Computer network intelligent analysis system based on big data

Abstract

The invention discloses a computer network intelligent analysis system based on big data, which relates to the technical field of computer networks and comprises a network data acquisition module, a user division module, a segmentation division management module, a safety protection module, an intelligent switching module and a data storage module. The network data acquisition module is used for acquiring network usage amount and program usage amount, the user division module is used for analyzing based on the program usage amount and dividing user categories, and the security protection module is used for setting corresponding security protection measures based on the user categories. According to the method, network resources are allocated specially, network usage weight is adjusted according to user categories, resource allocation accuracy is improved, dynamic safety protection is implemented in combination with the user categories, category switching is performed through an intelligent switching module according to actual use conditions of users, a dynamic and special safety protection strategy is realized, and potential safety hazards are reduced.

Description

Technical Field

[0001] This invention relates to the field of computer network technology, specifically to a computer network intelligent analysis system based on big data. Background Technology

[0002] In today's digital age, computer networks are becoming increasingly large and complex, network traffic is exploding, and network security threats are becoming increasingly diverse. Network analysis involves detecting, analyzing, and diagnosing all data transmitted within the network to help users troubleshoot network incidents, mitigate security risks, improve network performance, and increase network availability. Network analysis is a crucial part of network management and one of the most important technologies. Network analysis generally includes quickly locating and troubleshooting network faults; identifying network bottlenecks to improve network performance; discovering and resolving various network anomalies and crises to improve security; managing resources; and statistically recording the traffic and bandwidth of each node.

[0003] Current network analytics typically develops strategies based on average data across the entire network, failing to consider the varying network demands of different users and lacking analysis of network usage time periods. This leads to uneven distribution of computer resources; for example, game users and download users may experience game lag or download speed limits when sharing resources. Furthermore, traditional security measures are mostly static and general strategies that are not adjusted based on user behavior characteristics, which reduces user experience while increasing security risks. Summary of the Invention

[0004] The purpose of this invention is to provide a computer network intelligent analysis system based on big data, which solves the problems mentioned in the background art.

[0005] To achieve the above objectives, the present invention provides the following technical solution: a computer network intelligent analysis system based on big data, comprising a network data acquisition module, a user segmentation module, a segmentation management module, a security protection module, an intelligent switching module, and a data storage module;

[0006] The network data acquisition module is used to collect network usage and program usage, and transmit them to the data storage module for storage. The network usage is generated based on a weighted fusion of traffic rate, concurrent connection count, latency, and packet loss rate.

[0007] The user segmentation module analyzes program usage and categorizes users accordingly.

[0008] The security protection module sets corresponding security protection measures based on user categories;

[0009] The segmentation management module adjusts the weights of traffic rate, concurrent connections, latency, and packet loss rate in network usage based on user category, divides the time periods for each user category to use the computer into peak, normal, and off-peak periods, and takes corresponding management measures accordingly.

[0010] The intelligent switching module determines whether to switch user categories by setting trigger conditions.

[0011] Optionally, the network data acquisition module collects program usage data as follows:

[0012] Collect the runtime of the game program while the computer is running, and label the game program runtime as G. t The timer starts when the game program is launched;

[0013] Collect the usage time of office programs while the computer is running, and mark the usage time of office programs as B. t The timer starts when the office application is opened;

[0014] Collect the download program's usage time while the computer is running, and label the download program's usage time as D. t The timer for data collection starts from the actual download time.

[0015] Collect the duration of video program usage while the computer is running, and label the video program usage duration as C. t The timer starts from when the video starts playing in the video program;

[0016] The game program uses the duration marker G t +Office program usage time marker B t +Download program usage time marker D t +Video program usage time C t = Total program usage time T all .

[0017] Optionally, the user segmentation module calculates the game program usage time G separately. t Office program usage time B t Download program usage time D t Video program usage time C t Total program usage time T all The user category is divided according to the proportion of the program usage time to the total time T. all When the proportion is greater than 50%, the user categories will be divided according to the program, specifically as follows:

[0018] When the game program uses the duration marker G t Total program usage time T allWhen the proportion is greater than 50%, the user is judged to be a gamer user (GH).

[0019] When the office program uses the duration tag B t Total program usage time T all When the proportion is greater than 50%, the user is judged to be an office-type user (BH).

[0020] When the download program uses the duration tag D t Total program usage time T all When the proportion is greater than 50%, the user is judged to be a transmission / download type user (DH).

