A network traffic-based method and system for detecting ghost resources of computing nodes

Abstract

The application provides a network flow-based computing node ghost resource detection method and system, and belongs to the field of data center resource management and network observability. The method collects the communication flow between the computing node and the management and scheduling node in real time, performs protocol classification and flow feature extraction, and respectively identifies and extracts heartbeat flow and service I / O flow; a sliding time window is preset, the number of data packets of the heartbeat flow and the service I / O flow in the sliding time window is respectively counted, and the difference in each sliding time window is calculated; a difference threshold is set θ ; when the smoothed difference exceeds the threshold θ for N consecutive windows, and the duration of the current computing node being occupied T>t0, the CPU utilization <5%, and the disk I / O rate <1MB / s, the node is determined to be a ghost resource node, a ghost resource node alarm is generated, and the ghost resource node is governed. The application improves the detection real-time performance, accuracy and universality.

Description

Technical Field

[0001] This invention belongs to the field of data center resource management and network observability, specifically relating to a method and system for detecting ghost resources of computing nodes based on network traffic. Background Technology

[0002] In large data centers or computing clusters, job tasks are allocated to compute nodes for execution by a scheduling system. After a task is completed, the node should release the occupied computing, memory, GPU, and other resources for new tasks. However, in actual operation, a phenomenon often occurs where node resources are not properly released, known as the "ghost resource" problem. In this case, although the job is marked as "completed" at the scheduling level, and there is no actual computing, storage, or network I / O activity within the node, the node still maintains a heartbeat or daemon process. This causes the system to mistakenly believe that the resources are still occupied, severely impacting the efficiency and quality of job scheduling, and the compute node becomes a ghost resource. To ensure that ghost resources are released as quickly as possible, it is first necessary to detect ghost resources.

[0003] In existing technologies, detecting ghost resources in computing nodes generally involves comparing scheduling logs, statistically analyzing CPU / MEM utilization, or manually checking node status. However, these methods have the following shortcomings: relying solely on CPU / MEM metrics makes it difficult to identify nodes with light loads but active status, resulting in coarse detection granularity; they heavily rely on periodic scheduling logs, leading to high latency and poor timeliness; they cannot automatically clean up resources in conjunction with the scheduling system, failing to achieve automatic closed-loop management; furthermore, some heartbeat-type processes are misclassified as active jobs, resulting in a high false alarm rate and low detection efficiency. Summary of the Invention

[0004] In view of the above-mentioned defects or deficiencies in the prior art, the present invention aims to provide a method and system for detecting ghost resources of computing nodes based on network traffic. The method analyzes the network behavior pattern of nodes based on the difference between node heartbeat and service traffic, accurately identifies nodes with "normal heartbeat but no service activity", thereby improving the utilization rate of data center node resources and reducing operation and maintenance costs. It is applicable to resource scheduling and operation and maintenance management of high-performance computing clusters, AI training platforms, cloud computing and virtualized data centers.

[0005] To achieve the above objectives, the embodiments of the present invention adopt the following technical solutions:

[0006] In a first aspect, embodiments of the present invention provide a method for detecting ghost resources of computing nodes based on network traffic, characterized in that the method includes the following steps:

[0007] Step S1: Real-time collection of communication traffic between computing nodes and management scheduling nodes, wherein the communication traffic includes at least heartbeat traffic and service I / O data traffic;

[0008] Step S2: Perform protocol classification and traffic feature extraction on the communication traffic, and identify and extract heartbeat traffic and service I / O traffic respectively;

[0009] Step S3: Preset a sliding time window, and count the number of data packets H(t) and D(t) of internal beep traffic and service I / O traffic within the sliding time window respectively; where t is a time index variable;

[0010] Step S4: Calculate the difference between heartbeat and service traffic data packets within each sliding time window, and perform time series smoothing on the difference and store it.

[0011] Step S5: Set the difference threshold i And the duration threshold T0; when the smoothed difference Δ'(t) exceeds the threshold for N consecutive windows. i If the duration T for which the current computing node is occupied is greater than T0, the node is determined to be a ghost resource node, and the process proceeds to step S6; otherwise, the node is determined not to be a ghost resource node.

[0012] Step S6: Generate a ghost resource node alarm and manage the ghost resource node.

[0013] In a preferred embodiment of the present invention, step S2 includes:

[0014] Step S21: Extract the traffic characteristics and protocol type of the collected communication traffic. The traffic characteristics include: average packet length (APS), periodic stability (PS), and data directionality (DR).

