Network node monitoring method, apparatus, device, storage medium, and program product

Abstract

This invention provides a network node monitoring method, apparatus, device, storage medium, and program product, relating to the field of communication technology. The method includes: receiving reporting information sent by a target node, the reporting information including at least one of the following: historical performance parameters of the target node, first resource parameters of the target node when receiving a request, and routing parameters of the request; calculating a target score based on at least one of the historical performance parameters, the first resource parameters, and the routing parameters of the request, the target score being used to characterize the likelihood of the target node being attacked; and sending a target policy to the target node based on the target score, the target policy being used to instruct the target node to execute the request or refuse to execute the request. This invention can improve monitoring accuracy.

Description

Technical Field

[0001] This invention relates to the field of communication technology, and specifically to a network node monitoring method, apparatus, device, storage medium, and program product. Background Technology

[0002] Network nodes are a key technology in network transmission, enabling the interconnection of different addresses. Because network nodes are vulnerable to attack, they need to be monitored to prevent malicious requests from being executed, thus maintaining normal network operation. In related technologies, network node attack status is typically determined by monitoring changes in network traffic. However, since network traffic fluctuates over time, relying solely on traffic changes cannot accurately determine whether a network node is under attack, leading to false positives or false negatives during monitoring.

[0003] It is evident that the relevant technologies suffer from low accuracy in monitoring network nodes. Summary of the Invention

[0004] This invention provides a network node monitoring method, apparatus, device, storage medium, and program product to solve the problem of low accuracy in network node monitoring in related technologies.

[0005] To solve the above problems, the present invention is implemented as follows:

[0006] In a first aspect, embodiments of the present invention provide a network node monitoring method, comprising:

[0007] The system receives reporting information sent by the target node, the reporting information including at least one of the following: the historical performance parameters of the target node, the first resource parameters of the target node when it receives the request, and the routing parameters of the request;

[0008] A target score is calculated based on at least one of the historical performance parameters, the first resource parameters, and the routing parameters of the request. The target score is used to characterize the likelihood that the target node is attacked.

[0009] Based on the target score, a target policy is sent to the target node, which instructs the target node to execute the request or refuse to execute the request.

[0010] In one embodiment, calculating the target score based on at least one of the historical performance parameters, the first resource parameters, and the routing parameters of the request includes:

[0011] The target score is calculated based on at least one of the performance anomaly score, resource anomaly score, and anomaly path score.

[0012] in,

[0013] The performance anomaly score is calculated based on the historical performance parameters, the resource anomaly score is calculated based on the first resource parameters, and / or the anomaly path score is calculated based on the routing parameters.

[0014] In one embodiment, the performance anomaly score is calculated as follows:

[0015] Based on the historical performance parameters, the target node's first performance parameter in the first time period, the second performance parameter in the second time period, and the third performance parameter in the third time period are calculated. The first time period and the second time period are the two most recent time periods before the target node receives the request. The first time period is before the second time period, and the third time period is longer than the first time period and the second time period.

[0016] The predicted performance parameters are obtained by using a Long Short-Term Memory (LSTM) network based on the first performance parameters.

[0017] The performance anomaly score is calculated based on the second performance parameter, the predicted performance parameter, and the third performance parameter.

[0018] In one embodiment, calculating the performance anomaly score based on the second performance parameter, the predicted performance parameter, and the third performance parameter includes:

[0019] The quotient of the first difference and the second difference is set as the performance anomaly score, where the first difference is the difference between the predicted performance parameter and the second performance parameter, and the second difference is the difference between the third performance parameter and the second performance parameter.

[0020] In one embodiment, the resource anomaly score is calculated as follows:

[0021] Obtain the historical resource parameters of the target node;

[0022] The second resource parameters for the fourth time period are calculated based on the historical resource parameters.

[0023] The resource anomaly score is calculated based on the second resource parameter and the first resource parameter.

[0024] In one embodiment, processing the second resource parameter and the first resource parameter to calculate the resource anomaly score includes:

[0025] The first weight corresponding to the second resource parameter is obtained by calculating the first resource parameter based on the self-attention algorithm;

[0026] The product of the first weight and the first quotient is set as the resource anomaly score, where the first quotient is the quotient of the third difference and the second resource parameter, and the third difference is the difference between the second resource parameter and the first resource parameter.

[0027] In one embodiment, the abnormal path score is calculated as follows:

[0028] Based on the routing parameters, obtain N intermediate paths corresponding to the target node, where N is a positive integer greater than 1;

[0029] The N intermediate paths are scored to obtain the scores of the N intermediate paths;

[0030] The highest score among the N intermediate paths is set as the abnormal path score.

[0031] In one embodiment, the routing parameters include a source Internet Protocol IP address and a destination IP address, and obtaining N intermediate paths corresponding to the destination node based on the routing parameters includes:

[0032] Obtain the network topology diagram of the target node;

[0033] Multiple initial paths are obtained from the network topology map based on the source IP and the target IP;

[0034] The N intermediate paths are obtained by filtering from the multiple initial paths.

[0035] In one embodiment, the step of filtering the N intermediate paths from the plurality of initial paths includes:

[0036] Estimate the first packet loss rate from the source IP to the target node in each initial path, and the second packet loss rate from the target node to the target IP in each initial path;

[0037] Set the sum of the first packet loss rate and the second packet loss rate as the target packet loss rate for each initial path;

[0038] The N initial paths with the lowest target packet loss rate among the multiple initial paths are set as the N intermediate paths.

[0039] In one embodiment, the routing parameters include the source IP, and the scoring of the N intermediate paths to obtain scores for the N intermediate paths includes:

[0040] Based on the source IP, a preset network routing database is queried to obtain the first condition information associated with the source IP. The preset network routing database includes condition information associated with different IPs. The first condition information is used to characterize the relevant features of the source IP when no malicious requests are sent.

[0041] At least one second condition is generated based on the first condition information, and the at least one second condition information is used to characterize the relevant features of the source IP when sending an attack request;

[0042] The N intermediate paths are scored using a large language model (LLM) based on at least one second conditional information to obtain scores for the N intermediate paths.

[0043] Secondly, embodiments of the present invention also provide a network node monitoring device, comprising:

[0044] A receiving module is used to receive reporting information sent by a target node. The reporting information includes at least one of the following: historical performance parameters of the target node, first resource parameters of the target node when it receives the request, and routing parameters of the request.

[0045] The calculation module is used to calculate a target score based on at least one of the historical performance parameters, the first resource parameters, and the routing parameters of the request, wherein the target score is used to characterize the probability that the target node is attacked;

[0046] The sending module is used to send a target policy to the target node based on the target score. The target policy is used to instruct the target node to execute the request or refuse to execute the request.

[0047] In one embodiment, the computing module includes:

[0048] A calculation unit is configured to calculate the target score based on at least one of performance anomaly score, resource anomaly score, and anomaly path score.

[0049] in,

[0050] The performance anomaly score is calculated based on the historical performance parameters, the resource anomaly score is calculated based on the first resource parameters, and / or the anomaly path score is calculated based on the routing parameters.

[0051] In one embodiment, the performance anomaly score is calculated as follows:

[0052] Based on the historical performance parameters, the target node's first performance parameter in the first time period, the second performance parameter in the second time period, and the third performance parameter in the third time period are calculated. The first time period and the second time period are the two most recent time periods before the target node receives the request. The first time period is before the second time period, and the third time period is longer than the first time period and the second time period.

