A performance overload intelligent early warning method and system for a network security device

Abstract

This invention relates to the field of network security technology and discloses a method and system for intelligent early warning of performance overload of network security devices. The method includes acquiring operating status data and response latency data; performing time-domain segmented feature extraction processing on the operating status data to obtain dynamic load trend features; performing anomaly verification and physical resource association mapping processing based on the response latency data and the dynamic load trend features to obtain system performance bottlenecks; extracting original alarm signals based on the system performance bottlenecks, and combining them with an alarm type rule base to perform business rule mapping to generate a final sequence, thus generating a final overload early warning sequence. This method can accurately distinguish between instantaneous traffic fluctuations and actual overload, trace hardware bottlenecks across dimensions, effectively eliminate invalid interference noise, and improve early warning accuracy.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method and system for intelligent early warning of performance overload for network security equipment. Background Technology

[0002] Currently, with the rapid development of information technology, cyberspace security has become a core area for ensuring data and system stability. To cope with increasingly complex cybersecurity threats, firewalls, intrusion prevention systems, and other equipment bear critical protective responsibilities. The stability of their operation directly affects the reliability of the overall security protection system and is of great significance for predicting risks during system operation.

[0003] In existing technologies, distributed monitoring systems or built-in performance auditing modules are typically used to collect processor operating metrics in real time, and then combined with fixed threshold judgment logic to monitor the load level of the equipment. This type of solution mainly obtains surface-level indicators of equipment status and uses preset alarm rules to identify resource usage in a single dimension. However, when facing business fluctuations in complex network environments, this static threshold-based monitoring method struggles to achieve a deep understanding of dynamic changes in equipment resources. Due to the lack of sustained characteristics of resource load peaks and correlation analysis between multi-dimensional indicators, the system struggles to accurately distinguish between transient interference and persistent resource overload, failing to extract true performance risk signals from massive monitoring metrics, easily leading to lags and biases in system performance evaluation.

[0004] Existing technologies suffer from low accuracy in identifying overloaded network security devices and inconsistent warning signals. Summary of the Invention

[0005] This invention provides a method and system for intelligent early warning of performance overload of network security devices, in order to solve the problems of low accuracy in identifying performance overload status of network security devices and chaotic early warning signals in the prior art.

[0006] Firstly, in order to solve the above-mentioned technical problems, the present invention provides a method for intelligent early warning of performance overload for network security devices, comprising:

[0007] The system acquires operational status data of network security devices and response latency data of network communication, and performs time-domain segmentation feature extraction processing on the operational status data to obtain dynamic load trend features. The load similarity index is obtained by performing a similarity matching operation between the dynamic load trend characteristics and a pre-built historical high load pattern library. Anomaly verification is performed based on the load similarity index and the preset anomaly deviation benchmark to obtain load anomaly classification labels; Based on the load anomaly classification label, abnormal time period data is extracted from the response latency data. The abnormal time period data is divided into intervals to obtain the latency peak distribution interval. Based on the latency peak distribution interval and the dynamic load trend characteristics, physical resource association mapping is performed to obtain the system performance bottleneck point. Obtain signal interference spectrum data transmitted by network nodes, perform matching and retrieval in the system log according to the system performance bottleneck point to obtain the corresponding original alarm signal, and perform invalid interference screening processing on the original alarm signal according to the signal interference spectrum data to obtain a preliminary warning signal sequence; Extract the warning threshold corresponding to the preliminary warning signal sequence, filter high-risk signals based on the warning threshold, and generate the final overload warning sequence.

[0008] Secondly, the present invention provides an intelligent early warning system for performance overload of network security devices, comprising: The data extraction module is used to acquire the operating status data of network security devices and the response latency data of network communication, and to perform time-domain segmented feature extraction processing on the operating status data to obtain dynamic load trend features. The similarity matching module is used to perform similarity matching calculations between the dynamic load trend characteristics and a pre-built historical high load pattern library to obtain a load similarity index. The classification label module is used to perform anomaly verification processing based on the load similarity index and the preset anomaly deviation benchmark to obtain load anomaly classification labels. The bottleneck identification module is used to extract abnormal time period data from the response latency data according to the load anomaly classification label, perform interval division processing on the abnormal time period data to obtain the latency peak distribution interval, and perform physical resource association mapping processing on the latency peak distribution interval and the dynamic load trend characteristics to obtain the system performance bottleneck point. The signal filtering module is used to acquire signal interference spectrum data transmitted by network nodes, perform matching and retrieval in the system log according to the system performance bottleneck point to obtain the corresponding original alarm signal, and perform invalid interference filtering processing on the original alarm signal according to the signal interference spectrum data to obtain a preliminary warning signal sequence. The early warning generation module is used to extract the early warning threshold corresponding to the preliminary early warning signal sequence, filter high-risk signals based on the early warning threshold, and generate the final overload early warning sequence.

[0009] Compared with the prior art, the present invention has the following beneficial effects: (1) This invention obtains the operating status data of network security devices, performs time-domain segmented feature extraction, and combines it with a pre-built historical high-load pattern library for similarity matching and anomaly deviation verification, thereby achieving dynamic tracking and accurate verification of device load status. This mechanism breaks through the limitations of traditional single-point monitoring based on static physical thresholds, effectively distinguishing between instantaneous traffic fluctuations and real continuous resource overload in complex network environments, significantly improving the accuracy of identifying device performance overload status, and reducing the false alarm rate from the source.

[0010] (2) This invention extracts the peak latency distribution range during abnormal periods from network communication response latency data and performs physical resource correlation mapping with dynamic load trend characteristics, thereby achieving cross-dimensional tracing from surface response latency phenomena to deep hardware bottlenecks. Compared with the pain point of isolated monitoring indicators in existing technologies, this solution deeply maps multi-dimensional time-series characteristics with underlying physical resources, which can accurately pinpoint the real physical bottlenecks that limit system performance, providing precise data support for subsequent performance intervention and targeted protection.

[0011] (3) This invention introduces signal interference spectrum data to filter out invalid interference from the original alarm signals extracted based on system performance bottlenecks, and combines it with an alarm type rule base to map business rules to generate the final sequence, thus constructing a signal purification mechanism from bottom-level physical noise reduction to top-level business alignment. This mechanism effectively eliminates invalid false alarm noise caused by high-frequency signal crosstalk or disordered fluctuations, solves the problems of chaotic and stacked warning signals, and ensures the high purity and high business directivity of the final overload warning sequence without increasing additional system overhead, significantly enhancing the overall response efficiency of network security equipment. Attached Figure Description

[0012] Figure 1 This is a schematic flowchart of the intelligent early warning method for performance overload of network security equipment provided in the first embodiment of the present invention; Figure 2 This is a schematic diagram of the performance overload intelligent early warning system for network security devices provided in the second embodiment of the present invention. Detailed Implementation

[0013] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0014] Reference Figure 1The first embodiment of the present invention provides a method for intelligent early warning of performance overload for network security devices, comprising the following steps: S1, acquire the operating status data of network security devices and the response latency data of network communication, and perform time-domain segmentation feature extraction processing on the operating status data to obtain dynamic load trend features; S2, perform similarity matching calculations between the dynamic load trend characteristics and the pre-built historical high load pattern library to obtain a load similarity index; S3, perform anomaly verification processing based on the load similarity index and the preset anomaly deviation benchmark to obtain load anomaly classification labels; S4. Extract abnormal time period data from the response latency data according to the load anomaly classification label, perform interval division processing on the abnormal time period data to obtain the latency peak distribution interval, and perform physical resource association mapping processing on the latency peak distribution interval and the dynamic load trend characteristics to obtain the system performance bottleneck point. S5, acquire signal interference spectrum data transmitted by network nodes, perform matching and retrieval in the system log according to the system performance bottleneck point to obtain the corresponding original alarm signal, and perform invalid interference screening processing on the original alarm signal according to the signal interference spectrum data to obtain a preliminary warning signal sequence; S6, extract the warning threshold corresponding to the preliminary warning signal sequence, filter high-risk signals according to the warning threshold, and generate the final overload warning sequence.

