Method, system, device, medium and product for generating a probing task of a virtual network

Abstract

The application discloses a virtual network detection task generation method, system, device, medium and product, and relates to the technical field of cloud network operation and maintenance.The method comprises the following steps: obtaining subscription resources of a cloud service user; obtaining a detectable address of a virtual network corresponding to the cloud service user according to the subscription resources; and generating a detectable link.The method further comprises the following steps: dividing the detectable link into a plurality of continuous time units; calculating time attenuation quality characteristics of each time unit according to a time difference between each time unit and a latest time unit; sorting the detectable link according to the time attenuation quality characteristics of all the time units; screening a target detection link; and generating a detection task comprising the target detection link.The application can accurately adapt to virtual dynamic characteristics, capture real-time state changes of the link, significantly improve the generation efficiency of the detection task, and further strengthen the guarantee capability for a service level agreement.

Description

Technical Field

[0001] This invention relates to the field of cloud network operation and maintenance technology, and in particular to a method, system, device, medium and product for generating detection tasks for virtual networks. Background Technology

[0002] With the rapid iteration of cloud computing technology, cloud service providers need to support the deployment of virtual private clouds (VPCs) for a large number of tenants. They typically use virtual network probes to continuously track network status to ensure that the services provided meet the service level agreements (SLAs).

[0003] Existing virtual network detection technologies mainly revolve around the design of the underlay physical network, generating detection task plans either directly based on the underlay detection scenario or based on the evolution of underlay detection task rules.

[0004] However, as an overlay virtual network, VPC's probing mission planning scheme, which is based on the underlay design, is difficult to adapt to the probing requirements of the overlay virtual network, resulting in insufficient SLAs assurance capabilities. Summary of the Invention

[0005] This invention aims to provide a method, system, device, medium, and product for generating probe tasks in virtual networks. By introducing a time decay mechanism to dynamically adjust the priority of valid probeable links, it can not only accurately adapt to the dynamic characteristics of virtual networks and reduce resource waste caused by invalid probes from the source, but also capture real-time changes in link status, significantly improve the efficiency of probe task generation, and thus strengthen the guarantee capability for service level protocols.

[0006] In a first aspect, embodiments of the present invention provide a method for generating a detection task for a virtual network, comprising:

[0007] Obtain the ordered resources of the cloud service user, obtain the detectable address of the virtual network corresponding to the cloud service user based on the ordered resources, and generate a detectable link;

[0008] The detectable link is divided into several consecutive time units, and the time decay quality characteristics of each time unit are calculated based on the time difference between each time unit and the latest time unit.

[0009] Based on the time decay quality characteristics of all the time units, the detectable links are sorted, target detection links are filtered, and a detection task including the target detection links is generated.

[0010] As an improvement to the above solution, the step of obtaining the cloud service user's subscribed resources, obtaining the detectable address of the virtual network corresponding to the cloud service user based on the subscribed resources, and generating a detectable link includes:

[0011] Obtain the cloud service user's subscribed resources, and obtain the user's VPC security group and the security group's bound nodes;

[0012] The rules of the security group are parsed to calculate the inbound and outbound accessible addresses of the security group;

[0013] Based on the inbound and outbound accessible addresses, the accessible nodes of the security group are obtained; the accessible nodes include inbound accessible nodes and outbound accessible nodes;

[0014] A detectable link is generated based on the address of the bound node and the address of the accessible node.

[0015] As an improvement to the above scheme, the step of parsing the rules of the security group and calculating the inbound and outbound accessible addresses of the security group includes:

[0016] The rules of the security group are parsed to obtain the allowed inbound and outbound addresses of the security group;

[0017] Obtain the subnet CIDR of the user's VPC;

[0018] Calculate the intersection of the allowed inbound / outbound addresses and the subnet CIDR to obtain the inbound / outbound accessible addresses of the security group.

[0019] As an improvement to the above scheme, the step of generating a detectable link based on the address of the bound node and the address of the accessible node includes:

[0020] Get the first address of the first node's bound node; the first node can be any accessible node;

[0021] Get the node that is both an outgoing accessible node and a bound node of the first node, and use it as the second node;

[0022] Obtain the second address of the incoming accessible node of the second node;

[0023] If the first address and the second address have an intersection, an initial probe link from the first node to the second node is generated;

[0024] The initial probe links are deduplicated to generate probeable links.

[0025] As an improvement to the above scheme, the detectable link is divided into several consecutive time units, and the time attenuation quality characteristics of each time unit are calculated based on the time difference between each time unit and the latest time unit, including:

[0026] The detectable link is divided into several consecutive time units according to the preset time unit length;

[0027] Calculate the service access rate and failure rate of the detectable link under each time unit, and perform a weighted sum of the service access rate and failure rate as the initial quality feature;

[0028] Calculate the time difference between each time unit and the latest time unit, and calculate the time decay factor based on the time difference;

[0029] The initial quality characteristics are weighted using the time decay factor to obtain the time decay quality characteristics of each time unit.

[0030] As an improvement to the above scheme, the calculation of the service access rate and failure rate of the detectable link under each time unit, and the weighted summation of the service access rate and failure rate as the initial quality feature, includes:

[0031] Obtain service access data of the detectable link under the time unit, and calculate the service access rate based on the service access data;

[0032] Acquire alarm data and complaint data of the detectable link under the time unit, and calculate the failure rate based on the alarm data and complaint data;

[0033] Based on preset weighting factors, the service access rate and the failure rate of the same time unit are weighted and summed to obtain the initial quality characteristics of each time unit.

