CN111817875A - Method and device for detecting network fault - Google Patents
Method and device for detecting network fault Download PDFInfo
- Publication number
- CN111817875A CN111817875A CN202010495686.1A CN202010495686A CN111817875A CN 111817875 A CN111817875 A CN 111817875A CN 202010495686 A CN202010495686 A CN 202010495686A CN 111817875 A CN111817875 A CN 111817875A
- Authority
- CN
- China
- Prior art keywords
- target
- data
- data stream
- probability
- degree
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/06—Management of faults, events, alarms or notifications
- H04L41/0631—Management of faults, events, alarms or notifications using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/14—Network analysis or design
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L43/00—Arrangements for monitoring or testing data switching networks
- H04L43/08—Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
- H04L43/0823—Errors, e.g. transmission errors
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L43/00—Arrangements for monitoring or testing data switching networks
- H04L43/08—Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
- H04L43/0823—Errors, e.g. transmission errors
- H04L43/0829—Packet loss
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Environmental & Geological Engineering (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
The application relates to the field of artificial intelligence, and provides a method for detecting network faults, which comprises the following steps: acquiring target characteristic data, wherein the target characteristic data is data related to target characteristics of a first data stream; determining a target abnormal degree according to a target probability model and the target characteristic data, wherein the target probability model is used for indicating the probability distribution of normal characteristic data, the normal characteristic data is data related to the target characteristic of a normal data stream, and the target abnormal degree is the abnormal degree of the target characteristic of the first data stream; and determining the fault of the network for transmitting the first data flow according to the target abnormal degree. Compared with the method for detecting the network fault by manually setting the rule and the threshold, the method does not depend on the manually set rule and the manually set threshold, can improve the detection efficiency of the network fault, and has good self-adaptability.
Description
Technical Field
The application relates to the field of artificial intelligence, in particular to a method and a device for detecting network faults.
Background
Network transmission refers to a process of transmitting information using electric current or electromagnetic waves. In network transmission, faults such as low network speed and network congestion may occur, and at this time, the network fault needs to be detected, that is, the cause of the fault is determined, so as to specifically eliminate the fault.
One method of detecting network failure is to grab multiple packets from a data stream transmitted over a network and determine whether the data stream has an abnormal condition by analyzing characteristics of the multiple packets. Because the judgment standards for the abnormal features in different networks are different, and the data transmission protocol generally has certain fault tolerance, an experienced engineer is required to manually analyze the features of the data packet to find out the data stream with the abnormal condition. The method for detecting the network fault has strong dependence on manually set rules and thresholds, and is difficult to quickly determine the fault reason, which is a problem to be solved currently.
Disclosure of Invention
The application provides a method and a device for detecting network faults, which can improve the detection efficiency of the network faults.
In a first aspect, a method for detecting a network failure is provided, including: acquiring target characteristic data, wherein the target characteristic data is data related to target characteristics of a first data stream; determining a target abnormal degree according to a target probability model and the target characteristic data, wherein the target probability model is used for indicating the probability distribution of normal characteristic data, the normal characteristic data is data related to the target characteristic of a normal data stream, and the target abnormal degree is the abnormal degree of the target characteristic of the first data stream; and determining the fault of the network for transmitting the first data flow according to the target abnormal degree.
According to the method for detecting the network, the target characteristic data of the data stream to be detected is obtained firstly, and then the degree of the target characteristic data deviating from the normal characteristic data is measured through a target probability model, wherein the target probability model is Gaussian distribution obeyed by the statistic value of the target characteristic of the normal data stream, and the target probability model does not depend on manually set rules and threshold values, so that the fault reason can be determined quickly based on the target probability model, and the network fault detection efficiency is improved. In addition, the target probability model can be obtained by learning the target characteristics of normal data streams of different networks through the processor without manual intervention, so that the method can be suitable for different network environments and has good adaptivity.
Optionally, the determining the degree of target abnormality according to the target probability model and the target feature data includes: inputting the target characteristic data into the target probability model to determine a target probability, wherein the target probability is used for representing the target abnormal degree.
Optionally, the target feature data includes data of multiple dimensions, the target probability model includes probability models corresponding to the multiple dimensions, and the target probability includes probabilities corresponding to the multiple dimensions.
The target features are detected through multiple dimensions, the abnormal length of the target features can be comprehensively detected, and therefore a more accurate detection result is provided.
Optionally, the plurality of dimensions include statistical dimensions, the target feature data includes statistical values of a target feature of the first data stream, the target probability model includes a statistical value gaussian distribution, the target probability includes a cumulative distribution probability of the statistical values of the target feature of the first data stream over the statistical gaussian distribution, wherein the statistical value gaussian distribution is a gaussian distribution to which the statistical values of the target feature of the normal data stream obey.
Optionally, the plurality of dimensions include a data stream morphology dimension, the target feature data includes a target reconstruction error, the target probability model includes a gaussian distribution of reconstruction errors, the target probability includes a cumulative distribution probability of the target reconstruction error over the gaussian distribution of reconstruction errors, wherein the target reconstruction error is a reconstruction error of a data stream morphology of a target feature of the first data stream, and the gaussian distribution of reconstruction errors is a gaussian distribution obeyed by the reconstruction error of the data stream morphology of the target feature of the normal data stream.
Optionally, the plurality of dimensions include a correlation dimension, the target feature data includes a target correlation coefficient, the target probability model includes a correlation gaussian distribution, the target probability includes a cumulative distribution probability of the target correlation coefficient over the correlation gaussian distribution, wherein the target correlation coefficient is a correlation coefficient between a target feature of the first data stream and other features of the first data stream, and the correlation gaussian distribution is a gaussian distribution to which correlation coefficients between a target feature of the normal data stream and other features of the normal data stream obey.
Optionally, the determining the target abnormality degree according to the target probability includes: determining the abnormal degree of the target feature of the first data stream on the plurality of dimensions according to the corresponding probabilities of the plurality of dimensions; and determining the target abnormal degree according to the abnormal degree of the target characteristic of the first data stream in the plurality of dimensions.
Optionally, the target abnormality degree is one of the plurality of abnormality degrees having the largest value.
Optionally, the determining a fault of the network transmitting the first data stream according to the target abnormal degree includes: determining a degree of anomaly of a plurality of features of a first data stream, the plurality of features including the target feature; determining a final abnormal degree of the first data flow according to the abnormal degrees of the plurality of characteristics; and determining the fault of the network for transmitting the first data flow according to the final abnormal degree of the first data flow.