[0021] When the video program is used for duration C t Total program usage time T all When the proportion is greater than 50%, the user is judged to be a video user (CH).

[0022] The weights of traffic rate, concurrent connections, latency, and packet loss rate in network usage are adjusted according to different user categories to make the segmentation management module more in line with the actual network operation status. If no program's usage time exceeds 50% of the total time, it means that the user's usage time for each program is balanced, and the user is judged as a balanced user. Therefore, the weights of various data in network usage are not adjusted.

[0023] Optionally, the segmentation management module first standardizes the traffic rate, concurrent connections, latency and packet loss rate in the network usage to eliminate the influence of the units and obtain the standard network usage. Then, it analyzes the average value of the standard network usage per unit time in the past to obtain the average standard network usage. Finally, it analyzes the ratio of the standard network usage to the average standard network usage to determine the peak, normal and low peak periods of user computer usage.

[0024] By analyzing the ratio of standard network usage to average standard network usage for each user category, we can determine the peak, normal, and off-peak periods of computer usage for each user category, and then set corresponding network management measures accordingly.

[0025] Optionally, the intelligent switching module determines whether to switch by setting trigger conditions. Taking game users as an example, the trigger conditions are as follows:

[0026] Triggering condition one: The duration of game program usage by game-type users, marked as G, over the past n time periods. t Total program usage time T all The proportions are all less than 50%;

[0027] Triggering condition two: In the past n time periods, a program other than the game program has occupied a total program usage time T. allThe proportions are all greater than 50%;

[0028] When both trigger condition one and trigger condition two are met, the user category is switched through the user segmentation module.

[0029] Optionally, the intelligent switching module includes a switching interval unit, which is used to set the interval time of the intelligent switching module to avoid frequent switching.

[0030] Optionally, the network data acquisition module includes a data cleaning unit, which is used to remove redundant data and ensure the quality of the acquired data.

[0031] Optionally, the initial weights of traffic rate, concurrent connections, latency, and packet loss rate in the network usage are equal, and the sum of the initial weights is equal to one.

[0032] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0033] I. This invention uses a segmented management module to divide the time periods of user computer usage into peak, normal, and off-peak periods based on network usage. Combined with user categories, it can obtain the peak, normal, and off-peak periods of computer usage for different user categories. Then, it dynamically adjusts computer resource management measures according to the differences in peak, normal, and off-peak periods, fully considering the different network needs arising from different user categories and analyzing network usage time periods. This enables dedicated allocation of network resources, reduces resource waste, and improves user experience.

[0034] Second, this invention first classifies users into categories through a user segmentation module, and then takes corresponding security protection measures based on different user categories through a security protection module to improve the security protection effect. The intelligent switching module determines whether to switch user categories based on the actual usage of users, which fully considers user behavior characteristics and realizes a dynamic and dedicated security protection strategy to reduce security risks.

[0035] Third, after classifying users, the weights of traffic rate, concurrent connections, latency, and packet loss rate in network usage are adjusted based on user categories. This fully considers the differences in sensitivity to these metrics among different users, making the time period segmentation results more consistent with the actual situation of users and improving the accuracy of resource allocation. Attached Figure Description

[0036] Figure 1 This is a block diagram of the system modules of the present invention;

[0037] Figure 2 This is a schematic diagram of the system flow of the present invention. Detailed Implementation

[0038] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0039] Example 1:

[0040] Please see Figure 1 and Figure 2 This embodiment provides a computer network intelligent analysis system based on big data, including a network data acquisition module, a user segmentation module, a segmentation management module, an intelligent switching module, a security protection module, and a data storage module;

[0041] The network data acquisition module is used to collect network usage and program usage, and transmit them to the data storage module for storage. The network usage is generated based on a weighted fusion of traffic rate, concurrent connection count, latency, and packet loss rate.

[0042] The network data acquisition module supports real-time streaming access, offline batch access, and lightweight edge access, meeting the needs of high concurrency and low latency big data access.

[0043] The network data acquisition module includes a data cleaning unit, which includes steps such as noise and outlier removal, missing value filling, format standardization, deduplication, and redundancy filtering. The data cleaning unit is used to remove redundant data and reduce computer load.

[0044] The user segmentation module analyzes program usage and categorizes users accordingly.

[0045] The security protection module sets corresponding security protection measures based on user categories;

[0046] The segmented management module adjusts the weights of traffic rate, concurrent connections, latency, and packet loss rate in network usage based on user categories, and divides the time periods for each user category to use computers into peak, normal, and off-peak periods, and takes corresponding management measures accordingly.