[0034] As an improvement to the above scheme, the step of calculating the time difference between each time unit and the latest time unit, and calculating the time decay factor based on the time difference, includes:

[0035] Calculate the time difference between each time unit and the latest time unit;

[0036] The time difference is exponentially calculated to obtain the enhanced time difference;

[0037] The enhanced time difference is subjected to exponential decay processing to calculate the time decay factor.

[0038] As an improvement to the above scheme, the step of sorting the detectable links according to the time decay quality characteristics of all the time units, filtering target detection links, and generating a detection task including the target detection links includes:

[0039] The link detection score for each detectable link is obtained by summing the time decay quality characteristics of all the time units.

[0040] Based on the link detection score, the detectable links are ranked.

[0041] From the sorted detectable links, select the TOP-N detectable links as target detection links;

[0042] Based on the target detection link, a detection task including the target detection link is generated.

[0043] As an improvement to the above scheme, the step of selecting the TOP-N detectable links from the sorted detectable links as target detection links includes:

[0044] Obtain the physical server to which the source node of the detectable link belongs;

[0045] The maximum number of probe tasks supported by the physical server is obtained using the OVS injection packet detection method.

[0046] Based on the maximum number of detection tasks, the TOP-N detectable links are selected as target detection links.

[0047] Secondly, embodiments of the present invention also provide a virtual network detection task generation system, comprising:

[0048] The detectable link filtering module is used to obtain the ordered resources of cloud service users, obtain the detectable address of the virtual network corresponding to the cloud service users based on the ordered resources, and generate detectable links.

[0049] The time decay analysis module is used to divide the detectable link into several consecutive time units and calculate the time decay quality characteristics of each time unit based on the time difference between each time unit and the latest time unit.

[0050] The detection task generation module is used to sort the detectable links according to the time decay quality characteristics of all the time units, filter the target detection links, and generate a detection task including the target detection links.

[0051] Thirdly, embodiments of the present invention also provide a virtual network detection task generation device, including a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor executes the computer program to implement the virtual network detection task generation method described above.

[0052] Fourthly, embodiments of the present invention also provide a computer-readable storage medium, the computer-readable storage medium including a stored computer program, wherein, when the computer program is executed, it controls the device where the computer-readable storage medium is located to perform the virtual network detection task generation method as described above.

[0053] Fifthly, embodiments of the present invention also provide a computer program product, the computer program product including a computer program or computer instructions, wherein when the computer program or computer instructions are executed by a processor, the virtual network detection task generation method described above is performed.

[0054] Compared with existing technologies, this invention discloses a method, system, device, medium, and product for generating virtual network detection tasks. It obtains the subscribed resources of a cloud service user, identifies the detectable address of the virtual network corresponding to the user based on these resources, and generates detectable links. The detectable links are divided into several consecutive time units. Based on the time difference between each time unit and the latest time unit, the time decay quality characteristics of each time unit are calculated. Based on the time decay quality characteristics of all time units, the detectable links are sorted, target detection links are selected, and a detection task including the target detection links is generated. Using this invention, the dynamic characteristics of virtual networks can be accurately adapted, reducing resource waste caused by invalid detections at the source. It can also capture real-time changes in link status, significantly improving the generation efficiency of detection tasks and thus strengthening the protection capabilities for service level agreements (SLAs). Attached Figure Description

[0055] Figure 1 This is a flowchart illustrating the steps of a method for generating a detection task in a virtual network according to an embodiment of the present invention.

[0056] Figure 2 This is a schematic diagram illustrating the construction process of a VPC-type resource relationship model provided in an embodiment of the present invention;

[0057] Figure 3 This is a flowchart illustrating the steps of a prior art method for determining whether cloud hosts are detectable, as provided in this embodiment of the invention.

[0058] Figure 4 This is a schematic diagram of the partitioning result of a detectable link on the time axis provided by an embodiment of the present invention;

[0059] Figure 5 This is a schematic diagram of the structure of a virtual network detection task generation system provided in an embodiment of the present invention;

[0060] Figure 6 This is a schematic diagram of the structure of a virtual network detection task generation device provided in an embodiment of the present invention. Detailed Implementation

[0061] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0062] In the description and claims, it should be understood that the terms "first," "second," etc., used in the description and claims are only for the purpose of distinguishing the description of the same technical features, and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated, nor necessarily the order of description or chronological order. The terms are interchangeable where appropriate. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature.

[0063] With the rise of cloud computing, public cloud, as a cloud computing model that provides convenient and secure data sharing services, has been rapidly popularized and developed. Virtual Private Cloud (VPC) products provide users with an independent network space similar to a traditional local area network. Users can customize network segments and IPs in their virtual private cloud to achieve access isolation for cloud resources such as cloud servers, cloud containers, and cloud databases, and ensure network security through network access control technologies such as security groups.

[0064] Under the premise of full interconnection of the cloud data center underlay network, some virtual network probing task generation methods combine the physical network architecture and adopt a layered link probing coverage mechanism to formulate probing rules for cloud hosts within the same TOR, across TORs within the same POD, and across PODs, in order to achieve as much coverage as possible of the entire physical network. However, in VNET pingmesh practice, it was found that it is not feasible to directly reuse the probing rules formulated based on the underlay network to the overlay network environment.

[0065] Some virtual network probing task generation methods, based on successful experience in underlay network probing, address the challenges of overlay networks, such as the large scale of cloud hosts and the difficulty in perceiving differences in the underlying physical network architecture. They employ rule-based and layered probing approaches to improve task generation. However, this method only considers cross-region scenarios for path pruning, neglecting access restrictions within the same region based on security group rules. Furthermore, postponing the pruning action after the rule-based task generation leads to unnecessary waste of computational resources.

[0066] It can be seen that existing virtual network probing tasks are all based on underlay scenarios or are carried out through preset rules. However, there are many limitations in actual overlay virtual networks, and existing probing task generation methods are difficult to adapt to the SLAs capability requirements of VPCs.

[0067] Based on the above considerations, this invention provides a method for generating detection tasks in a virtual network. Please refer to... Figure 1 In this embodiment, the method for generating the detection task of the virtual network is specifically executed through steps S1 to S3:

[0068] S1. Obtain the ordered resources of the cloud service user, obtain the detectable address of the virtual network corresponding to the cloud service user based on the ordered resources, and generate a detectable link.

[0069] S2. Divide the detectable link into several consecutive time units, and calculate the time decay quality characteristics of each time unit based on the time difference between each time unit and the latest time unit.

[0070] S3. Based on the time decay quality characteristics of all the time units, sort the detectable links, filter the target detection links, and generate a detection task including the target detection links.

[0071] It should be noted that the method for obtaining ordered resources to generate links in this embodiment of the invention differs from the traditional method that relies on the physical structure of the underlay. The ordered resources reflect the virtual resources and virtual network configuration actually used by the user.

[0072] The above solution can generate detectable links based on virtual resources and their configuration logic, and then further generate detection tasks, avoiding invalid detection links from entering the subsequent task generation process and reducing the resource waste caused by traditional post-pruning.

[0073] In practical applications, changes in the business needs of cloud service users constantly update subscribed resources, which in turn triggers updates to detectable addresses. In some preferred embodiments of the present invention, based on real-time changes in subscribed resources, detectable links are regenerated, or updates are performed on previously generated detectable links, to capture the latest characteristics of cloud service users.

[0074] In this embodiment of the invention, the detectable link is divided into continuous and quantifiable time segments by time units, and the impact of stale data on the overall link quality is weakened by a time decay mechanism, dynamically reflecting the changes in link quality characteristics. Furthermore, the detection priority is determined based on the comprehensive quality of the detectable link, and detection tasks are generated by focusing on the target detection link. On the one hand, this avoids the rigidity of static task planning, and on the other hand, it strengthens the SLAs guarantee requirements of cloud services and adapts to the dynamic change characteristics of virtual networks.

[0075] In the above scheme, the identification of detectable links based on user-ordered resources can accurately adapt to the dynamic characteristics of the virtual environment and reduce resource waste caused by invalid probes from the source. Furthermore, considering the impact of time decay on the quality of detectable links, it can capture real-time status changes of the links to further filter target probe links and generate probe tasks, which significantly improves the generation efficiency of probe tasks and thus strengthens the guarantee capability for service level protocols.

[0076] In a preferred implementation, step S1 involves obtaining the subscribed resources of the cloud service user, obtaining the detectable address of the virtual network corresponding to the cloud service user based on the subscribed resources, generating a detectable link, and executing steps S11-S14.

[0077] S11. Obtain the cloud service user's subscribed resources and get the user's VPC security group and the security group's bound nodes;

[0078] S12. Parse the rules of the security group and calculate the inbound and outbound accessible addresses of the security group;

[0079] S13. Based on the inbound and outbound accessible addresses, obtain the accessible nodes of the security group; the accessible nodes include inbound accessible nodes and outbound accessible nodes;

[0080] S14. Generate a detectable link based on the address of the bound node and the address of the accessible node.

[0081] It should be noted that the accessible nodes are nodes in the virtual network that have network reachability, including cloud hosts, elastic network cards, load balancers, etc.

[0082] Based on the current virtual network architecture, in a preferred embodiment of the present invention, both the accessible node and the bound node are cloud hosts.

[0083] In public cloud scenarios, users build virtual machine local area networks (LANs) by subscribing to resources such as VPCs and cloud servers, and configuring subnets and security groups. Typically, the networks between cloud servers within the same VPC are fully interconnected, unaffected by whether they cross mainnets. However, users often set security group rules to restrict the accessibility of certain cloud servers for access control and security reasons. Therefore, the calculation of accessible network links within a VPC must consider both user-subscribed resources and security group rule restrictions.

[0084] In some preferred embodiments of the present invention, a relationship model between VPC-type resources of cloud service users is constructed to associate various subscribed resources, facilitating subsequent operations such as rule pruning and parsing. For example, the subscribed resources include: user ID, VPC ID, subnet CIDR, cloud host ID, network interface card ID, IP address, security group ID, and security group rules.

[0085] Please see Figure 2 Based on the association logic of virtual networks, a relationship model between VPC-like resources of cloud service users is constructed. A VPC can contain several subnets. By identifying the inclusion relationship between VPCs and subnets, the affiliation of a subnet within a VPC can be clarified. At the network access logic level, a subnet can be associated with several network interface cards (NICs). Through the association relationship between subnets and NICs, the deployment scope of the NICs can be determined, providing a basis for subsequent address acquisition. As the communication entry point of the virtual network, the NIC undergoes security group binding and cloud host binding. The binding relationship between NICs and security groups is many-to-many. Figure 2 The system also introduces security group rules to determine the reachability of virtual links within a given security group. Network interface cards (NICs) and cloud hosts have a many-to-one binding relationship, meaning one cloud host can have multiple NICs mounted on it. As the platform for business operations, multiple cloud hosts typically belong to a single compute node. The mapping between cloud hosts and compute nodes maps virtual cloud hosts to physical computing resources.

[0086] In some preferred embodiments, step S11 obtains the security group of the user's VPC and the binding node of the security group through the VPC-type resource relationship model constructed above.

[0087] Further, preferably, step S12, parsing the rules of the security group and calculating the inbound and outbound accessible addresses of the security group, includes:

[0088] The rules of the security group are parsed to obtain the allowed inbound and outbound addresses of the security group;

[0089] Obtain the subnet CIDR of the user's VPC;

[0090] Calculate the intersection of the allowed inbound / outbound addresses and the subnet CIDR to obtain the inbound / outbound accessible addresses of the security group.

[0091] In some preferred embodiments, the focus is primarily on network layer probing; therefore, when parsing security group rules, only ICMP (Internet Control Message Protocol) and ANY-class protocol rules are considered.

[0092] As those skilled in the art know, in a virtual network, subnet CIDR (Classless Inter-Domain Routing) is a core identifier used to define the range of subnet IP addresses, replacing the traditional Class A, Class B, and Class C address classifications by using network prefixes.

[0093] The inbound and outbound allowed addresses defined in the security group rules may include wide area addresses or external network segments, but the nodes of a user's virtual network only exist within the user's VPC's subnet CIDR; however, the subnet CIDR only defines the address range and cannot represent access permissions. By calculating the intersection of the inbound and outbound allowed addresses and the subnet CIDR, invalid addresses outside the user's VPC can be filtered out. Further integrating the intersections of all subnets can accurately pinpoint the valid access range within the user's VPC.

[0094] It should also be noted that a user VPC typically contains several security group rules. In practical applications, each security group rule is traversed and parsed to obtain the inbound and outbound accessible addresses corresponding to each security group. In some preferred embodiments, the inbound and outbound accessible address set of the user VPC is constructed based on the inbound and outbound accessible addresses of all security groups.

[0095] Preferably, step S14, generating a detectable link based on the address of the bound node and the address of the accessible node, includes:

[0096] Get the first address of the first node's bound node; the first node can be any accessible node;

[0097] Get the node that is both an outgoing accessible node and a bound node of the first node, and use it as the second node;

[0098] Obtain the second address of the incoming accessible node of the second node;

[0099] If the first address and the second address have an intersection, an initial probe link from the first node to the second node is generated;

[0100] The initial probe links are deduplicated to generate probeable links.

[0101] Traditional methods for determining whether two cloud hosts are detectable based on security group rules require separately checking whether the source's outbound traffic allows the destination IP address, and whether the destination's inbound traffic allows the source IP address. Please refer to [link to relevant documentation]. Figure 3 When determining whether a link from cloud host A to cloud host B is detectable, it's necessary to check if the address of cloud host B is included in the outbound allowed address of cloud host A. If not, the link from cloud host A to cloud host B is considered undetectable. If it is, it further checks if the address of cloud host A is included in the inbound allowed address of cloud host B. If not, the link from cloud host A to cloud host B is considered undetectable; if so, the link from cloud host A to cloud host B is considered detectable. For traditional detectable link generation methods, the computational complexity of one VPC is O(log n). ,in The number of cloud hosts within a user's VPC.

[0102] In this embodiment of the invention, by binding the address of the node and the address of the accessible node, the computational complexity of the aggregated value of the detectable link at the security group granularity is O(n). ,in, The number of security groups associated with the VPC. The number of security groups bound to the cloud host that allow access to the security group. As can be seen, the embodiments of the present invention can effectively reduce the computational complexity of generating detectable links, thereby improving computational efficiency.

[0103] In some preferred embodiments, the security group set associated with a user's VPC is defined as follows: ,in, This represents the number of security groups. Iterate through each security group to obtain the total number of security groups. Binding VPC cloud servers Outbound accessible cloud servers and incoming access to cloud servers .

[0104] Outbound accessible cloud host According to its bound security group Grouping to obtain security groups Outbound access to cloud servers Security groups are bound in The cloud server, denoted as Then it is possible to obtain... That is, by calculating the security group Inbound Accessible Cloud Server With security group Bound VPC cloud servers The intersection of these addresses can be used to identify detectable cloud hosts. ,based on The address can determine the initial probe link and its source and destination ends, where the security group of the source end is... The security group at the destination is .

[0105] By combining the initial probe links corresponding to all security groups, an initial probe link set is obtained. Links in the initial probe link set where the source and destination cloud host addresses are the same are removed, thus obtaining all probeable links and their addresses within the user's VPC.

[0106] Understandably, in public cloud scenarios, users continuously update their subscribed service products and related configuration data based on their own business needs. The detectable links within a user's VPC need to be aware of and dynamically update to reflect changes in user resources and configurations.

[0107] As a preferred implementation, a time window update mechanism is adopted to automatically update the detectable links obtained in step S1 with the user VPC as the update granularity.

[0108] For example, after obtaining the updated subscription resources, low-sensitivity update data, such as data with almost no impact on detection, like changes in cloud host specifications, is filtered out. Further, the data for the same resource is sorted according to timestamp order, and multiple historical update data entries with update types of add / update-delete are filtered out based on the sorting order, completing the preprocessing of the updated subscription resources. Then, the updated subscription resources within the time window are aggregated to the VPC granularity according to the above embodiment, and the detectable links and addresses of the affected user VPCs are updated.

