding to this comprehensive characteristic curve as the traffic prediction value of the target server at this time.

[0012] Automated security operation and maintenance device for servers, including: The data collection module is used to collect the historical traffic data of the target server and transmit it to the traffic visualization module; The traffic visualization module is used to mark the historical traffic data of the target server in a two-dimensional plane coordinate system to obtain a traffic change curve, and then the traffic visualization module transmits the traffic change curve to the traffic processing module; The flow processing module is used to process the flow change curve, identify the peak point in the flow change curve based on the curve function of the flow change curve, and set the flow increase interval according to the peak point. The flow processing module then transmits the flow increase interval to the feature analysis module; The feature analysis module is used to integrate the flow increase intervals corresponding to the peak points with the same value into a data set based on the peak points, wherein the flow increase interval is an element of the data set. The flow increase interval in each data set is then analyzed to obtain a characteristic change curve of the data set. The feature analysis module then transmits the characteristic change curve to the flow prediction module; The data detection module is used to monitor the real-time data traffic of the target server and identify the growth status of the real-time traffic data during the monitoring process. When the growth status is detected, the growth curve of the real-time traffic data is obtained and transmitted to the traffic prediction module; The traffic prediction module is used to obtain the growth curve of real-time traffic, calculate the similarity between the growth curve and the characteristic change curve, identify the maximum value among the similar values, and determine the traffic prediction value of the target server based on the maximum value of the similar values.

[0013] An electronic device includes a memory and a processor, wherein the memory is used to store one or more computer instructions, and the one or more computer instructions are executed by the processor to implement the above-mentioned operation and maintenance method.

[0014] Compared with the existing technology, the advantages of the present invention are: The present invention analyzes historical traffic data to obtain the peak points of the traffic data and calculates the characteristic change curve of each peak point. Based on the growth curve of real-time traffic data, similarity calculation is performed between the growth curve of real-time traffic data and the characteristic change curve. Finally, based on the similarity value, the traffic prediction value of the real-time traffic data is determined. According to the traffic prediction value of the target server, resource planning is performed in advance for the target server, and resource allocation is adjusted or network settings are optimized in a timely manner, which can ensure the smoothness of the service and improve user satisfaction. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 It is a schematic diagram of the method flow structure of the present invention; Figure 2 Schematic diagram of the system structure of the present invention. DETAILED DESCRIPTION

[0016] The technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments.