The above scheme gives a way of how to determine a network failure when the first data stream contains a plurality of characteristics.
Optionally, the final degree of abnormality is one of the degrees of abnormality of the plurality of features having the largest value.
Optionally, the determining a fault of a network transmitting the first data stream according to the final abnormal degree of the first data stream includes: determining a final degree of anomaly for a plurality of data streams, the plurality of data streams including the first data stream, and the plurality of data streams each being transmitted by a network that transmits the first data stream; and determining the fault of the network for transmitting the first data flow according to the final abnormal degrees of the plurality of data flows.
The above scheme presents a method of how to determine network failures when the network is transmitting multiple data streams.
In a second aspect, the present application provides an apparatus for detecting a network failure, comprising means for performing the method of the first aspect. The device can be a terminal device or a server, and can also be a chip in the terminal device or the server. The apparatus may include an input unit and a processing unit.
When the apparatus is a terminal device or a server, the processing unit may be a processor, and the input unit may be a transceiver; the terminal device may further include a storage unit, which may be a memory; the storage unit is configured to store instructions, and the processing unit executes the instructions stored in the storage unit, so as to enable the terminal device to execute the method according to the first aspect.
When the apparatus is a chip in a terminal device or a server, the processing unit may be a processing unit inside the chip, and the input unit may be an input/output interface, a pin, a circuit, or the like; the processing unit executes instructions stored in a storage unit (e.g., a register, a cache, etc.) within the chip or a storage unit (e.g., a read-only memory, a random access memory, etc.) external to the chip, so as to enable the chip to perform the method of the first aspect.
In a third aspect, the present application provides a computer readable storage medium having stored thereon a computer program which, when executed by a processor, causes the processor to perform the method of the first aspect.
In a fourth aspect, the present application provides a computer program product comprising: computer program code which, when executed by a processor, causes the processor to perform the method of the first aspect.
Drawings
FIG. 1 is a schematic diagram of a network suitable for use in the present application;
FIG. 2 is a schematic diagram of a method for detecting network failure provided herein;
FIG. 3 is a schematic diagram of an apparatus for detecting network failure provided herein;
fig. 4 is a schematic diagram of an apparatus for detecting a network failure according to the present application.
Detailed Description
The technical solution of the present application will be described below with reference to the accompanying drawings.
Fig. 1 shows a network suitable for use in the present application.
After obtaining information to be sent, the sending end 110 packages the information to be sent to generate a data packet, and the data packet is sent out in the form of electromagnetic waves or current after being modulated; the network device 130 transmits the data packet to the receiving end 120; after receiving the data packet, the receiving end 120 obtains the information carried in the data packet after performing demodulation and other processing.
The sender 110 may be a handset, the receiver 120 may be a server, and the network device 120 may be a base station and a core network. After the mobile phone sends out the data packet, the data packet finally reaches the server through the transmission of the base station and the core network. In the transmission process, the base station, the core network, the optical fiber or cable between the base station and the core network, and the optical fiber or cable between the core network and the server together form a network for transmitting data packets.
When there is a lot of information to be transmitted, the transmitting end 110 needs to carry the information to be transmitted through a plurality of data packets, and the plurality of data packets are sequentially transmitted to the receiving end 120 through the network, so the plurality of data packets may be referred to as one data stream (or "stream"). There may be multiple data streams in the network depending on the logical partitioning of the multiple packets. In addition, the network may transmit the data packet according to a Transmission Control Protocol (TCP), or may transmit the data packet according to other methods.
The network inevitably breaks down in the working process, when the network breaks down, the most direct experience of a user is that the network is fast blocked or disconnected, and at the moment, an engineer needs to determine the reason of the fault so as to eliminate the fault in a targeted manner. Since the fault is reflected by the characteristics of the data stream (e.g., packet loss), the fault can be detected by analyzing the characteristics of the data stream, and the method for detecting the network fault provided by the present application is described below.
Before detecting a network fault, a data stream to be detected needs to be acquired first, the data stream suitable for the present application may be a TCP stream, or a data stream based on other transport protocols, and the following describes the technical scheme of the present application by taking the TCP stream as an example. The device for detecting the network fault can acquire the TCP message from the network through the packet capturing module, wherein the packet capturing position of the packet capturing module can be any position in the network. After the device acquires the TCP messages, one or more TCP streams can be analyzed from the acquired TCP messages through the message analysis module.
For example, speed measurement can be performed at a mobile phone end through speedtest, and each time of speed measurement constitutes an affair; TCP messages, namely samples, captured in a speed measuring process; subsequently, the device for detecting the network fault can analyze the TCP flow and a plurality of characteristics of the TCP flow from the captured TCP packet according to a preset rule, and the characteristics may also be referred to as an item or an index.
In the model training phase, the proportion of the normal rate samples can be kept to be much larger than that of the abnormal rate samples, for example, the number of the abnormal samples in the currently acquired samples is large, and some abnormal samples can be discarded, so that the model can learn the characteristics of the normal data stream, and the abnormal data stream can be identified in the model application phase.
Table 1 is some of the features of the data flow provided herein.
TABLE 1
In table 1, the left side is the name of each feature, and the message parsing module may parse each feature from the TCP flow according to the description on the right side, where each feature may include a feature of an upstream TCP flow and a feature of a downstream TCP flow. Optionally, before detecting the network fault, the apparatus for detecting the network fault may pre-process each TCP flow, only the TCP flows with the payload ratios greater than the minimum payload ratio constraint (e.g., one thousandth) are retained, and detect the network fault based on the pre-processed TCP flows.
After parsing the features from the TCP stream, the apparatus for detecting a network failure may perform failure detection according to the method 200 shown in fig. 2.
As shown in fig. 2, the method 200 includes:
s210, target characteristic data is obtained, wherein the target characteristic data is data related to target characteristics of the first data stream.
The first data stream is a TCP stream to be tested and the target characteristic is a characteristic of the first data stream. The target feature is, for example, packet loss, and the target feature data may be data related to the target feature directly obtained from the first data stream, such as packet loss rate; the target feature data may also be data related to the target feature obtained by processing the first data stream multiple times, for example, a reconstruction error of a time series formed by packet loss number of the first data stream.
S220, determining a target abnormal degree according to a target probability model and the target characteristic data, wherein the target probability model is used for indicating the probability distribution of normal characteristic data, the normal characteristic data is data related to the target characteristic of a normal data stream, and the target abnormal degree is the abnormal degree of the target characteristic of the first data stream.
