WO2012083662A1 - 一种告警处理方法及dpi设备 - Google Patents

一种告警处理方法及dpi设备 Download PDF

Info

Publication number
WO2012083662A1
WO2012083662A1 PCT/CN2011/076258 CN2011076258W WO2012083662A1 WO 2012083662 A1 WO2012083662 A1 WO 2012083662A1 CN 2011076258 W CN2011076258 W CN 2011076258W WO 2012083662 A1 WO2012083662 A1 WO 2012083662A1
Authority
WO
WIPO (PCT)
Prior art keywords
alarm
unit
policy
real
statistical information
Prior art date
Application number
PCT/CN2011/076258
Other languages
English (en)
French (fr)
Inventor
王海森
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2012083662A1 publication Critical patent/WO2012083662A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/18—Protocol analysers
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/06—Management of faults, events, alarms or notifications

Definitions

  • the present invention relates to Deep Packet Inspection (DPI) technology in the communication field, and in particular, to an alarm processing method and a DPI device.
  • DPI Deep Packet Inspection
  • DPI devices have business data flow identification and service data flow control capabilities, and work in open systems.
  • the transport layer to the application layer (layer 2 to layer 7) of the OSI (Open System Interconnect) model has high data stream processing capability, can identify and manage traffic carried by the network, and can be deployed on the backbone network. Network equipment inside the metropolitan area network and enterprise network.
  • the purpose of the DPI device is to enable real-time monitoring of applications and users on the network, and to transmit real-time generated traffic and application data and alarms to the network management system.
  • the network management system displays the network management system in a graphical manner. Personnel, to help network managers to take appropriate management measures for users and behaviors on the network.
  • the DPI device mainly includes a policy setting unit, an aging unit, and an information sending unit.
  • the process of performing alarm processing by the DPI device is as shown in FIG. 2, and the aging unit obtains according to the flow table of each connection session.
  • the information is transmitted to the network management system through the information delivery unit, and the network management system performs data analysis and processing to generate graphical statistical information for the network administrator, network management.
  • the current network status is known.
  • the corresponding running policy is configured on the network management system.
  • the network management system sends the running policy configured by the network administrator to the policy setting unit.
  • the policy setting unit will Self-saved running strategy Updating to the running policy delivered by the network management system, the operating policy may be directly implemented by the current user and the application, or may be read from the policy setting unit and the current connection when the aging unit performs the aging operation.
  • the corresponding operation strategy is implemented into users and applications to meet the needs of network operation.
  • the DPI device needs to transmit the bandwidth, application, and user related information obtained in real time to the network management system. Then, the network management system sends the corresponding policy configured by the network administrator to the DPI device, and the data transmission amount is large, and the transmission cycle is long. Long, when the DPI device encounters an unexpected situation, the response and processing are not timely.
  • the DPI device itself mixes the mechanism for generating an alarm with the processing flow of the packet, which is not conducive to the expansion of the alarm mechanism and the type, and the overall performance of the DPI device.
  • the expert system is a system built using knowledge-based programming methods. It integrates the knowledge and experience of experts in a particular field. It can be used like a human expert to simulate the process of making decisions by human experts. Solve the complex problems that human experts can solve.
  • the expert system is mainly composed of two parts: knowledge base and inference engine.
  • the key to building a knowledge base is how to represent knowledge.
  • the inference engine is used for logical reasoning and corresponding results.
  • there are many types of expert systems for example, monitoring expert systems. Among them, the task of the monitoring expert system is to continuously observe the behavior of the communication system, the object or the process, and compare the observed behavior with the behavior it should have, and issue an alarm when an abnormal situation is found.
  • the monitoring expert system has the following features: It has the ability to respond quickly and alert in time before an accident occurs; the alarms issued are highly accurate; the information entered into the expert system can be processed dynamically as time and conditions change. Summary of the invention
  • the main purpose of the present invention is to provide an alarm processing method and a DPI device, which solve the problem that the existing DPI device processes a large amount of data, has a long transmission period, and is unresponsive and untimely.
