A network service running state monitoring method

Abstract

The present application relates to a kind of network service operating state monitoring method, it is related to data management technical field, including the configuration state of target equipment is obtained;The present application is consistent with the digital twin model of the behavior of target equipment, so that monitoring benchmark and equipment actual should be consistent, the processing logic declared by equipment is converted into comparison twin deduction benchmark, the action deviation and content deviation between the deduction result of twin and actual output result are calculated, the detection condition is dynamically adjusted and forced alignment, the mapping model between processing task quantity and theoretical resource consumption is built, the processing capacity declared by equipment is converted into quantifiable comparison theoretical resource consumption benchmark, the deviation rate of actual resource consumption and theoretical resource consumption is calculated, when detecting that resource consumption is significantly lower than theoretical expectation, the continuous tracking and confidence evaluation of lazy behavior are realized using sliding window average and correlation coefficient analysis.

Description

Technical Field

[0001] This invention relates to the field of data management technology, and in particular to a method for monitoring the operational status of network services. Background Technology

[0002] In the field of network communication technology, monitoring the operational status of services is a crucial means to ensure network service quality and maintain network security and reliability. As network scale continues to expand and service types become increasingly complex, network devices, including firewalls, routers, switches, load balancers, and intrusion detection systems, undertake core functions such as data forwarding, security filtering, traffic scheduling, and log auditing. Whether these devices correctly perform their duties according to their design specifications and configuration requirements directly affects the overall network's operational quality and security capabilities. Existing network service operational status monitoring technologies mainly include threshold monitoring based on device self-reported data, anomaly detection methods based on dynamic baselines, and compliance checks based on log auditing.

[0003] Currently, existing network service operation status monitoring technologies have the following shortcomings in practical applications: Threshold-based monitoring methods can only detect whether indicators exceed preset ranges, but cannot answer the fundamental question of whether the device has done what it should have done. They cannot determine whether the problem is due to network congestion, insufficient device processing capacity, or the device being lazy and abandoning some processing logic that should have been executed. They lack semantic understanding capabilities and cannot make a judgment on the compliance of behavior. Anomaly detection methods based on behavioral baselines require building statistical models by learning from historical normal data. The underlying assumption is that historical behavior is normal, and the device's lazy behavior may be the first time it has occurred, or the attacker may have already implanted lazy logic when deploying the device. The historical data itself is messy, and the output of the statistical model is the degree of deviation, rather than whether the declared responsibilities have been fulfilled, making it difficult to use directly for compliance judgment.

[0004] To address the aforementioned technical shortcomings, a solution is proposed. Summary of the Invention

[0005] This invention adopts the following technical solution: a method for monitoring the operation status of network services, comprising the following steps: S1: Obtain the configuration status, behavioral characteristics, and historical input and output sample pairs of the target device, and construct a digital twin model that is consistent with the behavior of the target device; S2: In a real network environment, obtain the original input text received by the target device and the corresponding actual output processing results, record them as real input-output pairs, and collect the real-time configuration status of the target device for twin model state synchronization. S3: Input the original input text into the digital twin model, output the twin inference result, compare the twin inference result with the actual output processing result, if the two are inconsistent, it is determined that the target device has abnormal behavior and outputs an abnormal alarm. S4: Deploy the first observation point on the ingress link to obtain input packets, and deploy the second observation point on the egress link to obtain output packets. Extract the packet identifier of the input packet, and search for the corresponding packet with the same identifier in the output packet. If there is no corresponding output packet for the input packet, query the target device log. If there is no drop record, it is determined that there is packet loss concealment. If the input packet and the output packet are successfully matched but the content of the output packet does not meet the expectations of the device configuration policy, it is determined that there is processing avoidance. S5: Collect real-time resource consumption indicators of the target device, and calculate the processing workload claimed by the device. When the actual resource consumption is lower than the theoretical resource consumption corresponding to the processing workload, it is determined that the device has behavioral irregularities.