The target probability model is a probability model of related data of the target feature determined according to the normal data stream and is used for indicating the probability distribution of the normal feature data, the target feature data can be input into the target probability model to determine a target probability, and the abnormal degree of the target feature of the first data stream is determined according to the target probability, wherein the target probability is used for indicating the degree of the target feature data deviating from the normal feature data.
In the above steps, the normal data stream may be determined based on the user experience, for example, the user experience is not stuck with the data stream, i.e., the normal data stream. The method of determining the normal data stream is not limited in this application.
In order to comprehensively detect the degree of abnormality of the target feature, the target feature may be detected from multiple dimensions. That is, the target feature data includes data corresponding to the plurality of dimensions, the target probability model includes a probability model corresponding to the plurality of dimensions, and the target probability includes a probability corresponding to the plurality of dimensions.
The plurality of dimensions may include at least one of a statistical dimension, a data stream morphological dimension, and a correlation dimension, and the specific content of the plurality of dimensions is not limited in the present application, and several examples of determining the degree of abnormality of the target feature from different dimensions are given below.
1. And (5) counting the dimensions.
In the statistical dimension, the target feature data includes a statistical value of a target feature of the first data stream, the target probability model may be a statistical value gaussian distribution, and the target probability may be a cumulative distribution probability of the statistical value of the target feature of the first data stream on the statistical value gaussian distribution, wherein the statistical value gaussian distribution is a gaussian distribution to which the statistical value of the target feature of the normal data stream obeys.
For example, the target feature is packet loss, the statistical value of the target feature may be packet loss rate, and the target probability model is gaussian distribution, i.e., gaussian distribution of statistical values, to which the packet loss rate of the normal data stream obeys; the packet loss rate of the first data stream is input into the gaussian distribution of the statistical values to obtain an accumulated distribution probability of the packet loss rate of the first data stream, and the accumulated distribution probability is used for indicating the degree of deviation of the packet loss rate of the first data stream from the packet loss rate of the normal data stream, so that the abnormal degree of the target characteristic (namely, packet loss) of the first data stream in the statistical dimension can be determined.
In the above example, the gaussian distribution of statistical values can be obtained by learning the packet loss rate of the normal data stream. The value range of the cumulative distribution probability is 0 to 1, and the greater the deviation degree of the statistical value of the target characteristic of the first data stream from the statistical value of the target characteristic of the normal data stream is, the closer the cumulative distribution probability approaches to 0 or 1; for the packet loss rate, the larger the value thereof is, the larger the anomaly degree is, therefore, only the case that the cumulative distribution probability approaches to 1 is considered, the closer the cumulative distribution probability of the packet loss rate of the first data stream approaches to 1 is, the larger the anomaly degree of the packet loss characteristic of the first data stream in the statistical dimension is.
2. And (5) data stream form dimension.
In the dimension of the data flow form, the target feature data may be a target reconstruction error, the target probability model may be a gaussian distribution of reconstruction errors, and the target probability may be a cumulative distribution probability of the target reconstruction errors on the gaussian distribution of reconstruction errors, where the target reconstruction errors are the reconstruction errors of the data flow form of the target feature of the first data flow, and the gaussian distribution of reconstruction errors obeyed by the reconstruction errors of the data flow form of the target feature of the normal data flow.
For example, the target feature is packet loss, and the target feature data may be a reconstruction error of a data stream form of the packet loss amount of the first data stream, that is, a target reconstruction error; the target probability model is gaussian distribution obeying the reconstruction error of the data flow form of the packet loss number of the normal data flow, namely, the reconstruction error gaussian distribution; inputting the target reconstruction error into the reconstruction error Gaussian distribution to obtain the cumulative probability distribution of the target reconstruction error, wherein the cumulative distribution probability is used for indicating the degree of the reconstruction error of the data stream form with the packet loss quantity of the first data stream deviating from the reconstruction error of the data stream form with the packet loss quantity of the normal data stream, so that the abnormal degree of the target characteristic (namely the packet loss) of the first data stream in the dimension of the data stream form can be determined.
The statistics may be performed at 200 ms intervals to determine the data stream shape of each feature of the first data stream, each feature forming a time-ordered data sequence, i.e. a time sequence. Taking target characteristics as an example of packet loss, after a time sequence of the number of packet loss is obtained, the time sequence is processed into a preset length by adopting a mode of firstly expanding and then sampling, then numerical normalization is carried out on the processed time sequence, and the time sequence after numerical normalization does not have information in numerical value any more, so that the neural network can be more focused on learning the information of the time sequence in the form dimension of the data stream.
For example, if the transmission duration of the first data stream is 2 seconds and the statistics is performed at intervals of 200 ms, the time sequence of the characteristic (for example, packet loss) has 10 data points, i.e., a is [0,2,0,3,0,0,0]For convenience, each point in the time series a is denoted as ai1,2, 10, wherein a10 means that there is no packet loss in the first interval, a22 means that there are two packets lost in the second interval, and so on.
Assuming that the preset length of the time sequence is 6, the sample after expansion may be as follows: each data point in a is first expanded by 6 times to obtain an expanded time series b, b ═ a1,a1,a1,a1,a1,a1,a2,a2,a2,a2,a2,a2,...,a10,a10,a10,a10,a10,a10]For convenience of expression, each point in b is denoted as bjJ 1, 2.., 60; sampling b to obtain a time sequence c with the length of 6, and recording each point in c as c for convenient expressionk1,2, ·, 6; wherein, every 10 points in b can be divided into a group for averaging, and the obtained result is one point in c. For example,
the preparation work required by the neural network learning is completed, and then model construction and training are carried out. A variational auto-encoder (VAE) aiming at different characteristics can be constructed, a time sequence of the packet loss quantity of a plurality of normal data streams is input into the packet loss VAE after the packet loss VAE is constructed by taking target characteristics as an example, the packet loss VAE is encoded and reconstructed, and the packet loss VAE is trained by minimizing reconstruction errors; after the training is completed, determining gaussian distribution, namely gaussian distribution of reconstruction errors, of the time sequence of packet loss number of the normal data stream.
Processing the time sequence of the packet loss number of the first data stream into a time sequence with the length (such as 6) equal to that of input data of the packet loss VAE, then performing numerical normalization on the processed time sequence, inputting the time sequence after the numerical normalization into the packet loss VAE to obtain a packet loss reconstruction error, and inputting the packet loss reconstruction error into Gaussian distribution of the reconstruction error to obtain cumulative distribution probability.