  • the present invention provides a DPI device for alarm processing, where the DPI device includes: an aging unit, a policy setting unit, and an expert unit, where
  • An aging unit configured to generate real-time statistical information of the current network, and send the generated real-time statistical information to the expert unit;
  • An expert unit configured to analyze real-time statistical information sent by the aging unit, generate an alarm when the real-time statistical information matches the currently configured alarm rule, and send an alarm prompt message to the policy setting unit;
  • the policy setting unit is configured to adjust an operation strategy of the current network according to the alarm prompt message sent by the expert unit.
  • the aging unit is further configured to: periodically acquire a flow table of the current network, and generate real-time statistical information of the current network according to the obtained flow table, and send the generated real-time statistical information to the
  • the expert unit includes: a rule base and a matching module, wherein the rule base is configured to save the currently configured alarm rule; the matching module is configured to receive real-time statistical information sent by the aging unit, and traverse the rule All the alarm rules saved in the library, whether the alarm rules match the real-time statistics information, if yes, generate an alarm according to the queried alarm rules, and send an alarm prompt message to the policy setting unit, otherwise
  • the policy setting unit is further configured to: receive an alarm prompt message sent by the expert unit, traverse the running operation policy item configured in the current network according to the received alarm prompt message, and reset the current network configuration. The running policy entry related to the alarm prompt message.
  • the expert unit further includes: a rule conversion module, configured to receive an alarm policy delivered by the network management system, and convert the received alarm policy into the matching module according to a preset rule format.
  • the alarm rule that can be identified, and the converted alarm rule is saved in the rule base.
  • the matching module is further configured to: generate the generated in real time or periodically. The alarm is reported to the network management system.
  • the aging unit is further configured to periodically traverse the flow table of the current network, and obtain an operation policy entry that is reset by the policy setting unit and needs to be implemented to each connection or session, according to the The obtained running policy entry updates the running policy entry of each connection in the flow table.
  • the DPI device further includes: an information sending unit, configured to report the real-time statistical information generated by the aging unit to the network management system in real time or periodically.
  • the present invention also provides an alarm processing method, the method includes: generating real-time statistical information of a current network; analyzing the generated real-time statistical information, and generating when the real-time statistical information matches the currently configured alarm rule The alarm is sent, and an alarm prompt message is sent; according to the alarm prompt message, the current network running policy is adjusted.
  • the method includes: the aging unit periodically acquires a flow table of the current network, and generates real-time statistical information of the current network according to the obtained flow table, and sends the generated real-time statistical information to the expert.
  • the expert unit receives the real-time statistical information sent by the aging unit; traverses all currently saved alarm rules, and queries whether there is an alarm rule matching the real-time statistical information, and if so, generates an alarm rule according to the queried alarm rule.
  • the alarm is sent to the policy setting unit, otherwise, the action setting unit receives the alarm prompt message sent by the expert unit, and traverses the running policy entry configured in the current network according to the received alarm prompt message, Set the running policy entry related to the alarm prompt message configured in the current network.
  • the method further includes: the expert unit receives the alarm policy sent by the network management system, and saves the received alarm policy into an alarm rule that can be recognized by itself according to a preset rule format.
  • the method further includes: the aging unit periodically traversing the flow table of the current network, and acquiring the policy The running policy entry that needs to be implemented in each connection or session is set, and the running policy entry of each connection in the flow table is updated according to the obtained running policy entry.
  • the alarm processing method and the DPI device provided by the invention integrate the functions and mechanisms of special event processing, alarm generation and real-time policy setting into the expert unit by adding an expert unit to the existing DPI device, thereby reducing the DPI device processing alarm.
  • the steps reduce the data transmission amount of the alarm processing process, shorten the alarm processing period, and ensure the real-time performance of data processing, alarm generation and corresponding policy implementation, so that the DPI device can perform real-time on the users and applications in the network. Monitoring, and timely response and processing of specific events, improve the efficiency of DPI equipment, and achieve better network management and control effects.
  • FIG. 1 is a schematic structural diagram of a DPI device in the prior art
  • FIG. 3 is a schematic structural diagram of a DPI device of the present invention.