[0015] In step S1, the operating status data of the network security device and the response latency data of the network communication are obtained, and the operating status data is processed by time-domain segmentation feature extraction to obtain dynamic load trend features.

[0016] Specifically, the time-domain segmentation feature extraction process is performed on the operating status data to obtain dynamic load trend features, including: Extract the peak load from the processor load data in the operating status data; For the memory usage data in the running status data, calculate the variance of the data within a preset memory fluctuation statistical period to obtain the memory usage fluctuation amplitude; For the storage space data in the aforementioned operating status data, predictive processing is performed to obtain the remaining space trend characteristics; The load peak, the memory usage fluctuation, and the remaining space trend characteristics are weighted and calculated to generate an initial resource monitoring sequence. The initial resource monitoring sequence is then segmented into time periods to obtain dynamic load trend characteristics.

[0017] In one implementation, a low-level monitoring agent service deployed on the network security device's operating system extracts processor load data, memory usage data, storage space data, and network communication response latency data at a fixed data collection frequency. In this embodiment, processor load data, memory usage data, and storage space data are integrated to construct runtime status data. For the processor load data within the runtime status data, this embodiment uses a sliding window. A data window of a fixed time length is slid along the time axis, point by point, to extract the maximum value of all processor load values ​​within the current data window. This maximum value is then determined as the load peak value corresponding to the current time window.

[0018] It should be noted that the preset memory fluctuation statistics period is determined in this embodiment using an objective system performance calibration method. Specifically, this embodiment first checks whether the current network security device has historical operation records; if historical operation records are detected, the average time interval sequence of system memory page allocation and reclamation in the device's historical operation records is extracted, the median value of the time difference of this time interval sequence is calculated, and this median value of the time difference is set as the preset memory fluctuation statistics period; if no historical operation records are detected, the factory-preset benchmark stress test memory scheduling cycle constant, such as 30 seconds, is extracted from the underlying system, and this benchmark stress test memory scheduling cycle constant is set as the preset memory fluctuation statistics period. This embodiment extracts all memory usage data within the preset memory fluctuation statistics period, calculates the arithmetic variance of all memory usage data within this period, and strictly determines the obtained arithmetic variance value as the memory usage fluctuation amplitude.

[0019] It is worth noting that, for the storage space data in the aforementioned operational status data, this embodiment uses linear regression for prediction. This embodiment uses the timestamp as the independent variable and the corresponding storage space occupancy value as the dependent variable. The least squares method is used to fit the linear relationship between the independent and dependent variables, and the slope of the fitted line is calculated. This slope value is then determined as the remaining space trend characteristic representing the storage growth rate.

[0020] In one implementation, the obtained load peak, memory usage fluctuation amplitude, and remaining space trend characteristics are respectively subjected to maximum and minimum value normalization processing. This embodiment obtains pre-calculated processor weight factor, memory weight factor, and storage weight factor. Regarding the determination of each weight factor, this embodiment uses principal component analysis to extract processor data, memory data, and storage data from the historical overload sample dataset to construct a covariance matrix, and calculates the eigenvalues ​​and eigenvectors of this covariance matrix. This embodiment extracts the principal component eigenvector corresponding to the largest eigenvalue, and divides the absolute value of each dimension of this principal component eigenvector by the sum of the absolute values ​​of all dimensions. The resulting three ratios are determined as the processor weight factor, memory weight factor, and storage weight factor, respectively. In this embodiment, the normalized load peak is multiplied by the processor weight factor, the normalized memory usage fluctuation is multiplied by the memory weight factor, and the normalized remaining space trend characteristic is multiplied by the storage weight factor. The results of the above three multiplication operations are summed to obtain the resource monitoring index for a single time node. The resource monitoring indices of multiple consecutive time nodes are concatenated in chronological order to generate an initial resource monitoring sequence.

[0021] Subsequently, this embodiment performs time-segmentation processing on the initial resource monitoring sequence. This embodiment divides the initial resource monitoring sequence into multiple non-overlapping data subsequences according to a fixed time span, calculates the continuous duration for which the resource monitoring index is greater than a given benchmark value in each data subsequence, and counts the number of times the resource monitoring index undergoes positive and negative slope reversals. The structured data vector formed by combining the continuous duration and the count is determined as the dynamic load trend feature.

[0022] It should be noted that this embodiment uses frequency domain analysis to determine the fixed time span. This embodiment extracts network traffic time-series data from historical long-term monitoring, performs spectral transformation on the network traffic time-series data using the Fast Fourier Transform algorithm, and calculates the energy spectral density distribution. This embodiment extracts the dominant frequency value corresponding to the global maximum value of the energy spectral density, calculates the reciprocal of this dominant frequency value to obtain the service fluctuation cycle duration, and strictly sets this service fluctuation cycle duration as the fixed time span. Regarding the determination of the given benchmark value, this embodiment uses the statistical quantile method. This embodiment extracts the set of full resource monitoring indices generated by the device during historical steady-state operation, and arranges all values ​​in the set in ascending order from smallest to largest. This embodiment calculates and extracts the specific value corresponding to the 85th percentile in the arranged sequence, and objectively labels it as the given benchmark value.

[0023] For example, network security devices extract operational status data at a frequency of five seconds. For processor load data, a window sliding along the time axis for sixty seconds is used to extract the maximum value of 85%, which is then defined as the load peak. The historical memory scheduling median is extracted, and a preset memory fluctuation statistical period of sixty seconds is set. The variance of all memory usage data within this period is calculated to obtain a memory usage fluctuation amplitude of 10%. For storage space data, a residual space trend feature with a slope of 2.5% is obtained through linear regression least squares fitting. Based on principal component analysis, processor weight factors of 0.4, memory weight factors of 0.3, and storage weight factors of 0.3 are extracted. The extracted load peak is normalized to its maximum and minimum values, resulting in a value of 0.85, which is multiplied by the processor weight factor of 0.4. The normalized memory fluctuation amplitude value is 0.10, multiplied by a weight of 0.3. The normalized residual space feature value is 0.025, multiplied by a weight of 0.3. The three product results are added together to generate a resource monitoring index for a single time node, which is then assembled into an initial resource monitoring sequence in chronological order. In this embodiment, the sequence is divided into data subsequences with a time span of 30 minutes. The duration of the resource monitoring index exceeding the benchmark value in a certain subsequence is 18 minutes and the number of reversals is 5. The 18 minutes and the 5 reversals are packaged to generate dynamic load trend features.

[0024] In step S2, a similarity matching operation is performed between the dynamic load trend characteristics and a pre-built historical high load pattern library to obtain a load similarity index, including: Calculate the similarity between the dynamic load trend characteristics and historical data in the historical high load pattern library; The dynamic load trend characteristics and the current business scenario are evaluated for feature importance to obtain a feature importance index; The load similarity index is obtained by performing data fusion processing based on the similarity and the feature importance index.