In the above example, the value range of the cumulative distribution probability is 0 to 1, and the greater the degree of deviation of the target reconstruction error from the normal reconstruction error (the reconstruction error of the data stream form of the target feature of the normal data stream), the closer the cumulative distribution probability approaches 0 or 1; for the packet loss reconstruction error, the larger the numerical value of the packet loss reconstruction error is, the larger the abnormal degree is, therefore, only the case that the cumulative distribution probability approaches to 1 is considered, the closer the cumulative distribution probability of the packet loss reconstruction error approaches to 1 is, and the larger the abnormal degree of the packet loss characteristic of the first data stream in the data stream form dimension is.
3. The correlation dimension.
In the correlation dimension, the target feature data includes a target correlation coefficient, and the target probability model includes a correlation gaussian distribution, and the target probability includes a cumulative distribution probability of the target correlation coefficient over the correlation gaussian distribution, wherein the target correlation coefficient is a correlation coefficient (such as a pearson correlation coefficient) between the target feature of the first data stream and other features of the first data stream, and the correlation gaussian distribution is a gaussian distribution of correlation obedience coefficients between the target feature of the normal data stream and other features of the normal data stream.
For example, the target characteristic is packet loss, and the target characteristic data may be a correlation coefficient between the packet loss amount of the first data stream and the out-of-order data packet amount of the first data stream; the target probability model is Gaussian distribution obeyed by a correlation coefficient of the packet loss number of the normal data stream and the disordered data packet number of the normal data stream; inputting the packet loss and disorder correlation coefficient of the first data stream into Gaussian distribution obeyed by the packet loss and disorder correlation coefficient to obtain cumulative probability distribution of the packet loss and disorder correlation coefficient of the first data stream, wherein the cumulative probability distribution is used for indicating the degree of deviation of the packet loss and disorder correlation coefficient of the first data stream from the packet loss and disorder correlation coefficient of the normal data stream; since the cumulative distribution probability of the correlation coefficient is close to 0 or 1 both indicate that the distribution of the correlation coefficient has a large deviation from the gaussian distribution, two deviation directions (the cumulative distribution probability is close to 0 or 1) need to be considered when calculating the cumulative distribution probability of the correlation coefficient, the cumulative distribution probability of the correlation coefficient may be subtracted by 0.5 to obtain an absolute value, and then multiplied by the normalization coefficient 2, and the obtained result may be used as the degree of abnormality of the correlation coefficient of the packet loss and the disorder of the first data stream. When the first data stream has 3 or more than 3 features, the abnormal degree of the correlation coefficient between the packet loss and any other feature can be calculated, the average value of the values of the plurality of abnormal degrees is calculated, and the average value is used as the abnormal degree of the correlation dimension of the packet loss.
In the above example, the value range of the cumulative distribution probability is 0 to 1, and the greater the degree of deviation of the target correlation coefficient from the normal correlation coefficient (correlation coefficient of the target feature of the normal data stream), the closer the cumulative distribution probability approaches 0 or 1; for the correlation coefficient of the packet loss, in some cases, the larger the value thereof is, the larger the abnormality degree is, in other cases, the smaller the value thereof is, the larger the abnormality degree is, therefore, it is necessary to consider a case that the cumulative distribution probability approaches to 1 or 0, and the closer the cumulative distribution probability of the correlation coefficient of the packet loss approaches to 0 or 1, the larger the abnormality degree of the packet loss characteristic of the first data stream in the correlation dimension is.
By the method, the cumulative distribution probability of the target feature in three dimensions can be obtained, so that the abnormal degree of the target feature in the three dimensions is determined; the maximum pooling (max boosting) method can be used for reasoning, and the most abnormal one of the abnormal degrees in the three dimensions is selected as the final abnormal degree of the target feature, i.e., the target abnormal degree.
After determining the target abnormality degree, the apparatus for detecting a network failure may perform the following steps.
And S230, determining the fault of the network for transmitting the first data stream according to the target abnormal degree.
If the data packet captured by the device for detecting the network fault is a data packet belonging to one data flow (i.e., the first data flow) and the data flow has only one characteristic (i.e., the target characteristic), the device for detecting the network fault may use the target abnormal degree as the final abnormal degree of the first data flow, and determine the network fault according to the final abnormal degree.
If the data packet captured by the device for detecting the network fault is a data packet belonging to one data flow (i.e., a first data flow), and the data flow includes a plurality of features (the plurality of features includes a target feature), the device for detecting the network fault may determine the abnormal degree of the plurality of features, determine the final abnormal degree of the first data flow based on the abnormal degree of the plurality of features, and the final abnormal degree of the first data flow may be one of the maximum abnormal degrees of the plurality of features; and then determining the network fault according to the final abnormal degree and the corresponding characteristics.
If the data packet captured by the device for detecting a network fault is a data packet belonging to a plurality of data flows, wherein the plurality of data flows include a first data flow, and the plurality of data flows are all transmitted by a network transmitting the first data flow, the device for detecting a network fault may determine a final abnormal degree of the plurality of data flows, and determine a network fault based on the final abnormal degree of the plurality of data flows. Optionally, the device for detecting network failure may rank the abnormal degrees of the multiple data streams, and present the data stream with the highest abnormal degree and the corresponding features.
For example, a data packet captured by current speed measurement belongs to three data streams, the three data streams are a first data stream, a second data stream and a third data stream, and each data stream can analyze the characteristics shown in table 1; the abnormal degree of the packet loss in the multiple characteristics of the first data flow is maximum, and if the abnormal degree is 0.8, the final abnormal degree of the first data flow is 0.8, and the abnormal characteristic is the packet loss; the abnormal degree of retransmission in the multiple characteristics of the second data stream is maximum, and if the abnormal degree is 0.5, the final abnormal degree of the second data stream is 0.5, and the abnormal characteristic is retransmission; the abnormal degree of the packet loss in the multiple features of the third data stream is maximum, and if the abnormal degree is 0.6, the final abnormal degree of the third data stream is 0.6, and the abnormal feature is the packet loss; the abnormal features of the transaction (i.e., speed measurement) can be determined based on the voting decision, and since the abnormal features of two data streams in the three data streams are packet loss, the abnormal features of the transaction can be determined to be packet loss, that is, the failure of the network transmitting the first data stream is packet loss.
