A virtualization environment socket listening monitoring system

Abstract

The present application relates to the technical field of virtualization environment network communication monitoring, in particular to a virtualization environment Socket monitoring system, which comprises a virtualization communication data capturing module, a multi-source protocol analysis module, a communication behavior modeling module, an abnormal behavior detection and evaluation module and a dynamic monitoring parameter adjustment module. The system generates basic monitoring units by distributing network communication nodes, analyzes multi-protocol communication data to form unified format data streams, constructs communication behavior models to extract multi-dimensional features, dynamically adjusts monitoring strategies in combination with local and overall abnormal states, and realizes real-time monitoring of virtualization environment network communication. The present application can effectively improve the accuracy and real-time performance of network communication anomaly detection in the virtualization environment.

Description

TECHNICAL FIELD

[0001] The present application belongs to the technical field of computer networks and virtualization, specifically a virtualized environment Socket monitoring system. BACKGROUND

[0002] With the widespread application of virtualization technology, the demand for Socket monitoring systems in virtualized environments is increasing. Such systems can capture and analyze network communication data in real time, providing important support for the security and performance optimization of virtualized environments. However, existing Socket monitoring technologies still have certain limitations in virtualized environments, especially in terms of compatibility, real-time performance, and resource occupation.

[0003] A container network communication monitoring method and system with publication number CN114416278B, which sets up a monitoring network card in the network namespace and uses a newly created virtual network device to send monitoring data to a remote monitoring device, achieving real-time monitoring of container network communication. However, this technical solution is mainly designed for container environments and does not fully consider the communication characteristics between different virtual machines in virtualized environments. In addition, the process of creating a virtual network device on the network namespace may introduce additional resource overhead, affecting the overall performance of the system, especially in high-load scenarios, which may cause monitoring delays or data loss.

[0004] A monitoring method and device for information, intelligent device, computer device, and medium with publication number CN111737084B, which achieves efficient and real-time monitoring of the connection state of the transmission port of the device to be monitored by monitoring the port information. However, this technical solution mainly faces the monitoring of physical devices and does not fully consider the special needs of multi-tenant isolation and dynamic resource allocation in virtualized environments. In addition, this solution relies on specific port configurations and may have compatibility issues in complex virtualized network topologies, with limited ability to adapt to dynamic scenarios such as virtual machine migration and network reconstruction.

[0005] The above problems show that the existing Socket monitoring technology has limitations in compatibility, real-time performance, and resource occupation in virtualized environments. Therefore, the present application aims to provide a virtualized environment Socket monitoring system to optimize the Socket monitoring mechanism in virtualized environments and improve the compatibility, real-time performance, and resource utilization of the system, thereby better meeting the needs of virtualized environments for efficient and stable monitoring systems. SUMMARY

[0006] The present application aims to provide a virtualized environment Socket monitoring system to solve the problems raised in the background technology.

[0007] To achieve the above object, the present application provides the following technical solutions: a virtualization environment Socket monitoring system, the system comprising:

[0008] A virtualization communication data capture module is configured to distribute network communication nodes in a virtualization environment to obtain basic monitoring units and extract a communication data collection range corresponding to the basic monitoring units;

[0009] A multi-source protocol analysis module is configured to collect multi-protocol communication data in the communication data collection range according to a preset time window and generate a communication data stream in a unified format according to the multi-protocol communication data;

[0010] A communication behavior modeling module is configured to abstract network communication behaviors in the communication data collection range according to the communication data stream to obtain a behavior abstraction model and extract multi-dimensional communication features corresponding to the behavior abstraction model using a preset behavior analysis framework;

[0011] An abnormal behavior detection and evaluation module is configured to identify local abnormal behaviors in the communication data collection range according to the multi-dimensional communication features and determine an overall communication abnormal state in combination with the local abnormal behaviors;

[0012] A dynamic monitoring parameter adjustment module is configured to dynamically configure monitoring strategy parameters through the local abnormal behaviors and the overall communication abnormal state, use the monitoring strategy parameters to perform real-time dynamic monitoring on network communication activities in a virtualization environment, and obtain real-time states of network communication.

