Detection method, device, equipment, medium and product

Abstract

The invention discloses a detection method, device and equipment, a medium and a product. Relates to the technical field of computers. The method comprises the following steps: acquiring the total number of OSPF Hello messages in a target link within target time and the total number of OSPF Hello messages sent by each routing device in the target link; and if the total number of the OSPF Hello messages in the target link within the target time is greater than or equal to a first numerical value, and / or the total number of the OSPF Hello messages sent by each routing device in the target link is greater than or equal to a second numerical value corresponding to each routing device, determining that the OSPF Hello messages in the target link are in an abnormal state. The efficiency and accuracy of OSPF Hello message detection can be improved, and the situation that network operation is affected due to OSPF Hello message abnormity is avoided.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of computer technology, and in particular to a detection method, apparatus, device, medium and product. Background Technology

[0002] The OSPF protocol is widely used in large enterprise networks and the Internet, providing a highly reliable and efficient routing mechanism capable of adapting to complex network environments. However, due to issues in protocol design, vendor implementation, and network operation and maintenance, attackers can exploit the protocol's inherent mechanisms to forge abnormal packets. By sending a large number of invalid packets, attackers can cause target hosts or network devices to malfunction, hindering normal network operation. Network operation can also be affected by misconfigurations by maintenance personnel.

[0003] The current main approach often requires manually logging into the routing device or checking the router's operation logs through the network management system after a network communication anomaly occurs. This involves analyzing the routing device's operating status, determining whether there are any abnormal OSPF Hello message behaviors, and combining the operation logs of multiple routing devices to infer the time and cause of the abnormal behavior.

[0004] The drawback of this solution is that it requires network maintenance personnel to log in to the routing equipment at irregular intervals to check the logs and rely on their experience to judge whether the routing equipment is operating normally at a certain time period, which consumes a lot of time and manpower and is also prone to misjudgment due to lack of experience. Summary of the Invention

[0005] This invention provides a detection method, apparatus, device, medium, and product that can improve the efficiency and accuracy of OSPF Hello message detection and avoid network operation being affected by abnormal OSPF Hello messages.

[0006] According to one aspect of the present invention, a detection method is provided, performed by an analysis device in a communication system, the communication system comprising: a plurality of routing devices, the analysis device being located in a target link to which the plurality of routing devices belong, the detection method comprising:

[0007] Obtain the total number of OSPF Hello packets in the target link within the target time period and the total number of OSPF Hello packets sent by each routing device in the target link;

[0008] If the total number of OSPF Hello packets in the target link within the target time is greater than or equal to the first value, and / or the total number of OSPF Hello packets sent by each routing device in the target link is greater than or equal to the second value corresponding to each routing device, then the OSPF Hello packets in the target link are determined to be in an abnormal state.

[0009] According to another aspect of the present invention, a detection device is provided, which is configured in an analysis device in a communication system, the communication system comprising: a plurality of routing devices, the analysis device being located in a target link to which the plurality of routing devices belong, the detection device comprising:

[0010] The acquisition module is used to acquire the total number of OSPF Hello packets in the target link within the target time and the total number of OSPF Hello packets sent by each routing device in the target link.

[0011] The determination module is used to determine that the OSPF Hello packets in the target link are in an abnormal state if the total number of OSPF Hello packets in the target link within the target time is greater than or equal to a first value, and / or the total number of OSPF Hello packets sent by each routing device in the target link is greater than or equal to a second value corresponding to each routing device.

[0012] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0013] At least one processor; and

[0014] A memory communicatively connected to the at least one processor; wherein,

[0015] The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the detection method described in any embodiment of the present invention.

[0016] According to another aspect of the present invention, a computer-readable storage medium is provided, the computer-readable storage medium storing computer instructions for causing a processor to execute and implement the detection method described in any embodiment of the present invention.

[0017] According to another aspect of the present invention, a computer program product is provided, which, when executed by a processor, implements the detection method as described in any of the embodiments of the present invention.

[0018] This invention obtains the total number of OSPF Hello packets in the target link within a target time period and the total number of OSPF Hello packets sent by each routing device in the target link. If the total number of OSPF Hello packets in the target link within the target time period is greater than or equal to a first value, and / or the total number of OSPF Hello packets sent by each routing device in the target link is greater than or equal to a second value corresponding to each routing device, then it is determined that the OSPF Hello packets in the target link are in an abnormal state. This can improve the efficiency and accuracy of OSPF Hello packet detection and avoid the situation where abnormal OSPF Hello packets affect network operation.