[0006] Furthermore, the configuration status, behavioral characteristics, and historical input and output sample pairs of the target device are obtained to construct a digital twin model that matches the behavior of the target device. The specific process is as follows: By acquiring input packets and their corresponding output packets from the historical traffic of the target device through sensor devices, an input-output sample pair set is formed. Define the input space and output space of the digital twin model. The input space of the digital twin model is the feature vector extracted from the message, including protocol type, message length, and application layer keywords. The output space is the actual processing result of the target device, including processing action, packet loss reason, and forwarding exit. The sample set is divided into training set, validation set and test set. The input message is converted into a feature vector and the output action code is output. A lightweight classifier is trained to learn the mapping relationship from the input feature vector to the output action. The input to the digital twin model is the message feature vector, and the output is the predicted probability distribution of the device's processing actions. The action corresponding to the highest probability is taken as the twin inference result.

[0007] Furthermore, in a real network environment, the original input text received by the target device and the corresponding actual output processing results are obtained and recorded as real input-output pairs. The real-time configuration status of the target device is also collected for twin model state synchronization. The specific process is as follows: Observation points are deployed at the inlet and outlet links of the target device, and input and output messages are acquired through sensor devices. Extract a unique identifier for each input message, use an identifier matching algorithm to find the corresponding output message, set a matching timeout window, and if no corresponding output message is found within the timeout window after the input message is sent, record the output result of the input message as no response. Successfully matched input / output pairs and unresponsive input messages are recorded as structured data and stored in a time-series database, indexed by device identifier and time range. A configuration acquisition channel with the target device is established through network management protocol and network configuration protocol. The acquisition cycle is dynamically adjusted according to the configuration change frequency. The configuration status of each acquisition is marked with version number and timestamp, and stored in association with the corresponding input and output pairs. The collected configuration status is pushed to the digital twin model and synchronized through the configuration update interface, and configuration features are dynamically injected during inference.

[0008] Furthermore, the original input text is input into the digital twin model, and the twin inference result is output. The twin inference result is compared with the actual output processing result. If the two are inconsistent, it is determined that the target device has abnormal behavior, and an abnormality alarm is output. The specific process is as follows: Extract the original input message from the real input-output pair, input it into the digital twin model for inference, and obtain the twin inference result; The twin simulation results are compared with the actual output processing results item by item, including the processing action type, output message content, and response time delay. When the processing action type is different, the hash value of the output message content is different, or the actual response latency exceeds the theoretical maximum latency of the twin model, it is directly determined to be inconsistent; When the twin simulation results are inconsistent with the actual output results, the inconsistency types are classified, the configuration consistency between the real equipment and the twin model is checked, and inconsistencies caused by configuration drift are eliminated. Once an inconsistency is detected and configuration drift is ruled out, it is determined that the target device has abnormal behavior. A structured anomaly alarm is output, which includes the device identifier, inconsistency type, trigger message digest, details of the comparison between the twin and the real result, and the current configuration version of the device. After an alarm is output, perform the corresponding post-processing operations according to the alarm type: For frequent inconsistent alarms, when the same type of alarm from the same device occurs more than a set number of times consecutively, the fidelity verification of the digital twin model is automatically triggered to check for inaccuracies in the digital twin model. For model interception error alarms, the characteristics of the input message that triggered the alarm will be stored in the anomaly database; The results of this comparison will be used as feedback samples to adjust the decision threshold of the digital twin model.

[0009] Furthermore, a first observation point is deployed on the ingress link to acquire input packets, and a second observation point is deployed on the egress link to acquire output packets. The packet identifier of the input packet is extracted, and a corresponding packet with the same identifier is searched in the output packets. If there is no corresponding output packet for the input packet, the target device log is queried. If there is no dropped record, it is determined that packet loss is hidden. If the input packet and output packet match successfully but the content of the output packet does not meet the expected configuration policy of the device, it is determined that there is a processing circumvention. The specific process is as follows: The first observation point is deployed on the ingress link of the target device to obtain input packets, and the second observation point is deployed on the egress link to obtain output packets. The time of the two observation points is synchronized. Extract the five-tuple from the input packet, including source IP, destination IP, source port, destination port, protocol and IP identifier, and TCP sequence number as a unique identifier. Search for the corresponding packet with the same identifier in the output packet and set a matching timeout window. If there is no corresponding output message for the input message within the timeout window, check the target device system log. If there is no record of the message being dropped in the log, it is determined that there is packet loss concealment behavior. The device claims to process normally but actually does not output or record it, and outputs a packet loss concealment alarm. If the input message and the output message match successfully, the actual output message is compared with the processing action and content expected by the device configuration policy. If the actual output does not meet expectations, it is determined that there is a processing avoidance behavior, and a processing avoidance alarm is output.