[0013] Preferably, when the virtualization communication data capture module distributes network communication nodes in a virtualization environment to obtain basic monitoring units, it is configured to:

[0014] Identify an initial distribution range of network communication nodes in a virtualization environment and extract a first demarcation threshold value corresponding to a range value of the initial distribution range;

[0015] Perform a first-level division of the network communication nodes according to the first demarcation threshold value to obtain first-level communication units;

[0016] Identify a secondary distribution range of the first-level communication units and extract a second demarcation threshold value corresponding to a range value of the secondary distribution range;

[0017] Perform a second-level division of the first-level communication units according to the second demarcation threshold value to obtain second-level communication units;

[0018] The network communication node, the first level communication unit and the second level communication unit are taken as communication nodes, and a connection path between the network communication node, the first level communication unit and the second level communication unit is constructed;

[0019] A basic monitoring unit is generated according to the communication nodes and the connection path;

[0020] The construction of the connection path between the network communication node, the first level communication unit and the second level communication unit comprises:

[0021] A basic connection strength is determined by extracting an overlapping proportion of distribution ranges of the network communication node and the first level communication unit;

[0022] A secondary connection strength is determined by extracting a communication data interaction frequency of the first level communication unit and the second level communication unit;

[0023] A path weight is set according to the basic connection strength and the secondary connection strength, a path of the network communication node to the first level communication unit is taken as a main connection path, and a path of the first level communication unit to the second level communication unit is taken as a secondary connection path;

[0024] The connection path construction is completed through the main connection path and the secondary connection path.

[0025] Preferably, the multi-source protocol analysis module, when collecting multi-protocol communication data in the communication data collection range according to a preset time window, is used for:

[0026] A starting collection time and a time interval of network communication data in the communication data collection range are determined according to the time window;

[0027] A data collection point is determined according to the starting collection time and the time interval;

[0028] TCP protocol data, UDP protocol data and ICMP protocol data corresponding to network communication in the communication data collection range are collected through the data collection point;

[0029] The TCP protocol data, the UDP protocol data and the ICMP protocol data are integrated into multi-protocol communication data in the communication data collection range.

[0030] Preferably, the multi-source protocol analysis module, when generating a communication data stream in a unified format according to the multi-protocol communication data, is used for:

[0031] Timestamp information corresponding to the multi-protocol communication data is extracted;

[0032] arranging the multi-protocol communication data corresponding to the timestamp information in chronological order;

[0033] arranging the multi-protocol communication data corresponding to the timestamp information in chronological order;

[0034] Preferably, the communication behavior modeling module is configured to:

[0035] extracting the multi-protocol communication data of different communication nodes within the same time interval in the communication data stream, and extracting the TCP protocol data of different communication nodes in the multi-protocol communication data;

[0036] extracting the key events of the TCP protocol data of different communication nodes one by one, and constructing the logical relationship of the TCP protocol data of different communication nodes according to the key events;

[0037] identifying a core event chain according to the logical relationship, and inducing a typical mode of network communication according to the occurrence order of the core event chain;

[0038] generating a state tag set of network communication according to the typical mode, generating a feature vector space of network communication according to the state tag set, mapping the statistical law of the TCP protocol data into the feature vector space, and obtaining the behavior abstraction model corresponding to the network communication;

[0039] abstracting the UDP protocol data and the ICMP protocol data in the multi-protocol communication data;

[0040] determining the behavior abstraction model according to the abstracted UDP protocol data, the abstracted ICMP protocol data, and the behavior abstraction model.

[0041] Preferably, the communication behavior modeling module is configured to:

[0042] extracting the performance indicators of the behavior abstraction model by using the behavior analysis framework, wherein the performance indicators include data transmission rate, response delay, and bandwidth utilization rate;

[0043] extracting the abnormal fluctuation indicators and the load distribution indicators of the behavior abstraction model;

[0044] determining the performance indicators, the abnormal fluctuation indicators, and the load distribution indicators as the multi-dimensional communication features.

[0045] Preferably, the abnormal behavior detection and evaluation module is configured to:

[0046] comparing the performance index in the multi-dimensional communication feature with a pre-set standard performance index to obtain a first comparison coefficient, and converting the first comparison coefficient into a first abnormal value;

[0047] comparing the abnormal fluctuation index in the multi-dimensional communication feature with a pre-set standard fluctuation index to obtain a second comparison coefficient, and converting the second comparison coefficient into a second abnormal value;

[0048] comparing the load distribution index in the multi-dimensional communication feature with a pre-set standard distribution index to obtain a third comparison coefficient, and converting the third comparison coefficient into a third abnormal value;

[0049] calculating abnormal mean values corresponding to the first abnormal value, the second abnormal value and the third abnormal value, and determining a local abnormal behavior in the communication data collection range according to the abnormal mean values.