In summary, the method 200 first obtains the target feature data of the data stream to be detected, and then measures the degree of the target feature data deviating from the normal feature data through the target probability model, wherein the target probability model does not depend on the manually set rules and threshold values, and compared with the manually set rules and threshold values, the method 200 can quickly determine the cause of the fault and improve the detection efficiency of the network fault. In addition, the target probability model can be obtained by learning the target characteristics of the normal data streams of different networks through the processor without manual intervention, so that the method 200 has good adaptivity.
Examples of the method for detecting network failure provided by the present application are described above in detail. It is understood that the corresponding apparatus contains hardware structures and/or software modules corresponding to the respective functions for implementing the functions described above. Those of skill in the art would readily appreciate that the various illustrative elements and algorithm steps described in connection with the embodiments disclosed herein may be implemented as hardware or combinations of hardware and computer software. Whether a function is performed as hardware or computer software drives hardware depends upon the particular application and design constraints imposed on the solution. Skilled artisans may implement the described functionality in varying ways for each particular application, but such implementation decisions should not be interpreted as causing a departure from the scope of the present application.
The present application may perform division of functional units on the apparatus according to the method example described above, for example, each function may be divided into each functional unit, or two or more functions may be integrated into one unit. The integrated unit can be realized in a form of hardware, and can also be realized in a form of a software functional unit. It should be noted that the division of the units in the present application is schematic, and is only one division of logic functions, and there may be another division manner in actual implementation.
Fig. 3 shows a schematic structural diagram of an apparatus for detecting a network fault provided in the present application. The apparatus 300 comprises a processing unit 310.
The processing unit 310 is configured to: acquiring target characteristic data, wherein the target characteristic data is data related to target characteristics of a first data stream; determining a target abnormal degree according to a target probability model and the target characteristic data, wherein the target probability model is used for indicating the probability distribution of normal characteristic data, the normal characteristic data is data related to the target characteristic of a normal data stream, and the target abnormal degree is the abnormal degree of the target characteristic of the first data stream; and determining the fault of the network for transmitting the first data flow according to the target abnormal degree.
Optionally, the processing unit 310 is specifically configured to: inputting the target characteristic data into the target probability model to determine a target probability, wherein the target probability is used for representing the target abnormal degree.
Optionally, the target feature data includes data of multiple dimensions, the target probability model includes probability models corresponding to the multiple dimensions, and the target probability includes probabilities corresponding to the multiple dimensions.
Optionally, the plurality of dimensions include statistical dimensions, the target feature data includes statistical values of a target feature of the first data stream, the target probability model includes a statistical value gaussian distribution, the target probability includes a cumulative distribution probability of the statistical values of the target feature of the first data stream over the statistical gaussian distribution, wherein the statistical value gaussian distribution is a gaussian distribution to which the statistical values of the target feature of the normal data stream obey.
Optionally, the plurality of dimensions include a data stream morphology dimension, the target feature data includes a target reconstruction error, the target probability model includes a gaussian distribution of reconstruction errors, the target probability includes a cumulative distribution probability of the target reconstruction error over the gaussian distribution of reconstruction errors, wherein the target reconstruction error is a reconstruction error of a data stream morphology of a target feature of the first data stream, and the gaussian distribution of reconstruction errors is a gaussian distribution obeyed by the reconstruction error of the data stream morphology of the target feature of the normal data stream.
Optionally, the plurality of dimensions include a correlation dimension, the target feature data includes a target correlation coefficient, the target probability model includes a correlation gaussian distribution, the target probability includes a cumulative distribution probability of the target correlation coefficient over the correlation gaussian distribution, wherein the target correlation coefficient is a correlation coefficient between a target feature of the first data stream and other features of the first data stream, and the correlation gaussian distribution is a gaussian distribution to which correlation coefficients between a target feature of the normal data stream and other features of the normal data stream obey.
Optionally, the processing unit 310 is specifically configured to: determining the abnormal degree of the target feature of the first data stream on the plurality of dimensions according to the corresponding probabilities of the plurality of dimensions; and determining the target abnormal degree according to the abnormal degree of the target characteristic of the first data stream in the plurality of dimensions.
Optionally, the target abnormality degree is one of the plurality of abnormality degrees having the largest value.
Optionally, the processing unit 310 is specifically configured to: determining a degree of anomaly of a plurality of features of a first data stream, the plurality of features including the target feature; determining a final abnormal degree of the first data flow according to the abnormal degrees of the plurality of characteristics; and determining the fault of the network for transmitting the first data flow according to the final abnormal degree of the first data flow.
Optionally, the final degree of abnormality is one of the degrees of abnormality of the plurality of features having the largest value.
Optionally, the processing unit 310 is specifically configured to: determining a final degree of anomaly for a plurality of data streams, the plurality of data streams including the first data stream, and the plurality of data streams each being transmitted by a network that transmits the first data stream; and determining the fault of the network for transmitting the first data flow according to the final abnormal degrees of the plurality of data flows.
The specific manner in which the apparatus 300 performs the method for detecting a network failure and the resulting beneficial effects can be seen in the related description of the method embodiments.
Fig. 4 shows a schematic structural diagram of an apparatus for detecting a network fault provided in the present application. The dashed lines in fig. 4 indicate that the unit or the module is optional. The apparatus 400 may be used to implement the methods described in the method embodiments above. The device 400 may be a terminal device or a server or a chip.
The apparatus 400 includes one or more processors 401, and the one or more processors 401 may support the apparatus 400 to implement the methods in the method embodiments. The processor 401 may be a general purpose processor or a special purpose processor. For example, the processor 401 may be a Central Processing Unit (CPU). The CPU may be configured to control the apparatus 400, execute software programs, and process data of the software programs. The device 400 may further comprise a communication unit 405 to enable input (reception) and/or output (transmission) of signals, such as the first data stream.
For example, the device 400 may be a chip and the communication unit 405 may be an input and/or output circuit of the chip, or the communication unit 405 may be a communication interface of the chip, and the chip may be a component of a terminal device or a network device or other electronic device.
Also for example, the device 400 may be a terminal device or a server, and the communication unit 405 may be a transceiver of the terminal device or the server, or the communication unit 405 may be a transceiver circuit of the terminal device or the server.
The device 400 may include one or more memories 402 having stored thereon a program 404, where the program 404 is executable by the processor 401 to generate instructions 403, so that the processor 401 may execute the method described in the above method embodiments according to the instructions 403. Optionally, data (e.g., target feature data) may also be stored in the memory 402. Alternatively, the processor 401 may also read data stored in the memory 402, the data may be stored at the same memory address as the program 404, and the data may be stored at a different memory address from the program 404.