[0010] Furthermore, it also includes the specific setup process for the first and second observation points: The time synchronization between the first and second observation points adopts a dual-mode timestamp correction mechanism, periodically sending timestamped reference probe messages between the observation points to measure the actual message transmission delay and clock drift between the two observation points. During message pairing, the matching timeout window is dynamically adjusted based on the delay distribution measured by the reference probe message, and the timestamps of the input and output messages are compensated for drift based on the clock drift curve. When time synchronization between two observation points is temporarily interrupted, it automatically switches to a drift self-correction mode based on message sequence number or content hash to ensure the continuity of message pairing.

[0011] Furthermore, real-time resource consumption indicators of the target device are collected, and the claimed processing workload of the device is statistically analyzed. When the actual resource consumption is lower than the theoretical resource consumption corresponding to the processing workload, it is determined that the device has engaged in behavioral irregularities. The specific process is as follows: Obtain real input-output pairs, count the amount of tasks claimed to be processed by the target device within the acquisition period, and construct a mapping function from the amount of tasks processed to the theoretical resource consumption based on the device type and the characteristics of the processing tasks. The theoretical resource consumption is linearly related to the amount of tasks processed. Based on the statistical processing volume, the theoretical resource consumption is calculated through a mapping function, and the actual resource consumption is extracted from the collected actual resource consumption indicators to calculate the resource consumption deviation rate. The correlation coefficient ρ between resource consumption and task volume is calculated to determine the significance of the linear relationship between the two. When ρ < 0.7, it indicates that the correlation between resource consumption and task volume is weak, the equipment behavior pattern may change, and the model is recalibrated. If the resource consumption deviation rate is less than the standard threshold, or if the duration of the resource consumption deviation rate is greater than the preset time standard value, then the equipment is determined to have behavioral irregularities.

[0012] In summary, due to the adoption of the above technical solution, the beneficial effects of the present invention are: This network service operation status monitoring method constructs a digital twin model consistent with the behavior of the target device. This model updates in real time based on the device configuration status, ensuring consistency between the monitoring baseline and the actual expected behavior of the device. The method transforms the device's claimed processing logic into a comparative twin inference baseline. By calculating the action and content deviations between the twin inference results and the actual output results, the abstract behavioral correctness is transformed into precisely quantifiable inconsistency alarms and confidence scores. When action mismatches or content tampering are detected, the method utilizes the decision boundary backtracking path of the twin model to achieve precise source tracing of abnormal behavior. It dynamically adjusts and forces alignment of detection conditions, significantly reducing... This approach mitigates the unreliability risks associated with relying on device-reported data, enhances the independence and credibility of network device operational status monitoring, and transforms the device's claimed processing capacity into a quantifiable benchmark for theoretical resource consumption by constructing a mapping model between processing workload and theoretical resource consumption. This effectively addresses the issue of hidden laziness caused by devices falsely reporting workloads or simplifying processing logic. By calculating the deviation rate between actual and theoretical resource consumption, abstract behavioral deviations are transformed into precisely quantifiable resource deviation indicators. When resource consumption is detected to be significantly lower than theoretical expectations, continuous tracking and confidence assessment of laziness behavior are achieved using sliding window averaging and correlation coefficient analysis. Attached Figure Description

[0013] Figure 1 A schematic diagram of the overall external structure of the present invention is shown; Figure 2 This diagram shows the overall external structure of the present invention from another angle. Detailed Implementation

[0014] To further illustrate the technical means and effects of the present invention in achieving its intended purpose, the following detailed description of the specific implementation methods, structures, features, and effects of the present invention, in conjunction with the accompanying drawings and preferred embodiments, is provided below.