[0019] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0020] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present invention and should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0021] Figure 1 This is a flowchart of a detection method according to an embodiment of the present invention;

[0022] Figure 2 This is a deployment example diagram of an analysis device in an embodiment of the present invention;

[0023] Figure 3 This is a schematic diagram of the structure of a detection device according to an embodiment of the present invention;

[0024] Figure 4 This is a schematic diagram of the structure of an electronic device according to an embodiment of the present invention. Detailed Implementation

[0025] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0026] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0027] It is understood that before using the technical solutions disclosed in the various embodiments of this disclosure, users should be informed of the types, scope of use, and usage scenarios of the personal information involved in this disclosure in an appropriate manner in accordance with relevant laws and regulations, and user authorization should be obtained.

[0028] Example 1

[0029] Figure 1 This is a flowchart illustrating a detection method provided in an embodiment of the present invention. This embodiment is applicable to the detection of OSPF Hello messages. The method can be executed by the detection device in this embodiment, which can be implemented in software and / or hardware, such as... Figure 1 As shown, the method specifically includes the following steps:

[0030] S110: Obtain the total number of OSPF Hello packets in the target link within the target time and the total number of OSPF Hello packets sent by each routing device in the target link.

[0031] In this embodiment, the communication system includes multiple routing devices and an analysis device. The detection method provided in this embodiment is executed by the analysis device, which is located in the target link to which the multiple routing devices belong.

[0032] In this embodiment, Figure 2 For example, to analyze the deployment of devices, such as Figure 2 As shown, routing device A is the routing device to be protected, and routing device B is a neighboring routing device of routing device A. To ensure the effectiveness of routing table overflow risk identification and interception capabilities, the analysis device should be deployed in series on the link to be protected. During operation, the analysis device can process the routing message data exchanged between the routing devices in real time, analyze the number of OSPFHello message transmissions on the link between routing device A and routing device B during network operation, and perform risk assessment and risk interception.

[0033] In this embodiment, the target time can be a pre-set time period. OSPF Hello messages are the most basic and core message type in the Open Shortest Path First (OSPF) protocol. OSPF Hello messages are used to establish and maintain adjacency relationships between OSPF neighbors.

[0034] In this embodiment, the method for obtaining the total number of OSPF Hello packets in the target link and the total number of OSPF Hello packets sent by each routing device in the target link within the target time period can be as follows: the analysis device analyzes the received OSPF Hello packets in real time, counts the number of OSPF Hello packets flowing through the analysis device within the target time period, and uses the number of OSPF Hello packets flowing through the analysis device within the target time period as the total number of OSPF Hello packets in the target link within the target time period. Based on the routing device identifier carried in the OSPF Hello packets within the target time period, the total number of OSPF Hello packets sent by each routing device is determined.

[0035] It should be noted that the detection device provided in this embodiment can be executed periodically, and the execution period is the target time.

[0036] S120, if the total number of OSPF Hello packets in the target link within the target time is greater than or equal to the first value, and / or the total number of OSPF Hello packets sent by each routing device in the target link is greater than or equal to the second value corresponding to each routing device, then it is determined that the OSPF Hello packets in the target link are in an abnormal state.

[0037] In this embodiment, the first value can be the total number of historical OSPF Hello packets in the target link within the target time period collected when the network is in a stable operating state. For example, if the target time is 3 seconds and the current time is December 6, 2025, then the first value can be the total number of historical OSPF Hello packets in the target link within 3 seconds collected on December 5, 2025, when the network is in a stable operating state.

[0038] In this embodiment, the second value corresponding to each routing device can be determined as follows: if the routing device is in the target routing device identifier list, the second value corresponding to the routing device is determined based on the total number of historical OSPF Hello messages sent by the routing device; if the routing device is not in the target routing device identifier list, a preset value is used as the second value corresponding to the routing device. The preset value can be determined based on the configuration information of the routing device.

[0039] In this embodiment, the OSPF Hello packets in the target link are in an abnormal state, meaning that the OSPF Hello packets in the target link are behaving abnormally.

