A method, apparatus, and electronic device for monitoring the performance of network devices.

Abstract

This invention relates to the field of data processing technology, specifically providing a method, apparatus, and electronic device for monitoring the performance of network devices. Based on the business cycle of each network device within an enterprise, the method determines whether the standard single performance indicator value of the network device meets preset conditions. If yes, the single performance indicator data corresponding to the standard single performance indicator value that meets the preset conditions is determined as the target detection result. If not, a secondary anomaly detection is performed on the single performance indicator data corresponding to the standard single performance indicator value that does not meet the preset conditions. The secondary anomaly detection is based on a comprehensive calculation of anomaly scores based on the standard multi-dimensional performance indicator values ​​of each network device within an enterprise, resulting in the target detection result. This method can solve the problems of difficult network device location and long troubleshooting times, improve the accuracy of network device monitoring, and thus ensure the operational reliability of network devices.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and specifically provides a method, apparatus, and electronic device for monitoring the performance of network equipment. Background Technology

[0002] With the development of network communication technology, the security of enterprise network equipment performance is becoming increasingly important. Traditional network monitoring cannot handle massive amounts of data and concurrent data from devices in real time. Therefore, real-time monitoring of network equipment status is crucial. Only real-time monitoring can promptly report abnormalities in network equipment, quickly locate and handle faulty devices, and ensure the safe operation of network equipment.

[0003] Traditional SNMP protocols involve numerous polling interactions, resulting in low network device monitoring efficiency. Using OID concatenation technology to merge SNMP requests can reduce the number of network interactions, thereby improving network monitoring efficiency. However, OID technology collects network device performance data in batches, which may lead to slow processing of network performance metrics and inaccurate anomaly detection. Summary of the Invention

[0004] This application provides a method, apparatus, and electronic device for monitoring the performance of network devices, in order to solve the problems of long processing time for network device performance data and inaccurate anomaly judgment, thereby enabling rapid and accurate judgment of abnormal conditions of network devices, and then quickly locating and handling faulty network devices.

[0005] In a first aspect, embodiments of this application provide a method for monitoring the performance of a network device, the method comprising:

[0006] Real-time acquisition of multi-dimensional performance index data of each enterprise's network devices is used to determine the target detection results;

[0007] The multidimensional performance index data of each network device of each enterprise are preprocessed to obtain the standard multidimensional performance index value of each network device of each enterprise. The standard multidimensional performance index value is at least two standard single performance index values.

[0008] Based on the business cycle of each network device in each enterprise, determine whether the standard single performance index value of the network device meets the preset conditions.

[0009] If so, then the single performance index data corresponding to the standard single performance index value that meets the preset conditions is determined as the target detection result;

[0010] If not, then a secondary anomaly detection is performed on the single performance index data corresponding to the standard single performance index value that does not meet the preset conditions; the secondary anomaly detection is based on the comprehensive calculation of the anomaly score of the standard multidimensional performance index values ​​of each network device of each enterprise to obtain the target detection result.

[0011] Based on the target detection results, network device warning information is output.

[0012] In some embodiments, the preprocessing of the multidimensional performance index data of each network device in each enterprise to obtain the standard multidimensional performance index values ​​of each network device in each enterprise includes:

[0013] The multidimensional performance index data of each network device in each enterprise is preprocessed using the Z-score algorithm to obtain the standard multidimensional performance index value.

[0014] In some embodiments, determining whether the standard single performance index value of the network device meets preset conditions based on the service cycle of each network device in each enterprise includes:

[0015] Based on the service cycle of each network device of the same enterprise, determine whether the standard single performance index value of the network device meets the first preset condition;

[0016] Based on the business cycle of each network device of different enterprises, determine whether the standard single performance index value of the network device meets the second preset condition;

[0017] Among them, meeting either the first preset condition or the second preset condition is considered meeting the preset conditions.

[0018] Specifically, based on the service cycles of each network device within the same enterprise, the service cycle is divided into three target service cycles; and cycle thresholds corresponding to the three target service cycles are set.

[0019] If the standard single performance index value of each network device of the same enterprise is greater than the period threshold corresponding to the target service period of each network device of the same enterprise, then the first preset condition is met.

[0020] If the standard single performance index value of each network device of the same enterprise is less than or equal to the period threshold corresponding to the target business period of each network device of the same enterprise, then the kmeans algorithm is used to detect abnormal data of the single performance index for the same target business period of each network device of the same enterprise.