[0053] The predicted performance parameters are obtained by using a Long Short-Term Memory (LSTM) network based on the first performance parameters.

[0054] The performance anomaly score is calculated based on the second performance parameter, the predicted performance parameter, and the third performance parameter.

[0055] In one embodiment, calculating the performance anomaly score based on the second performance parameter, the predicted performance parameter, and the third performance parameter includes:

[0056] The quotient of the first difference and the second difference is set as the performance anomaly score, where the first difference is the difference between the predicted performance parameter and the second performance parameter, and the second difference is the difference between the third performance parameter and the second performance parameter.

[0057] In one embodiment, the resource anomaly score is calculated as follows:

[0058] Obtain the historical resource parameters of the target node;

[0059] The second resource parameters for the fourth time period are calculated based on the historical resource parameters.

[0060] The resource anomaly score is calculated based on the second resource parameter and the first resource parameter.

[0061] In one embodiment, processing the second resource parameter and the first resource parameter to calculate the resource anomaly score includes:

[0062] The first weight corresponding to the second resource parameter is obtained by calculating the first resource parameter based on the self-attention algorithm;

[0063] The product of the first weight and the first quotient is set as the resource anomaly score, where the first quotient is the quotient of the third difference and the second resource parameter, and the third difference is the difference between the second resource parameter and the first resource parameter.

[0064] In one embodiment, the abnormal path score is calculated as follows:

[0065] Based on the routing parameters, obtain N intermediate paths corresponding to the target node, where N is a positive integer greater than 1;

[0066] The N intermediate paths are scored to obtain the scores of the N intermediate paths;

[0067] The highest score among the N intermediate paths is set as the abnormal path score.

[0068] In one embodiment, the routing parameters include a source Internet Protocol IP address and a destination IP address, and obtaining N intermediate paths corresponding to the destination node based on the routing parameters includes:

[0069] Obtain the network topology diagram of the target node;

[0070] Multiple initial paths are obtained from the network topology map based on the source IP and the target IP;

[0071] The N intermediate paths are obtained by filtering from the multiple initial paths.

[0072] In one embodiment, the step of filtering the N intermediate paths from the plurality of initial paths includes:

[0073] Estimate the first packet loss rate from the source IP to the target node in each initial path, and the second packet loss rate from the target node to the target IP in each initial path;

[0074] Set the sum of the first packet loss rate and the second packet loss rate as the target packet loss rate for each initial path;

[0075] The N initial paths with the lowest target packet loss rate among the multiple initial paths are set as the N intermediate paths.

[0076] In one embodiment, the routing parameters include the source IP, and the scoring of the N intermediate paths to obtain scores for the N intermediate paths includes:

[0077] Based on the source IP, a preset network routing database is queried to obtain the first condition information associated with the source IP. The preset network routing database includes condition information associated with different IPs. The first condition information is used to characterize the relevant features of the source IP when no malicious requests are sent.

[0078] At least one second condition is generated based on the first condition information, and the at least one second condition information is used to characterize the relevant features of the source IP when sending an attack request;

[0079] The N intermediate paths are scored using a large language model (LLM) based on at least one second conditional information to obtain scores for the N intermediate paths.

[0080] Thirdly, embodiments of the present invention also provide an electronic device, including a transceiver and a processor.

[0081] The transceiver is used to receive reporting information sent by the target node. The reporting information includes at least one of the following: the historical performance parameters of the target node, the first resource parameters of the target node when it receives the request, and the routing parameters of the request.

[0082] The processor is configured to calculate a target score based on at least one of the historical performance parameters, the first resource parameters, and the routing parameters of the request, wherein the target score is used to characterize the likelihood that the target node is attacked;

[0083] The transceiver is also configured to send a target policy to the target node based on the target score, the target policy being used to instruct the target node to execute the request or refuse to execute the request.

[0084] In one embodiment, calculating the target score based on at least one of the historical performance parameters, the first resource parameters, and the routing parameters of the request includes:

[0085] The target score is calculated based on at least one of the performance anomaly score, resource anomaly score, and anomaly path score.

[0086] in,

[0087] The performance anomaly score is calculated based on the historical performance parameters, the resource anomaly score is calculated based on the first resource parameters, and / or the anomaly path score is calculated based on the routing parameters.

[0088] In one embodiment, the performance anomaly score is calculated as follows:

[0089] Based on the historical performance parameters, the target node's first performance parameter in the first time period, the second performance parameter in the second time period, and the third performance parameter in the third time period are calculated. The first time period and the second time period are the two most recent time periods before the target node receives the request. The first time period is before the second time period, and the third time period is longer than the first time period and the second time period.

[0090] The predicted performance parameters are obtained by using a Long Short-Term Memory (LSTM) network based on the first performance parameters.

[0091] The performance anomaly score is calculated based on the second performance parameter, the predicted performance parameter, and the third performance parameter.

[0092] In one embodiment, calculating the performance anomaly score based on the second performance parameter, the predicted performance parameter, and the third performance parameter includes:

[0093] The quotient of the first difference and the second difference is set as the performance anomaly score, where the first difference is the difference between the predicted performance parameter and the second performance parameter, and the second difference is the difference between the third performance parameter and the second performance parameter.

[0094] In one embodiment, the resource anomaly score is calculated as follows:

[0095] Obtain the historical resource parameters of the target node;

[0096] The second resource parameters for the fourth time period are calculated based on the historical resource parameters.

[0097] The resource anomaly score is calculated based on the second resource parameter and the first resource parameter.

[0098] In one embodiment, processing the second resource parameter and the first resource parameter to calculate the resource anomaly score includes:

[0099] The first weight corresponding to the second resource parameter is obtained by calculating the first resource parameter based on the self-attention algorithm;

[0100] The product of the first weight and the first quotient is set as the resource anomaly score, where the first quotient is the quotient of the third difference and the second resource parameter, and the third difference is the difference between the second resource parameter and the first resource parameter.

[0101] In one embodiment, the abnormal path score is calculated as follows:

[0102] Based on the routing parameters, obtain N intermediate paths corresponding to the target node, where N is a positive integer greater than 1;

[0103] The N intermediate paths are scored to obtain the scores of the N intermediate paths;

[0104] The highest score among the N intermediate paths is set as the abnormal path score.

[0105] In one embodiment, the routing parameters include a source Internet Protocol IP address and a destination IP address, and obtaining N intermediate paths corresponding to the destination node based on the routing parameters includes:

[0106] Obtain the network topology diagram of the target node;

[0107] Multiple initial paths are obtained from the network topology map based on the source IP and the target IP;

[0108] The N intermediate paths are obtained by filtering from the multiple initial paths.

[0109] In one embodiment, the step of filtering the N intermediate paths from the plurality of initial paths includes:

[0110] Estimate the first packet loss rate from the source IP to the target node in each initial path, and the second packet loss rate from the target node to the target IP in each initial path;

[0111] Set the sum of the first packet loss rate and the second packet loss rate as the target packet loss rate for each initial path;

[0112] The N initial paths with the lowest target packet loss rate among the multiple initial paths are set as the N intermediate paths.

[0113] In one embodiment, the routing parameters include the source IP, and the scoring of the N intermediate paths to obtain scores for the N intermediate paths includes:

[0114] Based on the source IP, a preset network routing database is queried to obtain the first condition information associated with the source IP. The preset network routing database includes condition information associated with different IPs. The first condition information is used to characterize the relevant features of the source IP when no malicious requests are sent.

[0115] At least one second condition is generated based on the first condition information, and the at least one second condition information is used to characterize the relevant features of the source IP when sending an attack request;

[0116] The N intermediate paths are scored using a large language model (LLM) based on at least one second conditional information to obtain scores for the N intermediate paths.

[0117] Fourthly, embodiments of the present invention provide an electronic device, including: a processor, a memory, and a program stored in the memory and executable on the processor, wherein the program, when executed by the processor, implements the steps of the network node monitoring method described in the first aspect.

[0118] Fifthly, embodiments of the present invention provide a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the network node monitoring method described in the first aspect.

[0119] In a sixth aspect, the present invention also provides a computer program product, including computer instructions that, when executed by a processor, implement the steps in the network node monitoring method described in the first aspect above.

[0120] In this embodiment of the invention, a reported information sent by a target node is received. The reported information includes at least one of the following: historical performance parameters of the target node, first resource parameters of the target node when it receives a request, and routing parameters of the request. A target score is calculated based on at least one of the historical performance parameters, the first resource parameters, and the routing parameters of the request. The target score is used to characterize the likelihood that the target node is attacked. A target policy is sent to the target node based on the target score. The target policy is used to instruct the target node to execute the request or refuse to execute the request. Thus, by calculating the target score based on at least one of the historical performance parameters, the first resource parameters, and the routing parameters of the request, the target score can be used to confirm whether the request received by the target node is abnormal, improving the accuracy of monitoring. Furthermore, sending the target policy to the target node based on the target score allows the target node to execute or refuse to execute the request according to the target policy. Attached Figure Description

[0121] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the description of the embodiments of the present invention will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0122] Figure 1 This is a flowchart of a network node monitoring method provided in an embodiment of the present invention;

[0123] Figure 2 This is a schematic diagram of target node monitoring provided in an embodiment of the present invention;

[0124] Figure 3 This is a schematic diagram of the structure of the intelligent agent module provided in an embodiment of the present invention;

[0125] Figure 4 This is a schematic diagram of the structure of the decision module based on the LLM model provided in an embodiment of the present invention;

[0126] Figure 5 This is a schematic diagram of the structure of a network node monitoring device provided in an embodiment of the present invention;

[0127] Figure 6 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0128] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0129] In this embodiment of the invention, a method, apparatus, device, storage medium, and program product for monitoring network nodes are proposed to solve the problem of low accuracy in monitoring network nodes in related technologies.

[0130] See Figure 1 , Figure 1 This is a flowchart of a network node monitoring method provided in an embodiment of the present invention, such as... Figure 1 As shown, the method includes the following steps:

[0131] Step 101: Receive the reporting information sent by the target node. The reporting information includes at least one of the following: the historical performance parameters of the target node, the first resource parameters of the target node when it receives the request, and the routing parameters of the request.

[0132] The target nodes mentioned above are network nodes that need to be monitored. The reported information is the information reported by the target nodes under certain conditions. The attack status of the target nodes is determined by analyzing the reported information they send. The network nodes are used to receive and forward requests sent from different Internet Protocol (IP) addresses.

[0133] In some implementations, the preset conditions may include at least one of the following:

[0134] The set time has elapsed since the last reported information was sent;

[0135] The network node received a new request.

[0136] Network nodes can periodically send reporting information, meaning they can resend information after a set time has elapsed since the last reported information. In this case, the reported information can include the target node's historical performance parameters. It should be noted that these historical performance parameters can be parameters previously sent by the target node. These performance parameters are stored in a database, and are retrieved by querying the database when the target score needs to be calculated.

[0137] In addition, when a network node receives a new request, it can send parameters related to the new request. In this case, the reported information may include the first resource parameters and / or the routing parameters of the request.

[0138] It should be noted that the traffic of a network node changes during the process of receiving and forwarding requests. At the same time, the performance and / or resource usage of the network node also change. There is a significant difference in the changes in the performance and / or resource usage of a network node when it is forwarding requests normally and when it is under attack. Therefore, in this invention, at least one of the following is used to monitor whether a network node is under attack: the historical performance parameters of the target node, the first resource parameters of the target node when it receives the request, and the routing parameters of the request.

[0139] In some implementations, the historical performance parameters include at least one of the following: the number of Hypertext Transfer Protocol (HTTP) protocol parsing failures, the number of Transmission Control Protocol (TCP) connection failures, the number of User Datagram Protocol (UDP) packets sent, and the number of connections rejected by network nodes.

[0140] In some implementations, the resource parameters include at least one of central processing unit (CPU) utilization, input / output (IO) rate, and memory utilization.

[0141] The above request is a request received by the target node that needs to be forwarded or processed. The request may include the source IP address and the destination IP address, and the target node can forward the request based on these two IP addresses.

[0142] Step 102: Calculate the target score based on at least one of the historical performance parameters, the first resource parameters, and the routing parameters of the request. The target score is used to characterize the probability that the target node is attacked.

[0143] The target score mentioned above is used to characterize the probability that the target node is attacked. The target score can be used to determine whether the target node has been attacked.

[0144] In some implementations, a threshold can be set to determine whether a target node has been attacked.

[0145] Specifically, if the target score is greater than or equal to a set threshold, the request received by the target node is an abnormal request for attack. At this time, the request is rejected and recorded in the database so that it can be quickly confirmed whether the received request is an abnormal request through the records in the database. That is, a policy of refusing to execute the request is sent to the target node. After receiving the policy, the target node stops executing the request.

[0146] If the target score is less than the set threshold, the request is considered a normal request. In this case, a strategy for executing the request is sent to the target node, and the target node executes the request after receiving the strategy.

[0147] Step 103: Send a target policy to the target node based on the target score. The target policy is used to instruct the target node to execute the request or refuse to execute the request.

[0148] In this embodiment of the invention, a reported information sent by a target node is received. The reported information includes at least one of the following: historical performance parameters of the target node, first resource parameters of the target node when it receives a request, and routing parameters of the request. A target score is calculated based on at least one of the historical performance parameters, the first resource parameters, and the routing parameters of the request. The target score is used to characterize the likelihood that the target node is attacked. A target policy is sent to the target node based on the target score. The target policy is used to instruct the target node to execute the request or refuse to execute the request. Thus, by calculating the target score based on at least one of the historical performance parameters, the first resource parameters, and the routing parameters of the request, the target score can be used to confirm whether the request received by the target node is abnormal, improving the accuracy of monitoring. Furthermore, sending the target policy to the target node based on the target score allows the target node to execute or refuse to execute the request according to the target policy.

[0149] Furthermore, such as Figure 2 As shown, network nodes can be monitored through a cloud management platform. Network nodes send reporting information to the cloud management platform, such as periodically reporting performance parameters and resource parameters, and sending relevant data for real-time requests. The cloud management platform is equipped with an intelligent agent module, which sends the reporting information to the intelligent agent module. The intelligent agent module calculates the target score and generates the corresponding target strategy. The cloud management platform sends the target strategy to the network nodes to realize the monitoring and control of the network nodes.

[0150] In some implementations, the agent module can deploy an anomaly database, which includes recorded information on abnormal requests. This database allows for quick analysis of whether a request is abnormal.

[0151] In one embodiment, calculating the target score based on at least one of the historical performance parameters, the first resource parameters, and the routing parameters of the request includes:

[0152] The target score is calculated based on at least one of the performance anomaly score, resource anomaly score, and anomaly path score.

[0153] in,

[0154] The performance anomaly score is calculated based on the historical performance parameters, the resource anomaly score is calculated based on the first resource parameters, and / or the anomaly path score is calculated based on the routing parameters.

[0155] In this embodiment of the invention, a performance anomaly score is calculated using historical performance parameters, a resource anomaly score is calculated using a first resource parameter, an anomaly path score is calculated using routing parameters, and the target score is calculated based on at least one of the performance anomaly score, resource anomaly score, and anomaly path score.

[0156] In some implementations, if the reported information includes only one of the historical performance parameters, the first resource parameters, and the routing parameters of the request, the performance anomaly score, the resource anomaly score, or the anomaly path score is set as the target score.

[0157] In some implementations, when the reported information includes only at least two of the historical performance parameters, the first resource parameters, and the routing parameters of the request, the target score is obtained by weighting at least two of the performance anomaly score, the resource anomaly score, and the anomaly path score.

[0158] The target score can be calculated using the following formula:

[0159] CN = W l AL+W w AW+W z AZ;

[0160] In the formula, CN represents the target score, and W1 and W... w W z is the weighting coefficient, AL is the abnormal path score, AW is the performance anomaly score, and AZ is the resource anomaly score.

[0161] In one embodiment, the performance anomaly score is calculated as follows:

[0162] Based on the historical performance parameters, the target node's first performance parameter in the first time period, the second performance parameter in the second time period, and the third performance parameter in the third time period are calculated. The first time period and the second time period are the two most recent time periods before the target node receives the request. The first time period is before the second time period, and the third time period is longer than the first time period and the second time period.

[0163] Based on the first performance parameter, a prediction performance parameter is obtained by using a Long Short-Term Memory (LSTM) network.

[0164] The performance anomaly score is calculated based on the second performance parameter, the predicted performance parameter, and the third performance parameter.

[0165] The first and second time periods mentioned above are adjacent and can be performance parameters periodically reported by the target node. For example, if the target node reports performance parameters every 5 minutes, and it is necessary to calculate the performance anomaly score at time t, the first performance parameter of the first time period is the performance parameter sent by the target node within 5 minutes at time t-10, and the second performance parameter of the second time period is the performance parameter sent by the target node within 5 minutes at time t-5.

[0166] In some implementations, the first performance parameter can be the granular mean of performance parameters over a first time period, and the second performance parameter can be the granular mean of performance parameters over a second time period. For example, the first performance parameter for the first time period is T. n-10 {x 11 ,x 22 ,x 33 ,x 44 The second performance parameter for the second time period is T. n-5 {x1,x2,x3,x4}.

[0167] The third time period is longer than the first and second time periods. The third performance parameter of the third time period is used to set a baseline for normal data to determine whether the performance parameters of the current target node are in a normal state. For example, the third time period can be a day or half a day before time t.

[0168] In some implementations, the third performance parameter is the granular peak value of the performance parameter within a third time period. For example, the third performance parameter for the third time period is T. day {x 1i ,x 2i ,x 3i ,x 4i}

[0169] The aforementioned LSTM is used to predict performance parameters, yielding the predicted performance parameters. Specifically, the LSTM is trained using performance parameters periodically reported by the target node. These parameters are those reported when the target node is not under attack. If the target node is attacked at a certain moment, the performance parameters from that moment are not used to train the LSTM, ensuring that the LSTM can accurately predict the target node's performance parameters at that specific moment.

[0170] In this embodiment of the invention, a performance anomaly score is calculated based on a second performance parameter, a predicted performance parameter, and a third performance parameter. The performance anomaly score can be used to analyze whether the target node has been attacked from the perspective of performance parameters.

[0171] In some implementations, such as Figure 3 As shown, the intelligent agent module is equipped with an LSTM-based network performance prediction module. The LSTM-based network performance prediction module receives the first performance parameter, the second performance parameter, and the third performance parameter sent by the cloud management platform. The LSTM-based network performance prediction module calculates the performance anomaly score based on the first performance parameter, the second performance parameter, and the third performance parameter.

[0172] In one embodiment, calculating the performance anomaly score based on the second performance parameter, the predicted performance parameter, and the third performance parameter includes:

[0173] The quotient of the first difference and the second difference is set as the performance anomaly score, where the first difference is the difference between the predicted performance parameter and the second performance parameter, and the second difference is the difference between the third performance parameter and the second performance parameter.

[0174] In this embodiment of the invention, the quotient of the first difference and the second difference is taken as the performance anomaly score. The first difference is the difference between the predicted performance parameter and the second performance parameter, and the second difference is the difference between the third performance parameter and the second performance parameter. Thus, the performance anomaly score is calculated using the second performance parameter, the predicted performance parameter, and the third performance parameter.

[0175] The first, second, and third performance parameters include at least one of the following: the number of HTTP protocol parsing failures, the number of TCP connection failures, the number of UDP packets sent, and the number of connections rejected by network nodes. It should be noted that when the first, second, and third performance parameters include only one of these parameters, the performance anomaly score is calculated directly using these parameters. However, when the first, second, and third performance parameters include at least two of these parameters, a sub-score for each parameter needs to be calculated first, and then the sub-scores are weighted to obtain the final performance anomaly score.

[0176] For example, when the first, second, and third performance parameters include the number of HTTP protocol parsing failure messages, the number of TCP connection failures, the number of UDP packets sent, and the number of network nodes rejecting connections, the first performance parameter includes: the number of HTTP protocol parsing failure messages x1, the number of TCP connection failures x2, the number of UDP packets sent x3, and the number of network nodes rejecting connections x4. The formula for predicting the first performance parameter using LSTM is as follows:

[0177] {E1,E2...E4}=LSTM({X1,X2...X4});

[0178] In the formula, E1 is the predicted number of HTTP protocol parsing failure packets in the second time period, E2 is the predicted number of TCP connection failures in the second time period, E3 is the predicted number of UDP packets sent in the second time period, and E4 is the predicted number of network nodes rejecting connections in the second time period.

[0179] After predicting the number of HTTP protocol parsing failure messages, the number of TCP connection failures, the number of UDP packets sent, and the number of network nodes rejecting connections using the above formulas, the performance anomaly score is calculated by combining the second and third performance parameters. The calculation process can be expressed by the following formula:

[0180]

[0181] In the formula, AW represents the performance anomaly score, and W... k E represents the weighting coefficients for the number of HTTP protocol parsing failure messages, the number of TCP connection failures, the number of UDP packets sent, and the number of connections refused by network nodes.k To predict the number of HTTP protocol parsing failure messages, the number of TCP connection failures, the number of UDP packets sent, or the number of network nodes refusing connections, P k The second performance parameter includes the number of HTTP protocol parsing failure messages, the number of TCP connection failures, and the number of UDP packets sent. kmax The third performance parameter includes the number of HTTP protocol parsing failure messages, the number of TCP connection failures, and the number of UDP packets sent. The first and second performance parameters (the number of HTTP protocol parsing failure messages, the number of TCP connection failures, and the number of UDP packets sent) are granular averages, while the third performance parameter (the number of HTTP protocol parsing failure messages, the number of TCP connection failures, and the number of UDP packets sent) are granular peak values.

[0182] In this way, by using the third performance parameter as the baseline for normal data, the performance anomaly score is calculated using the predicted data (predicted performance parameter) and the actual data (second performance parameter).

[0183] In one embodiment, the resource anomaly score is calculated as follows:

[0184] Obtain the historical resource parameters of the target node;

[0185] The second resource parameters for the fourth time period are calculated based on the historical resource parameters.

[0186] The resource anomaly score is calculated based on the second resource parameter and the first resource parameter.

[0187] The aforementioned historical resource parameters are resource parameters previously sent by the target node. These parameters can be resource parameters sent periodically by the target node, or resource parameters sent by the target node after receiving different requests. The second resource parameter for the fourth time period is calculated using the historical resource parameters. This second resource parameter can be used as a baseline for normal data, thereby enabling the determination of whether the first resource parameter is abnormal.

[0188] The second resource parameter is the resource parameter for the fourth time period. To make the second parameter more accurate, the fourth time period should be the most recent and relatively long time period possible. This ensures that the baseline conforms to the changing characteristics of the current time and improves the accuracy of the baseline. For example, the fourth time period could be one month or half a month before the request was received.

[0189] In some implementations, the first resource parameter is the real-time resource parameter when the target node receives the request, and the second resource parameter is the granular average peak value of the fourth time period. The fourth time period can be divided into multiple sub-time periods, each with an average value, and the third resource parameter is the peak value among the average values ​​of the multiple sub-time periods.

[0190] In this embodiment of the invention, historical resource parameters of the target node are obtained; second resource parameters for a fourth time period are calculated based on the historical resource parameters; and the resource anomaly score is calculated based on the second resource parameters and the first resource parameters. Thus, the resource anomaly score is calculated using the historical resource parameters, the first resource parameters, and the second resource parameters of the target node.

[0191] In one embodiment, processing the second resource parameter and the first resource parameter to calculate the resource anomaly score includes:

[0192] The first weight corresponding to the second resource parameter is obtained by calculating the first resource parameter based on the self-attention algorithm;

[0193] The product of the first weight and the first quotient is set as the resource anomaly score, where the first quotient is the quotient of the third difference and the second resource parameter, and the third difference is the difference between the second resource parameter and the first resource parameter.

[0194] In this embodiment of the invention, a first weight corresponding to the second resource parameter is obtained by calculating the first resource parameter based on a self-attention algorithm; the product of the first weight and the first quotient is set as the resource anomaly score, where the first quotient is the quotient of the third difference and the second resource parameter, and the third difference is the difference between the second resource parameter and the first resource parameter. Thus, the resource anomaly score is calculated using the first and second resource parameters through the self-attention algorithm.

[0195] In some implementations, the resource parameters include at least one of CPU utilization, I / O rate, and memory utilization. When the first and second resource parameters include one of CPU utilization, I / O rate, and memory utilization, the resource anomaly score is directly calculated from the CPU utilization, I / O rate, and memory utilization. However, when the first and second resource parameters include at least two of CPU utilization, I / O rate, and memory utilization, it is necessary to first calculate the sub-score corresponding to each parameter, and then calculate the resource anomaly score by weighting the sub-scores.

[0196] For example, when the first and second resource parameters include CPU utilization, I / O rate, and memory utilization, the first resource parameters include CPU utilization Y1, I / O rate Y2, and memory utilization Y3. The first weights corresponding to CPU utilization Y1, I / O rate Y2, and memory utilization Y3 are calculated using the Self-Attention algorithm, and the calculation formula is as follows:

[0197]

[0198] Q=W in the formula Q X,K=W k X,V=W v X, W Q W k W v To set up the matrix with corresponding dimensions, X represents the first resource parameter, including CPU utilization Y1, IO rate Y2, or memory utilization Y3. Then, the Self-Attention algorithm is used to calculate the first weights {H1, H2, H3} corresponding to CPU utilization Y1, IO rate Y2, and memory utilization Y3, respectively.

[0199] After calculating the first weights corresponding to CPU utilization Y1, IO rate Y2, and memory utilization Y3, the resource anomaly score is calculated using the following formula:

[0200]

[0201] In the formula, AZ represents the resource anomaly score, and H... k Y is the first weight corresponding to CPU utilization Y1, IO rate Y2, or memory utilization Y3, respectively. k Y1 represents CPU utilization, Y2 represents I / O speed, or Y3 represents memory utilization. kmax The second resource parameters include CPU utilization, I / O rate, and memory utilization.

[0202] In this way, by setting the second resource parameter as the baseline for normal data, the greater the deviation from the baseline, the larger the AZ value, and the more likely the network node resource data is to be abnormal data. The resource anomaly score is calculated by using the second resource parameter and the first resource parameter.

[0203] In some implementations, such as Figure 3 As shown, the intelligent agent module is equipped with a resource data output module based on the self-attention algorithm. The resource data output module based on the self-attention algorithm receives the first resource parameters and historical resource parameters sent by the cloud management platform, and then calculates the resource anomaly score.

[0204] In one embodiment, the abnormal path score is calculated as follows:

[0205] Based on the routing parameters, obtain N intermediate paths corresponding to the target node, where N is a positive integer greater than 1;

[0206] The N intermediate paths are scored to obtain the scores of the N intermediate paths;

[0207] The highest score among the N intermediate paths is set as the abnormal path score.

[0208] In this embodiment of the invention, N intermediate paths corresponding to the target node are obtained based on the routing parameters, where N is a positive integer greater than 1; the N intermediate paths are scored to obtain a score for each of the N intermediate paths; the highest score among the N intermediate paths is set as the abnormal path score. Thus, by calculating the abnormal path score using the N intermediate paths, the normality of the request can be determined from the perspective of the request's sending path.

[0209] It should be noted that there are multiple paths between the same source IP address and the destination IP address, and the optimal path is usually selected during transmission. However, in the case of an attack request, there may be cases where the transmission does not follow the optimal path. In this case, the path can be used to determine whether the request is an attack request.

[0210] In one embodiment, the routing parameters include a source Internet Protocol IP address and a destination IP address, and obtaining N intermediate paths corresponding to the destination node based on the routing parameters includes:

[0211] Obtain the network topology diagram of the target node;

[0212] Multiple initial paths are obtained from the network topology map based on the source IP and the target IP;

[0213] The N intermediate paths are obtained by filtering from the multiple initial paths.

[0214] In this embodiment of the invention, multiple initial paths are determined by the network topology map, source IP and target IP, and then N intermediate paths are obtained by filtering from the multiple paths.

[0215] In some implementations, the N intermediate paths are obtained by filtering from the plurality of initial paths, which may be based on the path length, and the N intermediate paths are the paths with the shortest path length.

[0216] In another embodiment, the step of filtering the N intermediate paths from the plurality of initial paths includes:

[0217] Estimate the first packet loss rate from the source IP to the target node in each initial path, and the second packet loss rate from the target node to the target IP in each initial path;

[0218] Set the sum of the first packet loss rate and the second packet loss rate as the target packet loss rate for each initial path;

[0219] The N initial paths with the lowest target packet loss rate among the multiple initial paths are set as the N intermediate paths.

[0220] The first and second packet loss rates mentioned above can be calculated as follows:

[0221] Obtain the real-time packet loss rate during the fifth time period, as well as at least one of the latency and bandwidth parameters;

[0222] The real-time packet loss rate, and at least one of the latency parameter and bandwidth parameter are input into the A-Star algorithm module, and the first packet loss rate and the second packet loss rate are calculated by the A-Star algorithm module.

[0223] In this embodiment of the invention, the A* algorithm is used to select N initial paths with the lowest packet loss rates as N intermediate paths. The calculation process can be expressed by the following formula:

[0224] f(n) = g(n) + h(n);

[0225] Where f(n) is the target packet loss rate, g(n) is the first packet loss rate, and h(n) is the second packet loss rate.

[0226] In this way, N intermediate paths can be calculated using the above formula. For example, the A* algorithm can be used to obtain the top 50 intermediate paths with the lowest target packet loss rate {L1, L2, L3, ..., L50}.

[0227] In some implementations, such as Figure 3 As shown, the intelligent agent module is equipped with a routing planning module based on the A* algorithm. The routing planning module based on the A* algorithm receives the source IP, the destination IP and the network topology map, and calculates the N intermediate paths between the source IP and the destination IP.

[0228] In one embodiment, the routing parameters include the source IP, and the scoring of the N intermediate paths to obtain scores for the N intermediate paths includes:

[0229] Based on the source IP, a preset network routing database is queried to obtain the first condition information associated with the source IP. The preset network routing database includes condition information associated with different IPs. The first condition information is used to characterize the relevant features of the source IP when no malicious requests are sent.

[0230] At least one second condition is generated based on the first condition information, and the at least one second condition information is used to characterize the relevant features of the source IP when sending an attack request;

[0231] The scores of the N intermediate paths are obtained by scoring the N intermediate paths based on the at least one second conditional information using a Large Language Model (LLM).

[0232] In this embodiment of the invention, a first condition information associated with the source IP is obtained by querying a preset network routing database based on the source IP. The preset network routing database includes condition information associated with different IPs. The first condition information is used to characterize the relevant characteristics of the source IP when no malicious requests are sent. At least one second condition information is generated based on the first condition information. The at least one second condition information is used to characterize the relevant characteristics of the source IP when sending malicious requests. The N intermediate paths are scored using an LLM based on the at least one second condition information to obtain scores for the N intermediate paths. Thus, the scores for the N intermediate paths are obtained through the first and second condition information.

[0233] The first condition information can be obtained by querying the network routing database for normal network routing conditions associated with the source IP, where the requests associated with the source IP in the network routing database are normal requests. This first condition information can characterize the relevant features of the source IP when it has not sent any malicious requests.

[0234] In some implementations, generating at least one second condition based on the first condition information can be achieved by extracting normal network routing condition information (first condition information) from a Transformer model to generate the second condition information, which is then considered abnormal condition information. This second condition information can be used to determine the probability of N intermediate paths being abnormal, thereby calculating the path score. The second condition information may include multiple abnormal features {F1, F2, ..., F...} n}

[0235] Furthermore, scoring the N intermediate paths using LLM based on at least one second conditional information can be achieved by analyzing each intermediate path using LLM to obtain the number of anomalous features included in the second conditional information that each intermediate path meets, and then determining the score of each intermediate path based on the number of anomalous features, specifically expressed by the following formula:

[0236] AL = LLM({F1, F2, ..., F...) n});

[0237] AL represents the score for abnormal paths.

[0238] In some implementations, such as Figure 3 As shown, the intelligent agent module also deploys an LLM-based decision module. The LLM-based decision module is used to receive the performance anomaly score sent by the LSTM-based network performance prediction module, the resource anomaly score sent by the resource data output module based on the self-attention algorithm, and the N intermediate paths sent by the routing planning module based on the A* algorithm. The LLM-based decision module then calculates the anomaly path score by processing the N intermediate paths.

[0239] Among them, such as Figure 4 As shown, the decision-making module based on the LLM model includes a feature extraction module, an LLM model path scoring module, and an LLM model decision module. The feature extraction module extracts first conditional information and generates second conditional information, which is then sent to the LLM model path scoring module. The LLM model path scoring module calculates the scores of N intermediate paths based on the second conditional information, thereby obtaining the abnormal path score. The LLM model decision module calculates the target score based on at least one of the performance anomaly score, resource anomaly score, and abnormal path score, and generates a target strategy based on the target score.

[0240] In some implementations, if the target score is higher than or equal to a set threshold, the request received by the target node is considered an attack request. In this case, the source IP of the request can be set as an abnormal IP, and the request can be distributed to other network nodes through the cloud management platform. The network routing table is then updated, allowing other network nodes to quickly identify the request sent by the source IP as an attack request based on the updated network routing table and not execute it. This improves the accuracy and efficiency of the subsequent network monitoring system in monitoring abnormal network nodes.

[0241] Furthermore, the source IP can be sent to the management terminal to notify the network node administrator. After the network administrator fixes the source IP issue, the fixed source IP is distributed to each network node in the network environment through the cloud management platform to update the corresponding network routing table. This system can ensure that all nodes in the network environment are in a normal state, and can efficiently monitor and repair abnormal network nodes, significantly improving data transmission and data security in the network system.

[0242] In some implementations, when the target score is lower than a set threshold, the request received by the target node is a normal request, and the path with the lowest abnormal path score is the optimal path. In this case, the path with the lowest abnormal path score can be sent to the target node, so that the target node sends the request according to the optimal path. This improves the data transmission rate of network nodes while ensuring data security, and greatly improves the data security and transmission rate between various network nodes in the network environment.

[0243] Please see Figure 5 , Figure 5 This is a structural diagram of a network node monitoring device provided in an embodiment of the present invention, as shown below. Figure 5 As shown, the network node monitoring device 500 includes:

[0244] The receiving module 501 is used to receive the reporting information sent by the target node. The reporting information includes at least one of the following: the historical performance parameters of the target node, the first resource parameters of the target node when it receives the request, and the routing parameters of the request.

[0245] The calculation module 502 is used to calculate a target score based on at least one of the historical performance parameters, the first resource parameters, and the routing parameters of the request, wherein the target score is used to characterize the probability that the target node is attacked;

[0246] The sending module 503 is used to send a target policy to the target node based on the target score, wherein the target policy is used to instruct the target node to execute the request or refuse to execute the request.

[0247] In one embodiment, the computing module 502 includes:

[0248] A calculation unit is configured to calculate the target score based on at least one of performance anomaly score, resource anomaly score, and anomaly path score.

[0249] in,

[0250] The performance anomaly score is calculated based on the historical performance parameters, the resource anomaly score is calculated based on the first resource parameters, and / or the anomaly path score is calculated based on the routing parameters.

[0251] In one embodiment, the performance anomaly score is calculated as follows:

[0252] Based on the historical performance parameters, the target node's first performance parameter in the first time period, the second performance parameter in the second time period, and the third performance parameter in the third time period are calculated. The first time period and the second time period are the two most recent time periods before the target node receives the request. The first time period is before the second time period, and the third time period is longer than the first time period and the second time period.

[0253] The predicted performance parameters are obtained by using a Long Short-Term Memory (LSTM) network based on the first performance parameters.

[0254] The performance anomaly score is calculated based on the second performance parameter, the predicted performance parameter, and the third performance parameter.

[0255] In one embodiment, calculating the performance anomaly score based on the second performance parameter, the predicted performance parameter, and the third performance parameter includes:

[0256] The quotient of the first difference and the second difference is set as the performance anomaly score, where the first difference is the difference between the predicted performance parameter and the second performance parameter, and the second difference is the difference between the third performance parameter and the second performance parameter.

[0257] In one embodiment, the resource anomaly score is calculated as follows:

[0258] Obtain the historical resource parameters of the target node;

[0259] The second resource parameters for the fourth time period are calculated based on the historical resource parameters.

[0260] The resource anomaly score is calculated based on the second resource parameter and the first resource parameter.

