Real-time link detection method and system

Abstract

The invention discloses a real-time link detection method and system. The real-time link detection method comprises the following steps: detecting link accessibility through a physical layer, detecting a routing path through a network layer and monitoring performance of an application layer through a deep packet analysis technology; in combination with machine learning and data mining technologies, link states are analyzed in real time, faults and bottlenecks are automatically identified, and anomaly detection and trend prediction are carried out; a self-adaptive detection strategy is adopted to dynamically adjust the detection frequency and mode, and detection is optimized based on the current load and state; the redundant path detection and intelligent routing technology is automatically switched to a standby path when a link is abnormal; a real-time stream processing technology is adopted to process multi-source data streams, link changes are responded in time, and feedback and alarm are generated; according to the real-time link detection method and system, the health state of the network link is accurately evaluated through multi-level monitoring, intelligent analysis and a self-adaptive detection strategy, and the fault response speed and accuracy are improved by combining the real-time data flow processing and machine learning technology, predictive analysis and automatic repair functions.

Description

Technical Field

[0001] This invention relates to network monitoring technology, and in particular to a method and system for real-time monitoring and analysis of network link status. Background Technology

[0002] Real-time link probing methods are typically used to monitor and analyze the connection status and performance between nodes in a network. They can detect link availability, latency, bandwidth, packet loss rate, and other indicators in real time, helping maintenance personnel to promptly identify and resolve network problems. By sending ICMP echo requests to the target node, the online status of the target node and network latency can be detected. The Ping method is simple, but it cannot fully reflect complex issues such as network bandwidth and packet loss. By sending a series of ICMP packets, the path of the packets through the network can be traced step by step to determine the latency and link status of each hop. This helps locate the routing node where the network failure is located; SNMP is used to obtain real-time performance data from network devices such as routers and switches, helping to monitor link bandwidth usage, traffic, errors, etc. SNMP can provide more network performance metrics than Ping and Traceroute; Deep Packet Analysis (DPI) tools are used to monitor network traffic in real time to identify network bottlenecks, traffic anomalies, or potential attacks. This method performs detailed analysis of data packets and can provide more accurate link health status; BGP routing tables are used to monitor the network in real time and track route changes in the network. Through BGP monitoring, it is possible to determine whether network links have changed or been bypassed, and to promptly detect network outages or performance problems.

[0003] With the continuous development of the Internet and enterprise networks, the stability and reliability of network links are crucial to the normal operation of various application systems. Currently, although existing link detection methods can provide some link availability monitoring, they have some problems. The detection methods lack hierarchy, cannot fully reflect the actual performance of the link, have limited processing capabilities for encrypted traffic, are difficult to deeply analyze application layer performance bottlenecks, and cannot intelligently analyze and predict changes in link performance, resulting in relatively slow fault location and repair. A single detection strategy is easily affected by changes in the network environment, leading to inaccurate monitoring results. Summary of the Invention

[0004] To address the shortcomings of existing technologies, the purpose of this invention is to provide a real-time link detection method and system. Through multi-level and multi-dimensional monitoring, combined with intelligent analysis and adaptive detection strategies, the health status of network links can be assessed more accurately and comprehensively. Furthermore, through real-time data stream processing and machine learning technologies, predictive analysis and automated repair functions are provided, thereby improving the speed and accuracy of network fault response.

[0005] The technical solution adopted by this invention to solve its technical problem is:

[0006] A real-time link detection method includes:

[0007] The reachability of the link is detected by physical layer detection, the routing path is traced by network layer detection, and application layer performance is monitored by deep packet inspection.

[0008] Based on real-time detection data, machine learning and data mining techniques are used to analyze the network link status, automatically identify potential faults and performance bottlenecks, including anomaly detection and trend prediction, and predict changes in link performance through time series analysis.

[0009] An adaptive detection strategy is used to dynamically adjust the detection frequency and method based on the current network load and link status.

[0010] It employs redundant path detection and intelligent routing technology to automatically switch to a backup path when a link anomaly is detected;

[0011] It employs real-time stream processing technology to process data streams from different detection sources, respond to changes in link performance, and generate feedback and alarms.

[0012] As a preferred method, the approach of detecting link reachability through physical layer probing, tracing routing paths through network layer probing, and monitoring application layer performance using deep packet inspection is as follows:

[0013] The physical layer is used to check the reachability of the link. It uses signal strength, transmission delay and packet loss rate to identify whether the link is reachable. The detection techniques include ICMP Echo requests and network interface card status monitoring.

[0014] Physical layer probing determines the validity of a link based on the transmitted signal strength and packet loss rate, assuming the link's packet loss rate is [missing information]. The health status of the link is evaluated using the following formula:

[0015]

[0016] in, This represents the number of lost data packets.

[0017] The total number of data packets sent;

[0018] Traceroute operates based on ICMP and TTL values, determining the path by measuring the latency of each hop. For the first The delay of routing hops is calculated using the following formula to determine the total path delay:

[0019]

[0020] in, For the first The latency of the routing hop;

[0021] This represents the number of hops traversed in the route.

[0022] Application layer probing employs deep packet inspection (DPI) to examine the content of transmitted data packets and analyze application layer performance metrics. Application layer performance is calculated by analyzing multiple factors, including transmission latency, bandwidth, and packet loss. The transmission throughput is set as [value missing]. Data transmission latency is It is calculated using the following formula:

[0023]

[0024] in, For bandwidth;

[0025] The amount of data transmitted;

[0026] For application layer latency;

[0027] More detailed performance analysis can be performed using DPI, and further refined by calculating protocol-level latency, as shown in the formula:

[0028]

[0029] in, This refers to the total response time of the HTTP request;

[0030] The request was delayed;

[0031] The response was delayed.