[0021] If the single performance index data corresponding to the standard single performance index value of each network device of the same enterprise for the same target service period is detected to be abnormal, then the first preset condition is met; if the single performance index data corresponding to the standard single performance index value of each network device of the same enterprise for the same target service period is detected to be normal, then the first preset condition is not met.

[0022] Based on the service cycles of various network devices of different enterprises, the Prophet algorithm is used to predict the historical standard single performance index values ​​of the service cycles of various network devices of different enterprises, so as to obtain the predicted values ​​and confidence intervals of the standard single performance index corresponding to the service cycles of various network devices of different enterprises. The confidence interval is the upper and lower limits of the dynamic threshold.

[0023] When the absolute value of the difference between the actual value and the predicted value of the standard single performance indicator corresponding to the service cycle of each network device of different enterprises is greater than the upper limit of the dynamic threshold and less than the lower limit of the dynamic threshold, the actual value of the standard single performance indicator corresponding to the service cycle is abnormal, and the second preset condition is met; when the absolute value of the difference between the actual value and the predicted value of the standard single performance indicator corresponding to the service cycle of each network device of different enterprises is greater than the lower limit of the dynamic threshold and less than the upper limit of the dynamic threshold, the actual value of the standard single performance indicator corresponding to the service cycle is normal, and the second preset condition is not met.

[0024] In some embodiments, the secondary anomaly detection is based on a comprehensive calculation of anomaly scores using standard multidimensional performance index values ​​of each network device within each enterprise, to obtain target detection results, including:

[0025] The secondary anomaly detection is based on the comprehensive calculation of anomaly scores by the standard multidimensional performance index values ​​of each network device of each enterprise, and the anomaly score results are obtained.

[0026] Based on the anomaly scoring results, the target detection results are obtained;

[0027] Specifically, assign the The initial weights of the standard multidimensional performance index values ​​for a company's network equipment are: ;

[0028] Using a 7-day sliding window to count the first The standard for network equipment of individual enterprises This performance index is used as a baseline value. ;

[0029] When the abnormal score is greater than the preset threshold The target detection result is obtained after three consecutive sampling cycles.

[0030] Secondly, embodiments of this application provide a performance monitoring device for a network device, comprising:

[0031] Data acquisition module: Collects multi-dimensional performance index data of each enterprise network device in real time;

[0032] Data processing module: Data preprocessing to obtain standard multidimensional performance index values ​​for each enterprise network device;

[0033] Data detection module: Based on the business cycle of each enterprise network device, it obtains the target detection results by real-time anomaly detection standard performance index values;

[0034] Status monitoring module: Locates network device IDs based on target detection results and handles faults promptly.

[0035] The network device performance monitoring method provided in this application employs machine learning algorithms and threshold rules to quickly process network device performance data, shortening data processing time and solving the problems of difficult network device location and lengthy troubleshooting. Since network device performance is also affected by multi-dimensional information such as throughput, packet loss rate, CPU, temperature, and voltage environmental parameters, even when a single performance indicator is normal, further comprehensive analysis of multi-dimensional performance data is needed to more accurately detect the network device status and promptly and accurately locate faulty devices, thereby improving the accuracy of network device monitoring. Attached Figure Description

[0036] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0037] Figure 1 This is a flowchart illustrating the network device performance monitoring method provided in an embodiment of this application;

[0038] Figure 2 This is a schematic diagram of the logical architecture of the network device performance monitoring device provided in the embodiments of this application;

[0039] Figure 3 This is a schematic diagram of the electronic device structure of the network device performance monitoring method provided in the embodiments of this application.

[0040] Figure label:

[0041] 201. Data acquisition module; 202. Data processing module; 203. Data detection module; 204. Status monitoring module; 310. Processor; 320. Communication interface; 330. Memory; 340. Communication bus. Detailed Implementation

[0042] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0043] The following is combined Figures 1 to 3 The illustrated embodiments describe the technical solution of the present invention:

[0044] This application provides an embodiment of a network device performance monitoring method, referring to... Figure 1 As shown, the network device performance monitoring method provided in this embodiment includes the following steps:

[0045] S110: Real-time acquisition of multi-dimensional performance index data of each network device in each enterprise.