[0050] Preferably, the dynamic monitoring parameter adjustment module, when dynamically configuring monitoring strategy parameters through the local abnormal behavior and the overall communication abnormal state, is used for:

[0051] determining a first monitoring density and a monitoring time period of a first level communication unit according to the overall communication abnormal state;

[0052] determining a monitoring focus of a second level communication unit through the local abnormal behavior, and configuring a second monitoring density and a monitoring depth of the monitoring focus;

[0053] adjusting monitoring strategy parameters of the first level communication unit according to the first monitoring density and the monitoring time period;

[0054] adjusting monitoring strategy parameters of the second level communication unit according to the second monitoring density and the monitoring depth.

[0055] Preferably, the dynamic monitoring parameter adjustment module, when using the monitoring strategy parameters to perform real-time dynamic monitoring on network communication activities in a virtualization environment to obtain a real-time state of network communication, is used for:

[0056] collecting real-time monitoring data of network communication activities in the virtualization environment in real time using the monitoring strategy parameters;

[0057] analyzing state quantitative indexes corresponding to the real-time monitoring data;

[0058] determining the real-time state of network communication according to the analyzed state quantitative indexes.

[0059] Preferably, the constructing a logical relationship of TCP protocol data under different communication nodes according to the key event comprises:

[0060] Identify the trigger condition and execution result of the key event, extract the event causal relationship;

[0061] Statistics of the frequency of the key event in the same time interval, extract the event co-occurrence relationship;

[0062] The causal relationship and the co-occurrence relationship are used as the core elements of the logical relationship, and the key events with causal relationship are connected through directed edges, and the key events with co-occurrence relationship are connected through undirected edges;

[0063] According to the directed edge and the undirected edge, the logical relationship construction is completed.

[0064] The application generates a basic monitoring unit by distributing network communication nodes, analyzes multi-protocol communication data to form a unified format data stream, constructs a communication behavior model to extract multi-dimensional features, dynamically adjusts the monitoring strategy in combination with local and overall abnormal state, and realizes real-time monitoring of virtualization environment network communication. The application can effectively improve the accuracy and real-time performance of network communication anomaly detection in the virtualization environment. BRIEF DESCRIPTION OF DRAWINGS

[0065] Figure 1 It is a module structure schematic diagram of the virtualization environment Socket monitoring and control system in the embodiment of the application.

[0066] Figure 2 It is a work flow chart of the virtualization communication data capture module in the embodiment of the application.

[0067] Figure 3 It is an operation flow chart of the multi-source protocol analysis module in the embodiment of the application.

[0068] Figure 4 It is a processing logic diagram of the communication behavior modeling module in the embodiment of the application.

[0069] Figure 5 It is a running mechanism diagram of the dynamic monitoring parameter adjustment module in the embodiment of the application. DETAILED DESCRIPTION

[0070] The application provides a virtualization environment Socket monitoring and control system, and the specific implementation manner is combined with the accompanying drawings of the application Figure 1 to Figure 5 be described in detail. As Figure 1 shown, the system includes five main modules, which are a virtualization communication data capture module, a multi-source protocol analysis module, a communication behavior modeling module, an abnormal behavior detection and evaluation module, and a dynamic monitoring parameter adjustment module. These modules realize real-time monitoring and abnormal detection of network communication activities in the virtualization environment through cooperative work.

[0071] The workflow of the virtualized communication data capturing module is shown in Figure 2 FIG. 1, which is mainly used for distributed partitioning of network communication nodes in a virtualized environment to generate basic monitoring units and extract the communication data collection range corresponding to the basic monitoring units.

[0072] In actual operation, the initial distribution range of network communication nodes in the virtualized environment is first identified, and the first boundary threshold corresponding to the range value of the initial distribution range is extracted. The first boundary threshold is used to perform first-level partitioning of the network communication nodes to obtain first-level communication units. Subsequently, the secondary distribution range of the first-level communication units is identified, and the second boundary threshold corresponding to the range value of the secondary distribution range is extracted. Based on the second boundary threshold, the first-level communication units are partitioned at a second level to obtain second-level communication units.