[0032] As a preferred approach, based on real-time detection data, machine learning and data mining techniques are used to analyze the network link status, automatically identifying potential faults and performance bottlenecks, including anomaly detection and trend prediction. The method for predicting changes in link performance through time series analysis is as follows:

[0033] The real-time detection data is preprocessed, including noise reduction, data cleaning, standardization, and feature extraction, including packet loss rate, latency, bandwidth, throughput, and time delay.

[0034] To eliminate dimensional differences between different features, the data is standardized.

[0035]

[0036] in, This is the original data;

[0037] The mean of the data;

[0038] The standard deviation of the data;

[0039] The data is standardized.

[0040] Anomaly detection automatically identifies potential faults and performance bottlenecks, employing statistical and machine learning-based methods.

[0041] Z-score is used to identify outliers in the data. If the Z-score value of a data point is too large or too small, it indicates that the data point is an outlier.

[0042]

[0043] in, The value of a certain data point;

[0044] This is the mean of the data;

[0045] This represents the standard deviation of the data.

[0046] Time series analysis is used to predict trends in link performance, and methods include autoregression, moving average, ARIMA, and LSTM.

[0047] The ARIMA model is a classic time series forecasting model that combines autoregression, differencing, and moving average. Its basic formula is:

[0048]

[0049] in, For time points Observed values;

[0050] , ,..., These are autoregressive parameters;

[0051] , ,..., The moving average parameter;

[0052] LSTM is a neural network that learns long-term dependencies in time series data. It is used to predict link performance trends. Its basic operation uses a gating mechanism to control the flow of information. The formula is as follows:

[0053]

[0054]

[0055]

[0056]

[0057]

[0058] in, , , These are the forget gate, input gate, and output gate, respectively.

[0059] In cellular state;

[0060] It is in a hidden state;

[0061] , , , This is the weight matrix;

[0062] This is the current input;

[0063] Based on the above analysis methods, link state prediction based on machine learning predicts link performance changes by building a model and establishing... For the prediction function, For time points The feature data is used for prediction, and the formula is:

[0064]

[0065] in, For time points Link state prediction results;

[0066] For time points Input feature data;

[0067] For a trained machine learning model;

[0068] When identifying anomalies and bottlenecks, a classification model is established to automatically detect faults and performance bottlenecks in the pipeline, combining a machine learning classifier. The input features are The classification formula is:

[0069]

[0070] in, The predicted results for faults or bottlenecks;

[0071] For time points Feature data.

[0072] As a preferred approach, the method of dynamically adjusting the detection frequency and detection method based on the current network load and link status using an adaptive detection strategy is as follows:

[0073] Adaptive probing adjusts the probing frequency based on network load and link status, setting a baseline probing frequency. The detection frequency is dynamically adjusted based on the link performance. Adjustments can be made using the following formula:

[0074]

[0075] in, The reference detection frequency;

[0076] For time points The dynamic detection frequency at any given moment;

[0077] For time points Link load at any given moment;

[0078] This represents the maximum value of the link load.

[0079] For time points Bandwidth utilization at any given moment;

[0080] This represents the maximum bandwidth.

[0081] and To control the adjustment coefficient;

[0082] The formula means: when the link load As the frequency increases, the detection frequency also increases, and the bandwidth utilization rate also increases. As the frequency increases, the detection frequency decreases;

[0083] The detection method is dynamically adjusted based on the link status. When the link load is high, a lighter detection method is used, while when the load is low, a more precise detection method is used. A switching threshold for the detection method is set, and the detection method is adjusted according to the network load and status.

[0084]

[0085] in, For detection methods;

[0086] , This is the threshold for switching link load;

[0087] , This is the switching threshold for bandwidth utilization;

[0088] , , These correspond to different detection methods, namely lightweight, conventional, and depth detection.

[0089] This formula means that different detection methods are dynamically adopted based on different link loads and bandwidths.

[0090] Further refinement of the detection strategy involves adjusting the weights of load and bandwidth to more precisely control changes in the detection frequency, and adjusting the weighting factors. and Determine the extent to which link load and bandwidth affect the probe frequency:

[0091]

[0092] in, and To adjust the coefficients that influence the weights of link load and bandwidth;

[0093] The meanings of the other symbols are the same as before.

[0094] As a preferred method, redundant path detection and intelligent routing technology are used to automatically switch to a backup path when a link anomaly is detected.

[0095] Link status monitoring is fundamental for redundant path switching. When a link anomaly occurs, the intelligent routing policy needs to identify it and automatically switch over, by setting the link status function. Its value represents the health status of the link; the lower the status value, the higher the probability of link failure. The formula for calculating the link status is as follows:

[0096]

[0097] in, For time points Link status at any given time;

[0098] For link latency;

[0099] Packet loss rate;

[0100] For bandwidth utilization

[0101] , , As a weighting factor;

[0102] when Exceeding the set threshold If the link is deemed abnormal, it will switch to an alternative path:

[0103]

[0104] In the event of a link failure, the system will use a backup path. Replace the currently faulty main link The backup path uses multiple redundant paths in the network. The criteria for path selection are based on latency, bandwidth, and load factors. The formula for backup path selection is expressed as:

[0105]

[0106] in, The set of all possible redundant paths;

[0107] As a candidate backup path;

[0108] For path The delay;

[0109] For path bandwidth;

[0110] For path The load;

[0111] , , , which is a weighting factor, representing the degree to which latency, bandwidth, and load affect path selection;

[0112] Once a link anomaly is detected, the system will quickly switch to the backup path. This process is described by a dynamic switching function, where the current path is set as... The alternative path is The moment of switching The following conditions must be met:

[0113]

[0114] Right now:

[0115] When the current path is the primary path And link status When the set threshold is exceeded, the system will automatically switch the current path to an alternate path. ;

[0116] After the link switches to the backup path, the network will restore bandwidth and perform intelligent routing adjustments. During the bandwidth restoration phase, traffic allocation is controlled through a bandwidth adjustment formula:

[0117]

[0118] in, This represents the bandwidth of the current path.