[0046] In some embodiments, the implementation of step S110 (real-time acquisition of multi-dimensional performance index data of each network device of each enterprise) may include:

[0047] Using the Prometheus+SNMPExporter monitoring platform, the OID splicing technology is used to merge SNMP requests, and an adaptive sampling frequency method is used to collect multi-dimensional performance index data of network devices in real time.

[0048] It's important to note that traditional monitoring methods cannot monitor the real-time operation of network devices. The excessive time spent detecting device faults prevents administrators from promptly locating and addressing them, thus impacting the normal operation of the network. The advantage of SNMP-based monitoring is the real-time collection of device status data, such as CPU, memory, and port status. This protocol is highly versatile and relatively simple to deploy. However, a disadvantage is that high-frequency polling may increase the load on network devices. The SNMP protocol involves the management station polling the agent via UDP to obtain predefined OID values ​​from the MIB (Network Information Base), retrieving metrics such as CPU, memory, and port status from the network device's MIB database.

[0049] Specifically, the method of merging SNMP requests using OID concatenation technology can combine multiple SNMP requests into a single query, reducing the number of network interaction requests and thus improving the efficiency of network device performance monitoring. The backend extracts OIDs and their basic information by parsing the MIB files and the reference relationships between them. The basic OID information includes: OID, device name, data type, and device status.

[0050] It's important to note that OID, as a unique identifier in the SNMP protocol, is used to locate device performance metrics, including CPU utilization, port status, and traffic data. Enterprise network device monitoring associates device performance data with dedicated network IDs, establishing a mapping relationship between dedicated network IDs and devices. When a fault occurs, the faulty device can be quickly located using the ID, allowing for timely intervention and ensuring the safe operation of network devices. Batch collection of performance data such as CPU, memory, and port status using OIDs places higher demands on the efficiency of performance data processing due to the large volume of data collected in batches.

[0051] It should be noted that if the sampling frequency is too high, it will cause the device's CPU to overload and increase the dependence on bandwidth resources. Therefore, the sampling frequency should be set reasonably. An adaptive sampling frequency method should be adopted according to the different service cycles of the network device to balance resource consumption.

[0052] For example, the data collection interval can be dynamically adjusted according to the business cycle of different enterprise network devices or the fluctuation of different business cycles of the same enterprise. For example, during peak hours, sampling can be performed at the second level for 10 seconds / time, and during off-peak hours, sampling can be switched to the minute level for 5 minutes / time.

[0053] S120: Preprocess the multidimensional performance index data of each network device in each enterprise to obtain the standard multidimensional performance index values ​​of each network device in each enterprise.

[0054] In step S120 above, the multidimensional performance index data is preprocessed using the Z-score algorithm to obtain standard multidimensional performance index values.

[0055] Specifically, the Z-score algorithm can process multi-dimensional data. By using this algorithm to preprocess multi-dimensional performance index data such as CPU utilization of 80% and packet loss rate of 0.5%, standard multi-dimensional performance index values ​​can be obtained.

[0056] It's important to note that data preprocessing optimizes the collected raw data, addressing common data quality issues and improving the efficiency and accuracy of network device performance monitoring. Because performance metrics from different network devices can vary in units and magnitudes, direct data analysis can affect the accuracy of the results; data preprocessing is a crucial step in improving the accuracy of analysis. The Z-score algorithm quantifies the degree of deviation and is suitable for network device performance monitoring scenarios with real-time requirements.

[0057] It should be noted that the system receives performance index data corresponding to multiple network devices of the enterprise from the preset monitoring platform. First, the performance index data is preprocessed to obtain processed data. Data preprocessing makes the next step of data analysis more accurate. The processed data is then stored in the database, and the status of the monitoring platform is updated.

[0058] S130: Based on the business cycle of each network device in each enterprise, determine whether the standard single performance index value of the network device meets the preset conditions.

[0059] It should be noted that in network device monitoring, if the data processing takes too long, it can lead to difficulties in quickly locating faulty devices, resulting in delays in addressing them. The advantage of single performance metric anomaly detection is its fast response time and low resource consumption. It can quickly issue early warnings of device anomalies and promptly detect abnormal conditions in network devices. Firstly, a threshold-based method is used to determine the anomaly. This method performs single-metric anomaly detection locally based on threshold rules, allowing for a quick preliminary assessment of abnormal conditions.