[0073] The network communication nodes, first-level communication units, and second-level communication units are taken as communication nodes, and the connection paths therebetween are constructed. The construction process of the connection paths includes extracting the distribution range overlap ratio of the network communication nodes and the first-level communication units to determine the basic connection strength, and extracting the communication data interaction frequency of the first-level communication units and the second-level communication units to determine the secondary connection strength. According to the basic connection strength and the secondary connection strength, the path weight is set, the path from the network communication node to the first-level communication unit is defined as the main connection path, and the path from the first-level communication unit to the second-level communication unit is defined as the secondary connection path.

[0074] The construction of the connection paths is completed through the main connection path and the secondary connection path, and the basic monitoring units are finally generated. The generation process of the basic monitoring units ensures comprehensive coverage of the network communication nodes in the virtualized environment, and also provides clear range definition for subsequent data collection.

[0075] The operation flow of the multi-source protocol analysis module is shown in Figure 3 FIG. 3, which is mainly used for collecting multi-protocol communication data within the communication data collection range according to a preset time window, and generating a communication data stream in a unified format. Specifically, the starting collection time and the time interval of the network communication data within the communication data collection range are first determined according to the time window.

[0076] Based on the starting collection time and the time interval, the data collection points are determined, and the TCP protocol data, UDP protocol data, and ICMP protocol data corresponding to the network communication within the communication data collection range are collected through the data collection points. Subsequently, the TCP protocol data, UDP protocol data, and ICMP protocol data are integrated into multi-protocol communication data within the communication data collection range.

[0077] In order to generate the communication data stream in a unified format, the timestamp information corresponding to the multi-protocol communication data needs to be extracted, and the multi-protocol communication data corresponding to the timestamp information needs to be arranged in chronological order. The arranged multi-protocol communication data is the communication data stream in a unified format. The multi-source protocol analysis module realizes the efficient integration of multi-protocol communication data through the above steps, and provides high-quality data support for subsequent communication behavior modeling.

[0078] The processing logic of the communication behavior modeling module is shown in Figure 4 The main task of the communication behavior modeling module is to abstract the network communication behavior in the communication data collection range according to the communication data stream, generate a behavior abstraction model, and extract multi-dimensional communication features corresponding to the behavior abstraction model.

[0079] Specifically, first, the multi-protocol communication data of different communication nodes in the same time interval in the communication data stream is extracted, and the TCP protocol data of different communication nodes in the multi-protocol communication data is focused on. The key events of the TCP protocol data of different communication nodes are extracted one by one, and the logical relationship of the TCP protocol data of different communication nodes is constructed according to the key events.

[0080] The construction of the logical relationship includes identifying the trigger condition and execution result of the key event to extract the event causal relationship, and simultaneously counting the occurrence frequency of the key event in the same time interval to extract the event co-occurrence relationship. The causal relationship and the co-occurrence relationship are the core elements of the logical relationship, the key events with causal relationship are connected by directed edges, and the key events with co-occurrence relationship are connected by undirected edges, thereby completing the construction of the logical relationship.

[0081] Based on the logical relationship, the core event chain is identified, and the typical mode of network communication is induced according to the occurrence order of the core event chain. The typical mode is used to generate a set of state labels of network communication, and further generate a feature vector space of network communication. The statistical law of the TCP protocol data is mapped into the feature vector space to obtain the behavior abstraction model corresponding to the network communication.

[0082] In addition, the UDP protocol data and the ICMP protocol data in the multi-protocol communication data also need to be abstracted, and the final behavior abstraction model is generated in combination with the behavior abstraction model. In order to extract multi-dimensional communication features, the performance indicators of the behavior abstraction model are extracted by using a preset behavior analysis framework, including data transmission rate, response delay, and bandwidth utilization.

[0083] At the same time, the abnormal fluctuation indicators and the load distribution indicators of the behavior abstraction model are extracted, and the performance indicators, the abnormal fluctuation indicators, and the load distribution indicators are determined as the multi-dimensional communication features. The communication behavior modeling module lays a solid foundation for subsequent abnormal behavior detection through the abstract modeling and feature extraction of the communication behavior.