[0015] Step S22: Set the control plane protocol type library and the data transmission protocol type library, and set the first traffic characteristic condition and the second traffic characteristic condition.

[0016] Step S23: When the traffic characteristics meet the first traffic characteristic condition and belong to the control plane protocol type library, mark the current data packet as heartbeat traffic; when the traffic characteristics meet the second traffic characteristic condition and belong to the data transmission protocol type library, mark the current data packet as service I / O traffic; otherwise, mark the data packet as abnormal traffic.

[0017] In a preferred embodiment of the present invention, the control plane protocol type library includes at least the following communication protocols: Slurm RPC, MPIRank Heartbeat, TCP Keepalive, ICMP Echo, and gRPC Health Check; the data transmission protocol type library includes at least the following protocols: MPI, RDMA, NCCL, NFS, HTTP, gRPC, and database access protocols.

[0018] The first flow characteristic conditions include: APS < 128B, PS > 0.8, DR < 0.3; the second flow characteristic conditions include: APS > 512B, PS ≤ 0.8, DR ≥ 0.3.

[0019] In a preferred embodiment of the present invention, when identifying and classifying heartbeat traffic and business I / O traffic in step S2, a classification model based on machine learning is constructed. The input features of the model are traffic feature indicators, and the output labels of the model are {Heartbeat, Business, Unknown}. Automatic classification is performed through the machine learning model.

[0020] In a preferred embodiment of the present invention, the formula for calculating the data packet difference Δ(t) in step S4 is as follows:

[0021] Δ(t)=H(t)- α ·D(t)

[0022] in, α This is the weighting coefficient, with a value ranging from 0.1 to 0.5.

[0023] In a preferred embodiment of the present invention, the time series smoothing process in step S4 involves applying a moving average or exponentially weighted smoothing to the data packet difference Δ(t) sequence, as shown in the following formula:

[0024] Δ'(t) = β ·Δ(t) + (1- β )·Δ'(t-1)

[0025] in, β The value range is 0.2 to 0.5.

[0026] In a preferred embodiment of the present invention, step S5 involves setting a difference threshold. i At that time, the threshold is set using a moving average and standard deviation; specifically including:

[0027] Dynamically calculate the historical average difference of nodes m with standard deviation s ;

[0028] Set threshold i for: i = m +3 s ;

[0029] It also supports adaptive node type configuration, allowing compute nodes, storage nodes, and GPU nodes to be configured separately.

[0030] In a preferred embodiment of the present invention, when managing ghost resource nodes in step S6, one of the following operations is performed: automatically releasing resources; restarting node services; or notifying the administrator for manual review.

[0031] As a preferred embodiment of the present invention, step S6 further includes: visualizing the detection results, highlighting the ghost nodes in red in the monitoring system interface, providing trend curves to show the changes in Δ(t) or Δ'(t), and logging the alarm events.

[0032] Secondly, embodiments of the present invention also provide a ghost resource detection system for computing nodes based on network traffic. The system includes: a traffic acquisition module, a feature extraction module, a classification and statistics module, a difference calculation module, a judgment module, and an alarm and control module; wherein,

[0033] The traffic acquisition module is used to collect the communication traffic between the computing node and the management and scheduling node in real time. The communication traffic includes at least heartbeat traffic and service I / O data traffic.

[0034] The feature extraction module is used to classify communication traffic according to protocols and extract traffic features, and to identify and extract heartbeat traffic and service I / O traffic respectively;

[0035] The classification and statistics module is used to preset a sliding time window and count the number of data packets H(t) and D(t) of internal beep traffic and service I / O traffic within the sliding time window, respectively; where t is a time index variable;

[0036] The difference calculation module is used to calculate the difference between heartbeat and service traffic data packets within each sliding time window, and to perform time series smoothing and storage on the difference.

[0037] The determination module is used to set the difference threshold. i And the duration threshold T0; when the smoothed difference Δ'(t) exceeds the threshold for N consecutive windows. i If the duration T for which the current computing node is occupied is greater than T0, the node is determined to be a ghost resource node, and the alarm and control module is activated; otherwise, the node is determined not to be a ghost resource node.

[0038] The alarm and control module is used to generate ghost resource node alarms and manage ghost resource nodes.