[0025] In one implementation, regarding the method for establishing the pre-built historical high-load pattern library, this embodiment constructs a localized historical high-load pattern library specifically for a particular network security device. During the initial deployment and trial operation phase of the device, this embodiment introduces automated stress testing, using a traffic generator to inject simulated stepped high-concurrency burst traffic into the system, forcing the device's processor, memory, and other physical resources to reach a preset physical limit. Regarding the preset physical limit, this embodiment extracts the lowest percentage of physical resource utilization during the stress test when the device's underlying system begins to trigger performance degradation phenomena such as packet loss, connection rejection, or response timeouts due to resource exhaustion, and uses this as the objective calibrator for the preset physical limit. This embodiment directly hard-codes and labels the dynamic load characteristic data collected during this stress test as the actual overload state, using it as the first batch of basic marker data for the cold start phase.

[0026] After acquiring the first batch of basic marker data, this embodiment continuously collects operational characteristic samples of the equipment during actual operation. When the actual business traffic causes the physical resource occupancy of the equipment to reach the physical limit level determined in the stress test, this embodiment automatically marks the dynamic load characteristic data corresponding to that time period as a true overload state. This embodiment extracts the dynamic load characteristic data of the corresponding time period marked as a true overload state from the historical equipment alarm logs, integrates them into a multi-dimensional historical data set, and stores it in a vector database as a pre-built localized historical high load pattern library.

[0027] This embodiment extracts the dynamic load trend features generated in the preceding steps and uses the nearest neighbor algorithm to calculate the Euclidean distance between the dynamic load trend features and all historical data in the historical high load pattern library. Regarding the determination of the neighbor number parameter in the nearest neighbor algorithm, this embodiment uses multi-fold cross-validation to evaluate the classification accuracy under different neighbor number settings on the multidimensional historical data set, and extracts the neighbor value corresponding to the maximum accuracy as the target neighbor parameter. This embodiment sorts all calculated Euclidean distances in ascending order of value, extracts the top-ranked Euclidean distances, and ensures that the total number of extracted Euclidean distances is strictly equal to the target neighbor parameter. The arithmetic mean of these extracted Euclidean distances is calculated. This embodiment divides the value by the sum of this arithmetic mean and a preset minimum smoothing constant, and determines the result as the similarity. The preset minimum smoothing constant is the minimum floating-point precision of the system, such as... This is used to prevent overflow during division by zero calculations.

[0028] It should be noted that this embodiment extracts real-time network traffic logs from network security devices, statistically analyzes the total number of concurrent connections, the proportion of specific protocol packets, and the frequency of abnormal requests within a fixed time window, and concatenates these values ​​to construct a quantified current business scenario vector. Regarding the determination of the fixed time window, this embodiment extracts the time span from the establishment to the release of all complete Transmission Control Protocol (TCP) connections in historical network communication data, calculates the arithmetic mean of this time span, and strictly sets this arithmetic mean as the fixed time window. This embodiment uses a decision tree to evaluate the feature importance of the dynamic load trend characteristics and the current business scenario vector. Specifically, this embodiment extracts a classification decision tree model pre-trained based on load characteristics, business scenario data, and overload result labels under historical conditions. This classification decision tree model uses Gini impurity as the node splitting criterion. Regarding the determination of the maximum tree depth parameter and the minimum number of leaf node samples parameter of this classification decision tree model, this embodiment uses a grid search method combined with multi-fold cross-validation for calibration. This embodiment traverses a preset hyperparameter candidate space, extracts the parameter combinations corresponding to the maximum value of the validation set classification accuracy, and sets these as the maximum tree depth parameter and the minimum number of leaf node samples parameter of the classification decision tree model, respectively. Based on the set parameters, a pre-pruning operation is performed during the model training phase. This embodiment tracks the traversal path after the dynamic load trend feature is input into the classification decision tree model, extracts the sum of values ​​of the dynamic load trend feature that reduce Gini impurity in all nodes participating in the split; this embodiment divides this sum of values ​​by the overall sum of all features in the model that reduce Gini impurity, obtaining a proportionality constant between zero and one, which is strictly determined as the feature importance index.

[0029] It is worth noting that this embodiment performs data fusion processing based on the similarity and the feature importance index to obtain the load similarity index. This embodiment obtains a pre-objectively labeled first fusion weight and second fusion weight. Regarding the determination of the first fusion weight and the second fusion weight, this embodiment extracts the predicted residual variance of the overload result determined solely by similarity and the predicted residual variance of the overload result determined solely by the feature importance index from historical evaluation data; this embodiment uses the inverse variance allocation method, dividing the inverse of each predicted residual variance by the sum of the inverses of the two predicted residual variances, and labels them as the first fusion weight and the second fusion weight, respectively. This embodiment calculates the product of the similarity and the first fusion weight, calculates the product of the feature importance index and the second fusion weight, and performs algebraic addition to sum the results of these two products, outputting the final calculation result as the load similarity index.

[0030] For example, in this embodiment, dynamic load trend features are obtained, and the number of neighbors for the nearest neighbor algorithm is determined to be 5 through multi-fold cross-validation. The arithmetic mean of the five smallest Euclidean distances between the dynamic load trend features and the historical data in the database is calculated to be 2.0. Dividing 1 by (2.0 + 0.0001) yields a similarity of approximately 0.5. Simultaneously, the dynamic load trend features and the constructed current business scenario vector are input into a classification decision tree model. The total reduction in Gini impurity contributed by the dynamic load trend features is calculated to be 0.25, and the overall reduction in Gini impurity of the model is 1.0. Dividing the two yields a feature importance index of 0.25. The first fusion weight, calculated based on the inverse of the variance of the historical prediction residuals, is 0.6, and the second fusion weight is 0.4. In this embodiment, 0.5 is multiplied by 0.6 to obtain 0.30, and 0.25 is multiplied by 0.4 to obtain 0.10. Adding 0.30 and 0.10, the final load similarity index is 0.40.

[0031] In step S3, anomaly verification is performed based on the load similarity index and a preset anomaly deviation benchmark to obtain a load anomaly classification label, including: Extract the standard deviation multiple of the load value from the historical mean in the dynamic load trend characteristics; The standard deviation multiple is logically compared with a preset abnormal deviation benchmark. If the standard deviation multiple exceeds the abnormal deviation benchmark and the load similarity index meets the preset threshold condition, it is determined to be a continuous high load state. Based on the characteristic data mapping business scenario attributes in the continuous high load state, load anomaly classification labels are generated.

[0032] In one implementation, the dynamic load trend features generated in the preceding steps are extracted, and the current load peak data sequence is extracted from them. This embodiment extracts full load feature sample data from the historical operating database under normal, non-alarm conditions, calculates the arithmetic mean of this full load feature sample data, and strictly determines it as the historical mean; simultaneously, the variance corresponding to this full load feature sample data is calculated and its square root is taken to obtain the historical standard deviation. This embodiment subtracts the historical mean from the values ​​in the current load peak data sequence to calculate the absolute deviation value; subsequently, the absolute deviation value is divided by the historical standard deviation to calculate a dimensionless relative coefficient characterizing the degree of deviation, and this relative coefficient is determined as the standard deviation multiple.

[0033] It should be noted that this embodiment uses a combination of statistical analysis and performance-driven methods to objectively calibrate the preset abnormal deviation benchmark and the preset threshold condition. For the preset abnormal deviation benchmark, this embodiment extracts the standard deviation multiple corresponding to the historical steady-state data distribution boundary based on the Laida criterion of normal distribution, and sets it as the preset abnormal deviation benchmark. For the preset threshold condition, this embodiment extracts the sample set that has been verified as having a true high load as positive samples, and extracts the sample set of false alarms and transient fluctuations as negative samples; calculates the load similarity index of each sample output in the previous stage, and plots the Receiver Operating Characteristic (ROC) curve; this embodiment calculates the Youden index at each coordinate point on the curve, extracts the load similarity index value corresponding to the maximum value of the Youden index, and objectively calibrates it as the preset threshold condition.

