Network management and control method and device and electronic equipment

Abstract

The invention relates to a network management and control method and device and electronic equipment, and the method comprises the steps: obtaining target data information in real time from an authentication, authorization and accounting (AAA) server, the target data information comprising ticket messages generated by each communication behavior of N users, and N being a positive integer; link identifiers of M physical links and account identifiers of the N users are analyzed from ticket messages generated by each communication behavior of the N users, and M is a positive integer; integrating the account identifiers associated with the same link identifier in a preset time window, and determining the number of accounts logged in each physical link; and when the number of the accounts logged in the physical link is greater than a preset threshold, triggering a preset management and control event. According to the method, the real-time performance from data acquisition, analysis to management and control is realized, the behavior of'one-user multi-dialing 'can be quickly found, and the time difference from behavior occurrence to disposal is shortened.

Description

Technical Field

[0001] This invention relates to the field of communication technology, and in particular to a network management method, apparatus, and electronic device. Background Technology

[0002] In existing fixed-line networks, "multiple dial-up connections per user" often occur, meaning multiple broadband accounts log in within a short period on the same physical line. This behavior is frequently used to illegally operate Peer-to-Peer Content Delivery Network (PCDN) services, profiting from bandwidth aggregation. This not only consumes a large amount of network resources and degrades the user experience for other users, but also poses potential security risks. Existing network management methods for addressing this behavior largely rely on offline batch log analysis. This method periodically collects network login logs over a period of time, centrally analyzing login records for accounts on the same physical link to determine if "multiple dial-up connections per user" occurs within a short period. However, this method requires waiting for a certain amount of logs to accumulate before centralized processing, rather than receiving and analyzing data in real time. Therefore, there is a time lag between the occurrence and detection of the behavior, resulting in low real-time performance. Summary of the Invention

[0003] The present invention aims to provide a network management method, device and electronic device to overcome the shortcomings of the prior art. The technical problem to be solved by the present invention is achieved through the following technical solutions.

[0004] According to a first aspect of this disclosure, a network control method is provided, the method comprising: The target data information is obtained in real time from the Authentication, Authorization and Accounting (AAA) server. The target data information includes call detail records (CDRs) generated by each communication behavior of N users, where N is a positive integer. Parse the link identifiers of M physical links and the account identifiers of the N users from the call detail records (CDRs) generated by each communication behavior of the N users, where M is a positive integer; Integrate account identifiers associated with the same link identifier within a preset time window to determine the number of accounts logged in on each physical link; If the number of accounts logged in on a physical link exceeds a preset threshold, a preset control event will be triggered.

[0005] Furthermore, the step of obtaining target data information in real time from the Authentication, Authorization, and Accounting (AAA) server includes: The target data information is obtained in real time from the data collection agent at the AAA server through the message middleware.

[0006] Further, the step of parsing the link identifiers of M physical links and the account identifiers of the N users from the call detail records (CDRs) generated from each communication action of the N users includes: A stream processing engine is used to parse the link identifiers of M physical links and the account identifiers of the N users from the call detail records (CDRs) generated by each communication behavior of the N users.

[0007] Furthermore, the triggering of a preset control event when the number of accounts logged in on a physical link exceeds a preset threshold includes: If the number of accounts logged in on a physical link exceeds a preset threshold, the accounts logged in on the target physical link are added to the monitoring user pool. The target physical link is the physical link where the number of logged-in accounts exceeds the preset threshold. Obtain peer-to-peer content delivery network (PCDN) traffic data information on the target physical link; Based on the PCDN traffic data information, determine whether there is a violation event on the target physical link; If a violation occurs on the target physical link, an alarm work order corresponding to the monitoring user pool is generated and output.

[0008] Furthermore, the triggering of a preset control event when the number of accounts logged in on a physical link exceeds a preset threshold includes: If the number of accounts logged in on a physical link exceeds a preset threshold, the link port of the target physical link will be rate-limited or temporarily shut down. The target physical link is the physical link where the number of logged-in accounts exceeds the preset threshold.

[0009] Furthermore, the message middleware is Apache Kafka, and / or the stream processing engine is Spark Streaming.