[0039] The technical solutions provided in the embodiments of the present invention have the following beneficial effects:

[0040] The ghost resource detection method and system for computing nodes based on network traffic provided in this invention identifies hidden occupancy by utilizing the relationship between heartbeat and I / O difference. By introducing an adaptive judgment mechanism for traffic monitoring, ghost nodes can be detected in seconds. It also supports automatic release and node recovery, reducing the false alarm rate between different nodes. The detection is real-time, accurate, and versatile, and can achieve closed-loop management. It is applicable to various types of clusters such as HPC, AI training, and cloud computing.

[0041] Of course, implementing any product or method of the present invention does not necessarily require achieving all of the advantages described above at the same time. Attached Figure Description

[0042] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0043] Figure 1 This is a flowchart of the ghost resource detection method for computing nodes based on network traffic, as described in an embodiment of the present invention. Detailed Implementation

[0044] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of them. The components of the embodiments of the present invention described and shown in the accompanying drawings can generally be arranged and designed in various different configurations. It should be noted that, without conflict, the embodiments and features in the embodiments of the present invention can also be combined with each other.

[0045] It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. In the description of this invention, the terms "first," "second," "third," "fourth," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0046] To address the issue of ghost resources on compute nodes, this invention provides a method and system for detecting ghost resources on compute nodes based on network traffic. The method detects ghost resources based on the traffic difference between node heartbeats and services, and employs a sliding window and adaptive threshold algorithm for determination. It analyzes the behavioral patterns of network nodes to identify whether the current node is a ghost resource node. This invention supports closed-loop automatic governance of the scheduling system and is compatible with multiple types of compute clusters, such as HPC, Cloud, AI, and Edge computing.

[0047] like Figure 1 As shown, the method for detecting ghost resources of computing nodes based on network traffic includes the following steps:

[0048] Step S1: Real-time collection of communication traffic between computing nodes and management scheduling nodes, including at least heartbeat traffic and service I / O data traffic.

[0049] In this step, node data collection can be achieved by deploying bypass traffic acquisition or probes between the compute nodes and the management and scheduling nodes.

[0050] Step S2: Perform protocol classification and traffic feature extraction on the communication traffic, and identify and extract heartbeat traffic and service I / O traffic respectively.

[0051] In this step, different traffic identification is based on traffic characteristics. Heartbeat traffic is characterized by: packet length <128B, strong periodicity, and fixed source and destination nodes (scheduling and control nodes). Service I / O traffic is characterized by: packet length >512B, distribution ranging from several KB to tens of KB, bursty transmission characteristics, and involvement of Remote Direct Memory Access (RDMA) or TCP data interaction between nodes.

[0052] Specifically, this step includes:

[0053] Step S21: Extract the traffic characteristics and protocol type of the collected communication traffic. The traffic characteristics include: average packet length, periodic stability, and data directionality.

[0054] In this step, features of each data packet in the traffic are extracted, including average packet size (AvgPktSize, APS), periodic stability (PeriodStability, PS), and data directionality (DirectionRatio, DR). PS is calculated based on the data packet arrival time interval sequence, and the average interval (AvgInterval) serves as an intermediate statistic or auxiliary feature for calculating periodic stability. The protocol types include MPI, RDMA, and Slurm RPC. A protocol table including protocol types is used to increase the accuracy of data packet classification.

[0055] Step S22: Set the control plane protocol type library and the data transmission protocol type library, and set the first traffic characteristic condition and the second traffic characteristic condition.

[0056] In this step, the control plane protocol type library includes at least the following control plane communication protocols: Slurm RPC, MPI Rank Heartbeat, TCP Keepalive, ICMP Echo, gRPC Health Check, etc.; the data transmission protocol type library includes at least the following data transmission protocols: MPI, RDMA (Remote Direct Memory Access), NCCL, NFS, HTTP, gRPC, database access protocols, etc.

[0057] The first flow characteristics include: APS < 128B, PS > 0.8, DR < 0.3;

[0058] The second flow characteristic conditions include: APS > 512B, PS ≤ 0.8, DR ≥ 0.3.

[0059] Step S23: When the traffic characteristics meet the first traffic characteristic condition and belong to the control plane protocol type library, mark the current data packet as heartbeat traffic; when the traffic characteristics meet the second traffic characteristic condition and belong to the data transmission protocol type library, mark the current data packet as service I / O traffic; otherwise, mark the data packet as abnormal traffic.