[0015] Example 1: like Figure 1-2 As shown, a method for monitoring the operational status of network services includes the following steps: S1: Obtain the configuration status, behavioral characteristics, and historical input and output sample pairs of the target device, and construct a digital twin model that is consistent with the behavior of the target device; S2: In a real network environment, obtain the original input text received by the target device and the corresponding actual output processing results, record them as real input-output pairs, and collect the real-time configuration status of the target device for twin model state synchronization. S3: Input the original input text into the digital twin model, output the twin inference result, compare the twin inference result with the actual output processing result, if the two are inconsistent, it is determined that the target device has abnormal behavior and outputs an abnormal alarm. S4: Deploy the first observation point on the ingress link to obtain input packets, and deploy the second observation point on the egress link to obtain output packets. Extract the packet identifier of the input packet, and search for the corresponding packet with the same identifier in the output packet. If there is no corresponding output packet for the input packet, query the target device log. If there is no drop record, it is determined that there is packet loss concealment. If the input packet and the output packet are successfully matched but the content of the output packet does not meet the expectations of the device configuration policy, it is determined that there is processing avoidance. S5: Collect real-time resource consumption indicators of the target device, and calculate the processing workload claimed by the device. When the actual resource consumption is lower than the theoretical resource consumption corresponding to the processing workload, it is determined that the device has behavioral irregularities.

[0016] The configuration status, behavioral characteristics, and historical input and output sample pairs of the target device are obtained, and a digital twin model consistent with the behavior of the target device is constructed. The specific process is as follows: By acquiring input packets and their corresponding output packets from the historical traffic of the target device through sensor devices, an input-output sample pair set is formed. Define the input space and output space of the digital twin model. The input space of the digital twin model is the feature vector extracted from the message, including protocol type, message length, and application layer keywords. The output space is the actual processing result of the target device, including processing action, packet loss reason, and forwarding exit. The sample set is divided into training set, validation set and test set. The input message is converted into a feature vector and the output action code is output. A lightweight classifier is trained to learn the mapping relationship from the input feature vector to the output action. The input to the digital twin model is the message feature vector, and the output is the predicted probability distribution of the device's processing actions. The action corresponding to the highest probability is taken as the twin inference result.

[0017] In a real network environment, the raw input text received by the target device and the corresponding actual output processing results are obtained and recorded as real input-output pairs. The real-time configuration status of the target device is also collected for the state synchronization of the twin model. The specific process is as follows: Observation points are deployed at the inlet and outlet links of the target device, and input and output messages are acquired through sensor devices. Extract a unique identifier for each input message, use an identifier matching algorithm to find the corresponding output message, set a matching timeout window, and if no corresponding output message is found within the timeout window after the input message is sent, record the output result of the input message as no response. Successfully matched input / output pairs and unresponsive input messages are recorded as structured data and stored in a time-series database, indexed by device identifier and time range. A configuration acquisition channel with the target device is established through network management protocol and network configuration protocol. The acquisition cycle is dynamically adjusted according to the configuration change frequency. The configuration status of each acquisition is marked with version number and timestamp, and stored in association with the corresponding input and output pairs. The collected configuration status is pushed to the digital twin model and synchronized through the configuration update interface, and configuration features are dynamically injected during inference.

[0018] The original input text is input into the digital twin model, and the twin inference result is output. The twin inference result is compared with the actual output processing result. If the two are inconsistent, it is determined that the target device has abnormal behavior, and an abnormality alarm is output. The specific process is as follows: Extract the original input message from the real input-output pair, input it into the digital twin model for inference, and obtain the twin inference result; The twin simulation results are compared with the actual output processing results item by item, including the processing action type, output message content, and response time delay. When the processing action type is different, the hash value of the output message content is different, or the actual response latency exceeds the theoretical maximum latency of the twin model, it is directly determined to be inconsistent; When the twin simulation results are inconsistent with the actual output results, the inconsistency types are classified, including checking the configuration consistency between the real equipment and the twin model, and eliminating inconsistencies caused by configuration drift. Once an inconsistency is detected and configuration drift is ruled out, it is determined that the target device has abnormal behavior. A structured anomaly alarm is output, which includes the device identifier, inconsistency type, trigger message digest, details of the comparison between the twin and the real result, and the current configuration version of the device. After an alarm is output, perform the corresponding post-processing operations according to the alarm type: For frequent inconsistent alarms, when the same type of alarm from the same device occurs more than a set number of times consecutively, the fidelity verification of the digital twin model is automatically triggered to check for inaccuracies in the digital twin model. For model interception error alarms, the characteristics of the input message that triggered the alarm will be stored in the anomaly database; The results of this comparison will be used as feedback samples to adjust the decision threshold of the digital twin model.

