Network response test equipment and test method thereof

Abstract

The invention belongs to the technical field of network test equipment, and discloses network response test equipment and a test method thereof, and is characterized in that the network response test equipment comprises the following modules: a distributed multi-mode dynamic sensing probe used for capturing service flow characteristics and microsecond-level performance indexes of a network link in real time; the extensible data middle table is in data connection with the probe and is used for establishing a unified spatio-temporal index for cross-level performance data from a physical layer to an application layer; and the causal atlas analysis engine based on artificial intelligence is used for positioning a network fault root cause according to the cross-level performance data. According to the invention, an evaluation standard is automatically calibrated according to historical business load characteristics through an extensible data-in-station dynamic baseline threshold mechanism, so that a test environment completely fits complex scenes such as video burst frame transmission, database synchronization ACK, high-frequency transaction chain and the like, the simulation distortion of a traditional tool to business traffic burst and multi-protocol mixed characteristics is eliminated, and the test efficiency is improved. And the test result is ensured to accurately map the long-term stability requirement.

Description

Technical Field

[0001] This invention belongs to the field of network testing equipment technology, specifically a network response testing device and its testing method. Background Technology

[0002] Network response testing equipment is specialized equipment used to test and evaluate the responsiveness and performance of network systems under different conditions. With the rapid development of information technology, network environments are becoming increasingly complex, making the performance and reliability of network devices and applications crucial in practical use. Therefore, network response testing equipment plays a vital role in network construction and maintenance, helping engineers quickly identify network bottlenecks, fault points, and areas of insufficient performance. This testing equipment primarily simulates different network traffic scenarios and application loads to test key performance indicators of network devices (such as routers, switches, and servers) under high loads, including response speed, data transmission efficiency, latency, bandwidth utilization, and packet loss rate. Network response testing equipment helps users verify whether network devices can operate stably in high-concurrency, high-traffic environments, and is particularly suitable for large-scale data centers, cloud computing platforms, and high-performance computing scenarios.

[0003] However, traditional network response testing equipment generally relies on short-term instantaneous sampling, while modern businesses depend on long-term stability and performance under complex traffic patterns, which can easily lead to insufficient time granularity. Traditional tools use seconds or even milliseconds as the smallest unit, but microsecond-level latency fluctuations constitute substantial failures in scenarios such as high-frequency transactions. Instantaneous testing cannot capture occasional micro-burst traffic congestion or periodic routing oscillations, which are the main causes of business lag and can lead to distortion of traffic patterns. Testing tools usually use fixed-rate data packets or simple requests, while real business traffic has bursty and multi-protocol mixed characteristics. Traditional tools cannot simulate such complex behaviors, and the test results can deviate from the actual experience by more than 30%.

[0004] Meanwhile, network response testing equipment often focuses on a single layer, lacking the ability to perform cross-layer (L1-L7) and cross-domain (client-cloud-server) correlation analysis. This can easily lead to fragmented metrics failing to pinpoint the root cause. For example, ping may show high latency, but it cannot distinguish whether it is due to physical link failure (fiber optic damage), protocol stack issues (insufficient TCP buffer), or application layer blocking (thread pool exhaustion). Furthermore, it creates a contradiction between passive monitoring and active interference. Professional hardware testing instruments (such as Spirent) can actively inject traffic to test performance limits, but such operations are disabled in production environments (to avoid triggering real failures). Passive monitoring tools (such as NetFlow) cannot reconstruct the complete transaction chain, making it difficult to reproduce critical events (such as which firewall hop packet loss occurred at). Summary of the Invention

[0005] The purpose of this invention is to provide a network response testing device and a testing method thereof to solve the problems mentioned in the background art.

[0006] To achieve the above objectives, the present invention provides the following technical solution: a network response testing device and its testing method, comprising the following modules:

[0007] Distributed multimodal dynamic sensing probes are used to capture network link service traffic characteristics and microsecond-level performance indicators in real time.

[0008] A scalable data platform connected to probe data is used to establish a unified spatiotemporal index for cross-layer performance data from the physical layer to the application layer.