[0034] It is worth noting that this embodiment performs dual logical verification. This embodiment logically compares the calculated standard deviation multiple with the preset abnormal deviation benchmark, and simultaneously extracts the load similarity index generated in the previous steps, determining whether its value is greater than or equal to the preset threshold condition. If the standard deviation multiple is greater than the preset abnormal deviation benchmark, and the load similarity index is greater than or equal to the preset threshold condition, this embodiment outputs a Boolean type judgment result representing an abnormal state, determining that the current device is in a continuous high-load state. If neither of the above conditions is simultaneously met, the current system is determined to be in a normal instantaneous traffic jitter state, allowing passage and continuing into the next cycle of regular monitoring flow. This embodiment performs attribute association on the feature data of the continuous high-load state. This embodiment obtains a pre-established business scenario mapping dictionary, which uses the DBSCAN clustering algorithm to extract the source port, destination port, and communication protocol combination of historical traffic and maps them to the corresponding service identifier. Regarding the parameter settings of the DBSCAN clustering algorithm, this embodiment extracts the total number of historical traffic feature dimensions participating in clustering, and strictly determines the minimum number of core points by multiplying the total number of feature dimensions by a numerical value. For the neighborhood radius, this embodiment calculates the Euclidean distance from each data point in the historical traffic data set to its T-th nearest neighbor data point, where T equals the minimum number of core points. All calculated Euclidean distances are arranged in descending order to construct a T-distance distribution curve. The Euclidean distance value corresponding to the absolute maximum value of the second derivative of this curve, i.e., the inflection point with the largest rate of curvature change, is extracted and objectively labeled as the neighborhood radius. This embodiment extracts the business identifier corresponding to the current feature data by querying the business scenario mapping dictionary, and determines it as the business scenario attribute. This embodiment concatenates the business scenario attribute with the current load value to generate a text string sequence with business orientation, and outputs this text string sequence as a load anomaly classification label.

[0035] For example, in this embodiment, the current load peak is extracted as 88% from the dynamic load trend characteristics. Historical data under normal conditions is extracted, and the historical mean is calculated to be 65%, with a historical standard deviation of 10%. Subtracting 65% from 88% yields an absolute deviation of 23%. Dividing 23% by 10% yields a standard deviation multiple of 2.3. This embodiment extracts a preset abnormal deviation benchmark of 1.5 based on the Raida criterion. Simultaneously, the load similarity index output from the previous steps is 0.92, and the preset threshold condition based on maximizing the Youden index is 0.85. After dual logical comparison, since 2.3 is greater than 1.5 and 0.92 is greater than 0.85, the system determines that the device has entered a sustained high load state. This embodiment extracts the current traffic port and protocol characteristics, retrieves the corresponding business scenario attribute "database batch update" from the business scenario mapping dictionary, concatenates it with the status text, and finally generates the text sequence "database batch update - high load anomaly," which is output as a load anomaly classification label.

[0036] In step S4, abnormal time period data is extracted from the response latency data according to the load anomaly classification label, the abnormal time period data is divided into intervals to obtain the latency peak distribution interval, and physical resource association mapping is performed based on the latency peak distribution interval and the dynamic load trend characteristics to obtain the system performance bottleneck point.

[0037] Specifically, the abnormal time period data is divided into intervals to obtain the delay peak distribution intervals, including: The ARIMA model is used to perform time series analysis on the memory usage features corresponding to the load anomaly classification labels to obtain the predicted memory usage values ​​for future time steps. Calculate the statistical correlation coefficient between storage space characteristics and response latency data; The predicted memory usage, the statistical correlation coefficient, and the response delay distribution characteristics in the abnormal time period data are used to construct a multidimensional delay feature vector. The multidimensional delay feature vector is then clustered to obtain the delay peak distribution interval.

[0038] In one implementation, the timestamp sequence corresponding to the load anomaly classification label generated in the preceding steps is extracted. Based on this timestamp sequence, the pre-acquired response delay data is processed by time window truncation, and the response delay value sequence falling within this timestamp sequence is determined as abnormal period data. This embodiment extracts the memory usage characteristics corresponding to the abnormal period data and uses an Autoregressive Integral Moving Average (ARIMA) model for time series analysis. Regarding the determination method for the difference order, autoregressive order, and moving average order parameters of the ARIMA model, this embodiment uses a grid search method combined with rigorous statistical tests for calibration. This embodiment calculates the minimum difference order that allows the memory history sequence to reach a stationary state through the enhanced Dickey-Fuller test. After determining the difference order, minimizing the Akaike Information Criterion (AIC) is used as the calculation objective. The given candidate space of autoregressive and moving average parameters is traversed, and the parameter combinations corresponding to the minimum AIC value are extracted and determined as the optimal autoregressive order and moving average order, respectively. In this embodiment, the memory usage characteristics are input into the ARIMA model determined by the above parameters for single-step forward extrapolation calculation, and the single predicted value output by the calculation is strictly determined as the memory usage prediction value for the future time step.

[0039] It should be noted that in this embodiment, the storage space feature data and the response latency data within the time window corresponding to the abnormal period data are extracted. Linear regression analysis is used to calculate the Pearson correlation coefficient between the two sequences, and the calculated Pearson correlation coefficient value is strictly set as the statistical correlation coefficient. Subsequently, this embodiment calculates the skewness coefficient and kurtosis coefficient of the response latency value distribution in the abnormal period data, and combines these two statistical values ​​as the response latency distribution feature. In this embodiment, the predicted memory usage value, the statistical correlation coefficient, and the response latency distribution feature are respectively subjected to maximum and minimum value normalization processing, and then concatenated sequentially according to a fixed data bit width, such as 256 bits, to construct a single multidimensional latency feature vector. If the extracted feature bit width is insufficient, zero-padding is used to pad to the fixed data bit width to ensure the uniformity of the feature vector dimension.

[0040] It is worth noting that this embodiment uses the K-Means clustering algorithm to cluster a large number of historically extracted multidimensional delay feature vectors and the currently generated multidimensional delay feature vectors. Regarding the method for determining the number of clusters K in the K-Means clustering algorithm, this embodiment extracts a dataset containing all historical multidimensional delay feature vectors, calculates the average profile coefficient of the entire sample under different cluster numbers, extracts the cluster number corresponding to the global maximum value of the average profile coefficient, and objectively sets it as the cluster number K. This embodiment substitutes the currently generated multidimensional delay feature vectors into the configured K-Means algorithm model for Euclidean distance calculation and cluster assignment, extracting the target cluster containing the highest mean response delay data; establishes an index mapping table between the multidimensional delay feature vectors and the original abnormal time period data; after clustering, based on the feature vector index in the target cluster, backtracks to extract its corresponding original response delay value set; this embodiment calculates the maximum and minimum values ​​of all response delay data within the target cluster, and outputs the numerical range formed by the maximum and minimum values ​​as the delay peak distribution range.

[0041] Specifically, the system performance bottlenecks are obtained by performing physical resource association mapping based on the latency peak distribution range and the dynamic load trend characteristics, including: Memory and storage features are extracted from the dynamic load trend features, and network jitter features are extracted from the abnormal time period data falling within the latency peak distribution range; The memory characteristics, storage characteristics, and network jitter characteristics are inferred and calculated to obtain the contribution rate weight of each hardware indicator to the response latency; Based on the contribution rate weights, the hardware indicators are prioritized and sorted to determine the system performance bottlenecks.