[0047] The intelligent switching module determines whether to switch user categories by setting trigger conditions.

[0048] More specifically, in this embodiment: the user segmentation module first divides users into categories, and then the security protection module takes corresponding security protection measures based on different user categories, which improves the security protection effect while reducing computer load. The intelligent switching module determines whether to switch user categories based on the actual usage of users, which fully considers user behavior characteristics, realizes dynamic and dedicated security protection strategies, and reduces security risks.

[0049] Next, the segmented management module divides the time periods of user computer usage into peak, normal, and off-peak periods based on network usage. Combined with user categories, it can obtain the peak, normal, and off-peak periods of computer usage for different user categories. Based on the differences in peak, normal, and off-peak periods, computer resource management measures are dynamically adjusted. Furthermore, the weights of traffic rate, concurrent connections, latency, and packet loss rate in network usage are adjusted based on user categories. This fully considers the different network demands brought about by different user categories and the analysis of network usage time periods, achieving the effect of dedicated allocation of network resources, reducing resource waste, improving user experience, and reducing security risks.

[0050] The program usage data refers to the usage duration of different programs. The process of collecting program usage data by the network data acquisition module is as follows:

[0051] Collect the runtime of the game program while the computer is running, and label the game program runtime as G. t The timer starts when the game program is launched;

[0052] Collect the usage time of office programs while the computer is running, and mark the usage time of office programs as B. t The timer starts when the office application is opened;

[0053] Collect the download program's usage time while the computer is running, and label the download program's usage time as D. t The time taken for the data collection and download program is D. t The timer starts from the actual download start time;

[0054] Collect the duration of video program usage while the computer is running, and label the video program usage duration as C. t The timer starts from when the video starts playing in the video program;

[0055] The game program uses the duration marker G t +Office program usage time marker B t +Download program usage time marker D t +Video program usage time C t = Total program usage time T all ;

[0056] When using the data collection program, you can select a time span, such as the past month or a week. The longer the time span, the more accurate the classification of users will be.

[0057] Specifically, in actual data collection, there may be situations where multiple programs are used simultaneously, such as a downloader running while a game is in progress. In such cases, the duration of both programs being collected simultaneously is included in the total program usage time T. all In the middle, that is, the total program usage time T all This may exceed the computer usage time. By collecting the usage time of each different program separately to classify users, the accuracy of network analysis is improved, so that corresponding security measures can be taken for different users.

[0058] The user segmentation module calculates the game program usage time G separately. t Office program usage time B t Download program usage time D t Video program usage time C t Total program usage time T all The user category is divided according to the proportion of the program usage time to the total time T. all When the proportion is greater than 50%, the user categories will be divided according to the program, specifically as follows:

[0059] T all =G t +B t +D t +C t

[0060] T all Total program usage time;

[0061] G t For game program usage time;

[0062] B t Duration of use of office applications;

[0063] D t Duration for downloading the program;

[0064] C t For video program usage duration;

[0065]

[0066] The weights of traffic rate, concurrent connections, latency, and packet loss rate in network usage are adjusted according to different user categories to make the segmented management module more in line with the actual network operation status. If no program's usage time exceeds 50% of the total time, it means that the usage time of each program by the user is balanced, and the weights of each item in network usage are not adjusted. That is, the weights of traffic rate, concurrent connections, latency, and packet loss rate in network usage are consistent.

[0067] This embodiment only provides the above-mentioned user categories. However, it should be noted that in actual use, the user categories can be expanded according to actual needs.

[0068] The standard network usage for each user category is calculated as follows:

[0069]

[0070] In the formula, L j L1 represents the standard network usage for user category j, where j ranges from 1 to 5, corresponding to gaming user GH, office user BH, transmission and download user DH, video user CH, and load balancer user, respectively. That is, when j is 1, L1 represents the standard network usage for gaming user GH.

[0071] W i,j Let be the weight of the i-th indicator value for user category j;

[0072] i represents the i-th metric value in network usage, with a value ranging from 1 to 4, corresponding to traffic rate, concurrent connections, latency, and packet loss rate, respectively. Specifically, when i is 1 and j is 1, W... 1,1 The traffic rate weight for gaming users (GH);

[0073] Z i,j Let be the standard value of the i-th metric for user category j;

[0074] S i,j Let be the mean of the i-th indicator for user category j, i.e., the mean over a unit of time.