The processor 401 and the memory 402 may be provided separately or integrated together, for example, on a System On Chip (SOC) of the terminal device.
The specific manner in which the processor 401 executes the method embodiments may be referred to in the description of the method embodiments.
It should be understood that the steps of the above-described method embodiments may be performed by logic circuits in the form of hardware or instructions in the form of software in the processor 401. The processor 401 may be a CPU, a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field Programmable Gate Array (FPGA), or other programmable logic device, such as a discrete gate, a transistor logic device, or a discrete hardware component.
The application also provides a computer program product which, when executed by a processor 401, implements the method according to any of the method embodiments of the application.
The computer program product may be stored in the memory 402, for example, as a program 404, and the program 404 is finally converted into an executable object file capable of being executed by the processor 401 through preprocessing, compiling, assembling, and linking.
The present application also provides a computer-readable storage medium having stored thereon a computer program which, when executed by a computer, implements the method of any of the method embodiments of the present application. The computer program may be a high-level language program or an executable object program.
Such as memory 402. Memory 402 may be either volatile memory or nonvolatile memory, or memory 402 may include both volatile and nonvolatile memory. The non-volatile memory may be a read-only memory (ROM), a Programmable ROM (PROM), an Erasable PROM (EPROM), an electrically Erasable EPROM (EEPROM), or a flash memory. Volatile memory can be Random Access Memory (RAM), which acts as external cache memory. By way of example, but not limitation, many forms of RAM are available, such as Static Random Access Memory (SRAM), Dynamic Random Access Memory (DRAM), Synchronous Dynamic Random Access Memory (SDRAM), double data rate SDRAM, enhanced SDRAM, SLDRAM, Synchronous Link DRAM (SLDRAM), and direct rambus RAM (DR RAM).
It can be clearly understood by those skilled in the art that, for convenience and brevity of description, the specific working processes and the generated technical effects of the above-described apparatuses and devices may refer to the corresponding processes and technical effects in the foregoing method embodiments, and are not described herein again.
In the several embodiments provided in the present application, the disclosed system, apparatus and method can be implemented in other ways. For example, some features of the method embodiments described above may be omitted, or not performed. The above-described embodiments of the apparatus are merely exemplary, the division of the unit is only one logical function division, and there may be other division ways in actual implementation, and a plurality of units or components may be combined or integrated into another system. In addition, the coupling between the units or the coupling between the components may be direct coupling or indirect coupling, and the coupling includes electrical, mechanical or other connections.
It should be understood that, in the various embodiments of the present application, the sequence numbers of the processes do not mean the execution sequence, and the execution sequence of the processes should be determined by the functions and the inherent logic, and should not constitute any limitation to the implementation process of the embodiments of the present application.
In addition, the term "and/or" herein is only one kind of association relationship describing an associated object, and means that three kinds of relationships may exist, for example, a and/or B may mean: a exists alone, A and B exist simultaneously, and B exists alone. In addition, the character "/" herein generally indicates that the former and latter related objects are in an "or" relationship.
In short, the above description is only a preferred embodiment of the present disclosure, and is not intended to limit the scope of the present disclosure. Any modification, equivalent replacement, improvement and the like made within the principle of the present application shall be included in the protection scope of the present application.
Claims (24)
1. A method of detecting a network failure, comprising:
acquiring target characteristic data, wherein the target characteristic data is data related to target characteristics of a first data stream;
determining a target abnormal degree according to a target probability model and the target characteristic data, wherein the target probability model is used for indicating the probability distribution of normal characteristic data, the normal characteristic data is data related to the target characteristic of a normal data stream, and the target abnormal degree is the abnormal degree of the target characteristic of the first data stream;
and determining the fault of the network for transmitting the first data flow according to the target abnormal degree.
2. The method of claim 1, wherein determining a target anomaly degree from a target probability model and the target feature data comprises:
inputting the target characteristic data into the target probability model to determine a target probability, wherein the target probability is used for representing the target abnormal degree.
3. The method of claim 2, wherein the target feature data comprises data for a plurality of dimensions, wherein the target probability model comprises a probability model for the plurality of dimensions, and wherein the target probability comprises a probability for the plurality of dimensions.
4. The method of claim 3, wherein the plurality of dimensions include statistical dimensions, the target feature data includes statistics of a target feature of the first data stream, the target probability model includes a statistics Gaussian distribution, the target probability includes a cumulative distribution probability of the statistics of the target feature of the first data stream over the statistical Gaussian distribution, wherein the statistics Gaussian distribution is a Gaussian distribution to which the statistics of the target feature of the normal data stream follow.
5. The method of claim 3 or 4, wherein the plurality of dimensions include a data flow morphology dimension, the target feature data includes a target reconstruction error, the target probability model includes a Gaussian distribution of reconstruction errors, the target probability includes a cumulative distribution probability of the target reconstruction error over the Gaussian distribution of reconstruction errors, wherein the target reconstruction error is a reconstruction error of a data flow morphology of the target feature of the first data flow, and the Gaussian distribution of reconstruction errors is a Gaussian distribution obeyed by the reconstruction error of the data flow morphology of the target feature of the normal data flow.
6. The method of any of claims 3 to 5, wherein the plurality of dimensions include a correlation dimension, the target feature data includes a target correlation coefficient, the target probability model includes a correlation Gaussian distribution, the target probability includes a cumulative distribution probability of the target correlation coefficient over the correlation Gaussian distribution, wherein the target correlation coefficient is a correlation coefficient between a target feature of the first data stream and other features of the first data stream, and the correlation Gaussian distribution is a Gaussian distribution to which correlation coefficients between the target feature of the normal data stream and other features of the normal data stream are obeyed.
7. The method of any one of claims 3 to 6, wherein said determining the target degree of abnormality from the target probability comprises:
determining the abnormal degree of the target feature of the first data stream on the plurality of dimensions according to the corresponding probabilities of the plurality of dimensions;
and determining the target abnormal degree according to the abnormal degree of the target characteristic of the first data stream in the plurality of dimensions.
8. The method according to claim 7, wherein the target abnormality degree is one of the plurality of abnormality degrees which has the largest value.
9. The method according to claim 7 or 8, wherein the determining the failure of the network transmitting the first data stream according to the target degree of anomaly comprises:
determining a degree of anomaly of a plurality of features of a first data stream, the plurality of features including the target feature;
determining a final abnormal degree of the first data flow according to the abnormal degrees of the plurality of characteristics;
and determining the fault of the network for transmitting the first data flow according to the final abnormal degree of the first data flow.
