Network traffic prediction method and device, electronic equipment and storage medium

Abstract

The invention discloses a network traffic prediction method and device, electronic equipment and a storage medium. The method comprises the following steps: acquiring at least one network event in an effective state in a target time period; determining the predicted traffic of each network event in the target time period according to the associated information of each network event; determining participant overlapping information and combined influence information of each network event according to the associated information of each network event; determining a combined offset type and corresponding offset information of each network event according to the participant overlapping information and the combined influence information of each network event; and according to the combined offset type of each network event and the corresponding offset information, correcting the accumulated value of the predicted traffic of each network event in the target time period to obtain the target traffic. The embodiment of the invention can improve the accuracy of flow detection and ensure the stability of a network system.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of artificial intelligence, and in particular to a network traffic prediction method and device, electronic equipment and storage medium. BACKGROUND

[0002] With the development of network technology, the number of users using mobile banking is increasing.

[0003] In order to provide stable network services to users, the bank system needs to configure a proper number of servers for the user group to provide online banking services. Some events occurring at certain times usually cause a surge in the number of user service requests, leading to network traffic overload, and further causing the bank system to collapse, and users cannot normally use bank service functions. SUMMARY

[0004] The present application provides a network traffic prediction method, device, electronic equipment and storage medium, which can improve traffic detection accuracy and ensure network system stability.

[0005] According to an aspect of the present application, a network traffic prediction method is provided, the method comprising:

[0006] acquiring at least one network event in an effective state in a target time period;

[0007] determining the predicted traffic of each network event in the target time period according to the association information of each network event;

[0008] determining the participant overlap information and combined influence information of each network event according to the association information of each network event;

[0009] determining the combined offset type and corresponding offset information of each network event according to the participant overlap information and combined influence information of each network event;

[0010] correcting the cumulative value of the predicted traffic of each network event in the target time period according to the combined offset type and corresponding offset information of each network event, to obtain the target traffic.

[0011] According to another aspect of the present application, a network traffic prediction device is provided, the device comprising:

[0012] an event acquisition module for acquiring at least one network event in an effective state in a target time period;

[0013] a single traffic prediction module for determining the predicted traffic of each network event in the target time period according to the association information of each network event;

[0014] An overlap influence determining module is configured to determine participant overlap information and combined influence information of each network event according to the association information of each network event;

[0015] An offset calculating module is configured to determine a combined offset type and corresponding offset information of each network event according to the participant overlap information and combined influence information of each network event;

[0016] A flow correction module is configured to correct an accumulated value of the predicted flow of each network event in the target time period according to the combined offset type and corresponding offset information of each network event, to obtain a target flow.

[0017] According to another aspect of the present application, an electronic device is provided, which comprises:

[0018] at least one processor; and

[0019] a memory connected with the at least one processor in communication; wherein,

[0020] the memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor to enable the at least one processor to perform the network flow prediction method according to any one of the embodiments of the present application.

[0021] According to another aspect of the present application, a computer readable storage medium is provided, which stores computer instructions for enabling a processor to perform the network flow prediction method according to any one of the embodiments of the present application when executed by the processor.

[0022] The technical solution of the embodiments of the present application determines the flow generated by each individual network event in the target time period according to the association information of the effective network events in the target time period, and corrects the accumulated value of the predicted flow of each network event based on the participant overlap information and combined influence information of the network event, to obtain the target flow in the target time period, which can accurately predict the flow generated by the network event in the target time period, so that the server processing flow can be configured in advance according to the flow, the problem of network overload caused by network flow surge in the prior art can be solved, the flow can be predicted in advance to avoid system overload, and the flow can be corrected in view of the mutual influence and superposition effect between different events, which can improve the flow accuracy.

[0023] It should be understood that the content described in this part is not intended to identify key or important features of the embodiments of the present application, nor to limit the scope of the present application. Other features of the present application will become apparent from the following description. BRIEF DESCRIPTION OF DRAWINGS

[0024] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0025] Figure 1 This is a flowchart of a network traffic prediction method provided according to an embodiment of the present invention;

[0026] Figure 2 This is a flowchart of another network traffic prediction method provided according to an embodiment of the present invention;

[0027] Figure 3 This is a schematic diagram of the structure of a network traffic prediction device according to an embodiment of the present invention;

[0028] Figure 4 This is a schematic diagram of the structure of an electronic device that implements the network traffic prediction method of this invention. Detailed Implementation

[0029] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0030] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0031] In the technical solutions of this invention, the acquisition, storage, and application of network event association information and participant overlap information all comply with relevant laws and regulations and do not violate public order and good morals.

[0032] Figure 1This is a flowchart illustrating a network traffic prediction method provided in an embodiment of the present invention. This embodiment is applicable to situations where traffic caused by future network events needs to be predicted. The method can be executed by a network traffic prediction device, which can be implemented in hardware and / or software and can be configured in an electronic device. The electronic device can be a server, such as a server in a banking system.