[0075] μ i,j Let be the i-th metric value for user category j, i.e., the value detected in real time;

[0076] σ i,j Let be the standard deviation of the i-th metric for user category j;

[0077] By calculating the standard network usage for each user category, the influence of different data units in network usage is eliminated, so as to facilitate subsequent analysis of the time periods of computer usage for each user category.

[0078] Depending on the user category, the weights of traffic rate, concurrent connections, latency, and packet loss rate in network data vary. For example, consider a gaming user, GH:

[0079] L1 = W 1,1 ×Z 1,1 +W 2,1 ×Z 2,1 +W 3,1 ×Z 3,1 +W 4,1 ×Z 4,1

[0080] In the formula, L1 represents the standard network usage of the gaming user GH;

[0081] Z 1,1 The standard data rate value for GH, a user of games;

[0082] W 1,1 The traffic rate weight for gaming users GH is set to 0.1.

[0083] Z 2,1 The standard value for the number of concurrent connections for gaming users (GH);

[0084] W 2,1 The weight for concurrent connections of the gaming user GH is set to 0.1.

[0085] Z 3,1 The standard latency value for GH for gaming users;

[0086] W 3,1 The latency weight for GH, a gaming user, is set to 0.5.

[0087] Z 4,1 The standard value for packet loss rate for GH, a game-oriented user;

[0088] W 4,1 The packet loss rate weight for game users GH is set to 0.3.

[0089] Specifically, gaming users (GH) are typically very sensitive to game latency and data integrity because latency and packet loss rates can severely impact the gaming experience. Therefore, they need to increase the proportion of latency and packet loss rates in network usage. However, they have lower requirements for bandwidth and concurrent connections because most games use the UDP protocol, which has stable but not large bandwidth. Consequently, the weight of bandwidth and concurrent connections is reduced, making the gaming experience more comfortable.

[0090] Taking office users as an example, office work involves multiple tasks, such as video conferencing and document collaboration. It is necessary to ensure the stability of concurrent connections to avoid session interruptions, while ensuring low latency to make video smooth and documents synchronized in real time. The requirements for traffic rate and packet loss rate are relatively small. Therefore, when the user category is office users, the weights of each component in network usage are: concurrent connections 0.4, latency 0.3, traffic rate 0.2, and packet loss rate 0.1.

[0091] For users who primarily use data transfer and download, network speed is of paramount importance. Packet loss will lead to retransmissions and increase download time. Latency and concurrent connections have a smaller impact on users who primarily use data transfer and download. Therefore, when the user category is users who primarily use data transfer and download, the weights of each factor in network usage are: concurrent connections 0.1, latency 0.1, data transfer rate 0.6, and packet loss rate 0.2.

[0092] For video users, what is needed is a stable traffic rate to avoid buffering and low latency to ensure initial loading speed. The requirements for packet loss rate and concurrent connection count are relatively small. Therefore, when the user category is video user, the weights of each component in network usage are: traffic rate 0.5, latency 0.3, packet loss rate 0.1, and concurrent connection count 0.1.

[0093] By classifying users into different types and analyzing the core needs of each user category, the weights of various factors in network usage are different for each user category. This fully considers the different network needs brought about by different user categories, and the resulting network usage can more accurately represent the actual usage of users' computers, so that the system can allocate resources on demand and improve the efficiency of network resource management.

[0094] Since different user types have different security risks and needs, corresponding security protection measures are set according to user categories through the security protection module, as follows;

[0095] Gamer users:

[0096] 1. Force the use of TLS 1.3 protocol to encrypt game sessions to prevent man-in-the-middle attacks;

[0097] 2. Deploy application-layer DDoS protection, such as rate limiting and request validity verification, to ensure the availability of the game server;

[0098] Office users:

[0099] 1. Device authentication is performed using the 802.1X protocol, authorizing only devices to access the office network, and continuously verifying the health status of devices using a zero-trust model;

[0100] 2. Use AES-256 encryption for office traffic such as emails and documents, and enable end-to-end encryption for cloud collaboration programs;

[0101] Downloading / transferring users:

[0102] 1. Perform deep packet inspection on download traffic to identify and block malicious file characteristics, such as known virus hash values;

[0103] 2. Record the source address and file hash value of the download task for later traceability;

[0104] 3. Enable metadata analysis for P2P traffic, detect illegal resource sharing, record and report it;

[0105] Video users:

[0106] 1. Implement Digital Rights Management (DRM) for licensed videos to restrict illegal copying;

[0107] 2. Perform URL reputation analysis on video playback links, such as using a threat intelligence database to determine whether they are phishing websites and blocking illegal links;

[0108] As can be seen from the above, by taking different security protection measures for different types of users, we can achieve the effect of targeted solutions, improve the accuracy of system security protection, and improve the security protection effect while reducing resource consumption.