[0010] According to a second aspect of this disclosure, a network management and control device is provided, the device comprising: The first acquisition module is used to acquire target data information in real time from the Authentication, Authorization and Accounting (AAA) server. The target data information includes call detail records (CDRs) generated by N users for each communication behavior, where N is a positive integer. The first parsing module is used to parse the link identifiers of M physical links and the account identifiers of the N users from the call detail records (CDRs) generated by each communication behavior of the N users, where M is a positive integer; The first determination module is used to integrate account identifiers associated with the same link identifier within a preset time window to determine the number of accounts logged in on each physical link. The first triggering module is used to trigger a preset control event when the number of accounts logged in on a physical link exceeds a preset threshold.

[0011] According to a third aspect of this disclosure, an electronic device is provided. The electronic device includes a memory and a processor, wherein a computer program is stored on the memory, and the processor executes the computer program to implement the method.

[0012] According to a fourth aspect of this disclosure, a computer-readable storage medium is provided having a computer program stored thereon that, when executed by a processor, implements the method.

[0013] According to a fifth aspect of this disclosure, a computer program product is provided, including computer instructions that, when executed by a processor, implement the method.

[0014] The embodiments of the present invention have the following advantages: The network management and control method, apparatus, and electronic device provided in this invention include: acquiring target data information in real time from an Authentication, Authorization, and Accounting (AAA) server; the target data information includes call detail records (CDRs) generated by N users for each communication activity, where N is a positive integer; parsing link identifiers of M physical links and account identifiers of the N users from the CDRs generated by the N users for each communication activity, where M is a positive integer; integrating account identifiers associated with the same link identifier within a preset time window to determine the number of accounts logged in on each physical link; and triggering a preset management and control event when the number of accounts logged in on a physical link exceeds a preset threshold. This method acquires user communication CDRs in real time, parses physical link identifiers and account identifiers, counts the number of logged-in accounts on the same link within a preset time window, and triggers management and control when the number exceeds a preset threshold. Compared to traditional methods that rely on offline batch processing, it achieves real-time data acquisition, analysis, and management and control, enabling rapid detection of "one user, multiple dialing" behavior and shortening the time difference between the occurrence of the behavior and its handling. Attached Figure Description

[0015] Figure 1 This is one of the step flowcharts of an embodiment of the network management method of the present invention; Figure 2 This is a second flowchart of an embodiment of the network management method of the present invention; Figure 3 This is the third step in a flowchart of an embodiment of a network management method of the present invention; Figure 4 This is a schematic diagram of the structure of an embodiment of the network management and control device of the present invention; Figure 5 This is a schematic diagram of the structure of an electronic device according to the present invention. Detailed Implementation

[0016] It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other. The present invention will now be described in detail with reference to the accompanying drawings and embodiments.

[0017] Figure 1 A flowchart of a network control method 100 according to an embodiment of the present disclosure is shown. Specifically, the method 100 includes: S101. Obtain target data information in real time from the Authentication, Authorization and Accounting (AAA) server. The target data information includes call detail records (CDRs) generated by N users for each communication behavior, where N is a positive integer. In some embodiments, obtaining target data information in real time from the Authentication, Authorization, and Accounting (AAA) server includes: The target data information is obtained in real time from the data collection agent at the AAA server through the message middleware.

[0018] In the above embodiments, a user's communication behavior can be understood as the act of dialing in and out. In the network environment of a fixed-line operator, when a user dials in or out, it directly triggers the Broadband Remote Access Server (BRAS) device to interact with the backend Authentication, Authorization, and Accounting (AAA) server. During the interaction, corresponding authentication and accounting information is generated. This information is usually presented in the form of RADIUS protocol messages and is subsequently recorded by the AAA server to form a call detail record (CDR).

[0019] To achieve the goal of "real-time acquisition," this embodiment abandons the traditional method of exporting log files in batches after the fact. Instead, it deploys a data acquisition agent (such as Flume or Logstash) on the AAA server side. This data acquisition agent can capture newly generated call detail records (CDRs) from the AAA server in real time and push these CDRs as messages to a high-throughput distributed message middleware in real time.

[0020] In some embodiments, Apache Kafka can be used as the message middleware. As a high-performance, distributed, publish-subscribe messaging system, Kafka is well-suited for real-time data pipelines, handling data buffering and transmission between different system components. In this scenario, the AAA server's acquisition agent acts as the producer, sending each call detail record (CDR) message (e.g., a string containing user online information in JSON or CSV format) to a specific topic in the Kafka cluster.