[0017] Reference Figure 1 , an automated security operation and maintenance method for servers, the method specifically includes the following steps: Step 1: Select a target server and obtain historical traffic data of the target server within a validity period, wherein the validity period is a threshold, and the specific validity period is set by those skilled in the art based on big data experience; The time is set as the horizontal coordinate and the flow data is set as the vertical coordinate to establish a two-dimensional plane coordinate system. Then, the historical flow data within the validity period is marked in the two-dimensional plane coordinate system. At the same time, the marked points are fitted into a curve and marked as a flow change curve. The fitting method used in this embodiment is the fit function in MATLAB. Furthermore, the specific fitting method of the fit function is a prior art and will not be described in detail here. Step 2: Identify the peak point in the flow change curve and mark it as Fj. Take the adjacent peak points, identify the minimum value between the adjacent peak points, and mark this minimum value as the dividing point; Identify the demarcation point and set a flow increase interval based on the demarcation point and the peak point. The left endpoint of the specific flow increase interval is the demarcation point, and the right endpoint of the flow increase interval is the peak point. In a flow increase interval, the demarcation point corresponding to the left endpoint and the peak point corresponding to the right endpoint are adjacent to each other. In another embodiment of the present invention, a method for determining a peak point in a flow variation curve includes: Get the curve function of the flow change curve and mark it as f(x). Then calculate the first-order derivative of the curve function f(x) and mark it as ; The first-order derivative Set to 0, that is, , and calculate to obtain several extreme points Di, i represents different extreme points, where extreme points include maximum and minimum values; Then for the first-order derivative Further derivative calculation is performed to obtain the second-order derivative, which is marked as , then substitute the extreme point into the second-order derivative The operation is performed in , and the result of the operation is marked as the secondary operation value Yi; Compare the secondary operation value Yi with the threshold coefficient X1: If Yi>X1, the corresponding extreme point Di is marked as the minimum value. Otherwise, if Yi>X1, the corresponding extreme point Di is marked as the maximum value. If Yi=0, the first-order derivatives on the left and right sides of the corresponding extreme point Di are obtained respectively. If the first-order derivatives on the left and right sides of the extreme point Di have the same sign, the extreme point Di is deleted. >0, <0, then the corresponding extreme point Di is marked as the maximum value. Otherwise, if <0, > 0, then the corresponding extreme point Di is marked as the minimum value, where Represents the first-order derivative value to the left of the extreme point Di, Indicates the first-order derivative value to the right of the extreme point Di, and the first-order derivative with the same sign indicates and At the same time, they are greater than 0 or less than 0. Furthermore, in this embodiment, the threshold coefficient X1 is set to 0; Mark the point corresponding to the maximum value in the extreme value points as the peak point. At this time, the peak point setting in the flow change curve is completed; Step 3: Obtain peak points again and classify them according to specific values to obtain several data sets, where one data set corresponds to a peak point of a specific value, and the elements of a data set are the flow increase intervals corresponding to the peak point; Select any data set and mark it as the target analysis set. Taking the target analysis set as an example, analyze all traffic increase intervals in the target analysis set to determine the change characteristic curve of the target analysis set. The specific method for determining the change characteristic curve includes: SS1: Extract all the flow rate increase intervals in the target analysis set, and express the curve segments in each flow rate increase interval using a function. The function of the curve segment is marked as Fn, where n represents the different flow rate increase intervals in the target analysis set. SS2: Perform a derivative operation on the function Fn to obtain the slope expression Bn; According to the slope expression, a slope change curve is drawn in a two-dimensional coordinate system, where one slope expression corresponds to one slope change curve. Then, multiple slope change curves are integrated to obtain a curve, and this curve is marked as the comprehensive change curve of the target analysis set. Furthermore, in this embodiment, a polynomial fitting algorithm is used to fit multiple slope change curves into the comprehensive change curve. The specific processing process of the polynomial fitting algorithm is prior art and will not be described in detail here. SS3: Set the comprehensive change curve as the change characteristic curve corresponding to the peak point of the target analysis set; Then, the remaining data sets are set as target analysis sets in turn, and are processed according to the methods in steps SS1 to SS3 above to obtain the change characteristic curve corresponding to each data set; Step 4: Monitor the real-time data traffic in the target server. When it is identified that the real-time data traffic is in an increasing state, obtain a growth curve of the real-time traffic data. Then, calculate similarity values between the growth curve of the real-time traffic data and the comprehensive change curve of each data set to obtain curve similarity. In this embodiment, the method used for similarity calculation is the Euclidean algorithm. The specific processing process of the Euclidean algorithm is prior art and will not be described in detail here. Identify the maximum value of the similarity value, obtain the comprehensive characteristic curve corresponding to the maximum value, and mark the peak point corresponding to the comprehensive characteristic curve as the traffic prediction value of the target server at this time; Then, based on the traffic forecast value of the target server, resource planning is carried out in advance for the target server. Resource planning includes increasing the target server's memory, number of CPU cores, and storage capacity, thereby ensuring the target server's operating quality.