10. The method of claim 9, wherein the final degree of abnormality is the most significant one of the degrees of abnormality of the plurality of features.
11. The method according to claim 9 or 10, wherein the determining the failure of the network transmitting the first data flow according to the final degree of anomaly of the first data flow comprises:
determining a final degree of anomaly for a plurality of data streams, the plurality of data streams including the first data stream, and the plurality of data streams each being transmitted by a network that transmits the first data stream;
and determining the fault of the network for transmitting the first data flow according to the final abnormal degrees of the plurality of data flows.
12. An apparatus for detecting network failure, comprising a processing unit configured to:
acquiring target characteristic data, wherein the target characteristic data is data related to target characteristics of a first data stream;
determining a target abnormal degree according to a target probability model and the target characteristic data, wherein the target probability model is used for indicating the probability distribution of normal characteristic data, the normal characteristic data is data related to the target characteristic of a normal data stream, and the target abnormal degree is the abnormal degree of the target characteristic of the first data stream;
and determining the fault of the network for transmitting the first data flow according to the target abnormal degree.
13. The apparatus according to claim 12, wherein the processing unit is specifically configured to:
inputting the target characteristic data into the target probability model to determine a target probability, wherein the target probability is used for representing the target abnormal degree.
14. The apparatus of claim 13, wherein the target feature data comprises data for a plurality of dimensions, wherein the target probability model comprises a probability model for the plurality of dimensions, and wherein the target probability comprises a probability for the plurality of dimensions.
15. The apparatus of claim 14, wherein the plurality of dimensions comprise statistical dimensions, wherein the target feature data comprises a statistical value of a target feature of the first data stream, wherein the target probability model comprises a statistical gaussian distribution, wherein the target probability comprises a cumulative distribution probability of the statistical value of the target feature of the first data stream over the statistical gaussian distribution, and wherein the statistical gaussian distribution is a gaussian distribution obeyed by the statistical value of the target feature of the normal data stream.
16. The apparatus of claim 14 or 15, wherein the plurality of dimensions comprise a data flow morphology dimension, the target feature data comprises a target reconstruction error, the target probability model comprises a gaussian distribution of reconstruction errors, the target probability comprises a cumulative distribution probability of the target reconstruction error over the gaussian distribution of reconstruction errors, wherein the target reconstruction error is a reconstruction error of a data flow morphology of the target feature of the first data flow, and the gaussian distribution of reconstruction errors is a gaussian distribution obeyed by the reconstruction error of the data flow morphology of the target feature of the normal data flow.
17. The apparatus of any one of claims 14 to 16, wherein the plurality of dimensions include a correlation dimension, the target feature data includes a target correlation coefficient, the target probability model includes a correlation gaussian distribution, the target probability includes a cumulative distribution probability of the target correlation coefficient over the correlation gaussian distribution, wherein the target correlation coefficient is a correlation coefficient between a target feature of the first data stream and other features of the first data stream, and the correlation gaussian distribution is a gaussian distribution obeyed by correlation coefficients between the target feature of the normal data stream and other features of the normal data stream.
18. The apparatus according to any one of claims 14 to 17, wherein the processing unit is specifically configured to:
determining the abnormal degree of the target feature of the first data stream on the plurality of dimensions according to the corresponding probabilities of the plurality of dimensions;
and determining the target abnormal degree according to the abnormal degree of the target characteristic of the first data stream in the plurality of dimensions.
19. The apparatus according to claim 18, wherein the target abnormality degree is one of the plurality of abnormality degrees which has a largest value.
20. The apparatus according to claim 18 or 19, wherein the processing unit is specifically configured to:
determining a degree of anomaly of a plurality of features of a first data stream, the plurality of features including the target feature;
determining a final abnormal degree of the first data flow according to the abnormal degrees of the plurality of characteristics;
and determining the fault of the network for transmitting the first data flow according to the final abnormal degree of the first data flow.
21. The apparatus of claim 20, wherein the final degree of abnormality is a most significant one of the degrees of abnormality of the plurality of features.
22. The apparatus according to claim 20 or 21, wherein the processing unit is specifically configured to:
determining a final degree of anomaly for a plurality of data streams, the plurality of data streams including the first data stream, and the plurality of data streams each being transmitted by a network that transmits the first data stream;
and determining the fault of the network for transmitting the first data flow according to the final abnormal degrees of the plurality of data flows.
23. An apparatus for detecting a network failure, the apparatus comprising a processor and a memory, the memory for storing a computer program, the processor for invoking and running the computer program from the memory so that the apparatus performs the method of any one of claims 1 to 11.
24. A computer-readable storage medium, characterized in that the computer-readable storage medium stores a computer program which, when executed by a processor, causes the processor to carry out the method of any one of claims 1 to 11.