[0040] Optionally, before determining network malfunction, if the total number of OSPF Hello packets in the target link within the target time is greater than or equal to the first value, and / or the total number of OSPF Hello packets sent by each routing device in the target link is greater than or equal to the second value corresponding to each routing device, the following further steps are taken:

[0041] If the current network is in a stable operating state, the first value is determined based on the total number of historical OSPF Hello messages in the target link. If all routing devices in the target link are in the target routing device identifier list, the second value corresponding to each routing device is determined based on the total number of historical OSPF Hello messages sent by the routing devices in the target link. If there are routing devices in the target link that are not in the target routing device identifier list, a preset value is obtained and used as the second value corresponding to the routing devices that are not in the target routing device identifier list.

[0042] In this embodiment, the method for determining the first value based on the total number of historical OSPF Hello packets in the target link can be as follows: if the network is in a stable operating state during the first historical time period, then obtain the total number of historical OSPF Hello packets during the first historical time period, and multiply the ratio of the total number of historical OSPF Hello packets to the first historical time period by the target time period, and use this product as the first value.

[0043] In this embodiment, the preset value can be determined in advance based on the configuration information of the routing device.

[0044] In this embodiment, the first value comes from the data collected during the network stable operation determination process, and the total number of historical OSPF Hello packets received within the target time is recorded as the first value; the second value corresponding to the routing device is generated by the analysis device based on the target routing device identifier list, by counting the number of historical OSPF Hello packets sent by each routing device in the target routing device identifier list.

[0045] In this embodiment, the analysis device needs to complete network environment status identification after successful deployment, and run independently in a stable operating environment for a period of time to receive and analyze all OSPF Hello packets flowing through the analysis device, count the number of OSPF Hello packets transmitted by the device deployment link in a stable operating network environment, and form a target routing device identifier list.

[0046] Optional, also includes:

[0047] Get the total number of OSPF Hello packets in the target link within multiple consecutive periods.

[0048] In this embodiment, the period can be a preset time, and the present invention does not limit this.

[0049] A preset number of adjacent cycles are merged to obtain multiple merged cycles.

[0050] In this embodiment, the preset quantity is a pre-set quantity, and this embodiment of the present invention does not impose any limitation on it.

[0051] If the difference in the total number of OSPF Hello packets in the target link corresponding to adjacent merging cycles is less than the first difference threshold, and the difference in the total number of OSPF Hello packets in the target link within the corresponding period in adjacent merging cycles is less than the second difference threshold, then the current network is determined to be in a stable operating state.

[0052] In this embodiment, from the design specifications of the protocol itself, OSPF Hello messages have a periodic sending mechanism. In a network environment with OSPF protocol devices running and no fundamental changes in the network topology, the number of OSPF Hello messages transmitted on a specified link within a certain time range should be fixed. During operation, the analysis device collects all OSPF Hello messages in the deployed links in real time and counts the number of OSPF Hello messages generated every 10 seconds. After completing the message count for multiple statistical periods, if there are multiple consecutive and non-overlapping periods with a stable total number of messages and a periodic distribution pattern in the message count within each period, this is recorded as the minimum continuous period, and the current network is considered to be in a stable operating environment. In simple terms, the data collection involves multiple periods, denoted as T1 to Tn, and the number of packets within each period, denoted as C1 to Cn. If, through analysis and comparison, the total value of any smallest consecutive period Cm+Cm+1+Cm+2 is close to the total value of Cm+3+Cm+4+Cm+5, and the values ​​of Cm and Cm+3, Cm+1 and Cm+4, and Cm+2 and Cm+5 are similar, then the network can be considered to be in a stable operating state. The packet analysis equipment supports manual adjustment of the comparison sensitivity to reduce judgment errors.

[0053] Optional, also includes:

[0054] If the total number of OSPF Hello packets in the target link within the target time is less than the first value, and the total number of OSPF Hello packets sent by each routing device in the target link is less than the second value, then the OSPF Hello packets in the target link are determined to be in a normal state.

[0055] In this embodiment, if the total number of OSPF Hello packets in the target link within the target time is less than the first value, and the total number of OSPF Hello packets sent by each routing device in the target link is less than the second value, then it is determined that the OSPF Hello packets in the target link are in a normal state, that is, the network is operating normally.