[0009] An AI-based causal graph analysis engine is used to locate the root causes of network failures based on cross-level performance data.

[0010] As a further technical solution of the present invention, the multimodal dynamic sensing probe includes:

[0011] The dynamic traffic replication module captures real business traffic losslessly through port mirroring or optical splitting technology, and generates a traffic DNA fingerprint that includes protocol distribution, packet size sequence, and throughput fluctuation pattern.

[0012] The microsecond-level continuous monitoring module integrates a high-precision clock synchronization unit to continuously measure jitter and delay with a time accuracy of ≥10 microseconds;

[0013] The business context tagging module adds user priority and transaction type tags to captured traffic and associates them with service level agreement rules.

[0014] As a further technical solution of the present invention, the execution of the scalable data platform includes:

[0015] Construct a cross-layer data model, including nanosecond-level timestamps, physical layer to application layer identifiers, performance metric fields, and business context key-value pairs;

[0016] Time-sharing baseline thresholds are dynamically generated based on historical data, and cross-node data of the same transaction link are associated through a spatiotemporal index engine.

[0017] As a further technical solution of the present invention, the causal graph analysis engine implements:

[0018] The inter-layer dependency analysis algorithm outputs fault contribution weights across network layers based on traffic DNA fingerprints and performance mutation events.

[0019] The predictive alarm module uses a long short-term memory model to predict link jitter trends and trigger resource optimization commands.

[0020] As a further technical solution of the present invention, the dynamic traffic replication module includes:

[0021] The hardware acceleration unit uses a programmable gate array to implement feature extraction of encrypted traffic by the flow filter;

[0022] The traffic reconstruction engine transforms traffic DNA fingerprints into test templates that support QUIC and HTTP / 3 protocol simulation.

[0023] As a further technical solution of the present invention, the microsecond-level continuous monitoring module includes:

[0024] The kernel-mode extended Berkeley packet filter agent tracks Transmission Control Protocol retransmission events and protocol stack blocking status in real time.

[0025] The dual-clock source synchronization unit supports automatic switching between the Global Positioning System and precise time protocols to achieve cross-regional time alignment.

[0026] As a further technical solution of the present invention, the inter-layer dependency analysis algorithm of the causal graph analysis engine is specifically implemented as follows:

[0027] A weighted directed graph model is used to construct the network hierarchy, where:

[0028] Nodes represent physical devices, protocol stacks, or application services;

[0029] Edge weights are dynamically calculated using a random forest model. Input features include:

[0030] Historical fault correlation, traffic DNA fingerprint similarity, and cross-layer index correlation coefficient;

[0031] When a performance mutation is detected, the failure probability of the updated node is calculated through backpropagation gradient:

[0032]

[0033] Where w j Let v be the edge weight. j For upstream nodes;

[0034] The LSTM model training method for the predictive alarm module includes:

[0035] Use the cross-layer indicator sequence output by the spatiotemporal index engine as input;

[0036] The contribution weights of each network layer's metrics to the prediction results are dynamically allocated through an attention mechanism.

[0037] The hardware coordination mechanism of the microsecond-level continuous monitoring module:

[0038] When the GPS signal fails, the dual-clock source synchronization unit automatically switches to the PTPv2 protocol to obtain the clock reference from the network switching device.

[0039] The kernel-mode eBPF agent transmits protocol stack blocking events directly to the FPGA acceleration unit through a shared memory ring buffer, achieving hardware-level exception marking of ≤5μs.