[0119] This refers to the total bandwidth of the network.

[0120] Reserved bandwidth;

[0121] This represents the number of available paths.

[0122] As a preferred approach, real-time stream processing technology is used to process data streams from different detection sources, respond to changes in link performance, and generate feedback and alarms.

[0123] Real-time processing of data streams from different detection sources is performed to evaluate link performance. Monitoring metrics for the data streams, including latency, bandwidth utilization, and packet loss rate, are established, with each metric defined as follows: ,in Representing different monitoring parameters, Represents a timestamp;

[0124] The overall link performance score is calculated using a weighted sum formula:

[0125]

[0126] in, For time points Link performance score at any given time;

[0127] For at a certain point in time Constantly detected by the source The collected first One monitoring indicator;

[0128] For the first The weight of each monitoring indicator;

[0129] The total number of monitoring indicators;

[0130] When link performance When significant changes occur, feedback or alarms are generated. To detect changes in link performance in real time, the rate of change of link performance is calculated.

[0131]

[0132] like Exceeding a certain set threshold If so, it is considered that the link has undergone a significant change, that is:

[0133]

[0134] When the link performance change exceeds a predetermined threshold, feedback or an alarm is generated. The generation of feedback or alarm is based on the amount of link performance change and the current link health status, and an alarm threshold is set. Indicates the health status of the link; if the link performance... If the value is below this threshold, an alarm will be generated.

[0135]

[0136] Simultaneously, the system generates real-time feedback to help operations and maintenance personnel make decisions, generating optimization suggestions regarding bandwidth, latency, or other performance parameters based on performance changes and the current status.

[0137]

[0138] in, For time points Real-time feedback information;

[0139] This is a feedback generation function that generates targeted optimization suggestions or feedback information based on link performance, performance changes, and specific monitoring metrics.

[0140] Real-time stream processing technology continuously monitors the data stream and triggers alarms and performs feedback scheduling when conditions are met. It employs window functions within the stream processing framework, based on a specific time window. The trend of averaging link performance using a sliding window to process data streams:

[0141]

[0142] This formula represents the time window. Within the link, the moving average of link performance is used. If the difference between the moving average of link performance and the current performance is too large, an alarm or feedback will be triggered.

[0143]

[0144] Link health monitoring in real-time stream processing technology involves dynamically assessing link status through continuous analysis of real-time data streams, and establishing a link health status function as follows: When the link status Below the set threshold When an alarm is generated:

[0145]

[0146]

[0147] in, To determine the health status of the link, check its performance. and related monitoring indicators Calculation generated;

[0148] This is an evaluation function that assesses the health status of a link based on its performance score and other monitoring data.

[0149] A real-time link detection system includes:

[0150] Detection module: Used to perform multi-layer link detection, including physical layer detection, network layer detection and application layer performance detection, and to monitor network links in real time through different detection protocols;

[0151] Data processing module: Used to receive data from the detection module and analyze it using real-time data stream processing technology. The module includes anomaly detection, trend analysis, and performance prediction functions, and processes changes in link status in real time and generates reports.

[0152] Decision module: Based on the analysis results of the data processing module, it uses intelligent algorithms to evaluate the link status and predict faults, and automatically generates alarms or repair strategies.

[0153] Repair and Response Module: When a link failure or performance bottleneck is detected, the Repair and Response Module automatically performs network rerouting, traffic scheduling, or adjusts the detection strategy to repair the problem.

[0154] Visualization and monitoring module: Used to display the real-time status, performance data and alarm information of the link through an intuitive user interface, allowing network administrators to monitor the network status in real time.

[0155] Another technical problem to be solved by the present invention is to provide an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, it implements a real-time link detection method and system as described above.

[0156] Another technical problem to be solved by the present invention is to provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements a real-time link detection method and system.

[0157] The beneficial effects of this invention are:

[0158] Through multi-layered and multi-dimensional link probing, the status of network links can be comprehensively reflected, including the health status of the physical, network, and application layers. By employing machine learning and intelligent analysis technologies, link performance changes and potential faults can be predicted in advance, and automated repair solutions can be provided. The probing frequency and methods can be dynamically adjusted according to network load and link status to avoid unnecessary network burden. Redundant path design and fault tolerance mechanisms can effectively improve the reliability of link monitoring and prevent single points of failure from affecting monitoring results. Through real-time stream processing and intelligent repair mechanisms, link faults and performance bottlenecks can be responded to quickly, reducing fault recovery time and improving network operating efficiency. Attached Figure Description

[0159] Figure 1 This is a schematic diagram of a real-time link detection system according to the present invention. Detailed Implementation

[0160] The principles and features of the present invention are described below. The examples given are for illustrative purposes only and are not intended to limit the scope of the invention. The invention is described more specifically by way of example in the following paragraphs. The advantages and features of the invention will become clearer from the following description and claims.

[0161] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains. The terminology used herein in the description of the invention is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. The term "and / or" as used herein includes any and all combinations of one or more of the associated listed items.

[0162] Example

[0163] The technical solution adopted by this invention to solve its technical problem is:

[0164] A real-time link detection method includes:

[0165] The reachability of the link is detected by physical layer detection, the routing path is traced by network layer detection, and application layer performance is monitored by deep packet inspection.

[0166] Based on real-time detection data, machine learning and data mining techniques are used to analyze the network link status, automatically identify potential faults and performance bottlenecks, including anomaly detection and trend prediction, and predict changes in link performance through time series analysis.

[0167] An adaptive detection strategy is used to dynamically adjust the detection frequency and method based on the current network load and link status.

[0168] It employs redundant path detection and intelligent routing technology to automatically switch to a backup path when a link anomaly is detected;

[0169] It employs real-time stream processing technology to process data streams from different detection sources, respond to changes in link performance, and generate feedback and alarms.