[0033] See Figure 1 The network traffic prediction method shown includes:

[0034] S101. Obtain at least one network event that is valid during the target time period.

[0035] The target time period can refer to a future time period after the current time. A network event that is valid within the target time period indicates that the network event will occur within that future target time period. For example, if the current time is September 1st, the network event could be an event that occurs on September 10th. A network event can refer to an event that occurs on the network. In some embodiments, a network event can refer to an event that the mobile banking system plans to occur within a future time period. Users can participate in network events through the mobile banking system; specifically, users can send requests to the network event interface, browse network events, initiate participation requests, and perform participation operations. In some embodiments, a network event can be an event that generates a transaction request within the banking system.

[0036] S102. Based on the association information of each network event, determine the predicted traffic of each network event in the target time period.

[0037] The association information of network events is used to determine the traffic generated by the network events. In some embodiments, the association information may include the type of event, the time of occurrence of the event, and its duration. For example, the association information may include the type of users involved in the event. Alternatively, the association information may include the traffic generated by similar events within a historical time period. Predicted traffic may refer to the number of requests related to the network event during a target time period. The association information can be processed based on a pre-trained traffic detection model to output predicted traffic. The target time period may be divided into at least one sub-time period, and the predicted traffic may include the predicted traffic for each sub-time period.

[0038] S103. Based on the association information of each network event, determine the participant overlap information and combined influence information of each network event.

[0039] Participant overlap information refers to the overlapping range of participants in different network events. Combined impact information refers to the traffic impact between different network events; typically, combined impact information includes the direction and degree of impact. The direction of impact refers to the direction of traffic increase or decrease. The degree of impact refers to the quantified value of traffic change. The direction of impact can be positive, negative, or no impact. A positive impact means that two network events have a synergistic effect on each other's traffic, i.e., the total traffic when the two network events occur simultaneously is greater than the sum of the traffic when each network event occurs. A negative impact means that two network events have an inhibitory effect on each other's traffic, i.e., the total traffic when the two network events occur simultaneously is less than the sum of the traffic when each network event occurs. No impact means that two network events have no effect on each other's traffic, i.e., the total traffic when the two network events occur simultaneously is equal to the sum of the traffic when each network event occurs.

[0040] Based on the participant identifiers in the association information of each network event, it can be determined whether there are overlapping participants between any two network events. Based on the association information of network events with overlapping participants, the combined impact information of these network events can be determined. Combined impact information of historical events, as well as the association information of each historical event, can be obtained. The mapping relationship between the association information and the combined impact information can be extracted, and the combined impact information of these network events can be determined based on the mapping relationship and the association information of network events with overlapping participants. Alternatively, an impact detection model for combined impact information can be trained based on the combined impact information of historical events and the association information of each historical event. The association information of network events with overlapping participants can be input into the trained impact detection model, and the combined impact information of these network events can be output.

[0041] S104. Based on the participant overlap information and combined influence information of each network event, determine the combined offset type and corresponding offset information of each network event.

[0042] In this context, a combined offset type can refer to the direction of influence of multiple network events that affect each other's traffic. The offset information corresponding to a combined offset type can indicate the degree of influence of that combined offset type.

[0043] In some embodiments, mutually influencing network events can be identified based on participant overlap information of each network event. The direction and extent of influence of the mutually influencing network events can be determined based on combined influence information. The direction and extent of influence on a network event can be determined based on participant overlap information and combined influence information, thereby determining the combined offset type and corresponding offset information of the network event.

[0044] S105. Based on the combined offset type and corresponding offset information of each network event, the cumulative value of the predicted traffic of each network event in the target time period is corrected to obtain the target traffic.

[0045] The cumulative value of predicted traffic can be the simple sum of the predicted traffic of different network events. By combining the offset type and corresponding offset information to correct the cumulative value, the traffic offset information resulting from the mutual influence between network events is compensated into the total traffic value. This ensures that the calculated target traffic is an accurate value obtained based on the superposition effect between network events.

[0046] The technical solution of this invention determines the traffic generated by each individual network event in the target time period based on the correlation information of valid network events in the target time period. It then corrects the cumulative value of the predicted traffic for each network event based on the parameters, overlap information, and combined influence information of the network events, thus obtaining the target traffic for the target time period. This allows for accurate prediction of the traffic generated by network events in the target time period, enabling the configuration of traffic processing servers in advance. This solves the problem of network overload caused by surges in network traffic in existing technologies, allowing for advance traffic prediction and avoiding system overload. Furthermore, by correcting the traffic for the mutual influence and superposition effects between different events, the accuracy of the traffic prediction can be improved.