[0019] The first observation point is deployed on the ingress link to acquire input packets, and the second observation point is deployed on the egress link to acquire output packets. The packet identifier of the input packet is extracted, and the corresponding packet with the same identifier is searched in the output packets. If there is no corresponding output packet for the input packet, the target device log is queried. If there is no dropped record, it is determined that packet loss is hidden. If the input packet and output packet match successfully but the content of the output packet does not meet the expected configuration policy of the device, it is determined that there is a processing circumvention. The specific process is as follows: The first observation point is deployed on the ingress link of the target device to obtain input packets, and the second observation point is deployed on the egress link to obtain output packets. The time of the two observation points is synchronized. Extract the five-tuple from the input packet, including source IP, destination IP, source port, destination port, protocol and IP identifier, and TCP sequence number as a unique identifier. Search for the corresponding packet with the same identifier in the output packet and set a matching timeout window. If there is no corresponding output message for the input message within the timeout window, check the target device system log. If there is no record of the message being dropped in the log, it is determined that there is packet loss concealment behavior. The device claims to process normally but actually does not output or record it, and outputs a packet loss concealment alarm. If the input message and the output message match successfully, the actual output message is compared with the processing action and content expected by the device configuration policy. If the actual output does not meet expectations, it is determined that there is a processing avoidance behavior, and a processing avoidance alarm is output.

[0020] It also includes the specific setup process for the first and second observation points: The time synchronization between the first and second observation points adopts a dual-mode timestamp correction mechanism, periodically sending timestamped reference probe messages between the observation points to measure the actual message transmission delay and clock drift between the two observation points. During message pairing, the matching timeout window is dynamically adjusted based on the delay distribution measured by the reference probe message, and the timestamps of the input and output messages are compensated for drift based on the clock drift curve. When time synchronization between two observation points is temporarily interrupted, it automatically switches to a drift self-correction mode based on message sequence number or content hash to ensure the continuity of message pairing.

[0021] The system collects real-time resource consumption metrics of the target device, calculates the device's claimed processing workload, and determines that the device is misbehaving when the actual resource consumption is lower than the theoretical resource consumption corresponding to the processing workload. The specific process is as follows: Obtain real input-output pairs, count the amount of tasks claimed to be processed by the target device within the acquisition period, and construct a mapping function from the amount of tasks processed to the theoretical resource consumption based on the device type and the characteristics of the processing tasks. The theoretical resource consumption is linearly related to the amount of tasks processed. Construct a mapping function from the amount of processing tasks to the theoretical resource consumption, specifically as follows: , In the above formula, For theoretical resource consumption, This represents the baseline resource consumption when the device is idle. This represents the total number of input messages received by the device within the time window. The total number of bytes received by the device within the time window. This represents the number of new connections created within the time window. Based on the statistical processing volume, the theoretical resource consumption is calculated using a mapping function. And extract actual resource consumption based on the collected actual resource consumption indicators. Calculate the resource consumption deviation rate: , Where ϵ is a minimal constant to prevent division by zero. A value greater than 0 indicates that actual resource consumption is lower than theoretically expected. <0 indicates that the actual resource consumption is higher than the theoretical expectation. To eliminate the impact of short-term fluctuations, a sliding window with a window size of 10 sampling points is used to calculate the average deviation rate. The correlation coefficient ρ between resource consumption and task volume is calculated to determine the significance of the linear relationship between the two. When ρ < 0.7, it indicates that the correlation between resource consumption and task volume is weak, the equipment behavior pattern may change, and the model is recalibrated. If the resource consumption deviation rate is less than the standard threshold, or if the duration of the resource consumption deviation rate is greater than the preset time standard value, then the equipment is determined to have behavioral irregularities.