[0060] Preferably, when identifying and classifying heartbeat traffic and business I / O traffic, a lightweight machine learning model (such as a random forest) can be used for automatic classification. Specifically, a machine learning-based classification model is first constructed. The model's input features are traffic characteristic indicators, and the model's output labels are {Heartbeat, Business, Unknown}. For example, the output results are as follows: {node_id, timestamp, heartbeat_count, business_count}.

[0061] Step S3: Preset a sliding time window, and count the number of data packets H(t) and D(t) of internal beep traffic and service I / O traffic within the sliding time window, respectively. Here, t is a time index variable, representing the start and end time points of the sliding time window or the window number at the current moment, which is the window sequence number or center time identifier that moves with time.

[0062] In this step, the width W of the preset sliding time window is used to statistically analyze the flow characteristics of the node within a continuous time period. The window width W can be flexibly set according to the actual changes in flow, for example, W = 60 seconds.

[0063] The system can also set the sliding step size. lFor example, every 5 to 10 seconds, the window is shifted sequentially in steps on the time series, and the number of heartbeat data packets H(t) and the number of service I / O data packets D(t) within each time window are statistically analyzed to form a traffic characteristic sequence that changes over time. Step S4: The difference between heartbeat and service traffic data packets within each sliding time window is calculated, and the difference is smoothed over time and stored.

[0064] In this step, the formula for calculating the data packet difference is as follows:

[0065] Δ(t)=H(t)- α ·D(t)

[0066] in, α This is a weighting coefficient used to balance the differences in traffic volume between different computing nodes. α The specific selection can be made based on the actual situation of business differences, such as 0.1 to 0.5.

[0067] The time series smoothing process involves applying a moving average or exponentially weighted smoothing to the Δ(t) series, as shown in the following formula:

[0068] Δ'(t) = β ·Δ(t) + (1- β )·Δ'(t-1)

[0069] in, β The value range is 0.2 to 0.5.

[0070] When storing the difference sequence, the Δ'(t) sequence of the most recent M windows (e.g., M=10) can be maintained in the cache, or a REST interface can be provided for querying.

[0071] Step S5: Set the difference threshold i And the duration threshold T0; when the smoothed difference Δ'(t) exceeds the threshold for N consecutive windows. i If the duration T for which the current computing node is occupied is greater than T0, the node is determined to be a ghost resource node, and the process proceeds to step S6; otherwise, the node is determined not to be a ghost resource node.

[0072] In this step, the difference threshold is set. i In this case, the settings can be adaptively adjusted based on historical statistics. For example, a moving average and standard deviation can be used to set the threshold. Specifically, the mean of historical differences between nodes is dynamically calculated. m with standard deviation s Set the threshold as follows: i = m +3 sIt also supports adaptive node type configuration (compute nodes, storage nodes, and GPU nodes can be configured separately). Preferably, the determination criteria may also include: CPU utilization <5% and disk I / O rate <1MB / s.

[0073] When marking, the node state is updated, which can be done using the following expression:

[0074] {node_id, status: GHOST, Δ_avg, duration, last_update_time}

[0075] Synchronously write to the database or message queue.

[0076] Step S6: Generate a ghost resource node alarm and manage the ghost resource node.

[0077] When generating an alert in this step, the node status changes to GHOST, and the JSON alert can be generated using the following expression:

[0078] {node_id, Δ_avg, duration, threshold, timestamp}

[0079] It also pushes alerts to the message center (Kafka / MQTT) and notifies operations and maintenance personnel via email, SMS, webhook, etc.; it also supports multi-level alert policies: initial warning, automatic escalation after 5 minutes, etc.

[0080] The governance process involves performing one of the following operations: automatically releasing resources; restarting the node service; or notifying the administrator for manual review. A closed-loop governance mechanism can be implemented using either automatic or semi-automatic modes. In automatic mode, the scheduling system interface calls `slurm_reboot(node_id)` or `release_resource(node_id)` to update the node resource status. In semi-automatic mode, only a task order is generated, awaiting manual confirmation.

[0081] This step may also include: visualizing the detection results by highlighting ghost nodes in red on the monitoring system (such as NetInside or NAPM) interface and providing trend curves to show the changes in Δ(t) or Δ'(t). Additionally, alarm events can be logged, with each alarm and governance event written to a log table for subsequent statistics and model optimization, such as: ghost_log(node_id, start_time, end_time, Δ_series, action_taken).