[0047] In an optional embodiment, determining the predicted traffic of each network event in the target time period based on the association information of each network event includes: inputting the association information of each network event into a pre-trained traffic detection model to obtain the predicted traffic of each network event in the target time period, wherein the association information includes event attribute information, participation information, time sequence information, dependent resource information, and environmental information.

[0048] The event attribute information refers to information about the network event itself. Event attribute information may include: activity type, activity duration, activity cost, and activity delivery method (application, SMS, or platform). Event attribute information is typically configured by staff and serves as metadata for the network event. Participation information refers to information about the participants in the network event. Participation information may include: attribute information and characteristics of the user group to which the network event is applicable, information of users who have scheduled participation in the network event, and information about participants in similar historical network events. Participation information can be obtained from user-authorized features and from data collected from historical network events. Time-series information refers to the temporal characteristics of the network event. Time-series information may include: the start time, end time, included time type (e.g., weekday or holiday), duration, traffic changes over a period prior to the network event (e.g., traffic and slope over the past hour and past three hours), and historical traffic during the same period. Time-series information can be obtained from historical monitoring data. Dependency resource information refers to information about the resources provided to the network event. Dependency resource information includes: resource utilization parameters of network events (CPU utilization, memory usage, and thread pool utilization), current load status, cache hit rate, cluster load parameters, and network bandwidth utilization. Dependency resource information can be obtained through performance monitoring systems or database and monitoring systems. Environmental information refers to the environmental information of the scenario in which the network event occurs. Environmental information can include network environment, physical environment, and event environment. For example, the network environment can refer to different types of events occurring on the network, such as social events or entertainment events. The physical environment can refer to the weather. The event environment can refer to information about similar events occurring on the network. Environmental information can be obtained through external server interfaces or monitoring systems.

[0049] The associated information of a network event can be arranged and concatenated to form the input data for that network event. This input data is then fed into a traffic detection model, which processes the data and outputs the predicted traffic for each event. In some embodiments, the traffic detection model extracts features from the associated information of each network event to obtain feature values. In at least one pre-trained decision tree, a branch is selected based on the feature values, ultimately falling into a leaf node. The traffic value of the leaf node is then obtained. The traffic values ​​of the leaf nodes in each decision tree are weighted and summed to obtain the predicted traffic for that network event.

[0050] Traffic flow detection models can handle heterogeneous feature types and effectively fuse numerical and categorical features. They possess non-linear relationship fitting capabilities, prediction accuracy, and interpretability of feature importance, making them suitable for learning complex relationships between features that provide correlation information and future hourly traffic. A large number of training samples can be used to train the traffic flow detection model. The objective function of the traffic flow detection model is to establish a mapping relationship from the feature space to the predicted traffic value in the next H hours (H is typically set to 1 to 24). Training samples include correlation information of network events occurring in historical time periods and real traffic collected from network events. The model is trained to reduce the discrepancy between the predicted traffic and the actual traffic output by the traffic flow detection model. Specifically, at least one decision tree is pre-constructed based on the training samples, and the optimal split point is determined for each decision tree. Based on the learned mapping relationship, the traffic flow detection model outputs the predicted traffic of the network event in a specific hourly interval in the future (e.g., the next 1st hour, 2nd hour, until the end of the event). The predicted traffic represents the hourly predicted traffic of the network event.

[0051] It is evident that by using traffic detection models to predict network event traffic based on multidimensional correlation information, we can accurately capture the inherent patterns and risk signals of high-concurrency events, and characterize event features and system operating status from multiple perspectives, thereby improving the accuracy and efficiency of traffic prediction.

[0052] In an optional embodiment, after correcting the cumulative value of the predicted traffic of each network event in the target time period according to the combined offset type and corresponding offset information of each network event to obtain the target traffic, the method further includes: allocating resources to each network event in the target time period according to the target traffic.

[0053] The target traffic can be used to allocate appropriate resources for network events, avoiding resource waste due to resource excess during the target time period and preventing network event processing server crashes due to insufficient resources. In some embodiments, the target traffic is compared with a preset standard traffic. When the target traffic is greater than the standard traffic, the resources allocated based on the standard traffic are increased; when the target traffic is less than the standard traffic, the resources allocated based on the standard traffic are reduced or maintained.

[0054] It is evident that by adjusting the traffic allocated to network events based on target traffic, resource waste can be reduced, server operational stability can be improved, and resources can be used more efficiently.

[0055] Figure 2This is a flowchart illustrating a network traffic prediction method provided by an embodiment of the present invention. Based on the above embodiments, this embodiment determines the combined offset type and corresponding offset information of each network event according to the participant overlap information and combined influence information of each network event. Specifically, it involves: dividing each network event according to the participant overlap information to obtain at least one first event group and a second event group; the first event group includes network events with overlapping participants, and there are no overlapping participants between network events in different first event groups; the second event group includes network events with no overlapping participants with any of the network events; for each first event group, based on the association information of the network events included in the first event group, determining the participant overlap information and combined influence information corresponding to the first event group; obtaining the participant overlap information and combined influence information corresponding to the second event group; and combining the participant overlap information and combined influence information corresponding to each first event group with the participant overlap information and combined influence information corresponding to each second event group.