[0056] In this embodiment, by deploying a separate analysis device, OSPF Hello packets are analyzed and processed to extract packet content. By counting the number of OSPF Hello packets per unit time, it is determined whether there is any risk of abnormal OSPF Hello behavior and timely alarms and interception are made to avoid affecting network operation.

[0057] In this embodiment, during the detection phase, the analysis device analyzes the received OSPF Hello packets in real time, and counts the total number of OSPF Hello packets flowing through the analysis device and the total number of OSPF Hello packets sent by each routing device within a target time period. If the total number of OSPF Hello packets in the target link within the target time period is greater than or equal to a first value, and / or the total number of OSPF Hello packets sent by each routing device in the target link is greater than or equal to a second value corresponding to each routing device, then an abnormal OSPF Hello packet behavior risk is considered to exist; otherwise, the network is considered to be operating normally. Network maintenance personnel can manually adjust the first and / or second values ​​based on the baseline values ​​according to the actual situation to reduce misjudgments caused by normal network fluctuations.

[0058] Optionally, after the OSPF Hello message in the target link is in an abnormal state, the following also applies:

[0059] Based on the target routing device identifier list, OSPF Hello packets in the target link are filtered.

[0060] In this embodiment, the method for filtering OSPF Hello packets in the target link based on the target routing device identifier list can be: discarding OSPF Hello packets in the target link originating from routing devices outside the target routing device identifier list.

[0061] In this embodiment, if the total number of OSPF Hello packets in the target link within the target time is greater than or equal to the first value, the OSPF Hello packets in the target link can be filtered based on the target routing device identifier list.

[0062] An alarm message is generated based on the filtered OSPF Hello messages.

[0063] In this embodiment, an alarm message is generated based on the identifier of the filtered OSPF Hello message, wherein the alarm message may include the identifier of the filtered OSPF Hello message.

[0064] In this embodiment, if the total number of OSPF Hello packets in the target link within the target time is less than the first value, and there is a routing device in the target link whose total number of OSPF Hello packets sent is greater than or equal to the second value corresponding to each routing device, an alarm message can be generated based on the identifier of the routing device whose total number of OSPF Hello packets sent is greater than or equal to the second value corresponding to each routing device.

[0065] Based on the target routing device identifier list, OSPF Hello packets in the target link are filtered, including:

[0066] OSPF Hello packets originating from routing devices outside the target routing device identifier list on the target link will be discarded.

[0067] In this embodiment, the analysis device promptly generates alarm information based on the detection results of OSPF Hello packets, notifying network maintenance personnel to pay attention and take corresponding maintenance measures. For cases where the total number of OSPF Hello packets is abnormal, in addition to generating alarm information, the analysis device will call the target routing device identifier list to check and filter received OSPF Hello packets, discarding OSPF Hello packets sent by routing devices not in the target routing device identifier list to avoid affecting normal network operation. For cases where the total number of OSPF Hello packets sent by routing devices is abnormal, the analysis device, when generating alarm information, simultaneously records the identifiers of routing devices in the target routing device identifier list that sent excessive OSPF Hello packets, as well as the identifiers of routing devices in the non-target routing device identifier list that sent excessive OSPF Hello packets.

[0068] Optionally, obtain a list of target routing device identifiers, including:

[0069] Obtain the collection time corresponding to the OSPF Hello messages sent by all routing devices in the target link.

[0070] In this embodiment, the acquisition time corresponding to the OSPF Hello message is the time when the analysis device captures the OSPF Hello message.

[0071] Based on the collection time and the corresponding routing device, determine the OSPFHello message sending period of each routing device in the target link.

[0072] In this embodiment, the method for determining the OSPF Hello message transmission period of each routing device in the target link based on the acquisition time and the routing device corresponding to the acquisition time can be as follows: the acquisition time and the routing device corresponding to the acquisition time are regarded as time-domain discrete signals and converted into frequency-domain signals using the fast discrete Fourier transform method, and the OSPF Hello message transmission period of each routing device is determined by identifying the frequency value of the high-frequency signal.

[0073] Generate a list of target routing device identifiers based on the routing devices whose OSPF Hello message sending cycle is within a preset range.