[0042] In one implementation, a first numerical sequence representing the state of memory resources is extracted from the dynamic load trend features generated in the preceding steps as a memory feature, and a second numerical sequence representing the state of remaining storage space is extracted as a storage feature. Simultaneously, this embodiment performs mathematical variance calculation on the abnormal time period data falling within the aforementioned calculated latency peak distribution interval, and determines the calculated response latency variance value as the network jitter feature.

[0043] It should be noted that this embodiment utilizes a pre-constructed Bayesian network model to perform inference calculations on the memory features, storage features, and network jitter features. Regarding the construction method of the topology structure and conditional probability table of this Bayesian network model, this embodiment extracts the full dataset of historical device operation monitoring as training samples and introduces a prior knowledge pruning strategy based on the causal relationship of the system physical architecture to reduce the dimensionality of the search space. Specifically, this embodiment divides all nodes according to the system hierarchy into bottom-level hardware resource nodes (including the memory features and storage features), intermediate transmission nodes (including the network jitter features), and top-level performance nodes, i.e., response latency, and enforces directed topology constraints. Directed edges are only allowed to point from bottom-level hardware resource nodes to intermediate transmission nodes or top-level performance nodes, and from intermediate transmission nodes to top-level performance nodes, strictly prohibiting reverse dependencies within the same layer that could create loops. This embodiment performs structural pruning and filtering on all possible directed acyclic graph connection spaces according to the aforementioned directed topology constraint rules, generating a finite subset of candidate structures that conforms to objective physical laws. Within this subset, an iterative search algorithm based on the Bayesian Information Criterion (BIC) scoring is used to extract the network connection structure with the highest BIC score as the objective network topology. Based on this topology, maximum likelihood estimation is used to generate an objective conditional probability table parameter matrix by statistically analyzing the probability distribution between nodes based on historical frequency. In this embodiment, the normalized memory features, storage features, and network jitter features are used as observation evidence nodes input into the Bayesian network model. A joint tree inference algorithm is used to calculate the conditional posterior probability distribution with response latency anomalies as the target node. This embodiment extracts the posterior probability values ​​corresponding to each hardware feature sub-node output by the model and sets them as the contribution weights of the three hardware indicators (memory, storage, and network) to response latency.

[0044] It is worth noting that in this embodiment, the contribution rate weights corresponding to the acquired hardware indicators are sorted in descending order according to the rule of numerical values ​​from largest to smallest. This embodiment extracts the system identifier of the hardware indicator that is at the top of the sorted sequence, that is, the hardware indicator with the largest contribution rate weight value, and extracts and outputs the physical hardware resource object pointed to by the system identifier as the system performance bottleneck point.

[0045] For example, this embodiment obtains abnormal time period data by segmenting the time period corresponding to the load anomaly classification label. After comparing the AIC values ​​through ADF test and grid search, the optimal order parameter combination of the ARIMA model is determined to be (1,1,1). The memory usage feature is input into the model for calculation, and the predicted memory usage value for the future time step is 92%. Subsequently, the storage space features and response latency data within the abnormal time period are extracted, and the Pearson correlation coefficient is calculated to obtain 0.82 as the statistical correlation coefficient; and the skewness coefficient of 1.8 is extracted as the response latency distribution feature. The values ​​of these three dimensions are normalized and concatenated into a multi-dimensional latency feature vector, which is then input into the K-Means clustering algorithm (the number of clusters K is determined to be 3 based on the historical maximum average profile coefficient) for calculation. The system extracts the cluster with the highest mean response latency in the clustering results, obtains the boundary values ​​within the cluster, and generates a value range of 300 milliseconds to 400 milliseconds as the latency peak distribution interval. Subsequently, this embodiment calculates the variance from the abnormal time period data falling within the 300 milliseconds to 400 milliseconds interval, and obtains a network jitter feature value of 25. Normalized memory features, storage features, and network jitter features are used as inputs and fed into a pre-built Bayesian network model based on a greedy search using BIC scores. A joint tree algorithm is then used for inference to calculate the posterior probability of memory nodes (60%), storage nodes (30%), and network nodes (10%), which are the corresponding contribution weights. In this embodiment, the 60%, 30%, and 10% weights are sorted in descending order, and the memory hardware identifier corresponding to the top-ranked 60% weight is extracted. Finally, memory is output as the system performance bottleneck.

[0046] In step S5, signal interference spectrum data transmitted by network nodes is obtained, and a matching search is performed in the system log according to the system performance bottleneck to obtain the corresponding original alarm signal. The original alarm signal is then subjected to invalid interference screening processing based on the signal interference spectrum data to obtain a preliminary warning signal sequence.

[0047] Specifically, the original alarm signal is subjected to invalid interference filtering processing based on the signal interference spectrum data to obtain a preliminary warning signal sequence, including: The signal interference spectrum data is subjected to spectral decomposition to obtain the high-frequency interference proportion characteristics; The fluctuation characteristics of the protection trigger frequency of network security devices are classified as abnormal, and the trigger feature sequences classified as abnormal are extracted. Extract the hardware load timing data corresponding to the system performance bottleneck point, and use the Pearson correlation coefficient method to calculate the sequence correlation coefficient between the trigger feature sequence and the hardware load timing data; The temporal fluctuation characteristics of the original alarm signal are extracted, and combined with the high-frequency interference ratio characteristics and the sequence correlation coefficient, invalid interference data in the original alarm signal is identified and screened out to obtain a preliminary warning signal sequence.

[0048] In one implementation, the packet capture interface of the underlying network interface card and the performance statistics register of the network card driver are used to collect micro-fluctuation sampling values ​​of the arrival time interval of digital packets on the transmission channel and instantaneous statistical values ​​of the link layer frame check sequence error rate within a fixed 500-millisecond time window. The continuous sequence of these purely digital sampling values ​​is then used to construct signal interference spectrum data. In this embodiment, the hardware identifier code corresponding to the system performance bottleneck point determined in the preceding steps is extracted. Feature string matching is performed in the original log database at the system's underlying layer to extract the physical alarm pulse sequence corresponding to the log record containing the hardware identifier code, which is then identified as the original alarm signal.

[0049] It should be noted that this embodiment uses the Fast Fourier Transform (FFT) algorithm to decompose the signal interference spectrum data from the time domain to the frequency domain. Regarding the determination of the frequency band division standard, this embodiment extracts the idle spectrum dataset of devices in normal communication conditions, calculates its cumulative power spectral density curve, and extracts the frequency critical value corresponding to when the cumulative power ratio reaches 90%. Signal frequency bands with frequency values ​​greater than this frequency critical value are objectively labeled as high-frequency bands. This embodiment performs energy integration on the frequency domain matrix output by the Fourier transform, calculates the sum of signal energy integrals falling into the high-frequency band, and simultaneously calculates the sum of total signal energy integrals across the entire frequency band. The sum of signal energy integrals in the high-frequency band is divided by the sum of signal energy integrals across the entire frequency band to obtain an energy ratio constant between zero and one. This constant is strictly determined as the high-frequency interference ratio characteristic.