[0022] Methods for constructing and training digital twin models: From the historical operation records of the target device, the key feature vectors of the input messages and their corresponding device processing actions are extracted to form a training sample set. The input feature vectors include message quintuples, TCP flags, IP fragmentation information, message length and application layer keywords. The collected samples were divided into training set, validation set and test set in a ratio of 7:2:1, and the gradient boosting decision tree algorithm was used to build the basic framework of the device behavior twin model. Download the pre-trained behavior fit model weights, load them into the gradient boosting decision tree model to complete the transfer parameter initialization, modify the output layer, set the output dimension to the number of categories of actions processed by the device, and initialize the category weights of the output layer. The cross-entropy loss function is used as the optimization objective, and the Adam optimizer is used for gradient descent learning. The initial learning rate is set to 0.01, and an exponential decay strategy is adopted to multiply the learning rate by 0.9 every 10 training epochs. During the training process, small batches of samples are randomly selected from the training set for iterative training. All training samples are traversed once in each training epoch. When the validation set loss no longer decreases for 5 consecutive epochs, the training is terminated early to obtain the trained device behavior twin model. The trained device behavior twin model is deployed to the network monitoring and analysis engine to acquire input packets in real time and extract their feature vectors. These vectors are then input into the twin model for forward inference, and the expected processing action of the device for the current packet is output. This expected processing action serves as the twin inference result and is used to compare its consistency with the actual output of the real device to determine whether the device exhibits abnormal behavior.

[0023] This solution constructs a digital twin model that matches the behavior of the real device by collecting the configuration status, protocol stack behavior characteristics, and historical input / output sample pairs of the target device. It uses executable code to reproduce the behavior of open-source devices and acquires the original input packets received by the device and their corresponding actual output results through observation points in a real network environment. Simultaneously, it collects the real-time configuration status of the device to ensure that the twin model and the real device are on the same configuration baseline. The same input packet is fed into the digital twin model for simulation to obtain the twin output results, which are then compared item by item with the real output, including four dimensions: processing action type, output packet content, response latency, and log records. If the two are inconsistent and configuration drift factors are excluded, the device is determined to have abnormal behavior, and an abnormality alarm is output and classified. This overcomes the limitations of traditional monitoring that relies on device self-reported data, achieving independent behavior verification without relying on device cooperation. It can detect behaviors that should have been blocked but were not, and the detailed comparison dimensions enable accurate classification of abnormality types.

[0024] Observation points are deployed at both the device's ingress and egress links to precisely match input and output packets using packet identifiers. If an input packet does not have a corresponding output packet within the timeout window, the device log is queried: if a drop record is found, it is considered normal drop; otherwise, packet loss concealment is identified, meaning the device claims to process the packet normally but does not actually output it and does not record it. If the input and output are successfully matched, but the output packet content does not conform to the device's configuration policy expectations, processing evasion is identified, meaning the device outputs a packet but deliberately skips critical processing steps. This allows for the detection of hidden processing evasion behaviors that are not entirely silent. By precisely tracking and locating these two typical lazy behaviors—packet loss concealment and processing evasion—at the packet level, an immutable chain of evidence is provided for subsequent forensic investigations.

[0025] The system collects real-time resource consumption metrics from the data acquisition equipment and simultaneously tracks the reported workload, number of messages, bytes, and streams processed by the equipment at the observation points. When the actual resource consumption is consistently significantly lower than the theoretical value, the system determines that the equipment is exhibiting behavioral irregularities, indicating that the equipment may have simplified its processing logic or overstated the workload. This verifies whether the equipment is fulfilling its responsibilities from the perspective of physical resource conservation. It can detect lazy behavior without relying on any self-reported behavior logs from the equipment and can quantify the resource consumption deviation rate, providing an objective measure of the degree of behavioral irregularities.

[0026] The size of the interval and threshold is set to facilitate comparison. The size of the threshold depends on the amount of sample data and the number of bases set by those skilled in the art for each set of sample data; as long as it does not affect the ratio between the parameter and the quantized value.

[0027] The above formulas are all dimensionless calculations. The formulas are derived from software simulations based on a large amount of collected data to obtain the most recent real-world results. The preset parameters in the formulas are set by those skilled in the art according to the actual situation. In the embodiments provided in this application, it should be understood that the disclosed methods can be implemented in other ways; for example, the method embodiments described above are merely illustrative. For example, the division of modules is merely a logical functional division, and there may be other division methods in actual implementation. For example, multiple modules or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection between the shown or discussed components may be indirect coupling or communication connection through some interfaces, devices or modules, and may be electrical, mechanical or other forms. The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention in any way. Although the present invention has been disclosed above with reference to preferred embodiments, it is not intended to limit the present invention. Any person skilled in the art can make some modifications or alterations to the above-disclosed technical content to create equivalent embodiments without departing from the scope of the present invention. Any simple modifications, equivalent changes and alterations made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the scope of the present invention.