[0056] It should be noted that for parts not described in detail in the embodiments of the present invention, please refer to the descriptions in other embodiments.

[0057] See Figure 2 The network traffic prediction method shown includes:

[0058] S201. Obtain at least one network event that is valid during the target time period.

[0059] S202. Based on the association information of each network event, determine the predicted traffic of each network event in the target time period.

[0060] S203. Based on the participant overlap information of each network event, divide each network event to obtain at least one first event group and a second event group. The first event group includes network events with overlapping participants, and there are no overlapping participants between network events in different first event groups. The second event group includes network events with no overlapping participants with each network event.

[0061] In this process, the scope of participants in each network event is compared one by one with the scope of participants in other network events. In some embodiments, if the number of duplicate participants in two network events is less than a preset threshold, it can be determined that the two network events do not have duplicate participants. If the number of duplicate participants in two network events is greater than or equal to the preset threshold, it can be determined that the two network events do not have duplicate participants. In some embodiments, if two network events have at least one duplicate participant, it can be determined that the two network events have duplicate participants. If two network events do not have any duplicate participants, it can be determined that the two network events do not have duplicate participants.

[0062] Network events with duplicate participants are placed in the same first event group. Network events with different duplicate participants are placed in different first event groups. Network events with duplicate participants that overlap with any other network event are placed in a second event group.

[0063] S204. For each of the first event groups, based on the association information of the network events included in the first event group, determine the participant overlap information and combined influence information corresponding to the first event group.

[0064] The overlapping information of participants in the first event group can refer to the fact that there are overlapping participants in each network event in the first event group.

[0065] In some embodiments, based on the overlapping participants in the network events included in the first event group, an overlap participation ratio can be determined between the number of overlapping participants and the total number of participants in the network events. The overlap participation ratios and combined impact information of historical participants for historically occurring events are obtained, and a mapping relationship is determined. Combined impact information is determined based on the overlap participation ratios and mapping relationships of each network event.

[0066] In some embodiments, the information on the overlapping participants in the network events included in the first event group and the association information of the network events with overlapping participants is input into a pre-trained influence detection model to obtain the combined influence information of each network event in the first event group.

[0067] The correlation information of network events within the same first event group determines the overlap information of participants and the combined impact information of that first event group. The overlap information and combined impact information of participants in different first event groups are independent of each other. The direction and degree of influence between the same network events can be determined as the combined impact information.

[0068] S205. Obtain the participant overlap information and combined influence information corresponding to the second event group.

[0069] In the second event group, each network event is independent of the others. Therefore, the overlap information of the participants in the second event group can be non-overlapping. Correspondingly, the combination offset type of each network event in the second event group can be non-offset type, and the combination influence information can be non-influence. Correspondingly, the offset information of each network event in the second event group is 0 or empty.

[0070] S206. By combining the participant overlap information and combined influence information corresponding to each of the first event groups and the participant overlap information and combined influence information corresponding to each of the second event groups, the participant overlap information and combined influence information of each network event are determined.

[0071] Among them, there may be only the first event group, only the second event group, or both the first and second event groups.

[0072] S207. Based on the participant overlap information and combined influence information of each network event, determine the combined offset type and corresponding offset information of each network event.

[0073] S208. Based on the combined offset type and corresponding offset information of each network event, the cumulative value of the predicted traffic of each network event in the target time period is corrected to obtain the target traffic.

[0074] This invention divides network events into first and second event groups based on whether there are overlapping participants. It determines participant overlap and combined impact information based on the association information of the network events in the first event group, and directly obtains participant overlap and combined impact information for the second event group. This allows for precise differentiation of the impact types and degrees between network events with different participants. Furthermore, it determines the combined impact information of each network event based on the impact types and degrees, improving the accuracy of detecting the mutual influence relationships between network events, thereby correcting traffic and improving traffic prediction accuracy.

[0075] In an optional embodiment, the step of correcting the cumulative value of the predicted traffic of each network event in the target time period according to the combined offset type and corresponding offset information of each network event to obtain the target traffic includes: determining the offset sign corresponding to each first event group according to the combined offset type corresponding to each first event group; for each first event group, compensating the sum of the predicted traffic of the network events in the first event group according to the offset sign and offset information corresponding to the first event group to obtain the first traffic of the first event group; summing the predicted traffic of each network event in the second event group to obtain the second traffic of the second event group; and summing the first traffic and the second traffic of each first event group to obtain the target traffic.