[0084] The main function of the abnormal behavior detection evaluation module is to identify local abnormal behaviors in the communication data collection range according to the multi-dimensional communication features, and determine the overall communication abnormal state in combination with the local abnormal behaviors. Specifically, first, the performance indicators in the multi-dimensional communication features are compared with the pre-set standard performance indicators to obtain a first comparison coefficient, and the first comparison coefficient is converted into a first abnormal value.

[0085] Then, the abnormal fluctuation indicators in the multi-dimensional communication features are compared with the pre-set standard fluctuation indicators to obtain a second comparison coefficient, and the second comparison coefficient is converted into a second abnormal value. Similarly, the load distribution indicators in the multi-dimensional communication features are compared with the pre-set standard distribution indicators to obtain a third comparison coefficient, and the third comparison coefficient is converted into a third abnormal value.

[0086] The abnormal mean values corresponding to the first abnormal value, the second abnormal value and the third abnormal value are calculated, and the local abnormal behaviors in the communication data collection range are determined according to the abnormal mean values. The identification of the local abnormal behaviors provides an important basis for the subsequent overall communication abnormal state evaluation.

[0087] The running mechanism of the dynamic monitoring parameter adjustment module is as shown in Figure 5 The main task of the dynamic monitoring parameter adjustment module is to dynamically configure the monitoring strategy parameters through the local abnormal behaviors and the overall communication abnormal state, and to use the monitoring strategy parameters to perform real-time dynamic monitoring on the network communication activities in the virtualization environment to obtain the real-time state of the network communication.

[0088] Specifically, first, the first monitoring density and the monitoring period of the first level communication unit are determined according to the overall communication abnormal state. The monitoring focus of the second level communication unit is determined through the local abnormal behaviors, and the second monitoring density and the monitoring depth of the monitoring focus are configured. The monitoring strategy parameters of the first level communication unit are adjusted based on the first monitoring density and the monitoring period, and the monitoring strategy parameters of the second level communication unit are adjusted based on the second monitoring density and the monitoring depth.

[0089] The adjustment of the monitoring strategy parameters ensures the accurate monitoring of the network communication activities in the virtualization environment. Subsequently, the real-time monitoring data of the network communication activities in the virtualization environment are collected in real time using the monitoring strategy parameters, and the state quantitative indicators corresponding to the real-time monitoring data are analyzed. The real-time state of the network communication is determined according to the analyzed state quantitative indicators. Through the dynamic adjustment of the monitoring strategy parameters, the dynamic monitoring parameter adjustment module realizes the efficient monitoring of the network communication activities in the virtualization environment.

[0090] The five modules above jointly constitute the complete technical solution of the Socket monitoring system in the virtualization environment through close cooperation. The virtualization communication data capturing module provides a distributed division method for the generation of the basic monitoring unit, the multi-source protocol analysis module realizes the efficient integration of multi-protocol communication data, the communication behavior modeling module provides support for abnormal behavior detection through abstract modeling and feature extraction of communication behavior, the abnormal behavior detection and evaluation module identifies local abnormal behavior and overall communication abnormal state through analysis of multi-dimensional communication features, and the dynamic monitoring parameter adjustment module realizes real-time monitoring of network communication activities through dynamic adjustment of monitoring strategy parameters.

[0091] The modules are connected through data flow transmission and feedback to form a closed loop, ensuring efficient operation and accurate monitoring capability of the system.

[0092] In order to better enable relevant persons in the art to fully understand and implement the present application, the specific implementation principles of the present application are supplemented below in conjunction with a specific application scenario.

[0093] When deploying the Socket monitoring system in a virtualization environment, first, the network communication nodes are distributed by the virtualization communication data capturing module.

[0094] As shown in Figure 2 , the module identifies the initial distribution range in the virtualization environment and extracts the first boundary threshold to divide the first-level communication unit. Then, the secondary distribution range of the first-level communication unit is further analyzed, and the second boundary threshold is extracted to generate the second-level communication unit. In this process, the module determines the basic connection strength by calculating the overlap ratio of the distribution range between the network communication node and the first-level communication unit; at the same time, the secondary connection strength is determined by counting the communication data interaction frequency between the first-level communication unit and the second-level communication unit.