[0170] Through multi-layered probing, the system can deeply monitor all levels of network links, from physical hardware to application performance, ensuring that no link in the network link is missed, and improving the visualization and transparency of network operation and maintenance. Machine learning and data mining technologies enable the system to have automated fault identification and performance prediction capabilities, reducing the need for manual intervention and enabling more efficient identification of potential problems and prediction of changes in link status. The system automatically adjusts the probing frequency and method according to network load and status, optimizing resource usage, avoiding performance overhead caused by over-probing, and ensuring in-depth analysis at critical moments. Redundant path detection and intelligent routing technologies enable the network to quickly switch to backup paths when a link fails, ensuring high availability and fault recovery capabilities. Real-time stream processing technology and an automatically generated alarm system enable administrators to respond quickly to link changes, reduce the impact of network failures on business, and improve the response speed and accuracy of network management.

[0171] The method for monitoring application layer performance involves detecting link reachability through physical layer probing, tracing routing paths through network layer probing, and employing deep packet inspection.

[0172] The physical layer is used to check the reachability of the link. It uses signal strength, transmission delay and packet loss rate to identify whether the link is reachable. The detection techniques include ICMP Echo requests and network interface card status monitoring.

[0173] Physical layer probing determines the validity of a link based on the transmitted signal strength and packet loss rate, assuming the link's packet loss rate is [missing information]. The health status of the link is evaluated using the following formula:

[0174]

[0175] in, This represents the number of lost data packets.

[0176] The total number of data packets sent;

[0177] Traceroute operates based on ICMP and TTL values, determining the path by measuring the latency of each hop. For the first The delay of routing hops is calculated using the following formula to determine the total path delay:

[0178]

[0179] in, For the first The latency of the routing hop;

[0180] This represents the number of hops traversed in the route.

[0181] Application layer probing employs deep packet inspection (DPI) to examine the content of transmitted data packets and analyze application layer performance metrics. Application layer performance is calculated by analyzing multiple factors, including transmission latency, bandwidth, and packet loss. The transmission throughput is set as [value missing]. Data transmission latency is It is calculated using the following formula:

[0182]

[0183] in, For bandwidth;

[0184] The amount of data transmitted;

[0185] For application layer latency;

[0186] More detailed performance analysis can be performed using DPI, and further refined by calculating protocol-level latency, as shown in the formula:

[0187]

[0188] in, This refers to the total response time of the HTTP request;

[0189] The request was delayed;

[0190] The response was delayed.

[0191] This solution employs multi-layered probing at the physical, network, and application layers to comprehensively monitor link status, ensuring no potential problems are overlooked. Physical layer probing promptly detects link reachability issues, network layer probing identifies routing path and latency anomalies, and deep packet analysis at the application layer captures potential performance bottlenecks. By combining probing data from these layers, accurate fault diagnosis and identification of the problem's level are possible. Based on performance metrics such as throughput, latency, bandwidth, and packet loss, network administrators can monitor network link status in real time and optimize accordingly. DPI (Deep Packet Inspection) technology allows for finer-grained analysis of link performance, particularly application-layer bottlenecks. The solution processes detected data in real time and generates corresponding feedback and alerts, reducing the need for manual intervention. Network administrators can respond quickly to link issues, preventing prolonged service interruptions.

[0192] Based on real-time detection data, machine learning and data mining techniques are used to analyze network link status, automatically identifying potential faults and performance bottlenecks, including anomaly detection and trend prediction. The method for predicting changes in link performance through time series analysis is as follows:

[0193] The real-time detection data is preprocessed, including noise reduction, data cleaning, standardization, and feature extraction, including packet loss rate, latency, bandwidth, throughput, and time delay.

[0194] To eliminate dimensional differences between different features, the data is standardized.

[0195]

[0196] in, This is the original data;

[0197] The mean of the data;

[0198] The standard deviation of the data;

[0199] The data is standardized.

[0200] Anomaly detection automatically identifies potential faults and performance bottlenecks, employing statistical and machine learning-based methods.

[0201] Z-score is used to identify outliers in the data. If the Z-score value of a data point is too large or too small, it indicates that the data point is an outlier.

[0202]

[0203] in, The value of a certain data point;

[0204] This is the mean of the data;

[0205] This represents the standard deviation of the data.

[0206] Time series analysis is used to predict trends in link performance, and methods include autoregression, moving average, ARIMA, and LSTM.

[0207] The ARIMA model is a classic time series forecasting model that combines autoregression, differencing, and moving average. Its basic formula is:

[0208]

[0209] in, For time points Observed values;

[0210] , ,..., These are autoregressive parameters;

[0211] , ,..., The moving average parameter;

[0212] LSTM is a neural network that learns long-term dependencies in time series data. It is used to predict link performance trends. Its basic operation uses a gating mechanism to control the flow of information. The formula is as follows:

[0213]

[0214]

[0215]

[0216]

[0217]

[0218] in, , , These are the forget gate, input gate, and output gate, respectively.

[0219] In cellular state;

[0220] It is in a hidden state;

[0221] , , , This is the weight matrix;

[0222] This is the current input;

[0223] Based on the above analysis methods, link state prediction based on machine learning predicts link performance changes by building a model and establishing... For the prediction function, For time points The feature data is used for prediction, and the formula is:

[0224]

[0225] in, For time points Link state prediction results;

[0226] For time points Input feature data;

[0227] For a trained machine learning model;

[0228] When identifying anomalies and bottlenecks, a classification model is established to automatically detect faults and performance bottlenecks in the pipeline, combining a machine learning classifier. The input features are The classification formula is:

[0229]

[0230] in, The predicted results for faults or bottlenecks;

[0231] For time points Feature data.