[0076] The combined offset type is used to determine the offset direction. The offset direction corresponds to the offset sign. The offset direction can be positive or negative. A positive offset direction is equivalent to a positive offset sign, which can be understood as the traffic of two network events mutually promoting each other, resulting in the traffic of each network event being greater than the traffic caused by that network event alone, or the sum of the traffic of the two network events being greater than the sum of the traffic caused by each network event alone. A negative offset direction is equivalent to a negative offset sign, which can be understood as the traffic of two network events mutually inhibiting each other, resulting in the traffic of each network event being less than the traffic caused by that network event alone, or the sum of the traffic of the two network events being less than the sum of the traffic caused by each network event alone. Offset information can refer to a quantified value of the offset degree.

[0077] Compensating for the sum of predicted traffic of network events in the first time group based on the offset sign and offset information corresponding to the first time group can refer to calculating the sum of predicted traffic of each network event in the first event group, and then multiplying the sum of predicted traffic by the offset sign and offset information of each network event to obtain a compensation value for each network event, thus obtaining the first traffic. In some embodiments, the compensation value can be added to the sum of predicted traffic to obtain the first traffic. In some embodiments, the compensation value can be multiplied by the sum of predicted traffic to obtain the first traffic.

[0078] For example, in the first event group, the traffic value of network event A is 2, the traffic value of network event B is 3, and the sum of the predicted traffic is 2 + 3 = 5. The offset sign of network event A is positive, the offset information is 0.4, and the compensation value of network event A is +0.4. The offset sign of network event B is positive, the offset information is 0.3, and the compensation value is +0.3. Adding the compensation value to the sum of the predicted traffic yields the first traffic, which is 5 + (+0.4) + (+0.3) = 5.7.

[0079] For the second event group, since the network events within the second event group are independent of each other, they will not affect each other. The sum of the predicted traffic for each network event in the second event group is the second traffic for the second event group.

[0080] Different first event groups do not affect each other, nor do the first and second event groups. The sum of the first traffic of each first event group and the second traffic of the second event group is calculated and determined as the sum of all network events' traffic for the target time period. The cumulative value for the target time period is the sum of the predicted traffic for each network event. The predicted traffic for network events in the first event group needs compensation, while the predicted traffic for network events in the second event group does not. The first traffic is the traffic already corrected by the compensation value. Therefore, the sum of the first and second traffic is the target traffic obtained by correcting the cumulative value of the predicted traffic for each network event in the target time period.

[0081] As can be seen, by compensating each first event group according to the combination offset type and offset information, the first flow is obtained. The predicted flow of network events is directly accumulated for the second event group to obtain the second flow. The first flow and the second flow are summed to obtain the target flow. This method can distinguish between network events that need compensation and those that do not, and only compensate for the network events that need compensation. Finally, the predicted flow after compensation and the predicted flow that does not need compensation are summed to obtain the target flow, thus improving the accuracy of the target flow calculation.

[0082] In an optional embodiment, obtaining at least one network event that is valid during the target time period includes: obtaining initial events corresponding to the same interface; and filtering out at least one network event that is valid during the target time period from among the initial events.

[0083] In this context, an initial event corresponding to the same interface can refer to a service that can be accessed through the same interface. There must be at least one initial event corresponding to the same interface. For example, two initial events corresponding to the same interface indicate that these two initial events can be accessed and participated in by calling that interface. A valid state can refer to a network event being in a running or active state. A network event in a valid state for a target time period indicates that the duration of the network event includes the target time period; that is, the start time of the network event is before or the same as the start time of the target time period. Simultaneously, the end time of the network event is after or the same as the end time of the target time period.

[0084] As can be seen, by defining the statistical scope of target traffic as network events that are valid within the same interface and target time period, traffic prediction can be performed for a specific interface, and resource allocation can then be performed based on that interface. This enables interface-level traffic prediction and resource allocation strategy processing, thereby improving the accuracy of traffic prediction.

[0085] In an optional embodiment, determining the combined offset type and corresponding offset information of each network event based on the participant overlap information and combined influence information of each network event includes: when the number of events of each network event meets the high aggregation condition, determining the combined offset type and corresponding offset information of each network event based on the participant overlap information and combined influence information of each network event; when the number of events of each network event meets the low aggregation condition, summing the predicted traffic of each network event in the target time period to obtain the target traffic.