[0095] According to these strength values, the path weight is set, the main connection path and the secondary connection path are constructed, and finally the basic monitoring unit is generated. This process ensures comprehensive coverage of the network communication nodes in the virtualization environment, providing a clear range definition for subsequent data collection.

[0096] Next, the multi-source protocol analysis module collects multi-protocol communication data within the communication data collection range according to the preset time window. As shown in Figure 3 , the module first determines the starting collection time and time interval according to the time window, and sets the data collection point based on this.

[0097] Through these collection points, the module can efficiently collect TCP, UDP and ICMP protocol data and integrate these data into multi-protocol communication data. In order to generate a communication data stream in a unified format, the module extracts the timestamp information of the multi-protocol communication data and arranges it in chronological order. This arrangement not only realizes the efficient integration of multi-protocol data, but also provides high-quality data support for subsequent communication behavior modeling.

[0098] The communication behavior modeling module then abstracts and models the network communication behavior according to the communication data stream. As shown in Figure 4 , the module first extracts the multi-protocol communication data of different communication nodes within the same time interval, and focuses on key events in the TCP protocol data.

[0099] By analyzing the triggering conditions and execution results of these key events, the module extracts event causal relationships; at the same time, by counting the frequency of occurrence of key events, it extracts event co-occurrence relationships. Based on these logical relationships, the module connects key events with causal relationships using directed edges and connects key events with co-occurrence relationships using undirected edges, thereby completing the construction of logical relationships.

[0100] Subsequently, the module induces typical patterns of network communication according to the occurrence order of the core event chain, and generates a set of state labels and a feature vector space. By mapping the statistical rules of TCP protocol data into the feature vector space, the module generates a behavior abstraction model, and further combines the abstraction processing of UDP and ICMP protocol data to form the final behavior abstraction model.

[0101] In addition, the module also extracts multi-dimensional communication features, including performance indicators such as data transmission rate, response delay, and bandwidth utilization, as well as abnormal fluctuation indicators and load distribution indicators, laying a solid foundation for subsequent abnormal behavior detection.

[0102] The abnormal behavior detection and evaluation module identifies local abnormal behaviors according to multi-dimensional communication features, and determines the overall communication abnormal state in combination with local abnormal behaviors. As shown in Figure 5 , the module first compares the performance indicators in the multi-dimensional communication features with the pre-set standard performance indicators to obtain a first comparison coefficient, and converts it into a first abnormal value.

[0103] Next, the module compares the abnormal fluctuation indicators and load distribution indicators respectively to obtain a second abnormal value and a third abnormal value. By calculating the mean of these three abnormal values, the module can accurately identify local abnormal behaviors within the communication data collection range. This process provides an important basis for subsequent evaluation of the overall communication abnormal state.

[0104] Finally, the dynamic monitoring parameter adjustment module dynamically configures the monitoring strategy parameters based on the local abnormal behavior and the overall communication abnormal state, and uses these parameters to perform real-time dynamic monitoring on the network communication activities in the virtualization environment.

[0105] As shown in Figure 5 , the module first determines the first monitoring density and monitoring period of the first-level communication unit according to the overall communication abnormal state, and determines the monitoring focus of the second-level communication unit based on the local abnormal behavior. Based on this information, the module configures the second monitoring density and monitoring depth of the second-level communication unit, and adjusts the monitoring strategy parameters of the first-level and second-level communication units.

[0106] Subsequently, the module uses the adjusted monitoring strategy parameters to collect network communication activity monitoring data in the virtualization environment in real time, and analyzes the state quantization indicators of these data. Through the analysis of the state quantization indicators, the module can accurately determine the real-time state of network communication, thereby realizing efficient monitoring of network communication activities in the virtualization environment.

[0107] The above steps, through the close cooperation between the modules, jointly constitute the complete technical scheme of the virtualization environment Socket monitoring system. The virtualization communication data capture module provides a distributed division method for the generation of the basic monitoring unit, the multi-source protocol analysis module realizes the efficient integration of multi-protocol communication data, the communication behavior modeling module provides support for abnormal behavior detection through abstract modeling and feature extraction of communication behavior, the abnormal behavior detection and evaluation module identifies local abnormal behavior and overall communication abnormal state through analysis of multi-dimensional communication features, and the dynamic monitoring parameter adjustment module realizes real-time monitoring of network communication activities through dynamic adjustment of monitoring strategy parameters. Through the transmission and feedback of data flow between the modules, a closed loop is formed, ensuring efficient operation and accurate monitoring ability of the system.