[0109] Furthermore, the segmentation management module first standardizes the traffic rate, concurrent connections, latency, and packet loss rate in network usage to eliminate the influence of dimensions and obtain standard network usage. Then, it analyzes the average value of standard network usage per unit time in the past to obtain average standard network usage. Finally, it analyzes the ratio of standard network usage to average standard network usage to determine the peak, normal, and off-peak periods of user computer usage.

[0110] By analyzing the ratio of standard network usage to average standard network usage for each user category, we can ultimately determine the peak, normal, and off-peak periods of computer usage for each user category, and then set corresponding network management measures accordingly.

[0111]

[0112] In the formula, L j,avg The average network usage for user category j;

[0113] m represents the number of time points;

[0114] L j,k For user category j, the standard network usage at the k-th time point;

[0115] The above formula determines whether user category j experiences peak, normal, or off-peak computer usage. During the normal period, network usage is relatively stable, requiring no system adjustments; the default settings can be maintained. When peak or off-peak usage is identified, system adjustments are made. For example, adjustments are made for gaming and office users, as follows:

[0116] When the user category is gaming users and it is during peak hours;

[0117] 1. Allocate a dedicated low-latency channel for game sessions, such as the highest QoS priority, and reserve 20% of the bandwidth. The specific bandwidth reservation value can be manually adjusted according to the user's actual experience.

[0118] 2. Limit background traffic of non-game programs, such as music, download, and video programs, to 5Mbps to avoid resource hogging;

[0119] 3. Reduce end-to-end latency through route optimization, such as selecting paths with fewer hops and adjusting TCP congestion control, such as enabling the low-latency algorithm BBR.

[0120] During off-peak hours;

[0121] 1. Dedicated bandwidth reservation is cancelled; game sessions share bandwidth with other applications.

[0122] 2. The maximum latency for game sessions has been increased to 100ms.

[0123] When the user category is office users and it is during peak hours;

[0124] 1. Assign high-priority connections to office sessions, such as video conferencing and cloud documents, to ensure that 10-20 concurrent sessions are supported at the same time;

[0125] 2. Enable caching acceleration for office traffic, such as caching frequently used documents at CDN edge nodes to reduce latency;

[0126] 3. Isolate office application traffic from non-office application traffic to different VLANs to avoid interference;

[0127] During off-peak hours;

[0128] 1. Remove concurrent session priority; office applications and non-office applications share resources.

[0129] 2. The QoS priority of office application traffic is reduced to the normal level;

[0130] Conducting in-depth checks on office traffic during off-peak hours, such as log analysis, can identify potential security risks, such as abnormal file transfers. This allows security checks to be performed without affecting users' normal work, reducing security risks associated with computer use.

[0131] Specifically, by taking gaming users and office users as examples, different relationship measures are taken during peak and off-peak hours, enabling the system to accurately determine user needs, making the allocation of computer resources more even, reducing mutual interference when different types of users share resources, improving user experience, and avoiding resource waste.

[0132] In this system, the intelligent switching module determines whether to switch based on set trigger conditions. Taking game users as an example, the trigger conditions are as follows:

[0133] Triggering condition one: The duration of game program usage by game-type users, marked as G, over the past n time periods. t Total program usage time T all The proportions are all less than 50%;

[0134] Triggering condition two: In the past n time periods, a program other than the game program has occupied a total program usage time T. all The proportions are all greater than 50%;

[0135] When both trigger condition one and trigger condition two are met simultaneously, the user category is switched through the user segmentation module;

[0136] This embodiment only demonstrates the two triggering conditions mentioned above. In actual use, the triggering conditions can be deleted or modified according to actual needs to make the intelligent switching module more accurate. After switching user categories, the security protection measures also change accordingly. Thus, by cooperating with the security protection module and the intelligent switching module, adjustments can be made based on the user's actual behavior to achieve dynamic and dedicated security protection strategies, thereby improving user experience while reducing security risks.