[0086] The high aggregation condition refers to determining whether the number of mutually influencing network events is excessive. The low aggregation condition refers to determining whether the number of mutually influencing network events is insufficient. High aggregation and low aggregation conditions are mutually exclusive. In some embodiments, the number of network events with overlapping participants can be determined based on the participant overlap information. When the number of network events with overlapping participants is greater than or equal to a preset threshold, the number of events for each network event is determined to meet the high aggregation condition. When the number of network events with overlapping participants is less than the preset threshold, the number of events for each network event is determined to meet the low aggregation condition. If the number of mutually influencing network events is excessive, i.e., meets the high aggregation condition, it is necessary to consider the traffic interaction factors between network events. Therefore, it is necessary to compensate for the predicted traffic of mutually influencing network events, and then determine the combined offset type and corresponding offset information for each network event based on the participant overlap information and combined influence information. If the number of mutually influencing network events is too small, that is, if the low aggregation condition is met, there is no need to consider the traffic mutual influence factors between network events. Therefore, there is no need to compensate for the predicted traffic of mutually influencing network events. Instead, the predicted traffic of each network event is directly added together to obtain the target traffic.

[0087] It is evident that by determining whether network events need traffic compensation based on whether they meet high-aggregation or low-aggregation conditions, redundant compensation calculations can be reduced, balancing traffic prediction efficiency and accuracy.

[0088] In one scenario, network events corresponding to each interface are statistically analyzed. For each interface, network events in a valid state within a target time period (e.g., 10:00 AM - 11:00 AM the following day) are retrieved. A traffic detection model is invoked to obtain the predicted traffic for each network event in each hour within the target time period based on the correlation information of each network event. The number of network events with overlapping participants is counted based on the participants in the network events. When the number of events is less than a preset threshold, i.e., low aggregation is met, the predicted traffic of each network event is summed to obtain the target traffic for that interface. Based on this target traffic, corresponding resources are allocated to that interface within the target time period, such as allocating a corresponding number of servers or service nodes.

[0089] When the number of events is greater than or equal to a preset threshold, i.e., when high aggregation is met, a traffic correction method is triggered. First, the arithmetic sum of the predicted traffic for all network events within the target time period is calculated as the base superimposed traffic. Given that multiple concurrent network events may produce a synergistic effect (total traffic exceeding simple summation) or a suppressive effect (total traffic falling below the summation value), an interaction effect correction mechanism is introduced to analyze the combination of attribute characteristics of the superimposed network events, such as the degree of overlap of target user groups.

[0090] Based on the systematic deviation between the actual total traffic and the sum of the independent predicted values ​​of each activity when multiple network events occur concurrently, observed in historical data, an impact detection model is trained to learn a traffic overlay correction factor. Using the feature combination analysis results and the traffic overlay correction factor, the basic overlay traffic is dynamically adjusted, for example, by multiplying it by a correction coefficient or adding a feature-based prediction offset. The final value obtained after correction is the overall predicted total traffic for the target time period T, i.e., the target traffic.

[0091] The calculated target traffic is the core basis for subsequent high-concurrency risk probability assessment, resource demand forecasting, and automated scheduling decisions.

[0092] This invention has brought significant benefits to the digital operations and system stability of banks, especially in terms of risk control: it establishes a closed-loop system of pre-warning, in-process control, and post-event optimization. By accurately predicting peak activity traffic and automatically triggering a resource preloading mechanism, it eliminates system crashes caused by incorrect mode configuration, significantly reducing infrastructure costs while ensuring system resilience. It also reduces business interruptions during network events and improves the success rate of user request processing. Furthermore, by reconstructing the network event configuration decision-making process, it allows staff to test the high concurrency risk probability of different network event configuration schemes in real time, thereby reducing the configuration error rate and improving system stability during network event operation.

[0093] Figure 3This is a schematic diagram of a network traffic prediction device provided in an embodiment of the present invention. The present invention is applicable to situations where traffic caused by future network events is predicted. This device can execute a network traffic prediction method and can be implemented in hardware and / or software. The device can be configured in an electronic device.

[0094] See Figure 3 The network traffic prediction device shown includes:

[0095] The event acquisition module 301 is used to acquire at least one network event that is valid within a target time period;

[0096] The single traffic prediction module 302 is used to determine the predicted traffic of each network event in the target time period based on the association information of each network event.

[0097] The overlapping influence determination module 303 is used to determine the participant overlap information and combined influence information of each network event based on the association information of each network event;

[0098] The offset calculation module 304 is used to determine the combined offset type and corresponding offset information of each network event based on the participant overlap information and combined influence information of each network event;

[0099] The traffic correction module 305 is used to correct the cumulative value of the predicted traffic of each network event in the target time period according to the combined offset type and corresponding offset information of each network event, so as to obtain the target traffic.

[0100] The technical solution of this invention determines the traffic generated by each individual network event in the target time period based on the correlation information of valid network events in the target time period. It then corrects the cumulative value of the predicted traffic for each network event based on the parameters, overlap information, and combined influence information of the network events, thus obtaining the target traffic for the target time period. This allows for accurate prediction of the traffic generated by network events in the target time period, enabling the configuration of traffic processing servers in advance. This solves the problem of network overload caused by surges in network traffic in existing technologies, allowing for advance traffic prediction and avoiding system overload. Furthermore, by correcting the traffic for the mutual influence and superposition effects between different events, the accuracy of the traffic prediction can be improved.