[0261] In one embodiment, processing the second resource parameter and the first resource parameter to calculate the resource anomaly score includes:

[0262] The first weight corresponding to the second resource parameter is obtained by calculating the first resource parameter based on the self-attention algorithm;

[0263] The product of the first weight and the first quotient is set as the resource anomaly score, where the first quotient is the quotient of the third difference and the second resource parameter, and the third difference is the difference between the second resource parameter and the first resource parameter.

[0264] In one embodiment, the abnormal path score is calculated as follows:

[0265] Based on the routing parameters, obtain N intermediate paths corresponding to the target node, where N is a positive integer greater than 1;

[0266] The N intermediate paths are scored to obtain the scores of the N intermediate paths;

[0267] The highest score among the N intermediate paths is set as the abnormal path score.

[0268] In one embodiment, the routing parameters include a source Internet Protocol IP address and a destination IP address, and obtaining N intermediate paths corresponding to the destination node based on the routing parameters includes:

[0269] Obtain the network topology diagram of the target node;

[0270] Multiple initial paths are obtained from the network topology map based on the source IP and the target IP;

[0271] The N intermediate paths are obtained by filtering from the multiple initial paths.

[0272] In one embodiment, the step of filtering the N intermediate paths from the plurality of initial paths includes:

[0273] Estimate the first packet loss rate from the source IP to the target node in each initial path, and the second packet loss rate from the target node to the target IP in each initial path;

[0274] Set the sum of the first packet loss rate and the second packet loss rate as the target packet loss rate for each initial path;

[0275] The N initial paths with the lowest target packet loss rate among the multiple initial paths are set as the N intermediate paths.

[0276] In one embodiment, the routing parameters include the source IP, and the scoring of the N intermediate paths to obtain scores for the N intermediate paths includes:

[0277] Based on the source IP, a preset network routing database is queried to obtain the first condition information associated with the source IP. The preset network routing database includes condition information associated with different IPs. The first condition information is used to characterize the relevant features of the source IP when no malicious requests are sent.

[0278] At least one second condition is generated based on the first condition information, and the at least one second condition information is used to characterize the relevant features of the source IP when sending an attack request;

[0279] The N intermediate paths are scored using a large language model (LLM) based on at least one second conditional information to obtain scores for the N intermediate paths.

[0280] The network node monitoring device provided in this embodiment of the invention can realize the various processes of the above-described network node monitoring method, with one-to-one correspondence of technical features and can achieve the same technical effect. To avoid repetition, it will not be described again here.

[0281] It should be noted that the network node monitoring device in the embodiments of the present invention can be a device, or it can be a component, integrated circuit, or chip in an electronic device.

[0282] This invention also provides an electronic device, including: a processor, a memory, and a program stored in the memory and executable on the processor. When the program is executed by the processor, it implements the various processes of the above-described network node monitoring method embodiments and achieves the same technical effects. To avoid repetition, it will not be described again here.

[0283] For details, see Figure 6 As shown, this embodiment of the invention also provides an electronic device, including a bus 601, a transceiver 602, an antenna 603, a bus interface 604, a processor 605, and a memory 606.

[0284] The transceiver is used to receive reporting information sent by the target node. The reporting information includes at least one of the following: the historical performance parameters of the target node, the first resource parameters of the target node when it receives the request, and the routing parameters of the request.

[0285] The processor is configured to calculate a target score based on at least one of the historical performance parameters, the first resource parameters, and the routing parameters of the request, wherein the target score is used to characterize the likelihood that the target node is attacked;

[0286] The transceiver is also configured to send a target policy to the target node based on the target score, the target policy being used to instruct the target node to execute the request or refuse to execute the request.

[0287] In one embodiment, calculating the target score based on at least one of the historical performance parameters, the first resource parameters, and the routing parameters of the request includes:

[0288] The target score is calculated based on at least one of the performance anomaly score, resource anomaly score, and anomaly path score.

[0289] in,

[0290] The performance anomaly score is calculated based on the historical performance parameters, the resource anomaly score is calculated based on the first resource parameters, and / or the anomaly path score is calculated based on the routing parameters.

[0291] In one embodiment, the performance anomaly score is calculated as follows:

[0292] Based on the historical performance parameters, the target node's first performance parameter in the first time period, the second performance parameter in the second time period, and the third performance parameter in the third time period are calculated. The first time period and the second time period are the two most recent time periods before the target node receives the request. The first time period is before the second time period, and the third time period is longer than the first time period and the second time period.

[0293] The predicted performance parameters are obtained by using a Long Short-Term Memory (LSTM) network based on the first performance parameters.

[0294] The performance anomaly score is calculated based on the second performance parameter, the predicted performance parameter, and the third performance parameter.

[0295] In one embodiment, calculating the performance anomaly score based on the second performance parameter, the predicted performance parameter, and the third performance parameter includes:

[0296] The quotient of the first difference and the second difference is set as the performance anomaly score, where the first difference is the difference between the predicted performance parameter and the second performance parameter, and the second difference is the difference between the third performance parameter and the second performance parameter.

[0297] In one embodiment, the resource anomaly score is calculated as follows:

[0298] Obtain the historical resource parameters of the target node;

[0299] The second resource parameters for the fourth time period are calculated based on the historical resource parameters.

[0300] The resource anomaly score is calculated based on the second resource parameter and the first resource parameter.

[0301] In one embodiment, processing the second resource parameter and the first resource parameter to calculate the resource anomaly score includes:

[0302] The first weight corresponding to the second resource parameter is obtained by calculating the first resource parameter based on the self-attention algorithm;

[0303] The product of the first weight and the first quotient is set as the resource anomaly score, where the first quotient is the quotient of the third difference and the second resource parameter, and the third difference is the difference between the second resource parameter and the first resource parameter.

[0304] In one embodiment, the abnormal path score is calculated as follows:

[0305] Based on the routing parameters, obtain N intermediate paths corresponding to the target node, where N is a positive integer greater than 1;

[0306] The N intermediate paths are scored to obtain the scores of the N intermediate paths;

[0307] The highest score among the N intermediate paths is set as the abnormal path score.

[0308] In one embodiment, the routing parameters include a source Internet Protocol IP address and a destination IP address, and obtaining N intermediate paths corresponding to the destination node based on the routing parameters includes:

[0309] Obtain the network topology diagram of the target node;

[0310] Multiple initial paths are obtained from the network topology map based on the source IP and the target IP;

[0311] The N intermediate paths are obtained by filtering from the multiple initial paths.

[0312] In one embodiment, the step of filtering the N intermediate paths from the plurality of initial paths includes:

[0313] Estimate the first packet loss rate from the source IP to the target node in each initial path, and the second packet loss rate from the target node to the target IP in each initial path;

[0314] Set the sum of the first packet loss rate and the second packet loss rate as the target packet loss rate for each initial path;

[0315] The N initial paths with the lowest target packet loss rate among the multiple initial paths are set as the N intermediate paths.

[0316] In one embodiment, the routing parameters include the source IP, and the scoring of the N intermediate paths to obtain scores for the N intermediate paths includes:

[0317] Based on the source IP, a preset network routing database is queried to obtain the first condition information associated with the source IP. The preset network routing database includes condition information associated with different IPs. The first condition information is used to characterize the relevant features of the source IP when no malicious requests are sent.

[0318] At least one second condition is generated based on the first condition information, and the at least one second condition information is used to characterize the relevant features of the source IP when sending an attack request;

[0319] The N intermediate paths are scored using a large language model (LLM) based on at least one second conditional information to obtain scores for the N intermediate paths.