[0021] In the above embodiments, the traditional post-event batch export mode is abandoned. By cooperating with data acquisition agents and message middleware, call detail records (CDRs) generated by user communications can be captured in real time, ensuring that data acquisition is synchronized with business activities and providing a foundation for subsequent real-time analysis and dynamic decision-making. With the help of high-throughput message middleware (such as Kafka), massive amounts of user CDRs can be buffered and transmitted efficiently, avoiding data congestion and adapting to the data flow requirements of high-frequency communication scenarios with N users.

[0022] S102. Parse the link identifiers of M physical links and the account identifiers of the N users from the call detail records (CDRs) generated by each communication behavior of the N users, where M is a positive integer; In some embodiments, parsing the link identifiers of M physical links and the account identifiers of the N users from the call detail records (CDRs) generated from each communication activity of the N users includes: A stream processing engine is used to parse the link identifiers of M physical links and the account identifiers of the N users from the call detail records (CDRs) generated by each communication behavior of the N users.

[0023] In the above embodiments, the user's account identifier can be the User-Name field, i.e., the user's broadband account; the link identifier is used to uniquely identify a physical link. To uniquely identify a physical link, information that can be located to the user's access physical port needs to be extracted. In practical applications of telecommunications networks, combining the IP address of the BRAS device (e.g., the NAS-IP-Address field) with the ID on the BRAS device used to identify the user's physical port (e.g., the NAS-PORT-ID field) can form a highly accurate unique identifier for the physical link. Therefore, the link identifier in this embodiment can be defined as a string concatenated from BRASIP and NASPORTID.

[0024] In this embodiment, the execution entity can be a Kafka consumer, which will pull (or subscribe to) newly generated call detail records (CDRs) from the aforementioned topic in real time. Since these messages form a continuous stream, a powerful stream processing engine is required for processing.

[0025] In some embodiments, the Spark Streaming module in the Apache Spark framework can be used as the stream processing engine. This module can process real-time data streams in a micro-batch manner, possessing efficient and fault-tolerant stream computing capabilities. When the Spark Streaming application receives a batch of call detail record (CDR) messages, it parses each message. A typical CDR message (especially the "Start" message when a user comes online) usually contains rich field information. The aforementioned field information includes the physical link identifier and the user's account identifier.

[0026] In the above embodiments, by leveraging the efficient processing capabilities of the stream processing engine, massive amounts of call detail records (CDRs) can be parsed in real time, quickly extracting physical link identifiers and user account identifiers. This adapts to the real-time data processing needs of high-frequency communication scenarios involving N users, avoiding the latency issues of traditional batch processing. Furthermore, stream processing engines (such as Spark Streaming) possess fault tolerance and stability, ensuring that data is not lost or duplicated during parsing, guaranteeing the accuracy of link and account identifiers, and providing a reliable foundation for subsequent correlation analysis between users and physical links.

[0027] S103. Integrate the account identifiers associated with the same link identifier within the preset time window to determine the number of accounts logged in on each physical link. In the above embodiment, after obtaining a series of account information containing link identifiers, the next step is to count the number of different user accounts that are active under the same link identifier. This step can be completed by the Spark Streaming engine. Spark Streaming provides a rich set of stateful stream processing operators (such as updateStateByKey and mapWithState), which support maintaining the corresponding state for each key during stream processing. In this embodiment, the key is the "link identifier".

[0028] The specific processing logic is as follows: The stream processing engine maintains a state table, where the keys are link identifiers and the values ​​are data structures used to store all active accounts associated with that link and the current total number of active accounts. For example, the value can be an object containing a set of accounts and a count value (i.e., the number of accounts mentioned above) (Integer).

[0029] When a new online call detail record (CDR) message (link_id_X, user_account_N) is received, the specific processing logic is as follows: 1. Check the status table to see if an entry exists with the key link_id_X; 2. If the entry exists, retrieve the corresponding state object, add user_account_N to the account set (due to the characteristics of the set, adding the same account repeatedly will not change the contents of the set), and then update the count value to the current size of the set; 3. If the entry does not exist, create a new state object for link_id_X, add user_account_N to the new account set, and set the count value to 1.