[0074] In this embodiment, the preset range includes a minimum period and a maximum period. If the OSPF Hello message transmission period is greater than the minimum period and less than the maximum period, then the OSPF Hello message transmission period is determined to be within the preset range. If the OSPF Hello message transmission period is less than the minimum period or greater than the maximum period, then the OSPF Hello message transmission period is determined to be outside the preset range.

[0075] In this embodiment, the OSPF Hello message sending period of the routing devices in the target routing device identifier list is within a preset range.

[0076] It should be noted that if a routing device's OSPF Hello packet sending period is within a preset range, the routing device can be considered a legitimate device and added to the target routing device identifier list. The packet analysis device supports manually changing the allowed period range to improve the criteria for determining a legitimate routing device.

[0077] In this embodiment, in the OSPF Hello packet anomaly detection scenario, the legitimate routing devices of interest should periodically send OSPF Hello packets, while devices that send packets temporarily or in a short-term, high-frequency manner should be marked as illegitimate devices. Regarding the identification method, the packet analysis device, based on the periodically collected OSPF Hello packets, parses the source device (routing device) of each OSPF Hello packet, extracts the collection time corresponding to the OSPF Hello packets sent by all routing devices in the target link, determines the OSPF Hello packet sending period of each routing device in the target link based on the collection time and the corresponding routing device, and generates a target routing device identifier list based on the routing devices whose OSPF Hello packet sending periods are within a preset range.

[0078] In this embodiment, an independent routing protocol message analysis device is deployed in series on the link that needs to be monitored and protected. This device comprehensively receives and processes communication data targeting the routing device to be protected, analyzes the protocol type, extracts data related to the link, and implements risk message interception and handling based on the analysis results.

[0079] The technical solution of this embodiment obtains the total number of OSPF Hello packets in the target link within a target time and the total number of OSPF Hello packets sent by each routing device in the target link. If the total number of OSPF Hello packets in the target link within the target time is greater than or equal to a first value, and / or the total number of OSPF Hello packets sent by each routing device in the target link is greater than or equal to a second value corresponding to each routing device, then it is determined that the OSPF Hello packets in the target link are in an abnormal state. This can improve the efficiency and accuracy of OSPF Hello packet detection and avoid the situation where abnormal OSPF Hello packets affect network operation.

[0080] Example 2

[0081] Figure 3 This is a schematic diagram of a detection device provided in an embodiment of the present invention. This embodiment is applicable to OSPF Hello message detection. The device can be implemented using software and / or hardware, and can be integrated into any device that provides detection functionality, such as… Figure 3 As shown, the detection device specifically includes: an acquisition module 310 and a determination module 320.

[0082] The acquisition module is used to acquire the total number of OSPF Hello packets in the target link within the target time and the total number of OSPF Hello packets sent by each routing device in the target link.

[0083] The determination module is used to determine that the OSPF Hello packets in the target link are in an abnormal state if the total number of OSPF Hello packets in the target link within the target time is greater than or equal to a first value, and / or the total number of OSPF Hello packets sent by each routing device in the target link is greater than or equal to a second value corresponding to each routing device.

[0084] The above-described products can perform the methods provided in any embodiment of the present invention, and have the corresponding functional modules and beneficial effects for performing the methods.

[0085] Example 3

[0086] Figure 4A schematic diagram of an electronic device 10 that can be used to implement embodiments of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smartphones, wearable devices (e.g., helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0087] like Figure 4 As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12 or a random access memory (RAM) 13, communicatively connected to the at least one processor 11. The memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes based on the computer program stored in the ROM 12 or loaded from storage unit 18 into the RAM 13. The RAM 13 can also store various programs and data required for the operation of the electronic device 10. The processor 11, ROM 12, and RAM 13 are interconnected via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0088] Multiple components in electronic device 10 are connected to I / O interface 15, including: input unit 16, such as keyboard, mouse, etc.; output unit 17, such as various types of displays, speakers, etc.; storage unit 18, such as disk, optical disk, etc.; and communication unit 19, such as network card, modem, wireless transceiver, etc. Communication unit 19 allows electronic device 10 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0089] Processor 11 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 11 performs the various methods and processes described above, such as detection methods.

[0090] In some embodiments, the detection method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on electronic device 10 via ROM 12 and / or communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the detection method described above may be performed. Alternatively, in other embodiments, processor 11 may be configured to perform the detection method by any other suitable means (e.g., by means of firmware).