[0050] It is worth noting that, considering the fluctuation characteristics of the trigger frequency of network security device protection, this embodiment uses a pre-trained Support Vector Machine (SVM) algorithm for anomaly classification. Regarding the construction process of this SVM classification model, this embodiment extracts the sliding variance of the number of security policy triggers in historical operation logs as the feature input for training samples, and assigns binary discrete labels representing normal or abnormal based on the device's posterior audit results; a radial basis function is used as the kernel function to map low-dimensional linearly inseparable data to a high-dimensional feature space. Regarding the determination of the penalty coefficient and kernel function parameters of this SVM model, this embodiment uses a grid search method combined with multi-fold cross-validation for objective calibration. This embodiment traverses all parameter combinations within a preset logarithmic scale parameter space, calculates the classification accuracy of each parameter group on the validation set, extracts the parameter combination corresponding to the maximum classification accuracy, and strictly sets these as the penalty coefficient and kernel function parameters, respectively. This embodiment constructs a joint objective function containing maximizing the classification margin boundary term and minimizing the pagination loss term, and uses a sequential minimum optimization algorithm to iteratively solve this joint objective function to construct the SVM classification model. In this embodiment, the standard deviation of the number of protection triggers within the current time window is calculated as the fluctuation feature input to the model to obtain the model's output classification label sequence. This embodiment iterates through the classification label sequence, filters and extracts the trigger fluctuation feature values ​​at the time points corresponding to the abnormal labels, and concatenates these values ​​in chronological order to generate a trigger feature sequence.

[0051] In one implementation, this embodiment extracts a continuous resource utilization rate sequence of the system performance bottleneck point within the time window. Then, based on each abnormal time point recorded when generating the trigger feature sequence, synchronization point sampling is performed from the continuous resource utilization rate sequence to extract resource utilization rate values ​​strictly corresponding to the abnormal time points. These extracted resource utilization rate values ​​are then concatenated in chronological order to construct hardware load timing data of equal length that completely corresponds one-to-one with the trigger feature sequence in terms of data dimension and time node. This embodiment uses the Pearson correlation coefficient method for calculation. Specifically, the mathematical covariance value of the trigger feature sequence and the hardware load timing data is calculated, and the arithmetic standard deviation values ​​of both are calculated respectively. The covariance value is divided by the product of the two standard deviation values ​​to obtain a dimensionless floating-point value between negative one and positive one, which is used as the sequence correlation coefficient to measure the degree of linear correlation between the two time series.

[0052] It should be noted that this embodiment uses a random forest for the final filtering of invalid interference data. Regarding the construction of the random forest model, this embodiment uses a bootstrap resampling method to extract multiple training subsets with replacement from the historical full alarm feature set. For each training subset, a single classification decision tree is constructed based on the principle of maximizing the reduction of Gini impurity. All decision trees are combined and the ensemble prediction classification probability is output through a majority voting mechanism. Regarding the determination of the number of decision trees and the maximum depth of a single decision tree in the random forest model, this embodiment uses an out-of-bag error rate evaluation method combined with a grid search method for calibration. This embodiment traverses different combinations of the number of decision trees and the maximum depth in the parameter candidate matrix, calculating the prediction error rate of the model for out-of-bag data under each combination; extracts the parameter combinations corresponding to when the out-of-bag error rate reaches the global minimum and the model tends to converge, and sets them as the number of decision trees and the maximum depth of the single decision tree, respectively. This embodiment calculates the amplitude variance and pulse width data of the original alarm signal on the time axis, and combines them to determine the time-series fluctuation characteristics. In this embodiment, the time-series fluctuation characteristics, the high-frequency interference ratio characteristics, and the sequence correlation coefficient are numerically concatenated on a unified dimension and used as a comprehensive input vector. This vector is then substituted into the random forest model for forward inference to obtain a predicted probability value representing the data category as invalid interference. This embodiment compares this predicted probability value with a set classification probability threshold. If the value is greater than the threshold, the original alarm signal is determined to be invalid interference and the data is discarded; if the value is less than or equal to the threshold, it is determined to be a valid alarm and retained. This embodiment pushes all retained valid alarm signals into a data queue in chronological order to generate a preliminary warning signal sequence.

[0053] It is worth noting that the invalid interference labels required for training the random forest model are obtained by extracting the original alarm signals generated by the network security devices themselves based on static thresholds within a historical time period. These original alarm signals are then aligned with the time windows within the same time period that are identified as instantaneous traffic jitter (i.e., non-continuous high load) in step S3. If the occurrence time of an original alarm signal falls entirely within the instantaneous traffic jitter window, and the hardware resource corresponding to the alarm signal is not identified as a system performance bottleneck in step S4, then the original alarm signal is labeled as an invalid interference positive sample. Conversely, if the alarm signal falls within the continuous high load state window and matches the bottleneck hardware identifier output in step S4, then it is labeled as a valid alarm negative sample.

[0054] In step S6, the warning threshold corresponding to the preliminary warning signal sequence is extracted, and high-risk signals are filtered according to the warning threshold to generate the final overload warning sequence, including: Analyze the distribution characteristics of the response delay data corresponding to the preliminary warning signal sequence; Calculate the warning threshold for each load node; Based on the distribution characteristics of the response delay data and the warning threshold, high-risk signals in the preliminary warning signal sequence are selected to generate the final overload warning sequence.

[0055] In one implementation, the preliminary warning signal sequence generated in the preceding steps is extracted, and the discrete response delay value set corresponding to the preliminary warning signal sequence is extracted from the system's underlying logs. In this embodiment, a Gaussian distribution model is used to perform statistical calculations on the response delay value set, extracting its arithmetic mean and arithmetic standard deviation. The calculated arithmetic mean and arithmetic standard deviation are then used to construct a one-dimensional feature vector, which is determined as the distribution characteristic representing the response delay data.

[0056] It should be noted that this embodiment utilizes a genetic algorithm to calculate the warning threshold for each load node. Regarding the underlying implementation logic of this genetic algorithm, this embodiment employs a floating-point encoding strategy, encoding candidate warning thresholds with values ​​between the historical minimum and maximum delays into chromosome vectors, and randomly initializing them to generate the initial population. Regarding the determination of the initial population size, this embodiment extracts the total number of samples from the historical alarm test set with verification labels, multiplies this total number of samples by a constant ratio of 5%, and rounds down. The calculated integer result is objectively set as the initial population size. This embodiment applies each candidate warning threshold to the alarm test set, respectively counting the number of true positives that correctly hit the actual overload alarm and the total number of all triggered alarms. The number of true positives is divided by the total number of triggered alarms to calculate a proportional constant, which is objectively defined as the warning accuracy rate. This embodiment strictly sets this warning accuracy rate as the fitness function of the genetic algorithm, and maximizing the value of this fitness function is determined as the only optimization direction.

[0057] During the iterative calculation process, this embodiment uses a roulette wheel selection operator to retain chromosomes with higher fitness, and sequentially performs single-point crossover and non-uniform mutation operations to generate the offspring population. Regarding the setting method for crossover and mutation probabilities, this embodiment employs a fitness-based adaptive adjustment mechanism, calculating the difference between the fitness value of the current chromosome in the population and the average fitness value of the population. When the current fitness value is greater than the average fitness value, a linearly decreasing mapping function is used to reverse-map this difference to a preset probability baseline interval, obtaining the dynamic crossover probability and dynamic mutation probability. When the current fitness value is less than or equal to the average fitness value, the crossover probability and mutation probability are uniformly set to a preset maximum probability constant. Evolution is stopped when the maximum number of iterations is reached, and the optimal chromosome with the highest fitness value in the final population is extracted. Real-value decoding is performed on this chromosome, and the output floating-point value is the corresponding warning threshold. The maximum number of iterations is determined based on the maximum number of calculation rounds allowed by the system's highest tolerance time for alarm delay.