Priority Applications (2)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010495686.1A CN111817875B (en) | 2020-06-03 | 2020-06-03 | Method and device for detecting network fault |
| PCT/CN2021/096678 WO2021244415A1 (en) | 2020-06-03 | 2021-05-28 | Network failure detection method and apparatus |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010495686.1A CN111817875B (en) | 2020-06-03 | 2020-06-03 | Method and device for detecting network fault |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN111817875A true CN111817875A (en) | 2020-10-23 |
| CN111817875B CN111817875B (en) | 2022-06-28 |
Family
ID=72847936
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202010495686.1A Active CN111817875B (en) | 2020-06-03 | 2020-06-03 | Method and device for detecting network fault |
Country Status (2)
| Country | Link |
|---|---|
| CN (1) | CN111817875B (en) |
| WO (1) | WO2021244415A1 (en) |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2021244415A1 (en) * | 2020-06-03 | 2021-12-09 | 华为技术有限公司 | Network failure detection method and apparatus |
| CN116723059A (en) * | 2023-08-10 | 2023-09-08 | 湖南润科通信科技有限公司 | Security analysis system for network information |
Families Citing this family (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN114172796B (en) * | 2021-12-24 | 2024-01-30 | 中国工商银行股份有限公司 | Fault positioning method and related device for communication network |
| CN114363212B (en) * | 2021-12-27 | 2023-12-26 | 绿盟科技集团股份有限公司 | Equipment detection method, device, equipment and storage medium |
| CN114760190B (en) * | 2022-04-11 | 2023-06-20 | 北京邮电大学 | Service-oriented converged network performance anomaly detection method |
| CN115022908B (en) * | 2022-05-11 | 2023-05-12 | ***数智科技有限公司 | Method for predicting and positioning abnormality of core network and base station transmission network |
| CN115913898B (en) * | 2023-01-09 | 2023-05-16 | 浙江数思信息技术有限公司 | Internet of things terminal fault diagnosis method and medium based on machine learning algorithm |
Citations (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN105119734A (en) * | 2015-07-15 | 2015-12-02 | 中国人民解放军防空兵学院 | Full network anomaly detection positioning method based on robust multivariate probability calibration model |
| CN106453392A (en) * | 2016-11-14 | 2017-02-22 | 中国人民解放军防空兵学院 | Whole-network abnormal flow identification method based on flow characteristic distribution |
| US20170329314A1 (en) * | 2014-11-26 | 2017-11-16 | Shenyang Institute Of Automation, Chinese Academy Of Sciences | Modbus tcp communication behaviour anomaly detection method based on ocsvm dual-outline model |
| CN109951462A (en) * | 2019-03-07 | 2019-06-28 | 中国科学院信息工程研究所 | A kind of application software Traffic anomaly detection system and method based on holographic modeling |
| CN110086649A (en) * | 2019-03-19 | 2019-08-02 | 深圳壹账通智能科技有限公司 | Detection method, device, computer equipment and the storage medium of abnormal flow |
| CN110519290A (en) * | 2019-09-03 | 2019-11-29 | 南京中孚信息技术有限公司 | Anomalous traffic detection method, device and electronic equipment |
| CN110808972A (en) * | 2019-10-30 | 2020-02-18 | 杭州迪普科技股份有限公司 | Data stream identification method and device |
Family Cites Families (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US10958506B2 (en) * | 2017-12-07 | 2021-03-23 | Cisco Technology, Inc. | In-situ OAM (IOAM) network risk flow-based “topo-gram” for predictive flow positioning |
| CN110149343B (en) * | 2019-05-31 | 2021-07-16 | 国家计算机网络与信息安全管理中心 | Abnormal communication behavior detection method and system based on flow |
| CN111817875B (en) * | 2020-06-03 | 2022-06-28 | 华为技术有限公司 | Method and device for detecting network fault |
-
2020
- 2020-06-03 CN CN202010495686.1A patent/CN111817875B/en active Active
-
2021
- 2021-05-28 WO PCT/CN2021/096678 patent/WO2021244415A1/en active Application Filing
Patent Citations (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20170329314A1 (en) * | 2014-11-26 | 2017-11-16 | Shenyang Institute Of Automation, Chinese Academy Of Sciences | Modbus tcp communication behaviour anomaly detection method based on ocsvm dual-outline model |
| CN105119734A (en) * | 2015-07-15 | 2015-12-02 | 中国人民解放军防空兵学院 | Full network anomaly detection positioning method based on robust multivariate probability calibration model |
| CN106453392A (en) * | 2016-11-14 | 2017-02-22 | 中国人民解放军防空兵学院 | Whole-network abnormal flow identification method based on flow characteristic distribution |
| CN109951462A (en) * | 2019-03-07 | 2019-06-28 | 中国科学院信息工程研究所 | A kind of application software Traffic anomaly detection system and method based on holographic modeling |
| CN110086649A (en) * | 2019-03-19 | 2019-08-02 | 深圳壹账通智能科技有限公司 | Detection method, device, computer equipment and the storage medium of abnormal flow |
| CN110519290A (en) * | 2019-09-03 | 2019-11-29 | 南京中孚信息技术有限公司 | Anomalous traffic detection method, device and electronic equipment |
| CN110808972A (en) * | 2019-10-30 | 2020-02-18 | 杭州迪普科技股份有限公司 | Data stream identification method and device |
Cited By (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2021244415A1 (en) * | 2020-06-03 | 2021-12-09 | 华为技术有限公司 | Network failure detection method and apparatus |
| CN116723059A (en) * | 2023-08-10 | 2023-09-08 | 湖南润科通信科技有限公司 | Security analysis system for network information |
| CN116723059B (en) * | 2023-08-10 | 2023-10-20 | 湖南润科通信科技有限公司 | Security analysis system for network information |
Also Published As
| Publication number | Publication date |
|---|---|
| WO2021244415A1 (en) | 2021-12-09 |
| CN111817875B (en) | 2022-06-28 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN111817875B (en) | Method and device for detecting network fault | |
| CN110445653B (en) | Network state prediction method, device, equipment and medium | |
| CN104584483A (en) | Method and apparatus for automatically determining causes of service quality degradation | |
| CN110276257B (en) | Face recognition method, device, system, server and readable storage medium | |
| CN110298662B (en) | Automatic detection method and device for transaction repeated submission | |
| CN101714952A (en) | Method and device for identifying traffic of access network | |
| CN111309635A (en) | Test case generation method, device, server and storage medium | |
| CN112860676A (en) | Data cleaning method applied to big data mining and business analysis and cloud server | |
| CN114358312A (en) | Training method, equipment and storage medium of network alarm event recognition model | |
| CN110300008A (en) | A kind of method and device of the state of the determining network equipment | |
| CN111953504B (en) | Abnormal flow detection method and device, and computer readable storage medium | |
| CN113207146B (en) | Wireless communication network quality monitoring system and method | |
| US20200304396A1 (en) | Method of and system for testing a computer network | |
| CN112367215B (en) | Network traffic protocol identification method and device based on machine learning | |
| CN112702430A (en) | Data transmission system and method based on cloud edge mode and Web technology and application thereof | |
| CN114172796B (en) | Fault positioning method and related device for communication network | |
| CN114554521B (en) | Method and device for detecting sub-stream shared bandwidth bottleneck aiming at multipath transmission protocol | |
| CN114157486B (en) | Communication flow data abnormity detection method and device, electronic equipment and storage medium | |
| CN113505039A (en) | Communication fault analysis method, device and system | |
| CN116866240B (en) | CAN bus test method, device and system, electronic equipment and storage medium | |
| CN109981394B (en) | Communication method and device based on enhanced CAN bus protocol analyzer | |
| CN110309505A (en) | A kind of data format self-analytic data method of word-based insertion semantic analysis | |
| CN113784115B (en) | Multimedia quality evaluation method, device, equipment and storage medium | |
| US20230064755A1 (en) | Data processing method and apparatus | |
| CN117319529B (en) | Message analysis method and device applied to vehicle end, electronic equipment and storage medium |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |