Data reporting method, acquisition and monitoring device, network device and monitoring system

Abstract

This invention provides a data reporting method, a data acquisition and monitoring device, a network device, and a monitoring system, relating to the field of intelligent operation and maintenance. The method is applied to a data acquisition and monitoring device deployed in a virtual container within a network device. The method includes: loading a filtering program into the network device's kernel through the network device's kernel interface; acquiring management and control frames transmitted by the network device through this filtering program and storing the management and control frames in a memory cache; monitoring various event information in the network device, determining whether the event information meets preset reporting conditions, and locking the memory cache when the preset reporting conditions are met; taking a snapshot of the memory cache and reporting the snapshot data to a local management device so that the local management device can perform anomaly detection on the snapshot data. This method can achieve better anomaly monitoring while conserving network device hardware resources.

Description

Technical Field

[0001] This invention relates to the field of intelligent operation and maintenance, and in particular to a data reporting method, a data acquisition and monitoring device, a network device, and a monitoring system. Background Technology

[0002] In related technologies, the abnormal monitoring of network devices has the drawback of seriously consuming the hardware resources of the network devices and easily interfering with the normal operation of the network devices. Summary of the Invention

[0003] The purpose of this invention is to provide a data reporting method, a data acquisition and monitoring device, a network device, and a monitoring system, which can solve the technical problem that abnormal monitoring causes serious consumption of network device hardware resources.

[0004] To address the aforementioned technical problems, this invention provides a data reporting method applied to a data acquisition and monitoring device deployed in a virtual container within a network device. The method includes: A filtering program is loaded into the kernel of the network device through the kernel interface of the network device. The filtering program collects the management frames and control frames transmitted by the network device and saves the management frames and control frames in the memory cache. The system monitors various event information in the network device, determines whether the event information meets preset reporting conditions, and locks the memory cache when it is determined that the preset reporting conditions are met. A snapshot of the memory cache is taken, and the snapshot data is reported to the local management device so that the local management device can perform anomaly detection on the snapshot data.

[0005] Optionally, storing the management frame and the control frame in a memory cache includes: The management frame and the control frame are overwritten by the write pointer to the current position pointed to by the write pointer in the memory cache. Determine whether the current position is the end position of the memory cache area; If the current position is the end of the memory cache, then the write pointer is adjusted to point to the beginning of the memory cache; If the current position is not the end of the memory cache, then the write pointer is adjusted to point to the next position after the current position.

[0006] Optionally, it also includes: Obtain the available memory size of the network device; If the available memory size meets the preset memory expansion conditions, then the write pointer is suspended, the expansion size is determined according to the current size of the memory cache, a new memory space of the expansion size is requested from the network device, the data in the memory cache is migrated to the new memory space, the old memory space corresponding to the memory cache is released, and the write pointer is restored. If the available memory size meets the preset memory shrinkage condition, then the write pointer is suspended, the shrinkage size is determined according to the current size of the memory cache, the target memory segment containing the most recently written target data of the same size as the shrinkage size is determined, the portion of the memory cache excluding the target memory segment is released, and the write pointer is restored. When performing an expansion or contraction operation on the memory cache, if it is determined that the preset reporting conditions are met, the expansion or contraction operation is stopped, and the expansion or contraction operation is continued when the snapshot operation on the memory cache is completed.

[0007] Optionally, it also includes: Monitor abnormal events encountered by the network device and determine the frequency of occurrence of the abnormal events within a preset time window; The acquisition frequency of the management frame and the control frame is adjusted according to the occurrence frequency.

[0008] Optionally, it also includes: The system receives adjustment instructions from the local management device; wherein, when the local management device reports the anomaly detection results to the instant messaging software in the client, the user issues the adjustment instructions through the instant messaging software. Execute the adjustment command.

[0009] Optionally, the snapshot data is reported to the local management device, including: Sensitive fields in the snapshot data are anonymized. The processed snapshot data is encrypted and reported to the local management device through the encrypted channel between the acquisition and monitoring device and the local management device.

[0010] Optionally, the virtual container shares the network namespace of the network device, so that the network protocol stack in the virtual container and the physical network card of the network device are in the same network namespace; Loading a filter program into the kernel of the network device through the network device's kernel interface includes: The kernel interface of the network device is invoked to attach the filtering program to the physical interface of the physical network card.

[0011] The present invention also provides a data acquisition and monitoring device, which is deployed in a virtual container in a network device, the device comprising: The acquisition module is used to load a filtering program into the kernel of the network device through the kernel interface of the network device, acquire management frames and control frames transmitted by the network device through the filtering program, and save the management frames and control frames in the memory cache. The monitoring module is used to monitor various event information in the network device, determine whether the event information meets the preset reporting conditions, and lock the memory cache when it is determined that the preset reporting conditions are met. The reporting module is used to take a snapshot of the memory cache and report the obtained snapshot data to the local management device so that the local management device can perform anomaly detection based on the snapshot data.

[0012] The present invention also provides a network device, comprising: Memory, used to store computer programs; A processor is used to implement the above-described data reporting method when executing the computer program.

[0013] The present invention also provides a monitoring system, comprising: A network device, wherein a data acquisition and monitoring device is deployed in a virtual container of the network device, and the data acquisition and monitoring device is used to execute the above-described data reporting method; The local management device is used to receive snapshot data reported by the acquisition and monitoring device, perform anomaly detection on the snapshot data, and report the detection results to the client device; it also receives adjustment instructions from the client device and sends the adjustment instructions to the acquisition and monitoring device. The client device is equipped with the instant messaging software, which is used to receive and display the detection results; receive adjustment instructions input by the user, and send the adjustment instructions to the local management device.

[0014] The present invention also provides a computer-readable storage medium storing computer-executable instructions, which, when loaded and executed by a processor, implement the above-described data reporting method.

[0015] This invention provides a data reporting method applied to a data acquisition and monitoring device deployed in a virtual container within a network device. The method includes: loading a filtering program into the kernel of the network device through its kernel interface; acquiring management frames and control frames transmitted by the network device through the filtering program; storing the management frames and control frames in a memory cache; monitoring various event information in the network device; determining whether the event information meets preset reporting conditions; and locking the memory cache when the preset reporting conditions are met; taking a snapshot of the memory cache; and reporting the snapshot data to a local management device so that the local management device can perform anomaly detection on the snapshot data.

[0016] The beneficial effects of this invention are as follows: This invention can be executed by a data acquisition and monitoring device in a network device. The data acquisition and monitoring device is deployed in the network device via a virtual container to avoid serious intrusion into the network device firmware. The data acquisition and monitoring device can load a filtering program into the network device's kernel through the network device's kernel interface. This filtering program can acquire management and control frames transmitted by the network device and store them in a memory cache. In this way, this invention can acquire data directly from the network device kernel, ensuring effective acquisition. Furthermore, by caching data in memory, this invention avoids frequent read / write operations to the network device's flash memory. Simultaneously, by setting up a memory cache and storing only management and control frames most relevant to anomaly detection, the monitoring targeting can be improved, and the write size to the network device's memory can be constrained. Subsequently, the data acquisition and monitoring device can monitor various event information in the network device and determine whether the event information meets preset reporting conditions. If the preset reporting conditions are met, the memory cache is locked to prevent overwriting. Then, the data acquisition and monitoring module can take a snapshot of the memory cache and report the specified abnormal events and snapshot data to the local management device, so that the local management device can perform anomaly detection on the snapshot data. In this way, when an anomaly is detected, the acquisition and monitoring device can promptly report the relevant management and control frames to the local management device so that the latter can perform anomaly analysis, thereby achieving better anomaly monitoring while saving network equipment hardware resources.

[0017] The present invention also provides a data acquisition and monitoring device, a network device, a monitoring system, and a computer-readable storage medium, which have the above-mentioned beneficial effects. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0019] Figure 1 A flowchart of a data reporting method provided in an embodiment of the present invention; Figure 2 A structural block diagram of a monitoring system provided in an embodiment of the present invention; Figure 3 A timing flowchart for network device monitoring is provided in an embodiment of the present invention; Figure 4 This is a structural block diagram of a data acquisition and monitoring device provided in an embodiment of the present invention; Figure 5 A structural block diagram of a network device provided in an embodiment of the present invention; Figure 6 This is a structural block diagram of another monitoring system provided in an embodiment of the present invention. Detailed Implementation

[0020] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0021] Common network devices include access points, access controllers, switches, and routers. These network devices have limited hardware resources, such as limited processor and storage resources, and must prioritize meeting core business needs.

[0022] In related technologies, anomaly monitoring of network devices can severely consume the hardware resources of these devices and cause excessive wear and tear, affecting their lifespan. For example, related technologies may control network devices to report their transmitted network frames in real time or periodically, which wastes the computing and transmission resources of the network devices. Another example is the ability to store transmitted network frames in the network device's flash memory for long-term recording; however, this wastes limited flash memory space, and repeated data writing severely shortens the flash memory's lifespan, thus significantly impacting the lifespan of the network device.

[0023] Furthermore, to achieve effective monitoring of network devices, the relevant monitoring functions need to be configured in the network device's firmware, which intrudes on the firmware and hinders the setup of monitoring functions. Alternatively, the relevant monitoring functions need to be implemented using additional hardware sensors, incurring additional costs and hindering the reuse of the network device's original capabilities.

[0024] In view of this, in order to address the technical problem of how abnormal monitoring of network devices causes serious consumption of network device hardware resources, the present invention can provide a data reporting method that can optimize the monitoring function of network devices, thereby achieving better monitoring results while reducing hardware resource consumption.

[0025] For easier understanding, please refer to Figure 1 , Figure 1 This is a flowchart illustrating a data reporting method provided in an embodiment of the present invention. The method is applied to a data acquisition and monitoring device, which is deployed in a virtual container within a network device. Specifically, the data acquisition and monitoring device is a program device that performs data acquisition, anomaly monitoring, and event reporting; for example, it can be a low-hardware-resource-consumption agent. Deploying the data acquisition and monitoring device in a network device using a virtual container (such as a Docker container) reduces intrusion into the network device, thus making the deployment of data acquisition and monitoring functions more convenient.

[0026] This method may include: S10. Load the filtering program into the kernel of the network device through the kernel interface of the network device, collect the management frames and control frames transmitted by the network device through the filtering program, and save the management frames and control frames in the memory cache.

[0027] In this step, the data acquisition and monitoring device first loads a filter program into the network device's kernel via the network device's kernel interface to collect network frames transmitted by the network device. Considering that the data acquisition and monitoring device is located in a virtual container, isolated from the host environment, it may be unable to perceive the host (i.e., the network device's) physical network interface card (NIC). Therefore, to facilitate data acquisition, the virtual container can share the network device's network namespace, ensuring that the network protocol stack in the virtual container and the network device's physical NIC are in the same network namespace. In this case, the virtual container can run in non-privileged mode with CAP_NET_ADMIN and CAP_BPF capabilities; furthermore, the data acquisition and monitoring device can perceive the network device's physical NIC and, based on these capabilities, can call the network device's kernel interface (such as the bpf() interface) to attach the filter program to the physical interface of the physical NIC.

[0028] Furthermore, the monitoring device can collect management and control frames (802.11 management / control frames) transmitted by network devices through a filtering program. These management and control frames can be either sent or received by the network device. The monitoring device can then store these management and control frames in a memory cache. The reason for collecting management and control frames is that these two types of network frames are the most relevant to abnormal events encountered by the network device. For example, management frames can be used for network discovery and access, authentication and association, beacon broadcasting, and network parameter synchronization. When abnormal terminal device access is detected, or when terminal device access is poor, the management frames transmitted by the network device can be analyzed to determine the cause. The function of control frames is similar. Therefore, collecting and caching only management and control frames helps improve the targeting of anomaly monitoring.

[0029] It should be noted that this embodiment does not limit the acquisition method of management frames and control frames, and can be set according to actual application requirements. To preserve memory state, BPF (Berkeley Packet Filter) can be used to filter network frames transmitted by network devices to obtain the management frames and control frames transmitted by network devices. This BPF filtering can be implemented using eBPF bytecode, and BPF type format (BTF) can be used to achieve compatibility with the network device kernel version.

[0030] It should be noted that the filtering and acquisition of network frames can be performed in real time or periodically.

[0031] Furthermore, the memory cache in this step is a cache area set in the network device's memory, which can save the most recently collected management and control frames by overwriting. In this way, this embodiment can meet monitoring requirements while effectively limiting the memory resources consumed in saving management and control frames, and avoiding repeated writing to the network device's flash memory. It should be noted that this embodiment does not limit the size of the memory cache and can be set according to actual application needs.

[0032] Specifically, a write order can be set for each memory location in the memory cache, and according to this write order, management frames and control frames are written to each memory location sequentially using a write pointer. When it is determined that the write pointer has moved to the last position of the write order, the write pointer is readjusted to point to the first position of the write order, so that the most recently acquired management frames and control frames are used to sequentially overwrite the original data in each memory location, thereby achieving the purpose of overwrite.

[0033] Based on this, storing management frames and control frames in a memory buffer can include: S121. Use the write pointer to overwrite the management frame and control frame into the current position pointed to by the write pointer in the memory buffer.

[0034] S122. Determine if the current position is the end of the memory cache.

[0035] In this step, the last position is the last position in the above writing order.

[0036] S123. If the current position is the end of the memory cache, then adjust the write pointer to point to the beginning of the memory cache.

[0037] In this step, the starting position is the first position in the above writing order.

[0038] S124. If the current position is not the end of the memory cache, the write pointer will be adjusted to point to the next position after the current position.

[0039] Furthermore, the memory buffer can contain two areas: an active segment and a reserved segment. When the memory buffer is unlocked, management frames and control frames can be written to the active segment area via the write pointer. When the memory buffer is locked, the write pointer can be moved to the reserved segment area, and newly received management frames and control frames can be written to the reserved segment area via the write pointer. This effectively avoids the problem of not being able to record newly received management frames and control frames due to the memory buffer being locked, thus improving the reliability of real-time recording.

[0040] For a description of locking the memory cache, please refer to the following embodiments.

[0041] S20. Monitor various event information in the network device, determine whether the event information meets the preset reporting conditions, and lock the memory cache when it is determined that the preset reporting conditions are met.

[0042] In this step, event information comes from various data sources of the network device. For example, event information can be the network device's own system log information, physical layer indicators, or terminal information accessing the network device. The data acquisition and monitoring device can monitor this event information in various ways, such as determining whether the system log contains keywords indicating anomalies, whether the physical layer indicators do not meet preset threshold requirements, and whether the terminals accessing the network device exhibit abnormal behavior.

[0043] By monitoring the aforementioned event information, the monitoring device can determine whether an abnormal event has occurred. Abnormal events indicate unusual situations encountered by network devices during operation, such as system malfunctions, poor signal quality, or abnormal access terminal devices. If an abnormal event is confirmed, it can be determined that the preset reporting conditions are met, and the information can be reported. Of course, the preset reporting conditions can also be a combination of various abnormal event information, which can be set according to actual application needs.

[0044] When the preset reporting conditions are met, to protect the memory buffer and the management and control frames most relevant to the abnormal event, the acquisition and monitoring device can lock the memory buffer. This can be done through an atomic compare-and-swap (CSA) operation. This prevents modification of the data in the memory buffer and avoids the overwriting or loss of network frames related to the abnormal event.

[0045] S30. Take a snapshot of the memory cache and report the snapshot data to the local management device so that the local management device can perform anomaly detection on the snapshot data.

[0046] In this step, after locking the memory buffer, the acquisition and monitoring device can take a snapshot of the memory buffer and report the snapshot data to the local management device. The local management device provides anomaly analysis capabilities for network devices and can deploy analysis modules, such as language models for analyzing snapshot data. In this way, the local management device performs anomaly detection based on the snapshot data to determine the cause of the fault.

[0047] Of course, the acquisition and monitoring device can also take snapshots of management frames and control frames located in the memory buffer within a preset time window to improve the relevance of the reported data. The size of the preset time window can be set as needed; for example, the time window defaults to capturing T_pre (30 seconds) forward and retaining T_post (10 seconds) backward.

[0048] Furthermore, to avoid exposing privacy information, the data collection and monitoring device can anonymize sensitive fields (such as MAC addresses and SSID information) in the snapshot data and report the processed snapshot data to the local management device. This embodiment does not limit the specific anonymization operation; for example, it can perform local hashing operations, local masking operations, etc., such as using the HMAC-SHA256 algorithm for local hash anonymization. In addition, the data collection and monitoring device can also compress the snapshot data before uploading, such as using Gzip compression, to save transmission bandwidth.

[0049] Furthermore, to ensure data security, the data acquisition and monitoring device can establish an encrypted channel with the local management device, such as a TLS 1.3 connection, and encrypt and report the snapshot data to the local management device through the encrypted channel.

[0050] Based on this, reporting snapshot data to the local management device may include: S311. Desensitize sensitive fields in snapshot data; S312. The processed snapshot data is encrypted and reported to the local management device through the encrypted channel between the acquisition and monitoring device and the local management device.

[0051] Furthermore, the local management device can also be linked to the client's instant messaging software and report specified abnormal events of the network device and their causes to the client. This allows users to view these abnormal reports promptly through the instant messaging software, facilitating monitoring of network device malfunctions.

[0052] In addition, users can send adjustment commands to the local management device via instant messaging software, and the local management device can then issue these commands to the network devices. For example, commands can be issued to adjust network device parameters or to block terminal devices. This allows users to quickly handle network device malfunctions via instant messaging software, improving the ease of troubleshooting and reducing the learning and usage costs for users.

[0053] Based on this, the method may also include: S321. Receive adjustment instructions issued by the local management device; wherein, when the local management device reports the cause of a specified abnormal event to the instant messaging software in the client, the user issues the adjustment instructions through the instant messaging software.

[0054] S322, Execute the adjustment command.

[0055] For easier understanding, please refer to Figure 2 , Figure 2 This is a structural block diagram of a monitoring system provided in an embodiment of the present invention. Figure 2The monitoring system comprises data acquisition and monitoring devices within network equipment, local management devices, and an administrator terminal. Data acquisition and monitoring devices can be configured within the virtual containers of network equipment. These devices perform packet stream filtering at the wireless network card interface, saving management and control frames to a memory buffer. They also monitor system log streams and physical layer metrics, determining if specified abnormal events have occurred. If so, they lock the memory buffer, take a data snapshot, and upload the snapshot to the local management device. The local management device has an AI semantic analysis engine that analyzes the snapshots reported by the network equipment and reports the diagnostic results to the administrator terminal. The administrator terminal can display the diagnostic results to the user and relay user commands to the local management device, enabling the device to issue commands to the network equipment. Please refer to [reference needed]. Figure 3 , Figure 3 This invention provides a timing flowchart for network device monitoring, illustrating the interaction process between network devices, data acquisition and monitoring devices, local management devices, and administrator terminals.

[0056] Based on the above embodiments, this invention can be executed by a data acquisition and monitoring device in a network device. This device is deployed within the network device via a virtual container to avoid serious intrusion into the network device firmware. The data acquisition and monitoring device can load a filtering program into the network device's kernel through the kernel interface. This filtering program can acquire management and control frames transmitted by the network device and store them in a memory cache. In this way, this invention can acquire data directly from the network device kernel, ensuring effective acquisition. Furthermore, by caching data in memory, this invention avoids frequent read / write operations to the network device's flash memory. Moreover, by setting up a memory cache and storing only management and control frames most relevant to anomaly detection, the monitoring targeting can be improved, while also limiting the amount of data written to the network device's memory. Subsequently, the data acquisition and monitoring device can monitor various event information in the network device and determine whether the event information meets preset reporting conditions. If the preset reporting conditions are met, the memory cache is locked to prevent overwriting. Then, the data acquisition and monitoring module can take a snapshot of the memory cache and report the specified abnormal events and snapshot data to the local management device, enabling the local management device to perform anomaly detection on the snapshot data. In this way, when an anomaly is detected, the acquisition and monitoring device can promptly report the relevant management and control frames to the local management device so that the latter can perform anomaly analysis, thereby achieving better anomaly monitoring while saving network equipment hardware resources.

[0057] Based on the above embodiments, in order to effectively balance the relationship between network frame recording and the normal operation of network devices, this embodiment can also dynamically adjust the size of the memory buffer according to the memory usage of the network device itself. The adjustment method of the memory buffer is described below. Based on this, the method may also include: S41. Obtain the available memory size of the network device.

[0058] In this step, available memory size refers to the amount of free memory on the network device.

[0059] S42. If the available memory size meets the preset memory expansion conditions, then suspend the write pointer, determine the expansion size based on the current size of the memory cache, request new memory space of the expansion size from the network device, migrate the data in the memory cache to the new memory space, release the old memory space corresponding to the memory cache, and restore the write pointer.

[0060] In this step, a memory expansion condition can be set to trigger the memory cache expansion operation. This embodiment does not limit the memory expansion condition; for example, it can be that the available memory size is greater than a first preset threshold. To avoid interference with cache adjustment due to fluctuations in memory usage, the memory expansion condition can also be that the available memory size remains greater than the first preset threshold for a first preset duration.

[0061] When the preset memory expansion condition is met, the acquisition and monitoring device can determine the expansion size based on the current size of the memory buffer, for example, by adding a preset expansion step size to the current size. Subsequently, the acquisition and monitoring device can request new memory space from the network device's memory based on this expansion size, migrate the data in the memory buffer to the new memory space, and then release the old memory space corresponding to the memory buffer. During the migration process, the acquisition and monitoring device can suspend the write pointer and restore it when the migration is complete, ensuring normal data writing. The write pointer can be suspended using an atomic compare-and-swap (CSA) operation.

[0062] It should be noted that step S42 can be executed multiple times if the preset memory expansion conditions are met, until the memory buffer reaches the preset maximum size, so that more management frames and control frames can be recorded when the network device is idle.

[0063] S43. If the available memory size meets the preset memory shrinkage condition, suspend the write pointer, determine the shrinkage size based on the current size of the memory cache, determine the target memory segment where the most recently written target data of the shrinkage size is located in the memory cache, release the part of the memory cache except for the target memory segment, and restore the write pointer.

[0064] In this step, a memory shrinkage condition can be set to trigger the memory cache shrinkage operation. This embodiment does not limit the memory shrinkage condition; for example, it can be that the available memory size is less than a second preset threshold, and the second preset threshold is less than the aforementioned first preset threshold. To avoid interference with cache adjustment due to fluctuations in memory usage, the memory shrinkage condition can also be that the available memory size remains less than the second preset threshold for a duration equal to a second preset time.

[0065] When the preset memory shrinkage condition is met, the acquisition and monitoring device can determine the shrinkage size based on the current size of the memory buffer. For example, it can subtract a preset shrinkage step size from the current size to obtain the shrinkage size, or it can directly adjust the current size to the preset shrinkage size to shrink the memory buffer all at once. Subsequently, the acquisition and monitoring device can truncate the memory buffer to shrink it. Specifically, the acquisition and monitoring device can determine the shrinkage size based on the current size of the memory buffer, identify the target memory segment containing the most recently written target data of the shrinkage size, and release the portion of the memory buffer excluding the target memory segment. At this time, the released memory segment can be reused by the network device, and the data stored within it will be discarded. During the release process, the acquisition and monitoring device can suspend the write pointer and restore it upon completion of the release to ensure normal data writing.

[0066] Furthermore, this embodiment can also preset memory retention conditions, such as the available memory size being no less than a second preset threshold and no greater than a first preset threshold, in which case the current size of the memory cache can be kept unchanged.

[0067] S44. When performing an expansion or contraction operation on the memory cache, if it is determined that the preset reporting conditions are met, the expansion or contraction operation is stopped, and the expansion or contraction operation is continued when the snapshot operation on the memory cache is completed.

[0068] In this step, when a memory buffer resizing operation encounters a memory buffer locking operation, the locking operation will be performed first, suspending the resizing operation until the snapshot is completed, thus ensuring the integrity of the snapshot. Furthermore, the memory buffer can contain two areas: an active segment and a reserved segment. When the memory buffer is locked, the write pointer can be moved to the reserved segment area, and newly received management frames and control frames can be written to the reserved segment area through the write pointer. This effectively avoids the problem of not being able to record newly received management and control frames due to the memory buffer being locked, improving the reliability of real-time recording.

[0069] As can be seen, this embodiment can proactively release resources when memory is scarce, avoiding memory contention with core network device services and ensuring that the basic performance of the device is not affected. Furthermore, it automatically expands the traceable historical frame window when memory is ample, increasing the probability of capturing low-frequency transient faults. Moreover, the adjustment process of the memory buffer does not interrupt packet capture, is imperceptible to the service, and works in conjunction with a locking mechanism to ensure the integrity of snapshots.

[0070] Based on the above embodiments, to further improve the targeting of monitoring and avoid meaningless consumption of network device hardware resources, this embodiment can also dynamically adjust the acquisition frequency of management frames and control frames according to the frequency of abnormal events encountered by the network device. The dynamic adjustment process of the acquisition frequency is described below. Based on this, the method may also include: S51. Monitor abnormal events encountered by network devices and determine the frequency of occurrence of abnormal events within a preset time window.

[0071] S52. Adjust the acquisition frequency of management frames and control frames according to their occurrence frequency.

[0072] In this embodiment, when common anomalies occur frequently, network devices are more likely to encounter critical anomalies, thus triggering reporting. Therefore, this embodiment can set a time window and determine the frequency of abnormal events encountered by the network device within the preset time window, and then adjust the sampling frequency according to this frequency. This embodiment can set multiple adjustment levels for the sampling frequency based on the occurrence frequency, so that whenever the occurrence frequency of abnormal events reaches an adjustment level, the sampling frequency is adjusted to the corresponding value, thereby achieving dynamic adjustment of the sampling frequency.

[0073] For example, three levels can be set: low frequency, standard, and high frequency. The sampling period for the low frequency level is 2000ms, the sampling period for the standard level is 500ms, and the sampling period for the high frequency level is 100ms. The switching method can then be set as follows: 1. Switching from normal mode to high-frequency mode: When any of the indicators such as SNR, retransmission rate or channel utilization exceeds the preset warning threshold (e.g., higher than 80% of the trigger threshold, configurable) in a single sampling, it immediately switches to the high-frequency mode without waiting for the next cycle.

[0074] 2. Switch from normal mode to low frequency mode: When all indicators are sampled for N consecutive times (6 times by default, which means the normal state lasts for about 3 seconds) and are all below 50% of the normal threshold, switch to low frequency mode to save CPU resources.

[0075] 3. Switching from high-frequency mode to normal mode: When the sampling indicators return to within the normal threshold for M consecutive times (default 3 times, i.e., 300ms) in high-frequency mode, switch back to normal mode. If an event lock is triggered in high-frequency mode, the high-frequency mode can only be exited after the lock is released and the indicators return to normal.

[0076] 4. Switch from low-frequency mode to normal mode: When any indicator exceeds the normal threshold by 30%, immediately switch back to normal mode to ensure a fast response to early abnormal signs.

[0077] In this way, the acquisition frequency can be dynamically adjusted, which can reduce the probability of missing abnormal data and avoid meaningless waste of hardware resources.

[0078] The above data reporting methods will be introduced below based on three specific scenarios.

[0079] Scenario 1: The data acquisition and monitoring device continuously records 802.11 management frames in its memory buffer. When the hostapd log outputs a RADIUS-Timeout error, the device locks the buffer within a short time and captures the authentication frame sequence from the previous 30 seconds to the last 10 seconds. The snapshot is then locally anonymized with HMAC-SHA256 and uploaded to the local management device on the enterprise intranet. After large-scale model analysis, a notification is pushed to the enterprise's instant messaging software. Maintenance personnel directly reply with commands in the software to switch to the backup RADIUS, and the data acquisition and monitoring device executes the configuration change and reports the results. The complete diagnostic process requires no login to any professional console.

[0080] Scenario 2: The data acquisition and monitoring device continuously monitors the nl80211 PHY statistics. When the SNR is below the 15dB threshold for three consecutive samples, a buffer lock is triggered, capturing frame data from the previous 30 seconds to the next 10 seconds. The snapshot contains a large number of retransmission frames and channel switching request frames. After the local management device sends a notification to the instant messaging software, the maintenance personnel can confirm the channel switching command with one click, and the data acquisition and monitoring device calls the hostapd control interface to complete the change.

[0081] Scenario 3: Multiple access points (APs) in the park are running data acquisition and monitoring devices and connected to the same private local management device. When a roaming storm occurs, the local management device receives roaming failure snapshots from multiple APs. Through cross-device frame sequence time correlation analysis, it locates the root cause device that triggered the roaming storm, pushes a network-wide alarm, and automatically issues blocking commands to all APs, achieving network-wide handling.

[0082] The following describes the data acquisition and monitoring device, network device, computer-readable storage medium, and computer program product provided in the embodiments of the present invention. The data acquisition and monitoring device, network device, computer-readable storage medium, and computer program product described below can be referred to in correspondence with the data reporting method described above.

[0083] Please refer to Figure 4 , Figure 4This is a structural block diagram of a data acquisition and monitoring device provided in an embodiment of the present invention. The device is applied to a data acquisition and monitoring system and is deployed in a network device via a virtual container. The device includes: The acquisition module 401 is used to load a filtering program into the kernel of the network device through the kernel interface of the network device, acquire the management frames and control frames transmitted by the network device through the filtering program, and save the management frames and control frames in the memory cache. The monitoring module 402 is used to monitor various event information in the network device, determine whether the event information meets the preset reporting conditions, and lock the memory cache when it is determined that the preset reporting conditions are met. The reporting module 403 is used to take snapshots of the memory cache and report the snapshot data to the local management device so that the local management device can detect anomalies in the snapshot data.

[0084] Optionally, the acquisition module 401 may include: The write submodule is used to overwrite the current position pointed to by the write pointer in the memory buffer with management frames and control frames using the write pointer; The write pointer movement submodule is used to determine whether the current position is the end of the memory buffer; if the current position is the end of the memory buffer, the write pointer is adjusted to point to the beginning of the memory buffer; if the current position is not the end of the memory buffer, the write pointer is adjusted to point to the next position after the current position.

[0085] Optionally, the device may further include: The memory buffer adjustment module is used to obtain the available memory size of the network device. If the available memory size meets the preset memory expansion conditions, the write pointer is suspended, the expansion size is determined based on the current size of the memory buffer, a new memory space of the expansion size is requested from the network device, the data in the memory buffer is migrated to the new memory space, the old memory space corresponding to the memory buffer is released, and the write pointer is restored. If the available memory size meets the preset memory contraction conditions, the write pointer is suspended, the contraction size is determined based on the current size of the memory buffer, the target memory segment containing the most recently written target data of the contraction size is determined, the portion of the memory buffer excluding the target memory segment is released, and the write pointer is restored. When performing expansion or contraction operations on the memory buffer, if the preset reporting conditions are met, the expansion or contraction operation is stopped, and the expansion or contraction operation continues when the snapshot operation on the memory buffer is completed.

[0086] Optionally, the device may further include: The acquisition frequency adjustment module is used to monitor abnormal events encountered by network devices and determine the frequency of occurrence of abnormal events within a preset time window; and adjust the acquisition frequency of management frames and control frames according to the occurrence frequency.

[0087] Optionally, the device may further include: The instruction receiving module is used to receive adjustment instructions issued by the local management device; among them, when the local management device reports the cause of a specified abnormal event to the instant messaging software in the client, the user issues the adjustment instruction through the instant messaging software. The instruction execution module is used to execute adjustment instructions.

[0088] Optionally, the reporting module 403 may include: The desensitization submodule is used to desensitize sensitive fields in snapshot data; The encrypted reporting submodule is used to encrypt and report the processed snapshot data to the local management device through an encrypted channel between the acquisition and monitoring device and the local management device.

[0089] Optionally, the virtual container shares the network namespace of the network device, so that the network protocol stack in the virtual container and the physical network card of the network device are in the same network namespace; The acquisition module 401 may include: The filter mounting submodule is used to call the kernel interface of the network device and mount the filter program to the physical interface of the physical network card.

[0090] Please refer to Figure 5 , Figure 5 This is a structural block diagram of a network device provided in an embodiment of the present invention. The embodiment of the present invention provides a network device 10, including a processor 11 and a memory 12; wherein, the memory 12 is used to store a computer program; the processor 11 is used to execute the data reporting method provided in the foregoing embodiment when executing the computer program.

[0091] For details regarding the specific process of the above data reporting method, please refer to the relevant content provided in the foregoing embodiments, which will not be repeated here.

[0092] Furthermore, the memory 12, as a carrier for resource storage, can be a read-only memory, random access memory, disk, or optical disk, and the storage method can be temporary storage or permanent storage.

[0093] In addition, the network device 10 also includes a power supply 13, a communication interface 14, an input / output interface 15, and a communication bus 16; wherein, the power supply 13 is used to provide operating voltage for each hardware device on the network device 10; the communication interface 14 can create a data transmission channel between the network device 10 and external devices, and the communication protocol it follows can be any communication protocol applicable to the technical solution of this invention, and is not specifically limited here; the input / output interface 15 is used to acquire external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs, and is not specifically limited here.

[0094] Please refer to Figure 6 , Figure 6 This is a structural block diagram of another monitoring system provided in an embodiment of the present invention. The system includes: Network device 10, a data collection and monitoring device 102 is deployed in the virtual container 101 of network device 10, and the data collection and monitoring device 102 is used to execute the above-mentioned data reporting method; The local management device 20 is used to receive snapshot data reported by the acquisition and monitoring device 102, perform anomaly detection on the snapshot data, and report the detection results to the client device 30; it also receives adjustment instructions issued by the client device 30 and issues the adjustment instructions to the acquisition and monitoring device 102. The client device 30 is equipped with instant messaging software 301, which is used to receive and output display of detection results; receive adjustment instructions input by the user and send the adjustment instructions to the local management device 20.

[0095] As can be seen, in this system, users can interact bidirectionally through instant messaging software. This allows administrators to locate and handle faults without needing to master professional network analysis tools. They can do so using the enterprise instant messaging software they use daily, thus lowering the skill threshold for operation and maintenance and speeding up fault response.

[0096] Since the embodiments of the monitoring system section correspond to the embodiments of the data reporting method section, the embodiments of the storage medium section are described in the data reporting method section and will not be repeated here.

[0097] This invention also provides a computer program product, including a computer program / instruction, which, when executed by a processor, implements the data reporting method described in the above embodiments.

[0098] Since the embodiments of the computer program product section correspond to the embodiments of the data reporting method section, please refer to the description of the embodiments of the data reporting method section for the embodiments of the computer program product section, and they will not be repeated here.

[0099] This invention also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the data reporting method described in the above embodiments.

[0100] Since the embodiments of the computer-readable storage medium portion correspond to the embodiments of the data reporting method portion, the embodiments of the storage medium portion are described in the description of the embodiments of the data reporting method portion, and will not be repeated here.