[0058] It should be noted that the historical alarm test set with verification labels required by the genetic algorithm is extracted from the device's historical operation logs. Specifically, overload event records that have been confirmed on-site by maintenance personnel or confirmed through post-fault analysis are selected. The preliminary warning signal sequence and corresponding actual response delay value within one warning cycle before each event occur are extracted, and whether the event causes a real business failure, such as packet loss, connection interruption, or service restart, are used as verification labels. True positives are marked as 1, and false positives are marked as 0. The above labeled data samples are divided into training sets and validation sets in chronological order. The training set is used for the genetic algorithm to optimize the threshold, and the validation set is used to evaluate the accuracy of the optimized warnings.

[0059] It is worth noting that this embodiment performs signal filtering based on the distribution characteristics of the response delay data and the warning threshold. This embodiment extracts the actual response delay value corresponding to each signal in the preliminary warning signal sequence and compares it logically with the warning threshold. If the actual response delay value corresponding to a signal is greater than the warning threshold, this embodiment determines that the signal significantly deviates from the safe distribution range statistically, marks it, and extracts it as a high-risk signal. If the actual response delay value corresponding to the signal is less than or equal to the warning threshold, it is determined to be a normal fluctuation within the safe distribution range, and is ignored as a low-risk signal or only recorded in ordinary logs. This embodiment concatenates all the selected high-risk signals according to their timestamp order to generate the final overload warning sequence.

[0060] The method further includes, after generating the final overload warning sequence: Predict the system's storage space usage trend to obtain the remaining time for storage saturation; The final overload warning sequence is classified by risk level, and alarm information containing the remaining storage saturation time and storage bottleneck risk index is generated.

[0061] In one implementation, the current number of bytes occupied in storage space of the target storage node and the rate of change of space occupancy in adjacent sampling periods are extracted, and these two values ​​are used to construct a two-dimensional state vector. This embodiment uses the Kalman filter algorithm for extrapolation prediction. Regarding the construction of the discrete state transition matrix, this embodiment establishes a two-row, two-column parameter matrix based on a first-order constant-rate-growth kinematic model. The first row and first column of this parameter matrix are set to the value 1, the first row and second column to the time interval constant of the current adjacent sampling period, the second row and first column to the value 0, and the second row and second column to the value 1. This embodiment uses the discrete state transition matrix and the two-dimensional state vector of the current time step to perform matrix multiplication to obtain the prior state estimate; simultaneously, the actual space occupied by the storage controller at the current moment is collected, the observation residual and Kalman gain are calculated, and the weight correction calculation is performed on the prior state estimate using the Kalman gain to generate the posterior state estimate. This embodiment uses the posterior state estimate as the initial input for the next time step for iterative extrapolation until the number of bytes occupied in storage space predicted by the model reaches the preset saturation capacity. Regarding the determination of the saturation capacity, this embodiment extracts the total formatted capacity of the physical disk, subtracts the absolute value of the historical maximum daily burst write data volume as a safety redundancy, and strictly sets the difference between the two as the saturation capacity. This embodiment extracts the predicted timestamp corresponding to the saturation capacity being reached, calculates the time difference between the predicted timestamp and the current system timestamp, and outputs it as the remaining storage saturation time.

[0062] It should be noted that this embodiment uses a decision tree to classify the risk level of the final overload warning sequence. This embodiment extracts the frequency of abnormal signal triggers and the longest duration of a single signal from the final overload warning sequence as input features, and substitutes them into a pre-trained classification decision tree model. The leaf nodes of the tree model output the corresponding discrete risk level labels (e.g., high risk, medium risk). Regarding the construction and parameter setting of the classification decision tree model, this embodiment extracts alarm handling records from the historical operation and maintenance database, uses the frequency of historical warning signal triggers and the longest duration of a single signal as input features, and uses the severity of the actual accident as a discrete supervisory label. This embodiment uses a decision tree to calculate the information gain value corresponding to each feature, and extracts the feature with the largest information gain value for node splitting. Regarding the setting of the maximum tree depth parameter and the minimum number of samples per leaf node, this embodiment uses a grid search method combined with multi-fold cross-validation for objective calibration. It traverses all parameter combinations in a preset parameter candidate grid, extracts the combination corresponding to the global maximum classification accuracy of the validation set, and sets these as the maximum tree depth parameter and the minimum number of samples per leaf node, respectively. Based on this, pre-pruning is performed during model training to generate the classification decision tree model. Simultaneously, this embodiment extracts the current actual occupied space observation value, divides it by the saturation capacity, and calculates a dimensionless ratio constant, which is determined as the storage bottleneck risk index. Finally, this embodiment serializes and concatenates the output risk level label, the calculated remaining storage saturation time, and the storage bottleneck risk index according to a JSON key-value pair structure to generate structured alarm information.

[0063] In summary, this invention extracts time-domain segmented features from the operational status data of network security devices and performs multi-dimensional similarity matching and anomaly deviation verification based on historical high-load patterns. Furthermore, by deeply mapping the peak distribution range of response latency with dynamic load trend characteristics using physical resources, it accurately locates the bottleneck points of constrained system performance. Finally, it introduces signal interference spectrum data to filter out invalid interference from the original alarm signals and maps them to business rules, achieving accurate differentiation between instantaneous traffic fluctuations and real continuous overload in complex network environments, as well as cross-dimensional tracing of underlying hardware bottlenecks. This invention effectively eliminates noise signals caused by resource contention and high-frequency crosstalk, fundamentally solving the technical pain points of low overload identification accuracy and chaotic stacking of warning signals in traditional static monitoring solutions, significantly improving the purity of warnings and the efficiency of response decisions for network security devices during peak business periods.

[0064] Reference Figure 2 The second embodiment of the present invention provides an intelligent early warning system for performance overload of network security devices, comprising: The data extraction module is used to acquire the operating status data of network security devices and the response latency data of network communication, and to perform time-domain segmented feature extraction processing on the operating status data to obtain dynamic load trend features. The similarity matching module is used to perform similarity matching calculations between the dynamic load trend characteristics and a pre-built historical high load pattern library to obtain a load similarity index. The classification label module is used to perform anomaly verification processing based on the load similarity index and the preset anomaly deviation benchmark to obtain load anomaly classification labels. The bottleneck identification module is used to extract abnormal time period data from the response latency data according to the load anomaly classification label, perform interval division processing on the abnormal time period data to obtain the latency peak distribution interval, and perform physical resource association mapping processing on the latency peak distribution interval and the dynamic load trend characteristics to obtain the system performance bottleneck point. The signal filtering module is used to acquire signal interference spectrum data transmitted by network nodes, perform matching and retrieval in the system log according to the system performance bottleneck point to obtain the corresponding original alarm signal, and perform invalid interference filtering processing on the original alarm signal according to the signal interference spectrum data to obtain a preliminary warning signal sequence. The early warning generation module is used to extract the early warning threshold corresponding to the preliminary early warning signal sequence, filter high-risk signals based on the early warning threshold, and generate the final overload early warning sequence.

[0065] It should be noted that the intelligent performance overload warning system for network security devices provided in this embodiment of the invention executes all the process steps of the intelligent performance overload warning method for network security devices in the above embodiment. The working principles and beneficial effects of the two correspond one-to-one, so they will not be described again.

[0066] It should be noted that the system embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Furthermore, in the accompanying drawings of the system embodiments provided by this invention, the connection relationships between modules indicate that they have communication connections, which can be specifically implemented as one or more communication buses or signal lines. Those skilled in the art can understand and implement this without any creative effort.