[0030] To manage state lifecycles and adapt to business needs, the above aggregation and counting operations need to be performed within one or more "preset time windows," which can be achieved through Spark Streaming's window operations.

[0031] The preset time window can be implemented in the following two ways: 1. For example, a window with a length of 1 day and a sliding interval of 1 hour can be defined. This means that the system will continuously calculate the number of active accounts for each link in the past 24 hours and update the results every hour.

[0032] 2. Daily and monthly windows can be defined according to business needs to count the cumulative number of accounts launched for each link on the same day and in the same month.

[0033] The output of this step is a new data stream containing (link_id, account_count), which is each link identifier and the number of active accounts corresponding to it.

[0034] S104. If the number of accounts logged in on a physical link exceeds a preset threshold, a preset control event is triggered.

[0035] In some embodiments, triggering a preset control event when the number of accounts logged in on a physical link exceeds a preset threshold includes: If the number of accounts logged in on a physical link exceeds a preset threshold, the accounts logged in on the target physical link are added to the monitoring user pool. The target physical link is the physical link where the number of logged-in accounts exceeds the preset threshold. Obtain peer-to-peer content delivery network (PCDN) traffic data information on the target physical link; Based on the PCDN traffic data information, determine whether there is a violation event on the target physical link; If a violation occurs on the target physical link, an alarm work order corresponding to the monitoring user pool is generated and output.

[0036] This step filters and judges the (link_id, account_count) data stream output from step S103. The system can pre-configure one or more account count thresholds. For example, based on the operator's policy, the multi-call threshold for ordinary household users can be set to 2. When the stream processing engine receives a record (link_id_X, 5), it compares its count value 5 with the preset threshold 2. Since 5 > 2, the judgment result is "yes".

[0037] Once the number of active accounts on a particular connection exceeds a threshold, it indicates a suspected "one account, multiple connections" violation has been detected. At this point, the system needs to trigger a pre-set control event to initiate subsequent processing.

[0038] In the above embodiments, a preset control event can be achieved by sending the record (containing detailed information such as the link identifier, the number of accounts exceeding the limit, and a list of associated user accounts) to another dedicated Kafka topic, referred to as an "event topic" or "alarm topic." Downstream business systems or control platforms can subscribe to this event topic. Upon receiving a new event message, various automated or semi-automated control operations can be performed, for example: All user accounts associated with this link are automatically added to a "high-priority monitoring" or "suspected violation" user pool. Then, another analysis task is triggered to retrieve recent Peer-to-Peer Content Delivery (PCDN) traffic data for this link, perform cross-referencing, and further confirm whether it is engaging in unauthorized business activities. If it is determined that this link is engaging in unauthorized business activities, an alarm ticket can be generated through the operations and maintenance system to notify network engineers to investigate.

[0039] In this embodiment, high-risk physical links are filtered by preset thresholds to accurately identify accounts that need to be monitored and reduce invalid monitoring; violations are judged by combining PCDN traffic data to improve the accuracy of identification; alarm work orders are generated for links that are confirmed to be in violation, realizing closed-loop management from anomaly discovery to problem handling, which not only improves the efficiency of combating violations but also reduces the cost of manual intervention and can promptly curb violations.

[0040] In some embodiments, triggering a preset control event when the number of accounts logged in on a physical link exceeds a preset threshold includes: If the number of accounts logged in on a physical link exceeds a preset threshold, the link port of the target physical link will be rate-limited or temporarily shut down. The target physical link is the physical link where the number of logged-in accounts exceeds the preset threshold.

[0041] In the above embodiments, rate limiting can be understood as reducing network speed, and temporary shutdown can be understood as cutting off network connection. When the number of user accounts logged in on a certain physical link exceeds a preset threshold, measures such as reducing network speed or cutting off network connection are taken for the physical port corresponding to that link.

[0042] In this embodiment, by implementing rate limiting or temporary shutdown on target physical link ports where the number of accounts exceeds a threshold, the excessive occupation of network resources by abnormal links can be quickly curbed, preventing bandwidth congestion from affecting other users. At the same time, it can promptly block potential violations (such as batch sharing of accounts, malicious access, etc.), reducing network security risks. This targeted control avoids interference with normal links, ensuring stable network operation while improving the efficiency of handling violations.