[0320] exist Figure 6 In this document, a bus architecture (represented by bus 601) is used. Bus 601 can include any number of interconnected buses and bridges, linking various circuits including one or more processors represented by processor 605 and memory represented by memory 606. Bus 601 can also link various other circuits such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art and therefore will not be described further herein. Bus interface 604 provides an interface between bus 601 and transceiver 602. Transceiver 602 can be a single element or multiple elements, such as multiple receivers and transmitters, providing a unit for communicating with various other devices over a transmission medium. Data processed by processor 605 is transmitted over a wireless medium via antenna 603, which further receives data and transmits data to processor 605.

[0321] Processor 605 manages bus 601 and general processing, and also provides various functions, including timing, peripheral interface, voltage regulation, power management, and other control functions. Memory 606 can be used to store data used by processor 605 during operation.

[0322] Optionally, the processor 605 can be a CPU, ASIC, FPGA, or CPLD.

[0323] This invention also provides a computer-readable storage medium storing a computer program. When executed by a processor, this computer program implements the various processes of the network node monitoring method embodiments described above and achieves the same technical effects. To avoid repetition, it will not be described again here. The computer-readable storage medium may be a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, etc.

[0324] The present invention also provides a computer program product, including computer instructions that, when executed by a processor, implement the above-described... Figure 1The various processes of the corresponding network node monitoring method embodiments can achieve the same technical effect, and will not be described again here to avoid repetition.

[0325] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0326] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of the present invention.

[0327] The embodiments of the present invention have been described above with reference to the accompanying drawings. However, the present invention is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of the present invention without departing from the spirit and scope of the claims, and all of these forms are within the protection scope of the present invention.

Claims

1. A method for monitoring network nodes, characterized in that, include: The system receives reporting information sent by the target node, the reporting information including at least one of the following: the historical performance parameters of the target node, the first resource parameters of the target node when it receives the request, and the routing parameters of the request; A target score is calculated based on at least one of the historical performance parameters, the first resource parameters, and the routing parameters of the request. The target score is used to characterize the likelihood that the target node is attacked. Based on the target score, a target policy is sent to the target node, which instructs the target node to execute the request or refuse to execute the request.

2. The method as described in claim 1, characterized in that, The calculation of the target score based on at least one of the historical performance parameters, the first resource parameters, and the routing parameters of the request includes: The target score is calculated based on at least one of the performance anomaly score, resource anomaly score, and anomaly path score. in, The performance anomaly score is calculated based on the historical performance parameters, the resource anomaly score is calculated based on the first resource parameters, and / or the anomaly path score is calculated based on the routing parameters.

3. The method as described in claim 2, characterized in that, The performance anomaly score is calculated as follows: Based on the historical performance parameters, the target node's first performance parameter in the first time period, the second performance parameter in the second time period, and the third performance parameter in the third time period are calculated. The first time period and the second time period are the two most recent time periods before the target node receives the request. The first time period is before the second time period, and the third time period is longer than the first time period and the second time period. The predicted performance parameters are obtained by using a Long Short-Term Memory (LSTM) network based on the first performance parameters. The performance anomaly score is calculated based on the second performance parameter, the predicted performance parameter, and the third performance parameter.

4. The method as described in claim 3, characterized in that, The performance anomaly score is calculated based on the second performance parameter, the predicted performance parameter, and the third performance parameter, including: The quotient of the first difference and the second difference is set as the performance anomaly score, where the first difference is the difference between the predicted performance parameter and the second performance parameter, and the second difference is the difference between the third performance parameter and the second performance parameter.

5. The method as described in claim 2, characterized in that, The resource anomaly score is calculated as follows: Obtain the historical resource parameters of the target node; The second resource parameters for the fourth time period are calculated based on the historical resource parameters. The resource anomaly score is calculated based on the second resource parameter and the first resource parameter.

6. The method as described in claim 5, characterized in that, The process of processing the second resource parameter and the first resource parameter to calculate the resource anomaly score includes: The first weight corresponding to the second resource parameter is obtained by calculating the first resource parameter based on the self-attention algorithm; The product of the first weight and the first quotient is set as the resource anomaly score, where the first quotient is the quotient of the third difference and the second resource parameter, and the third difference is the difference between the second resource parameter and the first resource parameter.

7. The method as described in claim 2, characterized in that, The abnormal path score is calculated as follows: Based on the routing parameters, obtain N intermediate paths corresponding to the target node, where N is a positive integer greater than 1; The N intermediate paths are scored to obtain the scores of the N intermediate paths; The highest score among the N intermediate paths is set as the abnormal path score.

8. The method as described in claim 7, characterized in that, The routing parameters include a source Internet Protocol (IP) and a destination IP. Obtaining the N intermediate paths corresponding to the destination node based on the routing parameters includes: Obtain the network topology diagram of the target node; Multiple initial paths are obtained from the network topology map based on the source IP and the target IP; The N intermediate paths are obtained by filtering from the multiple initial paths.

9. The method as described in claim 8, characterized in that, The step of selecting the N intermediate paths from the plurality of initial paths includes: Estimate the first packet loss rate from the source IP to the target node in each initial path, and the second packet loss rate from the target node to the target IP in each initial path; Set the sum of the first packet loss rate and the second packet loss rate as the target packet loss rate for each initial path; The N initial paths with the lowest target packet loss rate among the multiple initial paths are set as the N intermediate paths.

10. The method as described in claim 7, characterized in that, The routing parameters include the source IP address. The scoring of the N intermediate paths to obtain scores for each of the N intermediate paths includes: Based on the source IP, a preset network routing database is queried to obtain the first condition information associated with the source IP. The preset network routing database includes condition information associated with different IPs. The first condition information is used to characterize the relevant features of the source IP when no malicious requests are sent. At least one second condition is generated based on the first condition information, and the at least one second condition information is used to characterize the relevant features of the source IP when sending an attack request; The N intermediate paths are scored using a large language model (LLM) based on at least one second conditional information to obtain scores for the N intermediate paths.

11. A network node monitoring device, characterized in that, include: A receiving module is used to receive reporting information sent by a target node. The reporting information includes at least one of the following: historical performance parameters of the target node, first resource parameters of the target node when it receives the request, and routing parameters of the request. The calculation module is used to calculate a target score based on at least one of the historical performance parameters, the first resource parameters, and the routing parameters of the request, wherein the target score is used to characterize the probability that the target node is attacked; The sending module is used to send a target policy to the target node based on the target score. The target policy is used to instruct the target node to execute the request or refuse to execute the request.

12. An electronic device, characterized in that, Including transceivers and processors, The transceiver is used to receive reporting information sent by the target node. The reporting information includes at least one of the following: the historical performance parameters of the target node, the first resource parameters of the target node when it receives the request, and the routing parameters of the request. The processor is configured to calculate a target score based on at least one of the historical performance parameters, the first resource parameters, and the routing parameters of the request, wherein the target score is used to characterize the likelihood that the target node is attacked; The transceiver is also configured to send a target policy to the target node based on the target score, the target policy being used to instruct the target node to execute the request or refuse to execute the request.

13. An electronic device, characterized in that, include: A processor, a memory, and a program stored in the memory and executable on the processor, wherein the program, when executed by the processor, implements the steps of the network node monitoring method as described in any one of claims 1 to 10.

14. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the network node monitoring method as described in any one of claims 1 to 10.

15. A computer program product, characterized in that, It includes computer instructions that, when executed by a processor, implement the steps of the network node monitoring method as described in any one of claims 1 to 10.

Images