[0232] By utilizing real-time probe data, link status can be dynamically monitored and potential problems can be identified in a timely manner, reducing the impact time of failures. By employing machine learning technology, problems in network links can be automatically identified and classified without human intervention, improving the network's self-healing capabilities. Time series analysis methods can predict future changes in link performance, helping to identify performance bottlenecks or potential faults in advance, facilitating preventative measures. Through multi-level analysis methods, link status can be comprehensively evaluated, ensuring efficient network operation from multiple dimensions.

[0233] The method of dynamically adjusting the detection frequency and detection method based on the current network load and link status through an adaptive detection strategy is as follows:

[0234] Adaptive probing adjusts the probing frequency based on network load and link status, setting a baseline probing frequency. The detection frequency is dynamically adjusted based on the link performance. Adjustments can be made using the following formula:

[0235]

[0236] in, The reference detection frequency;

[0237] For time points The dynamic detection frequency at any given moment;

[0238] For time points Link load at any given moment;

[0239] This represents the maximum value of the link load.

[0240] For time points Bandwidth utilization at any given moment;

[0241] This represents the maximum bandwidth.

[0242] and To control the adjustment coefficient;

[0243] The formula means: when the link load As the frequency increases, the detection frequency also increases, and the bandwidth utilization rate also increases. As the frequency increases, the detection frequency decreases;

[0244] The detection method is dynamically adjusted based on the link status. When the link load is high, a lighter detection method is used, while when the load is low, a more precise detection method is used. A switching threshold for the detection method is set, and the detection method is adjusted according to the network load and status.

[0245]

[0246] in, For detection methods;

[0247] , This is the threshold for switching link load;

[0248] , This is the switching threshold for bandwidth utilization;

[0249] , , These correspond to different detection methods, namely lightweight, conventional, and depth detection.

[0250] This formula means that different detection methods are dynamically adopted based on different link loads and bandwidths.

[0251] Further refinement of the detection strategy involves adjusting the weights of load and bandwidth to more precisely control changes in the detection frequency, and adjusting the weighting factors. and Determine the extent to which link load and bandwidth affect the probe frequency:

[0252]

[0253] in, and To adjust the coefficients that influence the weights of link load and bandwidth;

[0254] The meanings of the other symbols are the same as before.

[0255] Adjusting the probing frequency and method based on network load and status effectively reduces network resource waste. When link load is high, the probing frequency is increased to ensure timely problem detection; when load is low, the probing frequency is reduced to avoid additional impact on network performance. Dynamically selecting lightweight or deep probing methods allows for appropriate probing strategies to be adopted for different link load conditions. This ensures efficient troubleshooting without wasting bandwidth and computing resources due to excessive probing. Weighted adjustments based on link load and bandwidth utilization allow for precise control of probing frequency changes, making it more aligned with the actual network environment and needs. This provides network administrators with greater flexibility and adjustability. Dynamic adjustments based on load and bandwidth not only better address changing network loads but also effectively identify potential performance bottlenecks or faults, providing timely warnings and reducing the risk of network outages.

[0256] The method of automatically switching to a backup path when a link anomaly is detected, using redundant path detection and intelligent routing technology, is as follows:

[0257] Link status monitoring is fundamental for redundant path switching. When a link anomaly occurs, the intelligent routing policy needs to identify it and automatically switch over, by setting the link status function. Its value represents the health status of the link; the lower the status value, the higher the probability of link failure. The formula for calculating the link status is as follows:

[0258]

[0259] in, For time points Link status at any given time;

[0260] For link latency;

[0261] Packet loss rate;

[0262] For bandwidth utilization

[0263] , , As a weighting factor;

[0264] when Exceeding the set threshold If the link is deemed abnormal, it will switch to an alternative path:

[0265]

[0266] In the event of a link failure, the system will use a backup path. Replace the currently faulty main link The backup path uses multiple redundant paths in the network. The criteria for path selection are based on latency, bandwidth, and load factors. The formula for backup path selection is expressed as:

[0267]

[0268] in, The set of all possible redundant paths;

[0269] As a candidate backup path;

[0270] For path The delay;

[0271] For path bandwidth;

[0272] For path The load;

[0273] , , , which is a weighting factor, representing the degree to which latency, bandwidth, and load affect path selection;

[0274] Once a link anomaly is detected, the system will quickly switch to the backup path. This process is described by a dynamic switching function, where the current path is set as... The alternative path is The moment of switching The following conditions must be met:

[0275]

[0276] Right now:

[0277] When the current path is the primary path And link status When the set threshold is exceeded, the system will automatically switch the current path to an alternate path. ;

[0278] After the link switches to the backup path, the network will restore bandwidth and perform intelligent routing adjustments. During the bandwidth restoration phase, traffic allocation is controlled through a bandwidth adjustment formula:

[0279]

[0280] in, This represents the bandwidth of the current path.

[0281] This refers to the total bandwidth of the network.

[0282] Reserved bandwidth;

[0283] This represents the number of available paths.

[0284] Link status monitoring and automatic switching of backup paths ensure rapid network recovery in the event of link failures, preventing prolonged network unavailability and significantly improving network stability and reliability. By dynamically selecting redundant paths and adjusting bandwidth, the system optimizes based on real-time network conditions, avoiding excessive network load or path overload, ensuring an optimal balance between bandwidth and latency. Intelligent routing technology automatically selects suitable backup paths based on link status, avoiding manual intervention, reducing human error, and improving the overall system automation. Dynamic bandwidth allocation and path switching based on network status enable resource allocation under high load conditions, preventing excessive resource waste or ineffective usage. The combination of path switching and bandwidth recovery mechanisms allows the network to resume operation in the shortest possible time after a link failure, greatly reducing network failure recovery latency.