[0043] Furthermore, throughout the entire process, all intermediate and final analysis results (such as the identifiers of each link and their associated account lists, daily / monthly account counts, etc.) can be persistently stored in the database. NoSQL databases such as MongoDB can be used. Because MongoDB's document model is well-suited for flexible semi-structured data, it facilitates subsequent complex queries, statistical analysis, and user profile building.

[0044] See Figure 2 Kafka message middleware, acting as a data access and distribution hub, is responsible for receiving AAA call detail record (CDR) messages and distributing them in a distributed manner. It provides a stable and efficient raw data input channel for subsequent real-time processing, supporting reliable transmission of large-scale messages. Spark Streaming, the core data processing engine of the solution, performs real-time stream processing on the CDR messages distributed by Kafka. Its core functions include parsing messages to extract link information (BRASIP + NASPORTID) and user account information, and counting the number of accounts on the same link within a daily / monthly period. This is a key technical support for achieving real-time identification.

[0045] MongoDB serves as a data storage medium for persistently storing critical data generated after Spark Streaming processing. This includes account information corresponding to the same link, statistics on the number of accounts on the same link, etc., providing stable data storage support for subsequent threshold judgments (such as whether the number of accounts exceeds the set standard), data queries, and front-end display.

[0046] See Figure 3First, the system reads Kafka call detail records (CDRs). Then, it parses the link identifier and account identifier from the CDRs. Based on MongoDB (a NoSQL database) as described in the documentation, it appends the extracted user account information and corresponding link identifier information to a periodic line information table for the current day or month. This achieves cumulative storage of account data for the same link within a specified time range, laying the data foundation for subsequent account count statistics. After the database update is complete, it counts the total number of user accounts associated with the current link within a set period (day / month). If the threshold is met (i.e., the number of accounts on the same link exceeds a preset standard), an event handling mechanism is triggered. First, the information of multiple accounts on the same link is written to the data pool, and then the user's PCDN information is associated to create a user profile. If the threshold is not met, subsequent control operations are not triggered, and the process directly leads to the data persistence stage. Regardless of whether threshold control is triggered, the process ultimately enters the stage of persisting user information to the database for front-end display or data distribution. Here, the processed link account data, user profile results, and other key information are persistently stored in the database. On the one hand, this supports real-time querying of the front-end display module deployed with Spring Cloud technology, and on the other hand, it provides data distribution support for possible user management in the future (such as inclusion in the management pool).

[0047] According to embodiments of this disclosure, target data information is obtained in real time from an Authentication, Authorization, and Accounting (AAA) server. This target data information includes call detail records (CDRs) generated by N users for each communication activity, where N is a positive integer. Link identifiers of M physical links and account identifiers of the N users are parsed from the CDRs generated by each of the N users' communication activities, where M is a positive integer. Account identifiers associated with the same link identifier within a preset time window are integrated to determine the number of accounts logged in on each physical link. If the number of accounts logged in on a physical link exceeds a preset threshold, a preset control event is triggered. In this embodiment, by obtaining user communication CDRs in real time, parsing physical link identifiers and account identifiers, and counting the number of logged-in accounts on the same link within a preset time window, control is triggered when the number exceeds a preset threshold. Compared to traditional methods relying on offline batch processing, this achieves real-time data acquisition, analysis, and control, enabling rapid detection of "one user, multiple dialing" behavior and shortening the time lag between the occurrence of the behavior and its handling.

[0048] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that this disclosure is not limited to the described order of actions, because according to this disclosure, some steps can be performed in other orders or simultaneously. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are all optional embodiments, and the actions and modules involved are not necessarily essential to this disclosure.

[0049] The above is an introduction to the method embodiments. The following describes the solution described in this disclosure further through device embodiments.

[0050] Figure 4 A block diagram of a network management device 400 according to an embodiment of the present disclosure is shown. The device 400 includes: The first acquisition module 401 is used to acquire target data information in real time from the Authentication, Authorization and Accounting (AAA) server. The target data information includes call detail records (CDRs) generated by N users for each communication behavior, where N is a positive integer. The first parsing module 402 is used to parse the link identifiers of M physical links and the account identifiers of the N users from the call detail records (CDRs) generated by each communication behavior of the N users, where M is a positive integer; The first determining module 403 is used to integrate account identifiers associated with the same link identifier within a preset time window and determine the number of accounts logged in on each physical link. The first trigger module 404 is used to trigger a preset control event when the number of accounts logged in on a physical link exceeds a preset threshold.