[0018] Reference Figure 2 , an automated security operation and maintenance device for servers, which includes: The data collection module is used to collect the historical traffic data of the target server and transmit it to the traffic visualization module; The traffic visualization module is used to mark the historical traffic data of the target server in a two-dimensional plane coordinate system to obtain a traffic change curve, and then the traffic visualization module transmits the traffic change curve to the traffic processing module; The flow processing module is used to process the flow change curve, identify the peak point in the flow change curve based on the curve function of the flow change curve, and set the flow increase interval according to the peak point. The flow processing module then transmits the flow increase interval to the feature analysis module; The feature analysis module is used to integrate the flow increase intervals corresponding to the peak points with the same value into a data set based on the peak points, wherein the flow increase interval is an element of the data set. The flow increase interval in each data set is then analyzed to obtain a characteristic change curve of the data set. The feature analysis module then transmits the characteristic change curve to the flow prediction module; The data detection module is used to monitor the real-time data traffic of the target server and identify the growth status of the real-time traffic data during the monitoring process. When the growth status is detected, the growth curve of the real-time traffic data is obtained and transmitted to the traffic prediction module; The traffic prediction module is used to obtain the growth curve of real-time traffic, calculate the similarity between the growth curve and the characteristic change curve, identify the maximum value among the similar values, and determine the traffic prediction value of the target server based on the maximum value of the similar values; An electronic device for running the above-mentioned operation and maintenance method, the electronic device includes a memory and a processor, wherein the memory is used to store one or more computer instructions, and the one or more computer instructions are executed by the processor to implement the above-mentioned operation and maintenance method.

[0019] The above description is only a preferred specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any technician familiar with the technical field, within the technical scope disclosed by the present invention, who makes equivalent replacements or changes based on the technical solution and inventive concept of the present invention, should be covered by the scope of protection of the present invention.

Claims

1. The automated security operation and maintenance method for servers is characterized by: The operation and maintenance method specifically includes the following steps: Step 1: Collect historical traffic data of the target server and mark it in a two-dimensional plane coordinate system to obtain a traffic change curve; Step 2: Based on the curve function of the flow change curve, identify the peak point in the flow change curve, and set the flow increase range according to the peak point; Step 3: Based on the peak points, the flow rate increase intervals corresponding to the peak points with the same value are integrated into a data set. The flow rate increase intervals in each data set are analyzed to obtain the characteristic change curve of the data set. Step 4: Monitor the real-time data traffic of the target server, and identify the growth status of the real-time traffic data during the monitoring process. When the growth status is detected, obtain the growth curve of the real-time traffic data, calculate the similarity value between the growth curve and the characteristic change curve, identify the maximum value among the similar values, and determine the traffic prediction value of the target server based on the maximum value of the similar values.

2. The server-oriented automated security operation and maintenance method according to claim 1, characterized in that: Methods for obtaining flow change curves include: Obtain historical traffic data of a target server within a validity period, where the validity period is a threshold; Set time as the horizontal coordinate and flow data as the vertical coordinate to establish a two-dimensional plane coordinate system. Then, mark the historical flow data within the validity period in the two-dimensional plane coordinate system. At the same time, fit the marked points into a curve and mark them as the flow change curve.

3. The server-oriented automated security operation and maintenance method according to claim 1, characterized in that: Methods for obtaining the traffic increase interval include: Identify the peak point in the flow change curve and mark it as Fj. Take the adjacent peak points, identify the minimum value between the adjacent peak points, and mark this minimum value as the dividing point; Identify the dividing point and set the flow increase interval based on the dividing point and the peak point. The left endpoint value of the specific flow increase interval is the dividing point, and the right endpoint value of the flow increase interval is the peak point. In a flow increase interval, the dividing point corresponding to the left endpoint and the peak point corresponding to the right endpoint are adjacent positions.

4. The server-oriented automated security operation and maintenance method according to claim 3, characterized in that: Methods for determining the peak point in the flow change curve include: Get the curve function of the flow change curve and mark it as f(x). Then calculate the first-order derivative of the curve function f(x) and mark it as ; The first-order derivative Set to 0, that is, , and calculate to obtain several extreme points Di, i represents different extreme points, where extreme points include maximum and minimum values; Then for the first-order derivative Further derivative calculation is performed to obtain the second-order derivative, which is marked as , then substitute the extreme point into the second-order derivative The operation is performed in , and the result of the operation is marked as the secondary operation value Yi; The quadratic operation value Yi is compared with the threshold coefficient X1, and the extreme value point corresponding to the quadratic operation value Yi being greater than the threshold coefficient X1 is marked as a maximum value.