[0285] The method of using real-time stream processing technology to process data streams from different detection sources, respond to changes in link performance, and generate feedback and alarms is as follows:

[0286] Real-time processing of data streams from different detection sources is performed to evaluate link performance. Monitoring metrics for the data streams, including latency, bandwidth utilization, and packet loss rate, are established, with each metric defined as follows: ,in Representing different monitoring parameters, Represents a timestamp;

[0287] The overall link performance score is calculated using a weighted sum formula:

[0288]

[0289] in, For time points Link performance score at any given time;

[0290] For at a certain point in time Constantly detected by the source The collected first One monitoring indicator;

[0291] For the first The weight of each monitoring indicator;

[0292] The total number of monitoring indicators;

[0293] When link performance When significant changes occur, feedback or alarms are generated. To detect changes in link performance in real time, the rate of change of link performance is calculated.

[0294]

[0295] like Exceeding a certain set threshold If so, it is considered that the link has undergone a significant change, that is:

[0296]

[0297] When the link performance change exceeds a predetermined threshold, feedback or an alarm is generated. The generation of feedback or alarm is based on the amount of link performance change and the current link health status, and an alarm threshold is set. Indicates the health status of the link; if the link performance... If the value is below this threshold, an alarm will be generated.

[0298]

[0299] Simultaneously, the system generates real-time feedback to help operations and maintenance personnel make decisions, generating optimization suggestions regarding bandwidth, latency, or other performance parameters based on performance changes and the current status.

[0300]

[0301] in, For time points Real-time feedback information;

[0302] This is a feedback generation function that generates targeted optimization suggestions or feedback information based on link performance, performance changes, and specific monitoring metrics.

[0303] Real-time stream processing technology continuously monitors the data stream and triggers alarms and performs feedback scheduling when conditions are met. It employs window functions within the stream processing framework, based on a specific time window. The trend of averaging link performance using a sliding window to process data streams:

[0304]

[0305] This formula represents the time window. Within the link, the moving average of link performance is used. If the difference between the moving average of link performance and the current performance is too large, an alarm or feedback will be triggered.

[0306]

[0307] Link health monitoring in real-time stream processing technology involves dynamically assessing link status through continuous analysis of real-time data streams, and establishing a link health status function as follows: When the link status Below the set threshold When an alarm is generated:

[0308]

[0309]

[0310] in, To determine the health status of the link, check its performance. and related monitoring indicators Calculation generated;

[0311] This is an evaluation function that assesses the health status of a link based on its performance score and other monitoring data.

[0312] Through real-time stream processing technology, the system can react immediately to changes in link performance, generating timely alerts and feedback to help operations and maintenance personnel quickly identify problems and take measures. The system can automatically calculate the rate of change in link performance and generate alerts when it exceeds a set threshold, significantly reducing manual intervention and improving network response speed and reliability. Using a sliding window to analyze link performance trends smooths out short-term fluctuations, reduces misjudgments, and improves alert accuracy. By comprehensively considering multiple monitoring indicators and dynamically calculating link performance, the system can accurately assess the health status of links, thereby generating timely alerts when link problems occur and preventing network service interruptions. The system not only generates alerts when link performance degrades but also provides targeted optimization suggestions based on current performance and trends, helping operations and maintenance personnel take preventative measures before link failures occur, thus improving system stability and performance.

[0313] A real-time link detection system includes:

[0314] Detection module: Used to perform multi-layer link detection, including physical layer detection, network layer detection and application layer performance detection, and to monitor network links in real time through different detection protocols;

[0315] Data processing module: Used to receive data from the detection module and analyze it using real-time data stream processing technology. The module includes anomaly detection, trend analysis, and performance prediction functions, and processes changes in link status in real time and generates reports.

[0316] Decision module: Based on the analysis results of the data processing module, it uses intelligent algorithms to evaluate the link status and predict faults, and automatically generates alarms or repair strategies.

[0317] Repair and Response Module: When a link failure or performance bottleneck is detected, the Repair and Response Module automatically performs network rerouting, traffic scheduling, or adjusts the detection strategy to repair the problem.

[0318] Visualization and monitoring module: Used to display the real-time status, performance data and alarm information of the link through an intuitive user interface, allowing network administrators to monitor the network status in real time.

[0319] Through multi-layered detection covering all aspects from the physical layer and network layer to the application layer, the system can comprehensively and accurately understand link performance. The data processing and decision-making modules work together to analyze link status changes in real time, intelligently assess link performance, and predict potential faults. The repair and response modules automatically execute repair measures, reducing human intervention and improving network recovery speed. Based on fault prediction and trend analysis, the system can provide early warnings of performance issues and guide maintenance personnel to take measures through feedback and optimization strategies. The system can quickly identify and repair link faults, reducing link downtime and improving overall network stability. A visual interface displays link status, helping administrators better understand network conditions and improving work efficiency.

[0320] This embodiment also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, it implements a real-time link detection method and system as described above.

[0321] This embodiment also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the real-time link detection method and system described above.

[0322] The adaptive strategy intelligently analyzes and dynamically adjusts based on the historical performance trends of the link, real-time bandwidth usage, and latency parameters.

[0323] This performance prediction algorithm not only considers the performance data of a single link, but also analyzes multiple links, using multivariate regression analysis or LSTM-based deep learning models for prediction.

[0324] In anomaly detection, a multivariate anomaly detection method based on the covariance matrix is ​​combined to analyze from multiple dimensions simultaneously and identify potential bottlenecks or anomaly patterns in the system in advance.

[0325] The repair mechanism involves combining deep packet inspection technology with traffic identification, dynamically adjusting network routing based on actual business traffic to avoid affecting the normal operation of critical services;

[0326] In addition to regular link status monitoring, the system also prioritizes links based on business traffic and data flow, and dynamically adjusts the monitoring strategy according to the link priority.

[0327] Redundant path selection is based not only on link availability, but also on a comprehensive evaluation of link real-time performance data, historical stability and load conditions, providing intelligent fault switching solutions for the network.