[0051] Further, the first acquisition module includes: The first acquisition unit is used to acquire target data information in real time from the data acquisition agent at the AAA server through message middleware.

[0052] Furthermore, the first parsing module includes: The first parsing unit is used to parse the link identifiers of M physical links and the account identifiers of the N users from the call detail records (CDRs) generated by each communication behavior of the N users using a stream processing engine.

[0053] Furthermore, the first triggering module includes: The first adding unit is used to add the accounts logged in on the target physical link to the monitoring user pool when the number of accounts logged in on the physical link is greater than a preset threshold. The target physical link is the physical link where the number of logged-in accounts is greater than the preset threshold. The second acquisition unit is used to acquire peer-to-peer content delivery network (PCDN) traffic data information on the target physical link. The first judgment unit is used to determine whether there is a violation event on the target physical link based on the PCDN traffic data information; The first generation unit is used to generate an alarm work order corresponding to the monitoring user pool when there is a violation event on the target physical link, and output the alarm work order.

[0054] Furthermore, the first triggering module includes: The first processing unit is used to limit the speed or temporarily shut down the link port of a target physical link when the number of logged-in accounts on a physical link exceeds a preset threshold. The target physical link is the physical link where the number of logged-in accounts exceeds the preset threshold.

[0055] Furthermore, the message middleware is Apache Kafka, and / or the stream processing engine is Spark Streaming.

[0056] Figure 5 This example illustrates a schematic diagram of the physical structure of an electronic device, which can be a smart terminal. Its internal structure diagram can be as follows: Figure 5 As shown, the electronic device includes a processor, memory, and a network interface connected via a system bus. The processor provides computing and control capabilities. The memory includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The network interface is used to communicate with external terminals via a network connection. When the computer program is executed by the processor, it implements the aforementioned network management method.

[0057] On the other hand, the present invention also provides a computer storage medium storing a computer program, which, when executed by a processor, implements the above-described network management method.

[0058] In another aspect, a computer program product or computer program is provided, which includes computer instructions stored in a computer-readable storage medium. A processor of an electronic device reads the computer instructions from the computer-readable storage medium, and when the processor executes the computer instructions, it implements the aforementioned network control method.

[0059] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. This computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments of the methods described above. Any references to memory, storage, databases, or other media used in the embodiments provided by this invention can include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory may include random access memory (RAM) or external cache memory.

[0060] By way of illustration and not limitation, Random Access Memory (RAM) is available in a variety of forms, such as Static RAM (SRAM), Dynamic RAM (DRAM), Synchronous DRAM (SDRAM), Double Data Rate SDRAM (DDRSDRAM), Enhanced SDRAM (ESDRAM), Synchlink DRAM (SLDRAM), Rambus Direct RAM (RDRAM), Direct Rambus Dynamic RAM (DRDRAM), and Rambus Dynamic RAM (RDRAM), etc.

[0061] It should be noted that the above detailed descriptions are exemplary and intended to provide further explanation of this application. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains.

[0062] It should be noted that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the exemplary embodiments according to this application. As used herein, the singular form is intended to include the plural form as well, unless the context clearly indicates otherwise. Furthermore, it should be understood that when the terms "comprising" and / or "including" are used in this specification, they indicate the presence of features, steps, operations, devices, components, and / or combinations thereof.

[0063] It should be noted that the terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such terms can be used interchangeably where appropriate so that the embodiments of this application described herein can be implemented in sequences other than those illustrated or described herein.

[0064] Furthermore, the terms “comprising” and “having”, and any variations thereof, are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or apparatus that includes a series of steps or units is not necessarily limited to those steps or units that are explicitly listed, but may include other steps or units that are not explicitly listed or that are inherent to such process, method, product, or apparatus.