  • FIG. 4 is a schematic diagram of an implementation process of an alarm processing method according to the present invention. detailed description
  • the basic idea of the present invention is: adding an expert unit to the DPI device, the expert unit is configured to generate an alarm and perform related processing of the alarm, thereby separating the alarm generation processing mechanism from the DPI message processing flow, and
  • the NMS processes the processing of the real-time information and the execution of the real-time policy and the generation and processing of the alarms to the DPI device for processing. This effectively reduces the implementation process and time of the alarm generation mechanism, and enables the generation and processing of alarms in a timely manner.
  • the real-time nature of DPI enables more efficient management of the network.
  • the DPI device for alarm processing mainly includes: an aging unit, a policy setting unit, and an expert unit, where the aging unit is configured to generate real-time statistical information of the current network, and Generated real-time statistics sent to the expert unit; expert list The element is configured to analyze the real-time statistical information sent by the aging unit, generate an alarm when the real-time statistical information matches the currently configured alarm rule, and send an alarm prompt message to the policy setting unit; And adjusting an operation policy of the current network according to the alarm prompt message sent by the expert unit.
  • the aging unit may be configured to periodically obtain a current flow table of the current network, and generate real-time statistical information of the current network according to the obtained flow table, and send the generated real-time statistical information to the expert unit.
  • the period in which the aging unit obtains the flow table is generally short.
  • the period for obtaining the flow table may be set to two minutes, so that the aging unit can acquire the current network flow table every two minutes.
  • the flow table is related to a connection or a session existing in the current network, where the flow table is a set of all connections of the current network, and the flow table may include information about all current connections or information of sessions carried on all connections. , such as user information, traffic information, number of packages, application information, and so on.
  • the aging unit periodically performs statistical analysis on the information of each connection in the obtained flow table, and generates the real-time statistical information, and the generated real-time statistical information may include: the number of connections or sessions under each user, and each user Information such as the bandwidth of each application, the total bandwidth of each user, the total number of users, the total number of connections, or the total number of sessions.
  • the aging unit may transmit the generated real-time statistical information to the expert unit in the form of an event, periodically or in real time.
  • the real-time statistics of each user can include the following information: User IP 10.85.13.26, total traffic 36M, HTTP traffic 2M, PPLIVE traffic 16M, Thunder download traffic 18M, statistical period 30s, average bandwidth 1.2M/s,
  • the information is sent to the expert unit in a specific message format.
  • the specific message format can be determined according to the needs of the actual application and the type of the expert unit in the DPI device.
  • the DPI device may further include: an information sending unit, configured to report the real-time statistical information generated by the aging unit to the network management system in real time or periodically, so that the network management system can be
  • the image statistics information displayed by the network administrator can be updated in time to enable the network administrator to accurately and accurately estimate the current network status according to the graphical statistical information displayed by the network management system.
  • the expert unit may include: a rule base and a matching module, where the rule base is used to save the currently configured alarm rule; the matching module is configured to receive real-time statistical information sent by the aging unit, and traverse all the alarm rules saved in the rule base. Query whether there is an alarm rule matching the real-time statistical information. If yes, generate an alarm according to the queried alarm rule, and send an alarm prompt message to the policy setting unit. Otherwise, it does not operate.
  • the expert unit associates the event sent by the aging unit with the alarm rule in the rule base
  • the rule library may include multiple alarm rules, and the matching of the event and the alarm rule may use a specific matching algorithm, and the rule The alarm rules in the library are described by the corresponding specific syntax.
  • the rule base may include an alarm rule "If the bandwidth of the user exceeds 1 M/s, an alarm that the user bandwidth exceeds 1 M/s is generated", and the matching module of the expert unit matches the event sent by the aging unit with the alarm rule.
  • the expert unit may generate an alarm according to the queried alarm rule, and then send a corresponding alarm prompt message to the policy configuration unit according to the type of the generated alarm.
  • the alarm prompt message may include: a rule condition in the queried alarm rule, and information such as an IP address of the user in the real-time statistic information.
  • the alarm type may be an alarm number preset in the alarm rule.
  • the alarm number generated by the alarm rule 1 in the rule base is 1 and the predefined alarm prompt message 1 is sent to the policy setting unit, and the alarm rule is generated.
  • 2 Generate alarm 2, send alarm prompt message 2 to the policy setting unit, and so on.
  • the alarm 1 can be pre-defined as the bandwidth of the user exceeds 1 M/s
  • the alarm prompt message 1 can be defined as limiting the bandwidth of a user to 1 M/S.
  • the unit After the alarm rule 1 matches, the unit generates the alarm 1 and extracts the user's IP from the event sent by the aging unit, and fills the user's IP information into the alarm prompt message 1 to generate an alarm prompt message "to bandwidth the user 10.85.13.26. Set to within 1M/s and sent to the policy hive.
  • the expert unit further includes a rule conversion module, configured to receive an alarm policy delivered by the network management system, convert the received alarm policy into an alarm rule that the matching module can recognize according to a preset rule format, and convert the The obtained alarm rules are saved in the rule base.
  • an alarm rule may be configured in a rule base of the expert unit by using a network management system. Specifically, the network administrator knows the current network status according to the current graphical information and alarms displayed by the network management system. According to the current network status, actual requirements, and alarm experience, the network administrator configures an alarm policy in the network management system. The network management system sends the alarm policy to
  • the expert unit of the DPI device converts the alarm policy issued by the network management system into an alarm rule that can be identified by the matching module according to a preset rule format, and saves the alarm rule to the rule base. .
  • the alarm rules in the expert unit rule base have a specific syntax description manner, which is related to the syntax that the expert unit itself can recognize, and can be determined according to actual needs.
  • the network management system sends an alarm policy of "user bandwidth: lM/s" to the expert unit, and the expert unit generates an alarm rule that can be recognized by the expert according to the alarm policy. "If the bandwidth of the user exceeds 1 M/s, the user bandwidth is generated. More than 1M/s alarm.”
  • the expert unit is further configured to report the generated alarm to the network management system, so that the network management system can update the displayed alarm in time, so that the network administrator can timely and accurately understand the current network status.
  • the policy setting unit is specifically configured to: receive an alarm prompt message sent by the expert unit, traverse the operation policy entry configured in the current network according to the received alarm prompt message, and reset the current network configuration, and the Indicates the running policy entry related to the alarm prompt message.
  • the policy setting unit resets the current network according to the received alert prompt message.
  • the specific operation process of the network may include: the policy setting unit and the expert unit may negotiate in advance, pre-configure the operation policy in the policy setting unit, pre-configure the alarm prompt message in the expert unit, and run the policy and alarm through negotiation.
  • the prompt message is matched, so that the policy setting unit can find the running policy corresponding to the alarm prompt message in the pre-configured running policy after receiving the alarm prompt message, and update the found running policy to the current network configuration running.
  • the policy setting unit may query the corresponding running policy in the running policy table item of the current network according to the user information received from the alarm setting message, and search for the corresponding running policy.
  • the running policy is modified so that the modified running policy is consistent with the rule conditions included in the alarm prompt message.
  • the policy setting unit traverses the user table, wherein the user table stores the user IP and the user's
  • the rate limit policy is used to query the user entry corresponding to the user ID of the alarm prompt message, and the rate limit policy value in the user entry is modified to "no more than lM/s". After the modification, the new rate limit policy is modified. It will take effect. In the subsequent network operation, the bandwidth of the user 10.85.13.26 will not exceed lM/s.
  • the running strategy is different, and the running policy will not take effect after the adjustment.
  • the process of adjusting the running strategy will be different.
  • some of the running policies take effect immediately after the policy entry is reset.
  • the other part of the running policy is effective only after the policy entry of the connection or session is updated.
  • the aging unit is further configured to periodically traverse the flow table of the current network, and obtain an operation policy entry that is reset by the policy setting unit and needs to be implemented to each connection or session, according to the obtained operation.
  • the policy entry updates the running policy entry of each connection in the flow table.
  • the policy setting unit resets the running policy configured in the current network memory entry according to the alarm prompt message.
  • the running policy that needs to be implemented to each connection or session when the aging unit periodically traverses the flow table, access the related information table of each connection in the flow table one by one.