[0040] A testing method for a network response testing device includes the following steps:

[0041] S1: Synchronous acquisition of multi-source data:

[0042] The multimodal dynamic sensing probe is used to synchronously execute the following within the test window:

[0043] a) Use port mirroring or splitting technology to capture real business traffic without loss;

[0044] b) Continuous measurement of link jitter and delay with an accuracy of ≥10μs based on PTPv2 / GPS dual clock sources;

[0045] c) Add user priority and transaction type labels to captured traffic;

[0046] S2: Cross-layer spatiotemporal alignment analysis:

[0047] Within the scalable data platform:

[0048] a) Align the data collected in step S1 with nanosecond-level timestamps;

[0049] b) Associate physical layer packet loss events and application layer timeout errors with the same transaction link based on the business tag;

[0050] S3: Dynamic Root Cause Localization and Prediction:

[0051] Through the causal graph analysis engine:

[0052] a) Abnormal fluctuation patterns based on traffic DNA fingerprinting protocol;

[0053] b) Calculate the contribution weight of each network layer to performance degradation using the inter-layer dependency analysis algorithm;

[0054] c) When jitter is detected to exceed the dynamic baseline threshold, the LSTM model is triggered to predict the deterioration trend and output a scaling suggestion.

[0055] As a further technical solution of the present invention, the spatiotemporal alignment in step S2b specifically includes:

[0056] For cross-regional distributed node data, a sliding time window compensation mechanism is adopted:

[0057] (n≥1000 synchronous samples)

[0058] Where Δt is the clock offset compensation amount between nodes, realizing microsecond-level transaction link reconstruction.

[0059] As a further technical solution of the present invention, the contribution weight calculation method of step S3b is as follows:

[0060] Construct a vector of failure impact factors:

[0061] F = [f 物理层 f 传输层 f 应用层 ] T

[0062] Output root cause probabilities using a weighted directed graphical model:

[0063] P rootcause =Softmax(W·F+b)

[0064] The weight matrix W is generated by training with historical fault data, and the level corresponding to the maximum output probability is determined as the primary cause.

[0065] The beneficial effects of this invention are as follows:

[0066] (1) This invention achieves microsecond-level continuous monitoring capability through a multimodal dynamic sensing probe. It utilizes a high-precision clock synchronization unit and a kernel-mode extended Berkeley packet filter proxy to track microsecond-level events such as fiber jitter and protocol stack blockage in real time. At the same time, the dynamic traffic replication module captures real business traffic characteristics to generate a traffic DNA fingerprint that includes protocol distribution, packet sequence and throughput fluctuations. This completely replaces the traditional fixed-rate test traffic mode. The test template based on real traffic DNA is combined with the dynamic baseline threshold mechanism in the scalable data middle platform. The evaluation standard is automatically calibrated according to the historical business load characteristics, so that the test environment is fully adapted to complex scenarios such as video burst frame transmission, database synchronization ACK, and high-frequency transaction chain. This eliminates the simulation distortion of the burstiness and multi-protocol hybrid characteristics of business traffic by traditional tools, and ensures that the test results accurately reflect the long-term stability requirements.

[0067] (2) This invention constructs a cross-level spatiotemporal index engine to accurately align physical layer packet loss events, transport layer retransmission behaviors, and application layer timeout errors collected by the microsecond-level continuous monitoring module with nanosecond-level timestamps and user priority tags injected by the business context marking module. It synchronously restores the end-to-end transaction path in the distributed environment. Based on this, the causal graph analysis engine uses a weighted directed graph model to perform inter-layer dependency analysis. It dynamically calculates the historical fault correlation degree, traffic DNA similarity, and other features through the random forest algorithm to generate fault contribution weights at each level. It penetrates and locates the quantitative impact of optical attenuation on latency or the attribution relationship of protocol stack bottlenecks to packet loss, and directly associates the results with service level protocol rules. This mechanism transforms fragmented indicators into globally interpretable analysis, realizes full-stack root cause tracing from network devices to application services, and improves troubleshooting efficiency and decision-making accuracy.

[0068] (3) This invention captures real business flows through a lossless traffic replication mechanism, using hardware acceleration units combined with optical splitting and port mirroring technologies. It uses programmable gate arrays to extract encrypted traffic features and generate traffic DNA fingerprints, completely avoiding the risk of test traffic injection. The synchronously deployed predictive alarm module is based on cross-layer indicator sequences aligned by a spatiotemporal index engine. It uses a long short-term memory model to analyze the jitter correlation between the transport layer and the application layer. It predicts link degradation trends and outputs resource optimization instructions through an attention mechanism, such as triggering edge node expansion before video conferencing lags. The dual-clock source synchronization unit uses a sliding time window compensation algorithm to eliminate cross-domain node clock deviations and supports microsecond-level distributed transaction reconstruction, enabling test probes to be directly deployed in the production environment. The entire system achieves a closed loop of fault prediction and performance optimization with zero business interference, turning passive response into proactive protection and significantly reducing operation and maintenance risk costs. Attached Figure Description

[0069] Figure 1 This is a modular device architecture diagram of the present invention;

[0070] Figure 2 This is a flowchart of the probe layer operation of the present invention;

[0071] Figure 3 This is a diagram of the causal graph calculation model of the present invention;

[0072] Figure 4 This is a timing diagram of the test method of the present invention. Detailed Implementation

[0073] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0074] like Figures 1 to 4 As shown in this embodiment of the invention, a network response testing device includes the following modules:

[0075] Distributed multimodal dynamic sensing probes are used to capture network link service traffic characteristics and microsecond-level performance indicators in real time.

[0076] A scalable data platform connected to probe data is used to establish a unified spatiotemporal index for cross-layer performance data from the physical layer to the application layer.

[0077] An AI-based causal graph analysis engine is used to locate the root causes of network failures based on cross-level performance data.

[0078] The multimodal dynamic sensing probe includes:

[0079] The dynamic traffic replication module captures real business traffic losslessly through port mirroring or optical splitting technology, and generates a traffic DNA fingerprint that includes protocol distribution, packet size sequence, and throughput fluctuation pattern.

[0080] The microsecond-level continuous monitoring module integrates a high-precision clock synchronization unit to continuously measure jitter and delay with a time accuracy of ≥10 microseconds;

[0081] The business context tagging module adds user priority and transaction type tags to captured traffic and associates them with service level agreement rules.

[0082] The scalable data platform execution includes:

[0083] Construct a cross-layer data model, including nanosecond-level timestamps, physical layer to application layer identifiers, performance metric fields, and business context key-value pairs;

[0084] Time-sharing baseline thresholds are dynamically generated based on historical data, and cross-node data of the same transaction link are associated through a spatiotemporal index engine.

[0085] The causal graph analysis engine implements the following:

[0086] The inter-layer dependency analysis algorithm outputs fault contribution weights across network layers based on traffic DNA fingerprints and performance mutation events.

[0087] The predictive alarm module uses a long short-term memory model to predict link jitter trends and trigger resource optimization commands.

[0088] The dynamic traffic replication module includes:

[0089] The hardware acceleration unit uses a programmable gate array to implement feature extraction of encrypted traffic by the flow filter;

[0090] The traffic reconstruction engine transforms traffic DNA fingerprints into test templates that support QUIC and HTTP / 3 protocol simulation.

[0091] The microsecond-level continuous monitoring module includes:

[0092] The kernel-mode extended Berkeley packet filter agent tracks Transmission Control Protocol retransmission events and protocol stack blocking status in real time.

[0093] The dual-clock source synchronization unit supports automatic switching between the Global Positioning System and precise time protocols to achieve cross-regional time alignment.

[0094] The specific implementation of the inter-layer dependency analysis algorithm in the causal graph analysis engine is as follows:

[0095] A weighted directed graph model is used to construct the network hierarchy, where:

[0096] Nodes represent physical devices, protocol stacks, or application services;

[0097] Edge weights are dynamically calculated using a random forest model. Input features include:

[0098] Historical fault correlation, traffic DNA fingerprint similarity, and cross-layer index correlation coefficient;

[0099] When a performance mutation is detected, the failure probability of the updated node is calculated through backpropagation gradient:

[0100]

[0101] Where w j Let v be the edge weight. j For upstream nodes;

[0102] The training methods for the LSTM model in the predictive alarm module include:

[0103] Use the cross-layer indicator sequence output by the spatiotemporal index engine as input;

[0104] The contribution weights of each network layer's metrics to the prediction results are dynamically allocated through an attention mechanism.

[0105] Hardware coordination mechanism of the microsecond-level continuous monitoring module:

[0106] When the GPS signal fails, the dual-clock source synchronization unit automatically switches to the PTPv2 protocol to obtain the clock reference from the network switching equipment;

[0107] The kernel-mode eBPF agent transmits protocol stack blocking events directly to the FPGA acceleration unit through a shared memory ring buffer, achieving hardware-level exception marking with a time of ≤5μs.

[0108] A testing method for a network response testing device includes the following steps:

[0109] S1: Synchronous acquisition of multi-source data:

[0110] Synchronous execution is performed within the test window using a multimodal dynamic sensing probe:

[0111] a) Use port mirroring or splitting technology to capture real business traffic without loss;

[0112] b) Continuous measurement of link jitter and delay with an accuracy of ≥10μs based on PTPv2 / GPS dual clock sources;

[0113] c) Add user priority and transaction type labels to captured traffic;

[0114] S2: Cross-layer spatiotemporal alignment analysis:

[0115] Within a scalable data platform:

[0116] a) Align the data collected in step S1 with nanosecond-level timestamps;

[0117] b) Associate physical layer packet loss events and application layer timeout errors with the same transaction link based on the business tag;

[0118] S3: Dynamic Root Cause Localization and Prediction:

[0119] Through the causal graph analysis engine:

[0120] a) Abnormal fluctuation patterns based on traffic DNA fingerprinting protocol;

[0121] b) Calculate the contribution weight of each network layer to performance degradation using the inter-layer dependency analysis algorithm;

[0122] c) When jitter is detected to exceed the dynamic baseline threshold, the LSTM model is triggered to predict the deterioration trend and output a scaling suggestion.

[0123] Specifically, the spatiotemporal alignment in step S2b includes:

[0124] For cross-regional distributed node data, a sliding time window compensation mechanism is adopted:

[0125] (n≥1000 synchronous samples)

[0126] Where Δt is the clock offset compensation amount between nodes, realizing microsecond-level transaction link reconstruction.

[0127] The contribution weight in step S3b is calculated as follows:

[0128] Construct a vector of failure impact factors:

[0129] F = [f 物理层 f 传输层 f 应用层 ] T

[0130] Output root cause probabilities using a weighted directed graphical model:

[0131] P rootcause =Softmax(W·F+b)

[0132] The weight matrix W is generated by training with historical fault data, and the level corresponding to the maximum output probability is determined as the primary cause.

[0133] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A network response testing device, characterized in that: Includes the following modules: Distributed multimodal dynamic sensing probes are used to capture network link service traffic characteristics and microsecond-level performance indicators in real time. A scalable data platform connected to probe data is used to establish a unified spatiotemporal index for cross-layer performance data from the physical layer to the application layer. An AI-based causal graph analysis engine is used to locate the root causes of network failures based on cross-level performance data.

2. The network response testing device according to claim 1, characterized in that: The multimodal dynamic sensing probe includes: The dynamic traffic replication module captures real business traffic losslessly through port mirroring or optical splitting technology, and generates a traffic DNA fingerprint that includes protocol distribution, packet size sequence, and throughput fluctuation pattern. The microsecond-level continuous monitoring module integrates a high-precision clock synchronization unit to continuously measure jitter and delay with a time accuracy of ≥10 microseconds; The business context tagging module adds user priority and transaction type tags to captured traffic and associates them with service level agreement rules.

3. The network response testing device according to claim 1, characterized in that: The execution of the scalable data platform includes: Construct a cross-layer data model, including nanosecond-level timestamps, physical layer to application layer identifiers, performance metric fields, and business context key-value pairs; Time-sharing baseline thresholds are dynamically generated based on historical data, and cross-node data of the same transaction link are associated through a spatiotemporal index engine.

4. The network response testing device according to claim 1, characterized in that: The causal graph analysis engine implements: The inter-layer dependency analysis algorithm outputs fault contribution weights across network layers based on traffic DNA fingerprints and performance mutation events. The predictive alarm module uses a long short-term memory model to predict link jitter trends and trigger resource optimization commands.

5. A network response testing device according to claim 2, characterized in that: The dynamic traffic replication module includes: The hardware acceleration unit uses a programmable gate array to implement feature extraction of encrypted traffic by the flow filter; The traffic reconstruction engine transforms traffic DNA fingerprints into test templates that support QUIC and HTTP / 3 protocol simulation.

6. The network response testing device according to claim 2, characterized in that: The microsecond-level continuous monitoring module includes: The kernel-mode extended Berkeley packet filter agent tracks Transmission Control Protocol retransmission events and protocol stack blocking status in real time. The dual-clock source synchronization unit supports automatic switching between the Global Positioning System and precise time protocols to achieve cross-regional time alignment.

7. A network response testing device according to claim 4, characterized in that: The specific implementation method of the inter-layer dependency analysis algorithm of the causal graph analysis engine is as follows: A weighted directed graph model is used to construct the network hierarchy, where: Nodes represent physical devices, protocol stacks, or application services; Edge weights are dynamically calculated using a random forest model. Input features include: Historical fault correlation, traffic DNA fingerprint similarity, and cross-layer index correlation coefficient; When a performance mutation is detected, the failure probability of the updated node is calculated through backpropagation gradient: Where w j Let v be the edge weight. j For upstream nodes; The LSTM model training method for the predictive alarm module includes: Use the cross-layer indicator sequence output by the spatiotemporal index engine as input; The contribution weights of each network layer's metrics to the prediction results are dynamically allocated through an attention mechanism. The hardware coordination mechanism of the microsecond-level continuous monitoring module: When the GPS signal fails, the dual-clock source synchronization unit automatically switches to the PTPv2 protocol to obtain the clock reference from the network switching device. The kernel-mode eBPF agent transmits protocol stack blocking events directly to the FPGA acceleration unit through a shared memory ring buffer, achieving hardware-level exception marking of ≤5μs.

8. The testing method for a network response testing device according to claim 1, characterized in that: Includes the following steps: S1: Synchronous acquisition of multi-source data: The multimodal dynamic sensing probe is used to synchronously execute the following within the test window: a) Use port mirroring or splitting technology to capture real business traffic without loss; b) Continuous measurement of link jitter and delay with an accuracy of ≥10μs based on PTPv2 / GPS dual clock sources; c) Add user priority and transaction type labels to captured traffic; S2: Cross-layer spatiotemporal alignment analysis: Within the scalable data platform: a) Align the data collected in step S1 with nanosecond-level timestamps; b) Associate physical layer packet loss events and application layer timeout errors with the same transaction link based on the business tag; S3: Dynamic Root Cause Localization and Prediction: Through the causal graph analysis engine: a) Abnormal fluctuation patterns based on traffic DNA fingerprinting protocol; b) Calculate the contribution weight of each network layer to performance degradation using the inter-layer dependency analysis algorithm; c) When jitter is detected to exceed the dynamic baseline threshold, the LSTM model is triggered to predict the deterioration trend and output a scaling suggestion.

9. The testing method for a network response testing device according to claim 8, characterized in that: The spatiotemporal alignment in step S2b specifically includes: For cross-regional distributed node data, a sliding time window compensation mechanism is adopted: (n≥1000 synchronous samples) Where Δt is the clock offset compensation amount between nodes, realizing microsecond-level transaction link reconstruction.

10. The testing method for a network response testing device according to claim 8, characterized in that: The contribution weight calculation method for step S3b is as follows: Construct a vector of failure impact factors: F=[f 物理层 ,f 传输层 ,f 应用层 ] T Output root cause probabilities using a weighted directed graphical model: P rootcause =Softmax(W·F+b) The weight matrix W is generated by training with historical fault data, and the level corresponding to the maximum output probability is determined as the primary cause.

Images