[0060] In some embodiments, step S130 (determining whether the standard single performance index value of the network device meets preset conditions based on the service cycle of each network device in each enterprise) includes:

[0061] Step a: Based on the business cycle of each network device in the same enterprise, determine whether the standard single performance index value of the network device meets the first preset condition;

[0062] Specifically, a reference group is set based on historical data, and the service cycles of network devices are divided into three target service cycles: idle period, transition period, and peak period. The corresponding cycle thresholds for the three target service cycles are then set according to the reference group. , , .

[0063] If the standard single performance index value of each network device in the same enterprise is greater than the period threshold corresponding to the target service period, then the first preset condition is met; if the standard single performance index value of each network device in the same enterprise is less than or equal to the period threshold corresponding to the target service period, further judgment and analysis are required.

[0064] It should be further noted that, since the values ​​of the same performance index within the same business cycle of the same enterprise are relatively small, the threshold-based method may not be accurate in judging abnormal conditions; therefore, a clustering-based method is used to judge the performance status of network settings.

[0065] The standard single performance index values ​​of various network devices of the same enterprise for the same target business cycle are used to detect abnormal data of single performance index. If the single performance index data corresponding to the standard single performance index value of the same target business cycle is detected to be abnormal, it meets the first preset condition. If the single performance index data corresponding to the standard single performance index value of the same target business cycle is detected to be normal, it does not meet the first preset condition.

[0066] Step b: Based on the business cycle of each network device in different enterprises, determine whether the standard single performance index value of the network device meets the second preset condition;

[0067] Specifically, the Prophet algorithm is used to predict the historical standard single performance index values ​​of various network devices in different enterprises for the service cycle, and the predicted value and confidence interval of the standard single performance index corresponding to the service cycle are obtained. When the actual value of the standard single performance index corresponding to the service cycle is not in the dynamic threshold confidence interval, it is abnormal and meets the second preset condition. When the actual value of the standard single performance index corresponding to the service cycle is in the dynamic threshold confidence interval, it is normal and does not meet the second preset condition.

[0068] It should be noted that, due to differences in network equipment conditions, traffic volumes, and required bandwidth and CPU, the Prophet algorithm is used to predict the traffic volume of network equipment for different enterprises. This yields a confidence interval, which serves as the upper and lower limits of the dynamic alarm threshold. Data points where the difference between the predicted and actual values ​​exceeds a certain threshold can be considered abnormal. The algorithm can also effectively distinguish between traffic peaks (such as evening rush hours on weekdays) and genuine anomalies. Furthermore, it can determine persistent anomalies based on real-time network equipment performance, triggering an alarm only when performance data exceeds the confidence interval for three consecutive periods. The Prophet algorithm can predict potential network equipment performance failures, triggering early warning notifications to adjust network equipment resources in a timely manner, minimizing the occurrence of anomalies and reducing resource waste and economic losses.

[0069] The preset conditions include a first preset condition and a second preset condition. Meeting either the first preset condition or the second preset condition is considered to meet the preset conditions.

[0070] S140: Anomaly score is calculated based on the comprehensive values ​​of standard multidimensional performance indicators of each network device in each enterprise to obtain the target detection result.

[0071] It should be noted that while the aforementioned methods for detecting anomalies in a single performance metric of network devices can quickly identify abnormal conditions, a single metric indicating normal operation does not necessarily guarantee that the network device is functioning correctly. Network device performance monitoring is influenced by other factors, requiring the performance metrics of various devices to work together. A more comprehensive and detailed performance assessment is needed, based on real-time collected data on bandwidth, latency, packet loss rate, jitter, CPU usage, and other multi-dimensional metrics. For example, factors such as CPU processing power, potential hardware overheating leading to system crashes, and whether device configurations deviate from baselines can help prevent security vulnerabilities. A single normal performance metric cannot fully reflect the security status of a network device. Therefore, a multi-dimensional data fusion approach is necessary for further anomaly detection—a secondary anomaly detection—to more accurately monitor network device operation and minimize service interruptions.