  • the aging unit reads the running policy corresponding to each connection in the memory table entry, and the running policy of the current connection in the flow table and the read running policy. For comparison, if the difference is different, the running policy of the connection in the flow table is updated to the read running policy. If they are the same, the update is not performed, so that the reset running policy can be implemented into the corresponding connection or session. .
  • the running policy that can be executed directly by reading the memory table item can be implemented after the policy setting unit is reset.
  • the present invention further provides an alarm processing method, where the method mainly includes the following steps: Step 1: Generate real-time statistical information of the current network;
  • Step 2 The real-time statistical information is analyzed, and when the real-time statistical information matches the currently configured alarm rule, an alarm is generated, and an alarm prompt message is sent;
  • Step 3 Adjust the running policy of the current network according to the alarm prompt message.
  • S401 The network management system sends the alarm policy to the expert unit.
  • the network administrator writes an alarm policy for the emergency according to actual needs and experience on the network management system and saves it.
  • the network management system will be configured to send its own alarm policy to the expert unit of the DPI device.
  • the network administrator can configure the alarm policy by simply adding and editing some options on the network management system.
  • the network management system can send the configured alarm policy to the DPI device by sending a command to the network management system. Expert unit.
  • the network management system also analyzes and processes real-time statistics such as real-time data and log information reported by the aging unit of the DPI device through the information delivery unit, processes the generated bandwidth distribution map, applies the distribution map, and analyzes the log and other data.
  • the daily report, the monthly report, the annual report, etc. are displayed in the form of a report, which is displayed in the form of a report for the network management personnel to view, and the alarm sent by the expert unit is also provided to the network management personnel for viewing, so that the current network operation status can be known in real time. Update the alarm policy.
  • the network administrator can view and analyze the alarms received by the network management system at any time.
  • the expert unit enables the new alarm strategy to play a role in subsequent network supervision.
  • the step may further include: the network administrator viewing and analyzing the information displayed by the network management system, and configuring the operation policy to the policy setting unit through the network management system according to the current status of the network, and the specific process is a common technical means in the field, and details are not described herein.
  • the expert unit receives the alarm policy delivered by the network management system, and saves the received alarm policy into an alarm rule that can be recognized by itself according to a preset rule format.
  • the aging unit periodically acquires a flow table of the current network, and generates real-time statistical information of the current network according to the obtained flow table, and sends the generated real-time statistical information in the form of an event, periodically or in real time.
  • the expert unit at the same time, the aging unit can also send real-time statistical information generated in real time to the network management system through the information sending unit in real time or periodically;
  • the aging unit periodically reads the flow table in the memory, performs statistical analysis on the information in the obtained flow table, and periodically generates the number of connections under the user and each application under the user.
  • Real-time statistics such as the bandwidth, the total bandwidth of the user, the total number of users on the DPI device, and the total number of connections (the number of sessions), and generate and record monitoring logs, in addition to transmitting real-time statistics and monitoring logs generated in real time to the information.
  • the uploading unit and the information sending unit send the real-time statistical information and the monitoring log to the network management system for subsequent analysis and processing by the network management system; the aging unit also transmits the real-time statistical information to the expert unit for the expert unit to perform data. Analyze, generate alarms, and prompt for alarm handling.
  • the expert unit receives the real-time statistical information sent by the aging unit; traverses all the currently saved alarm rules, and queries whether there is an alarm rule that matches the real-time statistical information, and if so, generates an alarm according to the queried alarm rule. And sending an alarm prompt message to the policy setting unit, continuing to S405, and at the same time, the expert unit can also generate the generated alarm in real time, or periodically. Reporting to the network management system on the ground, if no alarm rules matching the real-time statistics information are queried, the action is not performed, and the process returns to S403;
  • the network management system sends the alarm policy to the expert unit of the DPI device.
  • the expert unit of the DPI converts the alarm policy into an alarm rule and saves it to form a knowledge base.
  • the real-time statistical information generated by the aging unit is periodically generated.