[0109] In the above scheme, user VPC resources are precisely selected by ordering resources, and then probeable links are generated by trimming based on user security group rules. Compared with existing technologies, this not only adapts to the characteristics of virtual networks, but also effectively reduces the computational complexity of probeable links, laying an efficient and accurate link foundation for the generation of subsequent probe tasks.

[0110] In a preferred implementation, step S2 involves dividing the detectable link into several consecutive time units, calculating the time attenuation quality characteristics of each time unit based on the time difference between each time unit and the latest time unit, and executing this step through steps S21-24.

[0111] S21. Divide the detectable link into several consecutive time units according to the preset time unit length;

[0112] S22. Calculate the service access rate and failure rate of the detectable link under each time unit, and perform a weighted summation of the service access rate and failure rate as the initial quality feature.

[0113] S23. Calculate the time difference between each time unit and the latest time unit, and calculate the time decay factor based on the time difference;

[0114] S24. The initial quality characteristics are weighted using the time decay factor to obtain the time decay quality characteristics of each time unit.

[0115] In a cloud network environment, a large resource pool typically contains hundreds of thousands of physical servers, and each physical server can virtualize hundreds of virtual machines. For some large customers, a single VPC can accommodate hundreds of thousands of virtual machines.

[0116] Therefore, even after trimming based on user security group rules, the traditional full-mesh ping probing strategy still results in a massive amount of probing tasks. The applicant discovered that cloud network traffic generally follows an 8:2 ratio, meaning that most user traffic typically covers only a small number of service paths. Existing technologies do not differentiate between all probeable links, using the same probing resources for all, leading to wasted resources on inefficient links and insufficient probing accuracy for core links. Therefore, this invention combines actual service traffic to obtain quality characteristics, and evaluates links based on these characteristics.

[0117] Furthermore, since a link's access volume or failure rate was high or low a month or longer ago, this embodiment of the invention further considers the changing trend over time and the impact of time decay factors when generating quality characteristics.

[0118] In some preferred embodiments, the preset time unit length mentioned in step S21 is 1 day, 3 days, or 1 week. Based on the user's requirements for timing characteristics, any time unit length is selected, and all detectable links are divided according to that selected time unit length.

[0119] For example, please see Figure 4 The detectable link is divided into several time units based on a preset time unit length. The earliest time unit ends at t1, and the latest time unit ends at tlatest.

[0120] Further, preferably, step S22, calculating the service access rate and failure rate of the detectable link under each time unit, and performing a weighted sum of the service access rate and failure rate as an initial quality feature, includes:

[0121] Obtain service access data of the detectable link under the time unit, and calculate the service access rate based on the service access data;

[0122] Acquire alarm data and complaint data of the detectable link under the time unit, and calculate the failure rate based on the alarm data and complaint data;

[0123] Based on preset weighting factors, the service access rate and the failure rate of the same time unit are weighted and summed to obtain the initial quality characteristics of each time unit.

[0124] Furthermore, in some preferred embodiments, service access data is obtained through a traffic mirroring collection system, and timestamps, VNIs in packets, source cloud host addresses, and destination cloud host addresses are further extracted from the service access data. Based on the correspondence between VNIs and VPC IDs, the service access rate of the detectable link in each time unit is calculated.

[0125] For example, time unit Internally detectable link Business access rate Represented as:

[0126]

[0127] in, Time unit Internally detectable link The number of business messages, This is a detectable link.

[0128] In some preferred embodiments, alarm data and complaint data are obtained through the alarm system and the user complaint system, respectively.

[0129] For example, time unit Internally detectable link failure rate Represented as:

[0130]

[0131] in, and The preset impact factor, , , ; Time unit Internally detectable link The number of alarms; Time unit Internally detectable link The number of complaint work orders.

[0132] Based on the aforementioned service access rate and failure rate, time unit The initial quality characteristics are represented as follows:

[0133]

[0134] in, The preset business access weight factor, The preset fault weighting factor, , , .

[0135] In the above scheme, the quality of the detectable link in each time unit is evaluated based on business traffic, number of alarms and number of complaint work orders. On the one hand, it can reduce the amount of detection tasks by calculating specific quality characteristics, and on the other hand, it can reflect the quality changes of the detectable link in different time periods.

[0136] Preferably, step S23, calculating the time difference between each time unit and the latest time unit, and calculating the time decay factor based on the time difference, includes:

[0137] Calculate the time difference between each time unit and the latest time unit;

[0138] The time difference is exponentially calculated to obtain the enhanced time difference;

[0139] The enhanced time difference is subjected to exponential decay processing to calculate the time decay factor.

[0140] In this embodiment of the invention, the sensitivity of time decay is adjusted by exponential operation to appropriately amplify the impact of time difference on quality characteristics; furthermore, the service traffic and link status of cloud networks often exhibit nonlinear changes, and this change process is reflected by exponential decay processing.

[0141] For example, the time decay factor of time unit i is expressed as:

[0142]

[0143] in, This represents the number of time unit differences from time unit i to the latest time unit.

[0144] In an embodiment of the present invention, when hour, , indicating no time decay effect; when As the value of the independent variable increases, the effect of time decay also increases.