[0067] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above descriptions are merely specific embodiments of the present invention and are not intended to limit the scope of protection of the present invention. In particular, it should be noted that any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention for those skilled in the art.

Claims

1. A performance overload intelligent early warning method for a network security device, characterized in that, include: The system acquires operational status data of network security devices and response latency data of network communication, and performs time-domain segmentation feature extraction processing on the operational status data to obtain dynamic load trend features. The load similarity index is obtained by performing a similarity matching operation between the dynamic load trend characteristics and a pre-built historical high load pattern library. Anomaly verification is performed based on the load similarity index and the preset anomaly deviation benchmark to obtain load anomaly classification labels; Based on the load anomaly classification label, abnormal time period data is extracted from the response latency data. The abnormal time period data is divided into intervals to obtain the latency peak distribution interval. Based on the latency peak distribution interval and the dynamic load trend characteristics, physical resource association mapping is performed to obtain the system performance bottleneck point. Obtain signal interference spectrum data transmitted by network nodes, perform matching and retrieval in the system log according to the system performance bottleneck point to obtain the corresponding original alarm signal, and perform invalid interference screening processing on the original alarm signal according to the signal interference spectrum data to obtain a preliminary warning signal sequence; Extract the warning threshold corresponding to the preliminary warning signal sequence, filter high-risk signals based on the warning threshold, and generate the final overload warning sequence.

2. The method for intelligent pre-warning of performance overload of network security device according to claim 1, characterized in that, The step of performing time-domain segmented feature extraction on the operating status data to obtain dynamic load trend features includes: Extract the peak load from the processor load data in the operating status data; For the memory usage data in the running status data, calculate the variance of the data within a preset memory fluctuation statistical period to obtain the memory usage fluctuation amplitude; For the storage space data in the aforementioned operating status data, predictive processing is performed to obtain the remaining space trend characteristics; The load peak, the memory usage fluctuation, and the remaining space trend characteristics are weighted and calculated to generate an initial resource monitoring sequence. The initial resource monitoring sequence is then segmented into time periods to obtain dynamic load trend characteristics. 3.The performance overload intelligent early warning method for network security devices according to claim 1, characterized in that, The step of performing a similarity matching operation between the dynamic load trend characteristics and a pre-built historical high load pattern library to obtain a load similarity index includes: Calculate the similarity between the dynamic load trend characteristics and historical data in the historical high load pattern library; The dynamic load trend characteristics and the current business scenario are evaluated for feature importance to obtain a feature importance index; The load similarity index is obtained by performing data fusion processing based on the similarity and the feature importance index.

4. The method for intelligent pre-warning of performance overload of network security device according to claim 1, characterized in that, The step of performing anomaly verification processing based on the load similarity index and a preset anomaly deviation benchmark to obtain load anomaly classification labels includes: Extract the standard deviation multiple of the load value from the historical mean in the dynamic load trend characteristics; The standard deviation multiple is logically compared with a preset abnormal deviation benchmark. If the standard deviation multiple exceeds the abnormal deviation benchmark and the load similarity index meets the preset threshold condition, it is determined to be a continuous high load state. Based on the characteristic data mapping business scenario attributes in the continuous high load state, load anomaly classification labels are generated.

5. The method for intelligent pre-warning of performance overload of network security device according to claim 1, characterized in that, The process of dividing the abnormal time period data into intervals to obtain the delay peak distribution interval includes: The ARIMA model is used to perform time series analysis on the memory usage features corresponding to the load anomaly classification labels to obtain the predicted memory usage values ​​for future time steps. Calculate the statistical correlation coefficient between storage space characteristics and response latency data; The predicted memory usage, the statistical correlation coefficient, and the response delay distribution characteristics in the abnormal time period data are used to construct a multidimensional delay feature vector. The multidimensional delay feature vector is then clustered to obtain the delay peak distribution interval.

6. The method for intelligent pre-warning of performance overload of network security device according to claim 1, characterized in that, The step of performing physical resource association mapping based on the latency peak distribution interval and the dynamic load trend characteristics to obtain the system performance bottleneck points includes: Memory and storage features are extracted from the dynamic load trend features, and network jitter features are extracted from the abnormal time period data falling within the latency peak distribution range; The memory characteristics, storage characteristics, and network jitter characteristics are inferred and calculated to obtain the contribution rate weight of each hardware indicator to the response latency; Based on the contribution rate weights, the hardware indicators are prioritized and sorted to determine the system performance bottlenecks.

7. The method for intelligent pre-warning of performance overload of network security device according to claim 1, characterized in that, The step of filtering out invalid interference from the original alarm signal based on the signal interference spectrum data to obtain a preliminary warning signal sequence includes: The signal interference spectrum data is subjected to spectral decomposition to obtain the high-frequency interference proportion characteristics; The fluctuation characteristics of the protection trigger frequency of network security devices are classified as abnormal, and the trigger feature sequences classified as abnormal are extracted. Extract the hardware load timing data corresponding to the system performance bottleneck point, and calculate the sequence correlation coefficient between the trigger feature sequence and the hardware load timing data; The temporal fluctuation characteristics of the original alarm signal are extracted, and combined with the high-frequency interference ratio characteristics and the sequence correlation coefficient, invalid interference data in the original alarm signal is identified and screened out to obtain a preliminary warning signal sequence.

8. The method for intelligent pre-warning of performance overload of network security device according to claim 1, characterized in that, The step of extracting the warning threshold corresponding to the preliminary warning signal sequence, filtering high-risk signals based on the warning threshold, and generating the final overload warning sequence includes: Analyze the distribution characteristics of the response delay data corresponding to the preliminary warning signal sequence; Calculate the warning threshold for each load node; Based on the distribution characteristics of the response delay data and the warning threshold, high-risk signals in the preliminary warning signal sequence are selected to generate the final overload warning sequence.

9. The method for intelligent pre-warning of performance overload of network security device according to claim 1, characterized in that, After generating the final overload warning sequence, the method further includes: Predict the system's storage space usage trend to obtain the remaining time for storage saturation; The final overload warning sequence is classified by risk level, and alarm information containing the remaining storage saturation time and storage bottleneck risk index is generated.

10. A performance overload intelligent early warning system for a network security device, characterized in that, include: The data extraction module is used to acquire the operating status data of network security devices and the response latency data of network communication, and to perform time-domain segmented feature extraction processing on the operating status data to obtain dynamic load trend features. The similarity matching module is used to perform similarity matching calculations between the dynamic load trend characteristics and a pre-built historical high load pattern library to obtain a load similarity index. The classification label module is used to perform anomaly verification processing based on the load similarity index and the preset anomaly deviation benchmark to obtain load anomaly classification labels. The bottleneck identification module is used to extract abnormal time period data from the response latency data according to the load anomaly classification label, perform interval division processing on the abnormal time period data to obtain the latency peak distribution interval, and perform physical resource association mapping processing on the latency peak distribution interval and the dynamic load trend characteristics to obtain the system performance bottleneck point. The signal filtering module is used to acquire signal interference spectrum data transmitted by network nodes, perform matching and retrieval in the system log according to the system performance bottleneck point to obtain the corresponding original alarm signal, and perform invalid interference filtering processing on the original alarm signal according to the signal interference spectrum data to obtain a preliminary warning signal sequence. The early warning generation module is used to extract the early warning threshold corresponding to the preliminary early warning signal sequence, filter high-risk signals based on the early warning threshold, and generate the final overload early warning sequence.

Images