[0082] Based on the same approach, this invention also provides a network traffic-based ghost resource detection system for computing nodes. The system includes: a traffic acquisition module, a feature extraction module, a classification and statistics module, a difference calculation module, a judgment module, and an alarm and control module. The modules communicate with each other via message queues or API interfaces and can be deployed on monitoring nodes or traffic bypass devices in a data center.

[0083] The traffic acquisition module is used to collect the communication traffic between the computing node and the management and scheduling node in real time. The communication traffic includes at least heartbeat traffic and service I / O data traffic.

[0084] The feature extraction module is used to classify communication traffic according to protocols and extract traffic features, and to identify and extract heartbeat traffic and service I / O traffic respectively;

[0085] The classification and statistics module is used to preset a sliding time window and count the number of data packets H(t) and D(t) of internal beep traffic and service I / O traffic within the sliding time window, respectively; where t is a time index variable;

[0086] The difference calculation module is used to calculate the difference between heartbeat and service traffic data packets within each sliding time window, and to perform time series smoothing and storage on the difference.

[0087] The determination module is used to set the difference threshold. i And the duration threshold T0; when the smoothed difference Δ'(t) exceeds the threshold for N consecutive windows. i If the duration T for which the current computing node is occupied is greater than T0, the node is determined to be a ghost resource node, and the alarm and control module is activated; otherwise, the node is determined not to be a ghost resource node.

[0088] The alarm and control module is used to generate ghost resource node alarms and manage ghost resource nodes.

[0089] In this embodiment, each module is implemented using a processor, with additional memory added as needed for storage. The processor can be, but is not limited to, a microprocessor (MPU), a central processing unit (CPU), a network processor (NP), a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), other programmable logic devices, discrete gates, transistor logic devices, discrete hardware components, etc. The memory can include random access memory (RAM) or non-volatile memory (NVM), such as at least one disk storage device. Optionally, the memory can also be at least one storage device located remotely from the aforementioned processor.

[0090] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of the present invention are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means.

[0091] It should also be noted that the network traffic-based ghost resource detection system for computing nodes described in this embodiment corresponds to the network traffic-based ghost resource detection method for computing nodes. The description and limitations of the method also apply to the system, and will not be repeated here.

[0092] The method and system for detecting ghost resources of computing nodes based on network traffic provided in this invention were applied to a large AI training data center. The system collects and detects node traffic through bypass. When the node's heartbeat packet frequency remains at 1Hz, and the service I / O traffic is zero within 5 minutes, Δ(t) continuously rises to more than three times the threshold. The system automatically marks the node as a ghost resource and notifies the scheduler to release the resource. Experiments show that the detection accuracy of this method exceeds 98%, and the average detection latency is less than 10 seconds.

[0093] As can be seen from the above technical solutions, the network traffic-based ghost resource detection method and system for computing nodes provided in this invention identifies hidden occupancy by utilizing the relationship between heartbeat and I / O difference. By introducing an adaptive judgment mechanism for traffic monitoring, ghost nodes can be detected in seconds. It also supports automatic release and node recovery, reducing the false alarm rate between different nodes. The detection is real-time, accurate, and versatile, and can achieve closed-loop governance. It is applicable to various types of clusters such as HPC, AI training, and cloud computing.

[0094] The above description is merely a preferred embodiment of the present invention and an explanation of the technical principles employed, and is not intended to limit the scope of the claimed invention, but merely to illustrate preferred embodiments of the invention. Those skilled in the art should understand that the scope of the invention is not limited to the specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the inventive concept. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without inventive effort are within the scope of protection of the present invention.

Claims

1. A method for detecting ghost resources in computing nodes based on network traffic, characterized in that, The method includes the following steps: Step S1: Real-time collection of communication traffic between computing nodes and management scheduling nodes, wherein the communication traffic includes at least heartbeat traffic and service I / O data traffic; Step S2: Perform protocol classification and traffic feature extraction on the communication traffic, and identify and extract heartbeat traffic and service I / O traffic respectively; Step S3: Preset a sliding time window, and count the number of data packets H(t) and D(t) of internal beep traffic and service I / O traffic within the sliding time window respectively; where t is a time index variable; Step S4: Calculate the difference between heartbeat and service traffic data packets within each sliding time window, and perform time series smoothing on the difference and store it. Step S5: Set the difference threshold θ And the duration threshold T0; when the smoothed difference Δ'(t) exceeds the threshold for N consecutive windows. θ If the duration T for which the current computing node is occupied is greater than T0, the node is determined to be a ghost resource node, and the process proceeds to step S6; otherwise, the node is determined not to be a ghost resource node. Step S6: Generate a ghost resource node alarm and manage the ghost resource node.