5. The server-oriented automated security operation and maintenance method according to claim 4, characterized in that: The specific method of comparing the secondary operation value Yi with the threshold coefficient X1 includes: If Yi>X1, the corresponding extreme point Di is marked as the minimum value. Otherwise, if Yi>X1, the corresponding extreme point Di is marked as the maximum value. If Yi=0, the first-order derivatives on the left and right sides of the corresponding extreme point Di are obtained respectively. If the first-order derivatives on the left and right sides of the extreme point Di have the same sign, the extreme point Di is deleted. >0, <0, then the corresponding extreme point Di is marked as the maximum value. Otherwise, if <0, > 0, then the corresponding extreme point Di is marked as the minimum value, where Represents the first-order derivative value to the left of the extreme point Di, Indicates the first-order derivative value to the right of the extreme point Di, and the first-order derivative with the same sign indicates and Both are greater than 0 or both are less than 0.

6. The server-oriented automated security operation and maintenance method according to claim 1, characterized in that: Methods for determining characteristic change curves include: The peak points are obtained again and classified according to specific values to obtain several data sets, wherein one data set corresponds to a peak point of a specific value, and in one data set, the elements of the data set are the flow increase intervals corresponding to the peak point; Arbitrarily select a data set and mark it as the target analysis set. Extract all the flow rate increase intervals in the target analysis set, and express the curve segments in each flow rate increase interval using a function. At the same time, mark the function of the curve segment as Fn, where n represents the different flow rate increase intervals in the target analysis set. Perform a derivative operation on the function Fn to obtain the slope expression Bn; According to the slope expression, a slope change curve is drawn in a two-dimensional coordinate system, where one slope expression corresponds to one slope change curve. Then, multiple slope change curves are integrated to obtain one curve, and this curve is marked as the comprehensive change curve of the target analysis set; The comprehensive change curve is set as the change characteristic curve of the corresponding peak point of the target analysis set.

7. The server-oriented automated security operation and maintenance method according to claim 1, characterized in that: Methods for determining the traffic prediction value of the target server include: The real-time data traffic in the target server is monitored. When the real-time data traffic is identified as increasing, the growth curve of the real-time traffic data is obtained. Then, the similarity value of the growth curve of the real-time traffic data is calculated with the comprehensive change curve of each data set to obtain the curve similarity; Identify the maximum value of the similarity value, obtain the comprehensive characteristic curve corresponding to the maximum value, and mark the peak point corresponding to this comprehensive characteristic curve as the traffic prediction value of the target server at this time.

8. An automated secure operation and maintenance device for a server, the operation and maintenance device adopts the automated secure operation and maintenance method for a server as described in any one of claims 1 to 7, characterized in that: include: The data collection module is used to collect the historical traffic data of the target server and transmit it to the traffic visualization module; The traffic visualization module is used to mark the historical traffic data of the target server in a two-dimensional plane coordinate system to obtain a traffic change curve, and then the traffic visualization module transmits the traffic change curve to the traffic processing module; The flow processing module is used to process the flow change curve, identify the peak point in the flow change curve based on the curve function of the flow change curve, and set the flow increase interval according to the peak point. The flow processing module then transmits the flow increase interval to the feature analysis module; The feature analysis module is used to integrate the flow increase intervals corresponding to the peak points with the same value into a data set based on the peak points, wherein the flow increase interval is an element of the data set. The flow increase interval in each data set is then analyzed to obtain a characteristic change curve of the data set. The feature analysis module then transmits the characteristic change curve to the flow prediction module; The data detection module is used to monitor the real-time data traffic of the target server and identify the growth status of the real-time traffic data during the monitoring process. When the growth status is detected, the growth curve of the real-time traffic data is obtained and transmitted to the traffic prediction module; The traffic prediction module is used to obtain the growth curve of real-time traffic, calculate the similarity between the growth curve and the characteristic change curve, identify the maximum value among the similar values, and determine the traffic prediction value of the target server based on the maximum value of the similar values.

9. An electronic device, characterized in that: It includes a memory and a processor, the memory is used to store one or more computer instructions, and the one or more computer instructions are executed by the processor to implement the server-oriented automated security operation and maintenance method described in any one of claims 1 to 7.

Images