[0101] Optionally, the overlap effect determination module 303 is specifically used for:

[0102] Based on the participant overlap information of each network event, the network events are divided to obtain at least one first event group and a second event group. The first event group includes network events with overlapping participants, and there are no overlapping participants between network events in different first event groups. The second event group includes network events with no overlapping participants with any of the network events.

[0103] For each of the first event groups, based on the association information of the network events included in the first event group, the participant overlap information and combined influence information corresponding to the first event group are determined;

[0104] Obtain participant overlap information and combined impact information corresponding to the second event group;

[0105] The overlapping information of participants and the combined impact information corresponding to each of the first event groups and the overlapping information of participants and the combined impact information corresponding to each of the second event groups are included.

[0106] Optional, the flow correction module 305 is specifically used for:

[0107] The offset symbol corresponding to each of the first event groups is determined based on the combined offset type corresponding to each of the first event groups;

[0108] For each of the first event groups, the sum of the predicted traffic of the network events in the first event group is compensated according to the offset sign and offset information corresponding to the first event group to obtain the first traffic of the first event group;

[0109] The predicted traffic of each network event in the second event group is summed to obtain the second traffic of the second event group;

[0110] The target flow is obtained by summing the first flow and the second flow of each of the first event groups.

[0111] Optionally, the event acquisition module 301 is specifically used for:

[0112] Get the initial event corresponding to the same interface;

[0113] Among the initial events, at least one network event that is in a valid state during the target time period is selected.

[0114] Optional, the offset calculation module 304 is specifically used for:

[0115] When the number of events in each of the network events meets the high aggregation condition, the combination offset type and corresponding offset information of each of the network events are determined based on the participant overlap information and combination influence information of each of the network events.

[0116] When the number of events for each of the network events meets the low aggregation condition, the predicted traffic for each of the network events in the target time period is summed to obtain the target traffic.

[0117] Optional, the single flow prediction module 302 is specifically used for:

[0118] The association information of each network event is input into a pre-trained traffic detection model to obtain the predicted traffic of each network event in the target time period. The association information includes event attribute information, participation information, time sequence information, dependent resource information, and environmental information.

[0119] Optionally, the network traffic prediction device also includes:

[0120] The resource allocation module is used to correct the cumulative value of the predicted traffic of each network event in the target time period according to the combined offset type and corresponding offset information of each network event, and then allocate resources to each network event in the target time period according to the target traffic.

[0121] The network traffic prediction device provided in this embodiment of the invention can execute the network traffic prediction method provided in any embodiment of the invention, and has the corresponding functional modules and beneficial effects of the method.

[0122] The acquisition, storage, and application of data involved in the technical solutions of this invention comply with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0123] Figure 4 A schematic diagram of the structure of a call response processing device 400 that can be used to implement an embodiment of the present invention is shown.

[0124] like Figure 4 As shown, the call response processing device 400 includes at least one processor 401 and a memory, such as a read-only memory 402 or a random access memory 403, communicatively connected to the at least one processor 401. The memory stores computer programs executable by the at least one processor. The processor 401 can perform various appropriate actions and processes based on the computer program stored in the read-only memory 402 or loaded from storage unit 408 into the random access memory 403. The random access memory 403 may also store various programs and data required for the operation of the call response processing device 400. The processor 401, read-only memory 402, and random access memory 403 are interconnected via a bus 404. An input / output interface 405 is also connected to the bus 404.

[0125] Multiple components in the call response processing device 400 are connected to the input / output interface 405, including: an input unit 406, such as a keyboard, mouse, etc.; an output unit 407, such as various types of displays, speakers, etc.; a storage unit 408, such as a disk, optical disk, etc.; and a communication unit 409, such as a network card, modem, wireless transceiver, etc. The communication unit 409 allows the call response processing device 400 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0126] Processor 401 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 401 include, but are not limited to, central processing units, graphics processing units, various special-purpose artificial intelligence computing chips, various processors running machine learning model algorithms, digital signal processors, and any suitable processor, controller, microcontroller, etc. Processor 401 performs the various methods and processes described above, such as call reply processing methods.

[0127] In some embodiments, the call response processing method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 408. In some embodiments, part or all of the computer program may be loaded and / or installed on the call response processing device 400 via read-only memory 402 and / or communication unit 409. When the computer program is loaded into random access memory 403 and executed by processor 401, one or more steps of the call response processing method described above may be performed. Alternatively, in other embodiments, processor 401 may be configured to perform the call response processing method by any other suitable means (e.g., by means of firmware).