2. The method according to claim 1, characterized in that, Step S2 includes: Step S21: Extract the traffic characteristics and protocol type of the collected communication traffic. The traffic characteristics include: average packet length (APS), periodic stability (PS), and data directionality (DR). Step S22: Set the control plane protocol type library and the data transmission protocol type library, and set the first traffic characteristic condition and the second traffic characteristic condition. Step S23: When the traffic characteristics meet the first traffic characteristic condition and belong to the control plane protocol type library, mark the current data packet as heartbeat traffic; when the traffic characteristics meet the second traffic characteristic condition and belong to the data transmission protocol type library, mark the current data packet as service I / O traffic; otherwise, mark the data packet as abnormal traffic.

3. The method according to claim 2, characterized in that, The control plane protocol type library includes at least the following communication protocols: Slurm RPC, MPI Rank Heartbeat, TCP Keepalive, ICMP Echo, and gRPC Health Check; the data transmission protocol type library includes at least the following protocols: MPI, RDMA, NCCL, NFS, HTTP, gRPC, and database access protocols. The first flow characteristic condition includes: APS < 128B, PS > 0.8, DR < 0.3; the second flow characteristic condition includes: APS > 512B, PS ≤ 0.8, DR ≥ 0.

3.

4. The method according to claim 1, characterized in that, In step S2, when identifying and classifying heartbeat traffic and business I / O traffic, a classification model based on machine learning is constructed. The input features of the model are traffic feature indicators, and the output labels of the model are {Heartbeat, Business, Unknown}. The machine learning model is used for automatic classification.

5. The method according to claim 1, characterized in that, Step S4 calculates the data packet difference Δ(t) using the following formula: Δ(t)=H(t)- α ·D(t) in, α This is the weighting coefficient, with a value ranging from 0.1 to 0.

5.

6. The method according to claim 1, characterized in that, Step S4 involves time series smoothing, which applies a moving average or exponentially weighted smoothing to the data packet difference Δ(t) sequence, as shown in the following formula: Δ'(t) = β ·Δ(t) + (1- β )·D'(t-1) in, β The value range is 0.2 to 0.

5.

7. The method according to claim 1, characterized in that, Step S5: Set the difference threshold θ At that time, the threshold is set using a moving average and standard deviation; specifically including: Dynamically calculate the historical average difference of nodes μ with standard deviation σ ; Set threshold θ for: θ = μ +3 σ ; It also supports adaptive node type configuration, allowing compute nodes, storage nodes, and GPU nodes to be configured separately.

8. The method according to claim 1, characterized in that, When managing ghost resource nodes in step S6, perform one of the following operations: automatically release resources; restart node services; or notify the administrator for manual review.

9. The method according to claim 1, characterized in that, Step S6 also includes: visualizing the detection results, highlighting the ghost nodes in red on the monitoring system interface, providing trend curves to show the changes in Δ(t) or Δ'(t), and logging the alarm events.

10. A ghost resource detection system for computing nodes based on network traffic, the system comprising: The system includes a traffic acquisition module, a feature extraction module, a classification and statistics module, a difference calculation module, a judgment module, and an alarm and control module; among which, The traffic acquisition module is used to collect the communication traffic between the computing node and the management and scheduling node in real time. The communication traffic includes at least heartbeat traffic and service I / O data traffic. The feature extraction module is used to classify communication traffic according to protocols and extract traffic features, and to identify and extract heartbeat traffic and service I / O traffic respectively; The classification and statistics module is used to preset a sliding time window and count the number of data packets H(t) and D(t) of internal beep traffic and service I / O traffic within the sliding time window, respectively; where t is a time index variable; The difference calculation module is used to calculate the difference between heartbeat and service traffic data packets within each sliding time window, and to perform time series smoothing and storage on the difference. The determination module is used to set the difference threshold. θ And the duration threshold T0; when the smoothed difference Δ'(t) exceeds the threshold for N consecutive windows. θ If the duration T for which the current computing node is occupied is greater than T0, the node is determined to be a ghost resource node, and the alarm and control module is activated; otherwise, the node is determined not to be a ghost resource node. The alarm and control module is used to generate ghost resource node alarms and manage ghost resource nodes.

Images