[0065] For ease of description, spatial relative terms such as "above," "on top of," "on the upper surface of," "above," etc., are used herein to describe the spatial positional relationship of a device or feature as shown in the figures to other devices or features. It should be understood that spatial relative terms are intended to encompass different orientations in use or operation beyond the orientation of the device as described in the figures. For example, if the device in the figures were inverted, a device described as "above" or "on top of" other devices or structures would subsequently be positioned as "below" or "under" other devices or structures. Thus, the exemplary term "above" can include both "above" and "below." The device may also be positioned in other different ways, such as rotated 90 degrees or in other orientations, and the spatial relative descriptions used herein will be interpreted accordingly.

[0066] In the detailed description above, reference has been made to the accompanying drawings, which form part of this document. In the drawings, similar symbols typically identify similar parts unless the context otherwise indicates otherwise. The illustrated embodiments described in the detailed specification, drawings, and claims are not intended to be limiting. Other embodiments may be used and other changes may be made without departing from the spirit or scope of the subject matter presented herein.

[0067] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A network management method, characterized by, The method comprises: real-time acquisition of target data information from an authentication, authorization and accounting (AAA) server, the target data information comprising billing messages generated by each communication behavior of N users, wherein N is a positive integer; resolution of link identifiers of M physical links and account identifiers of the N users from the billing messages generated by each communication behavior of the N users, wherein M is a positive integer; integration of account identifiers associated with the same link identifier within a preset time window to determine the number of accounts logged on each physical link; triggering of a preset control event in the case where the number of accounts logged on a physical link is greater than a preset threshold.

2. The network management method of claim 1, wherein, The real-time acquisition of target data information from the AAA server comprises: real-time acquisition of target data information from a data collection agent of the AAA server through a message middleware.

3. The network management method of claim 2, wherein, The resolution of link identifiers of M physical links and account identifiers of the N users from the billing messages generated by each communication behavior of the N users comprises: resolution of link identifiers of M physical links and account identifiers of the N users from the billing messages generated by each communication behavior of the N users by using a stream processing engine.

4. The network management method of claim 1, wherein, The triggering of a preset control event in the case where the number of accounts logged on a physical link is greater than a preset threshold comprises: in the case where the number of accounts logged on a physical link is greater than a preset threshold, adding accounts logged on a target physical link, which is a physical link with the number of accounts logged thereon greater than the preset threshold, to a monitoring user pool; acquisition of peer content distribution network (PCDN) traffic data information on the target physical link; determination of whether the target physical link has a violation event based on the PCDN traffic data information; in the case where the target physical link has a violation event, generation of an alarm work order corresponding to the monitoring user pool and output of the alarm work order.

5. The network management method of claim 1, wherein, The triggering of a preset control event in the case where the number of accounts logged on a physical link is greater than a preset threshold comprises: in the case where the number of accounts logged on a physical link is greater than a preset threshold, speed limiting or temporary shutdown of a link port of a target physical link, which is a physical link with the number of accounts logged thereon greater than the preset threshold.

6. The network management method of claim 3, wherein, The message middleware is Apache Kafka, and / or the stream processing engine is Spark Streaming.

7. A network management device, characterized by comprising: The apparatus comprises: a first acquisition module configured to acquire target data information from an authentication, authorization and accounting (AAA) server in real time, the target data information comprising billing messages generated by each communication behavior of N users, wherein N is a positive integer; a first resolution module configured to resolve link identifiers of M physical links and account identifiers of the N users from the billing messages generated by each communication behavior of the N users, wherein M is a positive integer; a first determination module configured to integrate account identifiers associated with the same link identifier within a preset time window to determine the number of accounts logged on each physical link; The first triggering module is configured to trigger a preset management and control event when the number of accounts logged on the physical link is greater than a preset threshold.

8. An electronic device, comprising: A computer program product comprising a processor, a memory, and a computer program stored on the memory and executable on the processor, the computer program, when executed by the processor, implements the steps of the network management method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, A computer program product comprising a processor, a memory, and a computer program stored on the memory and executable on the processor, the computer program, when executed by the processor, implements the steps of the network management method according to any one of claims 1 to 6.

10. A computer program product, characterised in that, A computer program product comprising a processor, a memory, and a computer program stored on the memory and executable on the processor, the computer program, when executed by the processor, implements the steps of the network management method according to any one of claims 1 to 6.

Images