[0108] In practical applications, for example, in a cloud computing environment containing multiple virtual machines, the system can capture and analyze network communication data between virtual machines in real time. By dynamically adjusting the monitoring strategy parameters, the system can maintain a low resource occupation under high load scenarios, while ensuring the real-time and accuracy of monitoring. This design significantly improves the security and performance optimization capability of the virtualization environment, meeting the needs of efficient and stable monitoring.

[0109] It is to be understood that the terminology used herein such as first and second, and the like, is only used to distinguish one entity or action from another entity or action, and does not necessarily require or imply any such actual relationship or order between such entities or actions. Moreover, the terms "comprises", "comprising", or any other variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can include other elements not expressly listed or inherent to such process, method, article, or apparatus.

[0110] While embodiments of the present application have been shown and described with reference to particular embodiments thereof, it will be understood by those skilled in the art that various changes in form and details can be made therein without departing from the spirit and scope of the application. The scope of the application is defined by the appended claims and their equivalents.

Claims

1. A virtualized environment socket monitoring system, characterized in that, The system includes: The virtualized communication data capture module is used to distribute the network communication nodes in the virtualized environment to obtain basic listening units, and to extract the communication data collection range corresponding to the basic listening units. The multi-source protocol parsing module is used to collect multi-protocol communication data within the communication data acquisition range according to a preset time window, and generate a communication data stream in a unified format based on the multi-protocol communication data; The communication behavior modeling module is used to abstract the network communication behavior within the communication data acquisition range based on the communication data stream, obtain a behavior abstract model, and extract the multi-dimensional communication features corresponding to the behavior abstract model using a preset behavior analysis framework. An abnormal behavior detection and evaluation module is used to identify local abnormal behaviors within the communication data acquisition range based on the multi-dimensional communication features, and to determine the overall communication abnormal state in combination with the local abnormal behaviors. The dynamic monitoring parameter adjustment module is used to dynamically configure monitoring policy parameters based on the local abnormal behavior and the overall abnormal communication status, and to use the monitoring policy parameters to perform real-time dynamic monitoring of network communication activities in the virtualization environment and obtain the real-time status of network communication.

2. The virtualized environment Socket monitoring system as described in claim 1, characterized in that, When the virtualized communication data capture module performs distributed partitioning of network communication nodes in the virtualized environment to obtain basic listening units, it is used for: Identify the initial distribution range of network communication nodes in the virtualization environment, and extract the first boundary threshold corresponding to the range value of the initial distribution range; The network communication nodes are divided into first-level units according to the first boundary threshold. Identify the secondary distribution range of the first-level communication unit, and extract the second boundary threshold corresponding to the range value of the secondary distribution range; The first-level communication unit is divided into second-level units according to the second boundary threshold to obtain the second-level communication unit. The network communication node, the first-level communication unit, and the second-level communication unit are used as communication nodes, and a connection path is constructed between the network communication node, the first-level communication unit, and the second-level communication unit. A basic listening unit is generated based on the communication node and the connection path.

3. The virtualized environment Socket monitoring system as described in claim 2, characterized in that, The process of constructing the connection path between the network communication node, the first-level communication unit, and the second-level communication unit includes: Extract the overlap ratio of the distribution range of the network communication nodes and the first-level communication units to determine the basic connection strength; Extract the communication data interaction frequency between the first-level communication unit and the second-level communication unit to determine the secondary connection strength; Path weights are set according to the basic connection strength and the secondary connection strength, and the path from the network communication node to the first-level communication unit is taken as the primary connection path, and the path from the first-level communication unit to the second-level communication unit is taken as the secondary connection path. The connection path is constructed using the primary connection path and the secondary connection path.

4. The virtualized environment Socket monitoring system as described in claim 1, characterized in that, When the multi-source protocol parsing module collects multi-protocol communication data within the communication data acquisition range according to a preset time window, it is used for: The starting time and time interval for collecting network communication data within the communication data collection range are determined based on the time window. The data collection points are determined based on the starting collection time and the time interval. The data collection points collect TCP protocol data, UDP protocol data, and ICMP protocol data corresponding to network communication within the communication data collection range. The TCP protocol data, the UDP protocol data, and the ICMP protocol data are integrated into multi-protocol communication data within the communication data acquisition range.