[0072] In some embodiments, step S140 (calculating anomaly scores based on the comprehensive values ​​of standard multidimensional performance indicators of each network device in each enterprise to obtain target detection results) includes:

[0073] Step a: Calculate the anomaly score based on the standard multidimensional performance index values ​​of each network device in each enterprise, and obtain the anomaly score result;

[0074] Specifically, a network device has multiple monitoring metrics such as CPU, ports, and memory. A normal performance metric alone does not guarantee that the network device is functioning correctly. For example, CPU overload may cause cache overflow, leading to packet loss on ports, even though port status may appear normal when checked individually. Multiple performance metrics need to be monitored and analyzed, integrating traffic characteristics, device status, and environmental parameters. A weighted scoring model is used to improve the comprehensiveness of the baseline. Initial weights are assigned to the standard multidimensional performance metric values ​​for each network device within each enterprise.

[0075] For example, the first The initial weights of the standard multidimensional performance index values ​​for a company's network equipment are: The allocation is as follows:

[0076] Traffic characteristics (weight 40%): throughput (20%), packet loss rate (15%), retransmission rate (5%).

[0077] Device status (weight 35%): CPU utilization (15%), memory usage (10%), disk I / O latency (10%).

[0078] Environmental parameters (weight 25%): temperature deviation from baseline (15%), voltage stability (10%).

[0079] Since 7 days include weekdays and weekends, and encompass the company's peak and off-peak business periods, a 7-day sliding window is used to statistically analyze the performance metrics of each network device as a baseline value. .

[0080] It should be noted that due to the periodic fluctuations in network traffic, the initial weights cannot distinguish between surges in normal business traffic and actual equipment failures, leading to a higher false alarm rate and affecting the accuracy of network equipment performance monitoring. Since different enterprises have different business demands, and even within the same enterprise, network equipment demands vary across different business cycles, the initial weights of performance metrics need to be dynamically adjusted.

[0081] Calculate the Pearson correlation coefficient between each network performance indicator and the core business indicator throughput, and amplify the weight of strongly correlated performance indicators.

[0082] The dynamic adjustment coefficient for weights is calculated as follows:

[0083] ;

[0084] In the formula, Indicates the first The standard for network equipment of individual enterprises The weighting adjustment coefficients for the values ​​of various performance indicators. Indicates the first Initial weights of standard multidimensional performance index values ​​for network equipment of an enterprise; Indicates the first The network performance standard for individual enterprises The Pearson correlation coefficient between the performance index values ​​and throughput.

[0085] Using a 7-day sliding window to count the first The standard for network equipment of individual enterprises This performance index is used as a baseline value. ;

[0086] The formula for calculating the anomaly score is as follows:

[0087] ;

[0088] In the formula, Indicates the first The initial weights of the standard multidimensional performance index values ​​for a company's network equipment. Indicates the first The standard for network equipment of individual enterprises The weighting adjustment coefficients for the values ​​of various performance indicators. Indicates the first The standard for network equipment of individual enterprises Real-time values ​​of various performance indicators Indicates the first The standard for network equipment of individual enterprises The baseline value of the performance index, This indicates an abnormal score.

[0089] Step b: Obtain the target detection results based on the anomaly scoring results;

[0090] Specifically, preset threshold The score is 0.8, if there is an abnormal score. When the value is >0.8 and continues for three consecutive sampling periods, the network device is in an abnormal state, and the result is the target detection result.

[0091] S150: Based on the target detection results, output network device warning information.

[0092] The target detection result indicates that the network device is in an abnormal state. The system outputs a network device warning message and promptly locates and handles the faulty device.

[0093] It should be noted that when an anomaly is detected, an early warning message is output, including the ID of the faulty network device. This device ID is used to quickly locate and address the faulty device. When no anomalies are detected, information about the device's normal status is output. The monitoring platform status is also updated promptly to ensure the safe operation of network devices.

[0094] Based on the same inventive concept, this application also provides a performance monitoring device for network devices. Please refer to [link to relevant documentation]. Figure 2 , Figure 2 This is a schematic diagram of the logical architecture of a network device performance monitoring device provided in an embodiment of this application. The network device performance monitoring device includes: a data acquisition module 201, a data processing module 202, a data detection module 203, and a status monitoring module 204; wherein:

[0095] Data acquisition module 201 is used to collect multi-dimensional performance index data of each enterprise network device in real time. Based on the Prometheus+SNMPExporter monitoring platform, it uses OID splicing technology to merge SNMP requests and adopts an adaptive sampling frequency method to collect multi-dimensional performance index data of each enterprise network device in real time.