[0328] This invention introduces network topology awareness technology, which dynamically detects and locates faults based on the actual network topology. By continuously collecting the status information of links and nodes, the system automatically learns the dependencies between nodes in the network, quickly locates the fault point when a link is abnormal, and takes preventative measures in advance.

[0329] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), Rambus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0330] Those skilled in the art will understand that, for the sake of convenience and brevity, the above-described division of functional units and modules is used as an example. In practical applications, the above functions can be assigned to different functional units and modules as needed, that is, the internal structure of the system can be divided into different functional units or modules to complete all or part of the functions described above.

[0331] The above embodiments of the present invention are not intended to limit the scope of protection of the present invention. The implementation of the present invention is not limited thereto. All other modifications, substitutions or alterations made to the above structure of the present invention based on the above content of the present invention, in accordance with ordinary technical knowledge and common practice in the field, without departing from the basic technical idea of ​​the present invention, shall fall within the scope of protection of the present invention.

Claims

1. A real-time link detection method, characterized in that, Including: The reachability of the link is detected by physical layer detection, the routing path is traced by network layer detection, and application layer performance is monitored by deep packet inspection. Based on real-time detection data, machine learning and data mining techniques are used to analyze the network link status, automatically identify potential faults and performance bottlenecks, including anomaly detection and trend prediction, and predict changes in link performance through time series analysis. An adaptive detection strategy is used to dynamically adjust the detection frequency and method based on the current network load and link status. It employs redundant path detection and intelligent routing technology to automatically switch to a backup path when a link anomaly is detected; It employs real-time stream processing technology to process data streams from different detection sources, respond to changes in link performance, and generate feedback and alarms.

2. The data packet loss recovery method according to claim 1, characterized in that, The method for monitoring application layer performance involves detecting link reachability through physical layer probing, tracing routing paths through network layer probing, and employing deep packet inspection. The physical layer is used to check the reachability of the link. It uses signal strength, transmission delay and packet loss rate to identify whether the link is reachable. The detection techniques include ICMP Echo requests and network interface card status monitoring. Physical layer probing determines the validity of a link based on the transmitted signal strength and packet loss rate, assuming the link's packet loss rate is [missing information]. The health status of the link is assessed using the following formula: in, This represents the number of lost data packets. The total number of data packets sent; Traceroute operates based on ICMP and TTL values, determining the path by measuring the latency of each hop. For the first The delay of routing hops is calculated using the following formula to determine the total path delay: in, For the first The latency of the routing hop; This represents the number of hops traversed in the route. Application layer probing employs deep packet inspection (DPI) to examine the content of transmitted data packets and analyze application layer performance metrics. Application layer performance is calculated by analyzing multiple factors, including transmission latency, bandwidth, and packet loss. The transmission throughput is set as [value missing]. Data transmission latency is It is calculated using the following formula: in, For bandwidth; The amount of data transmitted; For application layer latency; More detailed performance analysis can be performed using DPI, and further refined by calculating protocol-level latency, as shown in the formula: in, This refers to the total response time of the HTTP request; The request was delayed; The response was delayed.

3. The data packet loss recovery method according to claim 2, characterized in that, Based on real-time detection data, machine learning and data mining techniques are used to analyze network link status, automatically identifying potential faults and performance bottlenecks, including anomaly detection and trend prediction. The method for predicting changes in link performance through time series analysis is as follows: The real-time detection data is preprocessed, including noise reduction, data cleaning, standardization, and feature extraction, including packet loss rate, latency, bandwidth, throughput, and time delay. To eliminate dimensional differences between different features, the data is standardized. in, This is the original data; The mean of the data; The standard deviation of the data; The data is standardized. Anomaly detection automatically identifies potential faults and performance bottlenecks, employing statistical and machine learning-based methods. Z-score is used to identify outliers in the data. If the Z-score value of a data point is too large or too small, it indicates that the data point is an outlier. in, The value of a certain data point; This is the mean of the data; This represents the standard deviation of the data. Time series analysis is used to predict trends in link performance, and methods include autoregression, moving average, ARIMA, and LSTM. The ARIMA model is a classic time series forecasting model that combines autoregression, differencing, and moving average. Its basic formula is: in, For time points Observed values; , ,..., These are autoregressive parameters; , ,..., The moving average parameter; LSTM is a neural network that learns long-term dependencies in time series data. It is used to predict link performance trends. Its basic operation uses a gating mechanism to control the flow of information. The formula is as follows: in, , , These are the forget gate, input gate, and output gate, respectively. In cellular state; It is in a hidden state; , , , This is the weight matrix; This is the current input; Based on the above analysis methods, link state prediction based on machine learning predicts link performance changes by building a model and establishing... For the prediction function, For time points The feature data is used for prediction, and the formula is: in, For time points Link state prediction results; For time points Input feature data; For a trained machine learning model; When identifying anomalies and bottlenecks, a classification model is established to automatically detect faults and performance bottlenecks in the pipeline, combining a machine learning classifier. The input features are The classification formula is: in, The predicted results for faults or bottlenecks; For time points Feature data.