[0145] The above scheme constructs a detection link evaluation system that considers the impact of time decay. By dividing the time axis into basic time units, the initial quality characteristics of the detectable link are obtained for each time unit based on user business traffic, link alarm data, and customer complaint work order link data. A time decay function is constructed based on the time unit span difference from the historical time unit to the latest time unit, and the initial quality characteristics are weighted to further analyze the cumulative impact of each time unit in the current unit time, so as to obtain the time decay quality characteristics.

[0146] As a preferred implementation, step S3, sorting the detectable links according to the time decay quality characteristics of all the time units, filtering target detection links, and generating a detection task including the target detection links, includes:

[0147] The link detection score for each detectable link is obtained by summing the time decay quality characteristics of all the time units.

[0148] Based on the link detection score, the detectable links are ranked.

[0149] From the sorted detectable links, select the TOP-N detectable links as target detection links;

[0150] Based on the target detection link, a detection task including the target detection link is generated.

[0151] In some preferred embodiments, the link detection score of the detectable link L is expressed as:

[0152]

[0153] Further, preferably, the step of selecting the TOP-N detectable links from the sorted detectable links as target detection links includes:

[0154] Obtain the physical server to which the source node of the detectable link belongs;

[0155] The maximum number of probe tasks supported by the physical server is obtained using the OVS injection packet detection method.

[0156] Based on the maximum number of detection tasks, the TOP-N detectable links are selected as target detection links.

[0157] It should be noted that among the existing mainstream virtual network detection methods, the OVS packet injection detection method is currently the optimal solution. It has the advantages of being non-intrusive and imperceptible to users, and it does not occupy the management channel from the SDN controller to the forwarding plane, so it can be used as a data plane channel for normal service packet multiplexing.

[0158] The OVS packet injection probing method does not require deploying a probe agent on the user's cloud host. Instead, the probe agent is deployed on a physical server, constructing inner packets based on the issued probe tasks. The physical server consumes CPU, memory, and network bandwidth resources when sending and receiving data packets and performing metric calculations. Especially when initiating large-scale concurrent probe tasks, the massive influx of probe traffic can cause a sharp increase in CPU usage, affecting other running processes and the accuracy of the probes. Therefore, in this embodiment of the invention, the maximum number of concurrent tasks that a computing node can support is considered when generating probe tasks.

[0159] In some preferred embodiments, based on VPC resource relationships, primarily the relationship between cloud hosts and their host physical servers, a mapping relationship between the source cloud host and the physical server of the probe link is established. Using the OVS injection-based probe method, and based on maximum resource consumption constraints and probe cycle interval requirements, stress testing of the probe tasks is performed to obtain the maximum number of probe tasks supported within the probe cycle under the constraints. .

[0160] Next, the detectable links within the VPC are sorted based on their detectable link scores, and detectable links are selected in descending order of score. After each selection, the maximum number of corresponding detection tasks is set. ,when At this point, all subsequent source cloud hosts will no longer select tasks on the corresponding computing nodes until the TOP-N probe link selection is completed, at which point the process will terminate.

[0161] It should be noted that if the maximum number of detection missions... The actual number of detection missions is N; if the maximum number of detection missions is... The actual number of detection missions is The value of N depends on the user's needs, but it is also limited by the maximum number of detection tasks.

[0162] The virtual network probe task generation method provided by this invention introduces a time decay mechanism to dynamically adjust the priority of valid probeable links. This not only accurately adapts to the dynamic characteristics of the virtual network and reduces resource waste caused by invalid probes from the source, but also captures real-time changes in link status, significantly improving the generation efficiency of probe tasks and thus strengthening the guarantee capability for service level protocols.

[0163] This invention provides a system for generating detection tasks in a virtual network. Please refer to [link / reference]. Figure 5 The virtual network detection task generation system includes a detectable link filtering module 11, a time decay analysis module 12, and a detection task generation module 13, wherein:

[0164] The detectable link filtering module 11 is used to obtain the ordered resources of the cloud service user, obtain the detectable address of the virtual network corresponding to the cloud service user based on the ordered resources, and generate a detectable link.

[0165] The time decay analysis module 12 is used to divide the detectable link into several consecutive time units and calculate the time decay quality characteristics of each time unit based on the time difference between each time unit and the latest time unit.

[0166] The detection task generation module 13 is used to sort the detectable links according to the time decay quality characteristics of all the time units, filter the target detection links, and generate a detection task including the target detection links.

[0167] In a preferred embodiment, the detectable link filtering module 11 includes:

[0168] The resource acquisition unit is used to acquire the resources ordered by cloud service users and obtain the security groups and binding nodes of the user's VPC.

[0169] The rule parsing unit is used to parse the rules of the security group and calculate the inbound and outbound accessible addresses of the security group;

[0170] A node filtering unit is used to obtain the accessible nodes of a security group based on the inbound and outbound accessible addresses; the accessible nodes include inbound accessible nodes and outbound accessible nodes.

[0171] The link generation unit is used to generate a detectable link based on the address of the bound node and the address of the accessible node.

[0172] Further, preferably, the rule parsing unit is specifically used for:

[0173] The rules of the security group are parsed to obtain the allowed inbound and outbound addresses of the security group;

[0174] Obtain the subnet CIDR of the user's VPC;

[0175] Calculate the intersection of the allowed inbound / outbound addresses and the subnet CIDR to obtain the inbound / outbound accessible addresses of the security group.