[0096] Data processing module 202 is used to preprocess the multi-dimensional performance index data of each enterprise network device using the Z-score algorithm to obtain the standard multi-dimensional performance index value of each enterprise network device.

[0097] The data detection module 203 is used to detect anomalies in standard performance indicators in real time based on the business cycle of each enterprise's network devices, and obtain the target detection result. For the business cycle of each network device within the same enterprise, an algorithm is used to determine whether the standard single performance indicator value of the network device meets a first preset condition; for the business cycle of each network device in different enterprises, an algorithm is used to determine whether the standard single performance indicator value of the network device meets a second preset condition; meeting either the first or second preset condition is considered meeting the preset conditions; an anomaly score is calculated based on the comprehensive standard multi-dimensional performance indicator values ​​of each network device in each enterprise, and an anomaly score result is obtained; based on the anomaly score result, the target detection result is obtained.

[0098] The status monitoring module 204 is used to output network device early warning information based on the target detection results, locate the network device ID, and handle faulty network devices in a timely manner.

[0099] Figure 3 An example of a performance monitoring method for network devices is shown in the schematic diagram of the electronic device structure, such as... Figure 3 As shown, the electronic device may include a processor 310, a communications interface 320, a memory 330, and a communication bus 340. The processor 310, communications interface 320, and memory 330 communicate with each other via the communication bus 340. The processor 310 can call logical instructions stored in the memory 330 to execute the aforementioned network device performance monitoring method.

[0100] Furthermore, the logical instructions in the aforementioned memory 330 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0101] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0102] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0103] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method of performance monitoring of a network device, the method comprising: include: Real-time acquisition of multi-dimensional performance index data of each enterprise's network devices is used to determine the target detection results; The multidimensional performance index data of each network device of each enterprise are preprocessed to obtain the standard multidimensional performance index value of each network device of each enterprise. The standard multidimensional performance index value is at least two standard single performance index values. Based on the business cycle of each network device in each enterprise, determine whether the standard single performance index value of the network device meets the preset conditions. If so, then the single performance index data corresponding to the standard single performance index value that meets the preset conditions is determined as the target detection result; If not, then a second anomaly detection will be performed on the single performance index data corresponding to the standard single performance index value that does not meet the preset conditions. The secondary anomaly detection is based on the comprehensive calculation of anomaly scores by the standard multidimensional performance index values ​​of each network device of each enterprise, to obtain the target detection result; Based on the target detection results, output network device warning information; The process of acquiring multi-dimensional performance index data of each network device in real time includes: using the Prometheus+SNMPExporter monitoring platform, using OID splicing technology to merge SNMP requests, and using an adaptive sampling frequency method to collect multi-dimensional performance index data of network devices in real time. The business cycle based on each network device of each enterprise includes: dividing the business cycle into three target business cycles based on the business cycle of each network device of the same enterprise, wherein the three target business cycles are idle period, transition period and peak period respectively; and setting a cycle threshold corresponding to each of the three target business cycles. The process of determining whether the standard single performance index value of the network device meets the preset conditions includes: determining whether the standard single performance index value of the network device meets the first preset condition based on the service cycle of each network device of the same enterprise; determining whether the standard single performance index value of the network device meets the second preset condition based on the service cycle of each network device of different enterprises; wherein, meeting either the first preset condition or the second preset condition is considered to meet the preset conditions. The process of obtaining the target detection result includes: the secondary anomaly detection is based on the comprehensive calculation of the anomaly score based on the standard multidimensional performance index values ​​of each network device of each enterprise, and an anomaly score result is obtained; the target detection result is obtained based on the anomaly score result and for three consecutive sampling periods. Based on the target detection results, the process of outputting network device early warning information includes: when the target detection results indicate an abnormal situation, outputting network device early warning information and promptly locating and handling the faulty device; the early warning includes the ID of the faulty network device, using the device ID to promptly locate and quickly handle the faulty device; conversely, when there is no abnormality, outputting information about the normal status of the device.