[0091] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0092] Computer programs used to implement the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0093] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0094] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0095] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or middleware components (e.g., application servers), or frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0096] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0097] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0098] This invention also provides a computer program product, including a computer program that, when executed by a processor, implements the detection method according to any embodiment of the invention.

[0099] In implementing the computer program product, computer program code for performing the operations of this invention can be written in one or more programming languages ​​or a combination thereof. Programming languages ​​include object-oriented programming languages ​​such as Java, Smalltalk, and C++, as well as conventional procedural programming languages ​​such as C or similar languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0100] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A detection method, characterized in that, The detection method is performed by an analysis device in a communication system, which includes multiple routing devices, wherein the analysis device is located on a target link to which the multiple routing devices belong, and the detection method includes: Obtain the total number of OSPF Hello packets in the target link within the target time period and the total number of OSPF Hello packets sent by each routing device in the target link; If the total number of OSPF Hello packets in the target link within the target time is greater than or equal to the first value, and / or the total number of OSPF Hello packets sent by each routing device in the target link is greater than or equal to the second value corresponding to each routing device, then the OSPF Hello packets in the target link are determined to be in an abnormal state.

2. The method according to claim 1, characterized in that, Before determining network malfunction, the following steps are taken before confirming network abnormality: If the total number of OSPF Hello packets on the target link within the target time is greater than or equal to the first value, and / or the total number of OSPF Hello packets sent by each routing device on the target link is greater than or equal to the second value corresponding to each routing device. If the current network is in a stable operating state, the first value is determined based on the total number of historical OSPF Hello messages in the target link. If all routing devices in the target link are in the target routing device identifier list, the second value corresponding to each routing device is determined based on the total number of historical OSPF Hello messages sent by the routing devices in the target link. If there are routing devices in the target link that are not in the target routing device identifier list, a preset value is obtained and used as the second value corresponding to the routing devices that are not in the target routing device identifier list.

3. The method according to claim 2, characterized in that, Also includes: Get the total number of OSPF Hello packets in the target link within multiple consecutive periods; A preset number of adjacent cycles are merged to obtain multiple merged cycles; If the difference in the total number of OSPF Hello packets in the target link corresponding to adjacent merging cycles is less than the first difference threshold, and the difference in the total number of OSPF Hello packets in the target link within the corresponding period in adjacent merging cycles is less than the second difference threshold, then the current network is determined to be in a stable operating state.

4. The method according to claim 1, characterized in that, Also includes: If the total number of OSPF Hello packets in the target link within the target time is less than the first value, and the total number of OSPF Hello packets sent by each routing device in the target link is less than the second value, then the OSPF Hello packets in the target link are determined to be in a normal state.

5. The method according to claim 1, characterized in that, After the OSPF Hello message in the target link is in an abnormal state, it also includes: Based on the target routing device identifier list, OSPF Hello packets in the target link are filtered; Based on the filtered OSPF Hello messages, generate alarm information; Based on the target routing device identifier list, OSPF Hello packets in the target link are filtered, including: OSPF Hello packets originating from routing devices outside the target routing device identifier list will be dropped on the target link.

6. The method according to claim 4, characterized in that, Retrieve the target routing device identifier list, including: Obtain the collection time corresponding to the OSPF Hello messages sent by all routing devices in the target link; Based on the collection time and the corresponding routing device, determine the OSPFHello message sending period of each routing device in the target link; Generate a list of target routing device identifiers based on the routing devices whose OSPF Hello message sending cycle is within a preset range.

7. A detection device, characterized in that, An analysis device configured in a communication system, the communication system comprising: multiple routing devices, the analysis device being located on a target link to which the multiple routing devices belong, the detection device comprising: The acquisition module is used to acquire the total number of OSPF Hello packets in the target link within the target time and the total number of OSPF Hello packets sent by each routing device in the target link. The determination module is used to determine that the OSPF Hello packets in the target link are in an abnormal state if the total number of OSPF Hello packets in the target link within the target time is greater than or equal to a first value, and / or the total number of OSPF Hello packets sent by each routing device in the target link is greater than or equal to a second value corresponding to each routing device.

8. An electronic device, characterized in that, The electronic device includes: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the detection method according to any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that cause a processor to execute the detection method according to any one of claims 1-6.

10. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, implements the detection method according to any one of claims 1-6.

Images