[0176] Preferably, the link generation unit is specifically used for:

[0177] Get the first address of the first node's bound node; the first node can be any accessible node;

[0178] Get the node that is both an outgoing accessible node and a bound node of the first node, and use it as the second node;

[0179] Obtain the second address of the incoming accessible node of the second node;

[0180] If the first address and the second address have an intersection, an initial probe link from the first node to the second node is generated;

[0181] The initial probe links are deduplicated to generate probeable links.

[0182] In a preferred embodiment, the time decay analysis module 12 includes:

[0183] The link segmentation unit is used to divide the detectable link into several consecutive time units according to a preset time unit length.

[0184] An initial quality feature calculation unit is used to calculate the service access rate and failure rate of the detectable link under each time unit, and to perform a weighted summation of the service access rate and failure rate as the initial quality feature.

[0185] The time decay factor calculation unit is used to calculate the time difference between each time unit and the latest time unit, and calculate the time decay factor based on the time difference.

[0186] The time decay quality feature calculation unit is used to weight the initial quality feature using the time decay factor to obtain the time decay quality feature of each time unit.

[0187] Further, preferably, the initial quality characteristic calculation unit is specifically used for:

[0188] Obtain service access data of the detectable link under the time unit, and calculate the service access rate based on the service access data;

[0189] Acquire alarm data and complaint data of the detectable link under the time unit, and calculate the failure rate based on the alarm data and complaint data;

[0190] Based on preset weighting factors, the service access rate and the failure rate of the same time unit are weighted and summed to obtain the initial quality characteristics of each time unit.

[0191] Preferably, the time decay factor calculation unit is specifically used for:

[0192] Calculate the time difference between each time unit and the latest time unit;

[0193] The time difference is exponentially calculated to obtain the enhanced time difference;

[0194] The enhanced time difference is subjected to exponential decay processing to calculate the time decay factor.

[0195] In a preferred embodiment, the detection task generation module 13 includes:

[0196] The comprehensive scoring calculation unit is used to sum the time decay quality characteristics of all the time units to obtain the link detection score of each detectable link;

[0197] A link sorting unit is used to sort the detectable links according to the link detection score;

[0198] The link selection unit is used to select the top-N detectable links from the sorted detectable links as target detection links;

[0199] The task generation unit is used to generate a detection task including the target detection link based on the target detection link.

[0200] Further, preferably, the link selection unit is specifically used for:

[0201] Obtain the physical server to which the source node of the detectable link belongs;

[0202] The maximum number of probe tasks supported by the physical server is obtained using the OVS injection packet detection method.

[0203] Based on the maximum number of detection tasks, the TOP-N detectable links are selected as target detection links.

[0204] The virtual network probe task generation system provided by this invention introduces a time decay mechanism to dynamically adjust the priority of valid probeable links. This not only accurately adapts to the dynamic characteristics of the virtual network and reduces resource waste caused by invalid probes from the source, but also captures real-time changes in link status, significantly improving the generation efficiency of probe tasks and thus strengthening the guarantee capability for service level protocols.

[0205] See Figure 6 , Figure 6 This is a structural block diagram of a virtual network detection task generation device provided in an embodiment of the present invention. The virtual network detection task generation device includes a processor 31, a memory 32, and a computer program stored in the memory 32 and executable on the processor 31. When the processor 31 executes the computer program, it implements the steps in the above-described embodiments of the virtual network detection task generation methods, such as steps S1 to S3.

[0206] For example, the computer program may be divided into one or more modules / units, which are stored in the memory 32 and executed by the processor 31 to complete the present invention. The one or more modules / units may be a series of computer program instruction segments capable of performing specific functions, which describe the execution process of the computer program in the virtual network's probe task generation device.

[0207] The virtual network detection task generation device may include, but is not limited to, processor 31 and memory 32. Those skilled in the art will understand that the schematic diagram is merely an example of a virtual network detection task generation device and does not constitute a limitation on the virtual network detection task generation device. It may include more or fewer components than illustrated, or combine certain components, or different components. For example, the virtual network detection task generation device may also include input / output devices, network access devices, buses, etc.

[0208] The processor 31 can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor. The processor 31 is the control center of the virtual network's probe task generation device, connecting various parts of the entire virtual network's probe task generation device via various interfaces and lines.

[0209] The memory 32 can be used to store the computer programs and / or modules. The processor 31 implements various functions of the virtual network detection task generation device by running or executing the computer programs and / or modules stored in the memory 32 and calling the data stored in the memory 32. The memory 32 may mainly include a program storage area and a data storage area. The program storage area may store the operating system, at least one application program required for a function (such as sound playback function, image playback function, etc.), etc.; the data storage area may store data created according to the use of the mobile phone (such as audio data, phonebook, etc.). In addition, the memory 32 may include high-speed random access memory, and may also include non-volatile memory, such as hard disk, memory, plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, at least one disk storage device, flash memory device, or other volatile solid-state storage device.

[0210] If the modules / units integrated into the virtual network detection task generation device are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the above embodiments of the present invention can also be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by the processor 31, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include: any entity or device capable of carrying the computer program code, recording media, USB flash drives, portable hard drives, magnetic disks, optical disks, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media, etc.

[0211] The above description represents the preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of the present invention, and these improvements and modifications are also considered to be within the scope of protection of the present invention.