4. The data packet loss recovery method according to claim 3, characterized in that, The method of dynamically adjusting the detection frequency and detection method based on the current network load and link status through an adaptive detection strategy is as follows: Adaptive probing adjusts the probing frequency based on network load and link status, setting a baseline probing frequency. The detection frequency is dynamically adjusted based on the link performance. Adjustments can be made using the following formula: in, The reference detection frequency; For time points The dynamic detection frequency at any given moment; For time points Link load at any given moment; This represents the maximum value of the link load. For time points Bandwidth utilization at any given moment; This represents the maximum bandwidth. and To control the adjustment coefficient; The formula means: when the link load As the frequency increases, the detection frequency also increases, and the bandwidth utilization rate also increases. As the frequency increases, the detection frequency decreases; The detection method is dynamically adjusted based on the link status. When the link load is high, a lighter detection method is used, while when the load is low, a more precise detection method is used. A switching threshold for the detection method is set, and the detection method is adjusted according to the network load and status. in, For detection methods; , This is the threshold for switching link load. , This is the switching threshold for bandwidth utilization; , , These correspond to different detection methods, namely lightweight, conventional, and depth detection. This formula means that different detection methods are dynamically adopted based on different link loads and bandwidths. Further refinement of the detection strategy involves adjusting the weights of load and bandwidth to more precisely control changes in the detection frequency, and adjusting the weighting factors. and Determine the extent to which link load and bandwidth affect the probe frequency: in, and To adjust the coefficients that influence the weights of link load and bandwidth; The meanings of the other symbols are the same as before.

5. The data packet loss recovery method according to claim 4, characterized in that, The method of automatically switching to a backup path when a link anomaly is detected, using redundant path detection and intelligent routing technology, is as follows: Link status monitoring is fundamental for redundant path switching. When a link anomaly occurs, the intelligent routing policy needs to identify it and automatically switch over, by setting the link status function. Its value represents the health status of the link; the lower the status value, the higher the probability of link anomaly. The formula for calculating the link status is as follows: in, For time points Link status at any given time; For link latency; Packet loss rate; For bandwidth utilization , , As a weighting factor; when Exceeding the set threshold If the link is deemed abnormal, it will switch to an alternative path: In the event of a link failure, the system will use a backup path. Replace the currently faulty main link The backup path uses multiple redundant paths in the network. The criteria for path selection are based on latency, bandwidth, and load factors. The formula for backup path selection is expressed as: in, The set of all possible redundant paths; As a candidate backup path; For path The delay; For path bandwidth; For path The load; , , , which is a weighting factor, representing the degree to which latency, bandwidth, and load affect path selection; Once a link anomaly is detected, the system will quickly switch to the backup path. This process is described by a dynamic switching function, where the current path is set as... The alternative path is The moment of switching The following conditions must be met: Right now: When the current path is the primary path And link status When the set threshold is exceeded, the system will automatically switch the current path to an alternate path. ; After the link switches to the backup path, the network will restore bandwidth and perform intelligent routing adjustments. During the bandwidth restoration phase, traffic allocation is controlled through a bandwidth adjustment formula: in, This represents the bandwidth of the current path. This refers to the total bandwidth of the network. Reserved bandwidth; This represents the number of available paths.

6. The data packet loss recovery method according to claim 5, characterized in that, The method of using real-time stream processing technology to process data streams from different detection sources, respond to changes in link performance, and generate feedback and alarms is as follows: Real-time processing of data streams from different detection sources is performed to evaluate link performance. Monitoring metrics for the data streams, including latency, bandwidth utilization, and packet loss rate, are established, with each metric defined as follows: ,in Representing different monitoring parameters, Represents a timestamp; The overall link performance score is calculated using a weighted sum formula: in, For time points Link performance score at any given time; For at a certain point in time Constantly detected by the source The collected first One monitoring indicator; For the first The weight of each monitoring indicator; The total number of monitoring indicators; When link performance When significant changes occur, feedback or alarms are generated. To detect changes in link performance in real time, the rate of change of link performance is calculated. like Exceeding a certain set threshold If so, it is considered that the link has undergone a significant change, that is: When the link performance change exceeds a predetermined threshold, feedback or an alarm is generated. The generation of feedback or alarm is based on the amount of link performance change and the current link health status, and an alarm threshold is set. Indicates the health status of the link; if the link performance... If the value is below this threshold, an alarm will be generated. Simultaneously, the system generates real-time feedback to help operations and maintenance personnel make decisions, generating optimization suggestions regarding bandwidth, latency, or other performance parameters based on performance changes and the current status. in, For time points Real-time feedback information; This is a feedback generation function that generates targeted optimization suggestions or feedback information based on link performance, performance changes, and specific monitoring metrics. Real-time stream processing technology continuously monitors the data stream and triggers alarms and performs feedback scheduling when conditions are met. It employs window functions within the stream processing framework, based on a specific time window. The trend of averaging link performance using a sliding window to process data streams: This formula represents the time window. Within the link, the moving average of link performance is used. If the difference between the moving average of link performance and the current performance is too large, an alarm or feedback will be triggered. Link health monitoring in real-time stream processing technology involves dynamically assessing link status through continuous analysis of real-time data streams, and establishing a link health status function as follows: When the link status Below the set threshold When an alarm is generated: in, To determine the health status of the link, check its performance. and related monitoring indicators Calculation generated; This is an evaluation function that assesses the health status of a link based on its performance score and other monitoring data.

7. A real-time link detection system, characterized in that, Including: Detection module: Used to perform multi-layer link detection, including physical layer detection, network layer detection and application layer performance detection, and to monitor network links in real time through different detection protocols; Data processing module: Used to receive data from the detection module and analyze it using real-time data stream processing technology. The module includes anomaly detection, trend analysis, and performance prediction functions, and processes changes in link status in real time and generates reports. Decision module: Based on the analysis results of the data processing module, it uses intelligent algorithms to evaluate the link status and predict faults, and automatically generates alarms or repair strategies. Repair and Response Module: When a link failure or performance bottleneck is detected, the Repair and Response Module automatically performs network rerouting, traffic scheduling, or adjusts the detection strategy to repair the problem. Visualization and monitoring module: Used to display the real-time status, performance data and alarm information of the link through an intuitive user interface, allowing network administrators to monitor the network status in real time.

8. An electronic device, characterized in that, It includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, it implements a real-time link detection method as described in any one of claims 1-6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by the processor, the program implements a real-time link detection method as described in any one of claims 1-6.

Images