Claims

1. A method for monitoring the operational status of network services, characterized in that, Includes the following steps: S1: Obtain the configuration status, behavioral characteristics, and historical input and output sample pairs of the target device, and construct a digital twin model that is consistent with the behavior of the target device; S2: In a real network environment, obtain the original input text received by the target device and the corresponding actual output processing results, record them as real input-output pairs, and collect the real-time configuration status of the target device for twin model state synchronization. S3: Input the original input text into the digital twin model, output the twin inference result, compare the twin inference result with the actual output processing result, if the two are inconsistent, it is determined that the target device has abnormal behavior and outputs an abnormal alarm. S4: Deploy the first observation point on the ingress link to obtain input packets, and deploy the second observation point on the egress link to obtain output packets. Extract the packet identifier of the input packet, and search for the corresponding packet with the same identifier in the output packet. If there is no corresponding output packet for the input packet, query the target device log. If there is no drop record, it is determined that there is packet loss concealment. If the input packet and the output packet are successfully matched but the content of the output packet does not meet the expectations of the device configuration policy, it is determined that there is processing avoidance. S5: Collect real-time resource consumption indicators of the target device, and calculate the processing workload claimed by the device. When the actual resource consumption is lower than the theoretical resource consumption corresponding to the processing workload, it is determined that the device has behavioral irregularities.

2. The method for monitoring the operation status of network services according to claim 1, characterized in that, The configuration status, behavioral characteristics, and historical input and output sample pairs of the target device are obtained, and a digital twin model consistent with the behavior of the target device is constructed. The specific process is as follows: By acquiring input packets and their corresponding output packets from the historical traffic of the target device through sensor devices, an input-output sample pair set is formed. Define the input space and output space of the digital twin model. The input space of the digital twin model is the feature vector extracted from the message, including protocol type, message length, and application layer keywords. The output space is the actual processing result of the target device, including processing action, packet loss reason, and forwarding exit. The sample set is divided into training set, validation set and test set. The input message is converted into a feature vector and the output action code is output. A lightweight classifier is trained to learn the mapping relationship from the input feature vector to the output action. The input to the digital twin model is the message feature vector, and the output is the predicted probability distribution of the device's processing actions. The action corresponding to the highest probability is taken as the twin inference result.

3. The method for monitoring the operation status of network services according to claim 1, characterized in that, In a real network environment, the raw input text received by the target device and the corresponding actual output processing results are obtained and recorded as real input-output pairs. The real-time configuration status of the target device is also collected for the state synchronization of the twin model. The specific process is as follows: Observation points are deployed at the inlet and outlet links of the target device, and input and output messages are acquired through sensor devices. Extract a unique identifier for each input message, use an identifier matching algorithm to find the corresponding output message, set a matching timeout window, and if no corresponding output message is found within the timeout window after the input message is sent, record the output result of the input message as no response. Successfully matched input / output pairs and unresponsive input messages are recorded as structured data and stored in a time-series database, indexed by device identifier and time range. A configuration acquisition channel with the target device is established through network management protocol and network configuration protocol. The acquisition cycle is dynamically adjusted according to the configuration change frequency. The configuration status of each acquisition is marked with version number and timestamp, and stored in association with the corresponding input and output pairs. The collected configuration status is pushed to the digital twin model and synchronized through the configuration update interface, and configuration features are dynamically injected during inference.