Claims

1. A method for generating detection tasks in a virtual network, characterized in that, include: Obtain the ordered resources of the cloud service user, obtain the detectable address of the virtual network corresponding to the cloud service user based on the ordered resources, and generate a detectable link; The historical data of the detectable link is divided into several consecutive time units, and the time decay quality characteristics of each time unit are calculated based on the time difference between each time unit and the latest time unit. Based on the time decay quality characteristics of all the time units, the detectable links are sorted, target detection links are filtered, and a detection task including the target detection links is generated.

2. The method for generating a detection task in a virtual network as described in claim 1, characterized in that, The step of obtaining the cloud service user's subscribed resources, obtaining the detectable address of the virtual network corresponding to the cloud service user based on the subscribed resources, and generating a detectable link includes: Obtain the cloud service user's subscribed resources, and obtain the user's VPC security group and the security group's bound nodes; The rules of the security group are parsed to calculate the inbound and outbound accessible addresses of the security group; Based on the inbound and outbound accessible addresses, the accessible nodes of the security group are obtained; the accessible nodes include inbound accessible nodes and outbound accessible nodes; A detectable link is generated based on the address of the bound node and the address of the accessible node.

3. The method for generating a detection task in a virtual network as described in claim 2, characterized in that, The process of parsing the rules of the security group and calculating the inbound and outbound accessible addresses of the security group includes: The rules of the security group are parsed to obtain the allowed inbound and outbound addresses of the security group; Obtain the subnet CIDR of the user's VPC; Calculate the intersection of the allowed inbound / outbound addresses and the subnet CIDR to obtain the inbound / outbound accessible addresses of the security group.

4. The method for generating a detection task in a virtual network as described in claim 2, characterized in that, The step of generating a detectable link based on the address of the bound node and the address of the accessible node includes: Get the first address of the first node's bound node; the first node can be any accessible node; Get the node that is both an outgoing accessible node and a bound node of the first node, and use it as the second node; Obtain the second address of the incoming accessible node of the second node; If the first address and the second address have an intersection, an initial probe link from the first node to the second node is generated; The initial probe links are deduplicated to generate probeable links.

5. The method for generating a detection task in a virtual network as described in claim 1, characterized in that, The process of dividing the historical data of the detectable link into several consecutive time units and calculating the time attenuation quality characteristics of each time unit based on the time difference between each time unit and the latest time unit includes: Based on the preset time unit length, the historical data of the detectable link is divided into several consecutive time units; Calculate the service access rate and failure rate of the detectable link under each time unit, and perform a weighted sum of the service access rate and failure rate as the initial quality feature; Calculate the time difference between each time unit and the latest time unit, and calculate the time decay factor based on the time difference; The initial quality characteristics are weighted using the time decay factor to obtain the time decay quality characteristics of each time unit.

6. The method for generating a detection task in a virtual network as described in claim 5, characterized in that, The calculation of the service access rate and failure rate of the detectable link in each time unit, and the weighted summation of the service access rate and failure rate as the initial quality feature, includes: Obtain service access data of the detectable link under the time unit, and calculate the service access rate based on the service access data; Acquire alarm data and complaint data of the detectable link under the time unit, and calculate the failure rate based on the alarm data and complaint data; Based on preset weighting factors, the service access rate and the failure rate of the same time unit are weighted and summed to obtain the initial quality characteristics of each time unit.

7. The method for generating a detection task in a virtual network as described in claim 5, characterized in that, The calculation of the time difference between each time unit and the latest time unit, and the calculation of the time decay factor based on the time difference, includes: Calculate the time difference between each time unit and the latest time unit; The time difference is exponentially calculated to obtain the enhanced time difference; The enhanced time difference is subjected to exponential decay processing to calculate the time decay factor.

8. The method for generating a detection task in a virtual network as described in claim 1, characterized in that, The step of sorting the detectable links according to the time decay quality characteristics of all the time units, filtering target detection links, and generating a detection task including the target detection links includes: The link detection score for each detectable link is obtained by summing the time decay quality characteristics of all the time units. Based on the link detection score, the detectable links are ranked. From the sorted detectable links, select the TOP-N detectable links as target detection links; Based on the target detection link, a detection task including the target detection link is generated.

9. The method for generating a detection task in a virtual network as described in claim 8, characterized in that, The step of selecting the top-N detectable links from the sorted detectable links as target detection links includes: Obtain the physical server to which the source node of the detectable link belongs; The maximum number of probe tasks supported by the physical server is obtained using the OVS injection packet detection method. Based on the maximum number of detection tasks, the TOP-N detectable links are selected as target detection links.

10. A virtual network detection task generation system, characterized in that, include: The detectable link filtering module is used to obtain the ordered resources of cloud service users, obtain the detectable address of the virtual network corresponding to the cloud service users based on the ordered resources, and generate detectable links. The time decay analysis module is used to divide the historical data of the detectable link into several consecutive time units, and calculate the time decay quality characteristics of each time unit based on the time difference between each time unit and the latest time unit. The detection task generation module is used to sort the detectable links according to the time decay quality characteristics of all the time units, filter the target detection links, and generate a detection task including the target detection links.

11. A device for generating detection tasks in a virtual network, characterized in that, It includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor executes the computer program to implement the method for generating a probe task for a virtual network as described in any one of claims 1 to 9.

12. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored computer program, wherein, when the computer program is executed, it controls the device containing the computer-readable storage medium to perform the virtual network probe task generation method as described in any one of claims 1 to 9.

13. A computer program product, characterized in that, The computer program product includes a computer program or computer instructions, which, when executed by a processor, perform the method for generating a detection task for a virtual network as described in any one of claims 1 to 9.

Images