[0101] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to the method section.

[0102] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0103] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0104] The data reporting method, data acquisition and monitoring device, network equipment, monitoring system, and computer-readable storage medium provided by this invention have been described in detail above. Specific examples have been used to illustrate the principles and implementation methods of this invention. The descriptions of the embodiments above are only for the purpose of helping to understand the method and core ideas of this invention. It should be noted that those skilled in the art can make various improvements and modifications to this invention without departing from its principles, and these improvements and modifications also fall within the protection scope of this invention.

Claims

1. A data reporting method, characterized in that, Applied to a data acquisition and monitoring device, wherein the data acquisition and monitoring device is deployed in a virtual container within a network device, the method includes: A filtering program is loaded into the kernel of the network device through the kernel interface of the network device. The filtering program collects the management frames and control frames transmitted by the network device and saves the management frames and control frames in the memory cache. The system monitors various event information in the network device, determines whether the event information meets preset reporting conditions, and locks the memory cache when it is determined that the preset reporting conditions are met. A snapshot of the memory cache is taken, and the snapshot data is reported to the local management device so that the local management device can perform anomaly detection on the snapshot data.

2. The data reporting method according to claim 1, characterized in that, The step of storing the management frame and the control frame in a memory cache includes: The management frame and the control frame are overwritten by the write pointer to the current position pointed to by the write pointer in the memory cache. Determine whether the current position is the end position of the memory cache area; If the current position is the end of the memory cache, then the write pointer is adjusted to point to the beginning of the memory cache; If the current position is not the end of the memory cache, then the write pointer is adjusted to point to the next position after the current position.

3. The data reporting method according to claim 2, characterized in that, Also includes: Obtain the available memory size of the network device; If the available memory size meets the preset memory expansion conditions, then the write pointer is suspended, the expansion size is determined according to the current size of the memory cache, a new memory space of the expansion size is requested from the network device, the data in the memory cache is migrated to the new memory space, the old memory space corresponding to the memory cache is released, and the write pointer is restored. If the available memory size meets the preset memory shrinkage condition, then the write pointer is suspended, the shrinkage size is determined according to the current size of the memory cache, the target memory segment containing the most recently written target data of the same size as the shrinkage size is determined, the portion of the memory cache excluding the target memory segment is released, and the write pointer is restored. When performing an expansion or contraction operation on the memory cache, if it is determined that the preset reporting conditions are met, the expansion or contraction operation is stopped, and the expansion or contraction operation is continued when the snapshot operation on the memory cache is completed.

4. The data reporting method according to claim 1, characterized in that, Also includes: Monitor abnormal events encountered by the network device and determine the frequency of occurrence of the abnormal events within a preset time window; The acquisition frequency of the management frame and the control frame is adjusted according to the occurrence frequency.

5. The data reporting method according to claim 1, characterized in that, Also includes: The system receives adjustment instructions from the local management device; wherein, when the local management device reports the anomaly detection results to the instant messaging software in the client, the user issues the adjustment instructions through the instant messaging software. Execute the adjustment command.

6. The data reporting method according to claim 1, characterized in that, Reporting snapshot data to the local management device includes: Sensitive fields in the snapshot data are anonymized. The processed snapshot data is encrypted and reported to the local management device through the encrypted channel between the acquisition and monitoring device and the local management device.

7. The data reporting method according to claim 1, characterized in that, The virtual container shares the network namespace of the network device, so that the network protocol stack in the virtual container and the physical network card of the network device are in the same network namespace. Loading a filter program into the kernel of the network device through the network device's kernel interface includes: The kernel interface of the network device is invoked to attach the filtering program to the physical interface of the physical network card.

8. A data acquisition and monitoring device, characterized in that, The data acquisition and monitoring device is deployed in a virtual container within a network device, and the device includes: The acquisition module is used to load a filtering program into the kernel of the network device through the kernel interface of the network device, acquire management frames and control frames transmitted by the network device through the filtering program, and save the management frames and control frames in the memory cache. The monitoring module is used to monitor various event information in the network device, determine whether the event information meets the preset reporting conditions, and lock the memory cache when it is determined that the preset reporting conditions are met. The reporting module is used to take a snapshot of the memory cache and report the obtained snapshot data to the local management device so that the local management device can perform anomaly detection based on the snapshot data.

9. A network device, characterized in that, include: Memory, used to store computer programs; A processor for executing the computer program to implement the data reporting method as described in any one of claims 1 to 7.

10. A monitoring system, characterized in that, include: A network device, wherein a data acquisition and monitoring device is deployed in a virtual container of the network device, the data acquisition and monitoring device being used to perform the data reporting method as described in any one of claims 1 to 7; The local management device is used to receive snapshot data reported by the acquisition and monitoring device, perform anomaly detection on the snapshot data, and report the detection results to the client device; Receive adjustment instructions from the client device and send the adjustment instructions to the acquisition and monitoring device; The client device is equipped with the instant messaging software, which is used to receive and display the detection results; receive adjustment instructions input by the user, and send the adjustment instructions to the local management device.

11. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when loaded and executed by a processor, implement the data reporting method as described in any one of claims 1 to 7.

Images