4. The method for monitoring the operation status of network services according to claim 1, characterized in that, The original input text is input into the digital twin model, and the twin inference result is output. The twin inference result is compared with the actual output processing result. If the two are inconsistent, it is determined that the target device has abnormal behavior, and an abnormality alarm is output. The specific process is as follows: Extract the original input message from the real input-output pair, input it into the digital twin model for inference, and obtain the twin inference result; The twin simulation results are compared with the actual output processing results item by item, including the processing action type, output message content, and response time delay. When the processing action type is different, the hash value of the output message content is different, or the actual response latency exceeds the theoretical maximum latency of the twin model, it is directly determined to be inconsistent; When the twin simulation results are inconsistent with the actual output results, the inconsistency types are classified. Inconsistency types include model interception errors, action type mismatches, content tampering, and response delays. The configuration consistency between the real device and the twin model is checked to eliminate inconsistencies caused by configuration drift. Once an inconsistency is detected and configuration drift is ruled out, it is determined that the target device has abnormal behavior. A structured anomaly alarm is output, which includes the device identifier, inconsistency type, trigger message digest, details of the comparison between the twin and the real result, and the current configuration version of the device. After an alarm is output, perform the corresponding post-processing operations according to the alarm type: For frequent inconsistent alarms, when the same type of alarm from the same device occurs more than a set number of times consecutively, the fidelity verification of the digital twin model is automatically triggered to check for inaccuracies in the digital twin model. For model interception error alarms, the characteristics of the input message that triggered the alarm will be stored in the anomaly database; The results of this comparison will be used as feedback samples to adjust the decision threshold of the digital twin model.

5. The method for monitoring the operation status of network services according to claim 1, characterized in that, The first observation point is deployed on the ingress link to acquire input packets, and the second observation point is deployed on the egress link to acquire output packets. The packet identifier of the input packet is extracted, and the corresponding packet with the same identifier is searched in the output packets. If there is no corresponding output packet for the input packet, the target device log is queried. If there is no dropped record, it is determined that packet loss is hidden. If the input packet and output packet match successfully but the content of the output packet does not meet the expected configuration policy of the device, it is determined that there is a processing circumvention. The specific process is as follows: The first observation point is deployed on the ingress link of the target device to obtain input packets, and the second observation point is deployed on the egress link to obtain output packets. The time of the two observation points is synchronized. Extract the five-tuple from the input packet, including source IP, destination IP, source port, destination port, protocol and IP identifier, and TCP sequence number as a unique identifier. Search for the corresponding packet with the same identifier in the output packet and set a matching timeout window. If there is no corresponding output message for the input message within the timeout window, check the target device system log. If there is no record of the message being dropped in the log, it is determined that there is packet loss concealment behavior. The device claims to process normally but actually does not output or record it, and outputs a packet loss concealment alarm. If the input message and the output message match successfully, the actual output message is compared with the processing action and content expected by the device configuration policy. If the actual output does not meet expectations, it is determined that there is a processing avoidance behavior, and a processing avoidance alarm is output.

6. The method for monitoring the operation status of network services according to claim 1, characterized in that, It also includes the specific setup process for the first and second observation points: The time synchronization between the first and second observation points adopts a dual-mode timestamp correction mechanism, periodically sending timestamped reference probe messages between the observation points to measure the actual message transmission delay and clock drift between the two observation points. During message pairing, the matching timeout window is dynamically adjusted based on the delay distribution measured by the reference probe message, and the timestamps of the input and output messages are compensated for drift based on the clock drift curve. When time synchronization between two observation points is temporarily interrupted, it automatically switches to a drift self-correction mode based on message sequence number or content hash to ensure the continuity of message pairing.

7. The method for monitoring the operation status of network services according to claim 1, characterized in that, The system collects real-time resource consumption metrics of the target device, calculates the device's claimed processing workload, and determines that the device is misbehaving when the actual resource consumption is lower than the theoretical resource consumption corresponding to the processing workload. The specific process is as follows: Obtain real input-output pairs, count the amount of tasks claimed to be processed by the target device within the acquisition period, and construct a mapping function from the amount of tasks processed to the theoretical resource consumption based on the device type and the characteristics of the processing tasks. The theoretical resource consumption is linearly related to the amount of tasks processed. Based on the statistical processing volume, the theoretical resource consumption is calculated through a mapping function, and the actual resource consumption is extracted from the collected actual resource consumption indicators to calculate the resource consumption deviation rate. The correlation coefficient ρ between resource consumption and task volume is calculated to determine the significance of the linear relationship between the two. When ρ < 0.7, it indicates that the correlation between resource consumption and task volume is weak, the equipment behavior pattern may change, and the model is recalibrated. If the resource consumption deviation rate is less than the standard threshold, or if the duration of the resource consumption deviation rate is greater than the preset time standard value, then the equipment is determined to have behavioral irregularities.

Images