5. The virtualized environment Socket monitoring system as described in claim 1, characterized in that, When generating a unified format communication data stream based on the multi-source protocol parsing data, the multi-source protocol parsing module is used for: Extract the timestamp information corresponding to the multi-protocol communication data; The multi-protocol communication data corresponding to the timestamp information are arranged in chronological order. The arranged multi-protocol communication data is used as a communication data stream in a unified format.

6. The virtualized environment Socket monitoring system as described in claim 1, characterized in that, When the communication behavior modeling module abstracts the network communication behavior within the communication data acquisition range based on the communication data stream to obtain a behavior abstraction model, it is used for: Extract multi-protocol communication data from different communication nodes within the same time interval from the communication data stream, and extract TCP protocol data from different communication nodes within the multi-protocol communication data; Extract key events from TCP protocol data under different communication nodes one by one, and construct logical relationships of TCP protocol data under different communication nodes based on the key events; Identify the core event chain based on the logical relationship, and summarize the typical patterns of network communication based on the occurrence order of the core event chain; A set of state labels for network communication is generated based on the typical pattern, and a feature vector space for network communication is generated based on the set of state labels. The statistical regularities of TCP protocol data are mapped to the feature vector space to obtain the behavioral abstract model corresponding to network communication. Abstract the UDP protocol data and ICMP protocol data in the multi-protocol communication data; The behavior abstract model is determined based on the abstracted UDP protocol data, the abstracted ICMP protocol data, and the behavior abstract model.

7. The virtualized environment Socket monitoring system as described in claim 1, characterized in that, When the communication behavior modeling module extracts the multidimensional communication features corresponding to the behavior abstract model using a preset behavior analysis framework, it is used for: The performance metrics of the behavioral abstract model are extracted using a behavioral analysis framework, wherein the performance metrics include data transmission rate, response latency, and bandwidth utilization. Extract the abnormal fluctuation indicators and load distribution indicators from the behavioral abstract model; The performance index, the abnormal fluctuation index, and the load distribution index are defined as multidimensional communication features.

8. The virtualized environment Socket monitoring system as described in claim 1, characterized in that, When the abnormal behavior detection and evaluation module identifies local abnormal behaviors within the communication data acquisition range based on the multidimensional communication features, it is used for: The performance indicators in the multidimensional communication features are compared with the pre-set standard performance indicators to obtain the first comparison coefficient, and the first comparison coefficient is converted into the first outlier. The abnormal fluctuation index in the multidimensional communication features is compared with the pre-set standard fluctuation index to obtain the second comparison coefficient, and the second comparison coefficient is converted into the second outlier. The load distribution index in the multidimensional communication features is compared with the pre-set standard distribution index to obtain the third comparison coefficient, and the third comparison coefficient is converted into the third outlier. Calculate the average anomaly value corresponding to the first anomaly value, the second anomaly value, and the third anomaly value, and determine the local abnormal behavior within the communication data acquisition range based on the average anomaly value.

9. The virtualized environment Socket monitoring system as described in claim 1, characterized in that, When the dynamic monitoring parameter adjustment module dynamically configures the monitoring strategy parameters based on the local abnormal behavior and the overall communication abnormal state, it is used for: The first listening density and listening period of the first-level communication unit are determined based on the overall communication anomaly status. The monitoring focus of the second-level communication unit is determined by the local abnormal behavior, and the second monitoring density and monitoring depth of the monitoring focus are configured. Adjust the monitoring strategy parameters of the first-level communication unit according to the first monitoring density and the monitoring period; The monitoring strategy parameters of the second-level communication unit are adjusted according to the second monitoring density and the monitoring depth.

10. The virtualized environment Socket monitoring system as described in claim 1, characterized in that, When the dynamic monitoring parameter adjustment module uses the monitoring policy parameters to perform real-time dynamic monitoring of network communication activities in the virtualization environment and obtain the real-time status of network communication, it is used for: The aforementioned monitoring strategy parameters are used to collect real-time monitoring data of network communication activities in the virtualization environment. Analyze the status quantification indicators corresponding to the real-time monitoring data; The real-time status of network communication is determined based on the analyzed state quantification indicators.

Images