[0128] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays, application-specific integrated circuits (ASICs), application-specific standard products (ASICs), systems-on-a-chip (SoCs), complex programmable logic devices, computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0129] Computer programs used to implement the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0130] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory, read-only memory, erasable programmable read-only memory, flash memory, optical fiber, portable compact disk read-only memory, optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0131] To provide interaction with the user, the systems and techniques described herein can be implemented on an operational detection device. This call response processing device includes: a display device (e.g., a cathode ray tube or liquid crystal display monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the call response processing device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including voice input, speech input, or tactile input).

[0132] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or computing systems that include middleware components (e.g., application servers), or computing systems that include frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0133] A computing system can include target user terminals and servers. Target user terminals and servers are generally geographically separated and typically interact via communication networks. The relationship between target user terminals and servers is created by computer programs running on the respective computers and establishing a target user-server relationship between them. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a host product within the cloud computing service system. It addresses the shortcomings of traditional physical hosts and virtual private servers, such as high management difficulty and weak business scalability.

[0134] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0135] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A network traffic prediction method, characterized in that, include: Obtain at least one network event that is valid within the target time period; Based on the association information of each network event, determine the predicted traffic of each network event in the target time period; Based on the correlation information of each network event, determine the participant overlap information and combined influence information of each network event; Based on the participant overlap information and combined influence information of each network event, determine the combined offset type and corresponding offset information of each network event; Based on the combined offset type and corresponding offset information of each network event, the cumulative value of the predicted traffic of each network event in the target time period is corrected to obtain the target traffic.

2. The method according to claim 1, characterized in that, The step of determining the participant overlap information and combined influence information of each network event based on the association information of each network event includes: Based on the participant overlap information of each network event, the network events are divided to obtain at least one first event group and a second event group. The first event group includes network events with overlapping participants, and there are no overlapping participants between network events in different first event groups. The second event group includes network events with no overlapping participants with any of the network events. For each of the first event groups, based on the association information of the network events included in the first event group, the participant overlap information and combined influence information corresponding to the first event group are determined; Obtain participant overlap information and combined impact information corresponding to the second event group; The overlapping information of participants and the combined impact information corresponding to each of the first event groups and the overlapping information of participants and the combined impact information corresponding to each of the second event groups are included.

3. The method according to claim 2, characterized in that, The step of correcting the cumulative value of the predicted traffic of each network event in the target time period based on the combined offset type and corresponding offset information of each network event to obtain the target traffic includes: The offset symbol corresponding to each of the first event groups is determined based on the combined offset type corresponding to each of the first event groups; For each of the first event groups, the sum of the predicted traffic of the network events in the first event group is compensated according to the offset sign and offset information corresponding to the first event group to obtain the first traffic of the first event group; The predicted traffic of each network event in the second event group is summed to obtain the second traffic of the second event group; The target flow is obtained by summing the first flow and the second flow of each of the first event groups.

4. The method according to claim 1, characterized in that, The acquisition of at least one network event that is valid within the target time period includes: Get the initial event corresponding to the same interface; Among the initial events, at least one network event that is in a valid state during the target time period is selected.

5. The method according to claim 1, characterized in that, The step of determining the combined offset type and corresponding offset information of each network event based on the participant overlap information and combined influence information of each network event includes: When the number of events in each of the network events meets the high aggregation condition, the combination offset type and corresponding offset information of each of the network events are determined based on the participant overlap information and combination influence information of each of the network events. When the number of events for each of the network events meets the low aggregation condition, the predicted traffic for each of the network events in the target time period is summed to obtain the target traffic.

6. The method according to claim 1, characterized in that, Determining the predicted traffic of each network event in the target time period based on the association information of each network event includes: The association information of each network event is input into a pre-trained traffic detection model to obtain the predicted traffic of each network event in the target time period. The association information includes event attribute information, participation information, time sequence information, dependent resource information, and environmental information.

7. The method according to claim 1, characterized in that, After correcting the cumulative value of the predicted traffic of each network event in the target time period according to the combined offset type and corresponding offset information of each network event to obtain the target traffic, the method further includes: Based on the target traffic, resources are allocated to each of the network events within the target time period.

8. A network traffic prediction device, characterized in that, The device includes: The event acquisition module is used to acquire at least one network event that is valid within a target time period. A single traffic prediction module is used to determine the predicted traffic of each network event in the target time period based on the association information of each network event. The overlapping impact determination module is used to determine the participant overlap information and combined impact information of each network event based on the association information of each network event; The offset calculation module is used to determine the combined offset type and corresponding offset information of each network event based on the participant overlap information and combined influence information of each network event; The traffic correction module is used to correct the cumulative value of the predicted traffic of each network event in the target time period according to the combined offset type and corresponding offset information of each network event, so as to obtain the target traffic.

9. An electronic device, characterized in that, The electronic device includes: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the network traffic prediction method according to any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that cause a processor to execute the network traffic prediction method according to any one of claims 1-7.

Images