2. The method of claim 1, wherein the network device is a router. The step of determining whether the standard single performance index value of the network device meets the first preset condition based on the service cycle of each network device of the same enterprise includes: If the standard single performance index value of each network device of the same enterprise is greater than the period threshold corresponding to the target service period of each network device of the same enterprise, then the first preset condition is met. If the standard single performance index value of each network device of the same enterprise is less than or equal to the period threshold corresponding to the target business period of each network device of the same enterprise, then the kmeans algorithm is used to detect abnormal data of the single performance index for the same target business period of each network device of the same enterprise. If the single performance index data corresponding to the standard single performance index value of each network device of the same enterprise for the same target service period is detected to be abnormal, then the first preset condition is met; if the single performance index data corresponding to the standard single performance index value of each network device of the same enterprise for the same target service period is detected to be normal, then the first preset condition is not met.

3. The network device performance monitoring method according to claim 1, characterized in that, The step of determining whether the standard single performance index value of the network device meets the second preset condition based on the service cycle of each network device in different enterprises includes: Based on the service cycles of various network devices of different enterprises, the Prophet algorithm is used to predict the historical standard single performance index values ​​of the service cycles of various network devices of different enterprises, so as to obtain the predicted values ​​and confidence intervals of the standard single performance index corresponding to the service cycles of various network devices of different enterprises. The confidence interval is the upper and lower limits of the dynamic threshold. When the absolute value of the difference between the actual value of the standard single performance index corresponding to the service cycle of each network device of different enterprises and the predicted value of the standard single performance index corresponding to the service cycle is greater than the upper limit of the dynamic threshold and less than the lower limit of the dynamic threshold, the actual value of the standard single performance index corresponding to the service cycle is abnormal, and the second preset condition is met. When the absolute value of the difference between the actual value of the standard single performance index corresponding to the service cycle of each network device of different enterprises and the predicted value of the standard single performance index corresponding to the service cycle is greater than the lower limit of the dynamic threshold and less than the upper limit of the dynamic threshold, the actual value of the standard single performance index corresponding to the service cycle is normal, and the second preset condition is not met.

4. The network device performance monitoring method according to claim 1, characterized in that, The secondary anomaly detection is based on a comprehensive calculation of the anomaly score using standard multidimensional performance index values ​​of each network device in each enterprise, resulting in an anomaly score result, including: Allocation of the first The initial weights of the standard multidimensional performance index values ​​for a company's network equipment are: ; Using a 7-day sliding window to count the first The standard for network equipment of individual enterprises This performance index is used as a baseline value. ; The method for calculating the anomaly score is as follows (1): （1） In the formula, Indicates the first The initial weights of the standard multidimensional performance index values ​​for a company's network equipment. Indicates the first The standard for network equipment of individual enterprises The weighting adjustment coefficients for the values ​​of various performance indicators. Indicates the first The standard for network equipment of individual enterprises Real-time values ​​of various performance indicators Indicates the first The standard for network equipment of individual enterprises The baseline value of the performance index, This indicates an abnormal score.

5. The network device performance monitoring method according to claim 4, characterized in that, The process of obtaining the target detection result based on the anomaly scoring result and for three consecutive sampling periods includes: When the abnormal score is greater than a preset threshold The target detection result is obtained after three consecutive sampling cycles.

6. An apparatus for a network device, used to implement the performance monitoring method for a network device as described in any one of claims 1-5, characterized in that, include: Data acquisition module: Used to collect multi-dimensional performance index data of each enterprise network device in real time. The data acquisition module is based on the Prometheus+SNMPExporter monitoring platform, uses OID splicing technology to merge SNMP requests, and adopts an adaptive sampling frequency method to complete the real-time collection of multi-dimensional performance index data of each enterprise network device. Data processing module: Used to preprocess the multidimensional performance index data of each enterprise network device using the Z-score algorithm to obtain the standard multidimensional performance index value of each enterprise network device; Data detection module: used to perform real-time anomaly detection on the standard multidimensional performance index values ​​based on the business cycle of each enterprise network device, and obtain the target detection result; for the business cycles of various network devices of the same enterprise, to determine whether the standard single performance index value meets the first preset condition; For the business cycles of various network devices in different enterprises, it is determined whether the standard single performance index value meets the second preset condition; wherein, meeting either the first preset condition or the second preset condition is considered to meet the preset condition; then, based on the standard multi-dimensional performance index values ​​of each network device in each enterprise, an anomaly score is calculated to obtain the anomaly score result; finally, based on the anomaly score result, the target detection result is obtained. Status monitoring module: Used to output network device early warning information based on the target detection results, carry and locate the network device ID in the early warning information, and then handle faulty network devices in a timely manner.

Images