[0137] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A computer network intelligent analysis system based on big data, characterized in that: It includes a network data acquisition module, a user segmentation module, a segmentation management module, a security protection module, an intelligent switching module, and a data storage module; The network data acquisition module is used to collect network usage and program usage, and transmit them to the data storage module for storage. The network usage is generated based on a weighted fusion of traffic rate, concurrent connection count, latency, and packet loss rate. The user segmentation module analyzes program usage and categorizes users accordingly. The security protection module sets corresponding security protection measures based on user categories; The segmentation management module adjusts the weights of traffic rate, concurrent connections, latency, and packet loss rate in network usage based on user category, divides the time periods for each user category to use the computer into peak, normal, and off-peak periods, and takes corresponding management measures accordingly. The intelligent switching module determines whether to switch user categories by setting trigger conditions.

2. The computer network intelligent analysis system based on big data according to claim 1, characterized in that: The network data acquisition module collects program usage data as follows: Collect the runtime of the game program while the computer is running, and label the game program runtime as G. t The timer starts when the game program is launched; Collect the usage time of office programs while the computer is running, and mark the usage time of office programs as B. t The timer starts when the office application is opened; Collect the download program's usage time while the computer is running, and mark the download program's usage time as D. t The timer for data collection starts from the actual download time. The duration of video program usage during computer operation is collected and labeled as C. t The timer starts from when the video starts playing in the video program; The game program uses the duration marker G t +Office program usage time marker B t +Download program usage time marker D t +Video program usage time C t = Total program usage time T all .

3. The computer network intelligent analysis system based on big data according to claim 2, characterized in that: The user segmentation module calculates the game program usage time G separately. t Office program usage time B t Download program usage time D t Video program usage time C t Total program usage time T all The user category is divided according to the proportion of the program usage time to the total time T. all When the proportion is greater than 50%, the user categories will be divided according to the program, specifically as follows: When the game program uses the duration marker G t Total program usage time T all When the proportion is greater than 50%, the user is judged to be a gamer user (GH). When the office program uses the duration marker B t Total program usage time T all When the proportion is greater than 50%, the user is judged to be an office-type user (BH). When the download program uses the duration tag D t Total program usage time T all When the proportion is greater than 50%, the user is judged to be a transmission / download type user (DH). When the video program is used for duration C t Total program usage time T all When the proportion is greater than 50%, the user is judged to be a video user (CH). The weights of traffic rate, concurrent connections, latency, and packet loss rate in network usage are adjusted according to different user categories to make the segmentation management module more in line with the actual network operation status. If no program's usage time exceeds 50% of the total time, it means that the user's usage time for each program is balanced, and the user is judged as a balanced user. Therefore, the weights of various data in network usage are not adjusted.

4. The computer network intelligent analysis system based on big data according to claim 3, characterized in that: The segmentation management module first standardizes the traffic rate, concurrent connections, latency, and packet loss rate in network usage to eliminate the influence of dimensions and obtain standard network usage. Then, it analyzes the average value of standard network usage per unit time in the past to obtain average standard network usage. Finally, it analyzes the ratio of standard network usage to average standard network usage to determine the peak, normal, and off-peak periods of user computer usage. By analyzing the ratio of standard network usage to average standard network usage for each user category, we can determine the peak, normal, and off-peak periods of computer usage for each user category, and then set corresponding network management measures accordingly.

5. The computer network intelligent analysis system based on big data according to claim 4, characterized in that: The intelligent switching module determines whether to switch by setting trigger conditions. Taking game users as an example, the trigger conditions are as follows: Triggering condition one: The duration of game program usage by game-type users, marked as G, over the past n time periods. t Total program usage time T all The proportions are all less than 50%; Triggering condition two: In the past n time periods, a program other than the game program has occupied a total program usage time T. all The proportions are all greater than 50%; When both trigger condition one and trigger condition two are met, the user category is switched through the user segmentation module.

6. The computer network intelligent analysis system based on big data according to claim 5, characterized in that: The intelligent switching module includes a switching interval unit, which is used to set the interval time of the intelligent switching module to avoid frequent switching.

7. The computer network intelligent analysis system based on big data according to claim 1, characterized in that: The network data acquisition module includes a data cleaning unit, which is used to remove redundant data and ensure the quality of the acquired data.

8. The computer network intelligent analysis system based on big data according to claim 1, characterized in that: The initial weights of traffic rate, concurrent connections, latency, and packet loss rate in the network usage are equal, and the sum of the initial weights is equal to one.

Images