  • the form is put into the expert unit; the expert unit compares the event with the alarm rule in the knowledge base and logically infers. If there is an alarm rule matching the event, an alarm is generated, and a corresponding alarm prompt message is sent to the policy setting unit.
  • the policy setting unit performs the adjustment of the operation policy according to the alarm prompt message, and can also report the alarm to the network management system for the network management personnel to analyze and understand the status of the network. If no alarm rule matches the event, no alarm is generated. No operation is performed. In this way, the amount of data transmission in the network can be effectively reduced, the amount of data processed by the network administrator can be reduced, and the emergency events in the network can be processed in time to effectively avoid network failure.
  • the policy setting unit receives the alarm prompt message sent by the expert unit, and traverses the running operation policy item configured in the current network according to the received alarm prompt message, and resets the current network configuration related to the alarm prompt message. Run the policy table entry;
  • the policy setting unit modifies the corresponding running policy in the current network according to the running policy corresponding to the alarm prompt message in the pre-configured running policy according to the type of the received alert prompt message and the information included in the user.
  • the entry in order to adjust and control the operation of the network, for example, can control the users and traffic on the DPI.
  • the running policy table is modified, the running policies applied to users and bandwidth will change. Some running policies need to be executed after S406 to take effect. Partial operational policies are effective in real time, such as bandwidth throttling policies. In actual applications, the effective time of the running policy and the effective mode are determined according to the type of the running policy and the required real-time performance.
  • the aging unit periodically traverses the flow table of the current network, and obtains a running policy entry that is reset by the policy setting unit and needs to be implemented to each connection or session, according to the obtained
  • the running policy table entry updates the running policy table entries of each connection in the flow table.
  • the aging unit performs the aging operation periodically, and each time the aging operation is performed, the running policy corresponding to each connection is read from the memory, and the read running policy and the corresponding connection in the flow table are run. When the policy is compared, the running policy is updated when the running policy is different from the corresponding running policy in the flow table. This action is required for each aging process. The policy may change during the aging interval. Therefore, you need to read the corresponding policy to implement the policy to ensure the consistency of the policy.
  • the foregoing aging operation includes an operation process of the aging unit acquiring the flow table, generating real-time statistical information, and the like.
  • the foregoing alarm processing flow is a process that is continuously looped.
  • the network management system continuously receives the alarm reported by the expert unit and the real-time statistical information uploaded by the aging unit through the information transmission unit, and continuously updates the displayed graphical statistical information. If the information is displayed, the network administrator can update the current network status in real time, or periodically, or rewrite the alarm policy configured in the network management system, and update the alarms in the network management system in real time.
  • the policy enables the DPI device to update the alarm rules according to the alarm policy delivered by the network management system in real time, and adjust the specific processing process of the alarm.
  • the network administrator can configure the alarm policy "bandwidth cannot exceed 4MB/s" in the network management system.
  • the network management system sends the foregoing alarm policy to the expert unit, and the expert unit can perform rule conversion on the policy and convert it into an alarm rule that can be recognized by itself. “If the bandwidth of a user on the DPI device exceeds 4 MB/S, then It performs the speed limit" and saves it to the rule base.
  • the aging unit obtains that the bandwidth information of the user is 5 MB/S, and transmits the information to the expert unit, and the expert unit matches the bandwidth information of the user with the alarm rule in the rule base, and queries the user and the bandwidth information.
  • the matching alarm rule "If the bandwidth of a user on the DPI device exceeds 4MB/S, the speed limit is performed", the expert unit generates an alarm that limits the bandwidth of the user, and sends an alert prompt for prompting the user to adjust the bandwidth.
  • the message "control the bandwidth of the user within 2MB/s" to the policy setting unit, and the policy setting unit according to the alarm prompt message,
  • the rate limit policy of the user is queried from the memory entry, and the rate limit policy is modified to "not more than 2MB/s". After the rate limit policy is modified, the bandwidth is valid. After that, the bandwidth of the user in the network operation is Reduced to 2MB/s.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Description

一种告警处理方法及 DPI设备 技术领域
本发明涉及通信领域的深度报文检测 （DPI, Deep Packet Inspection ) 技术， 尤其涉及一种告警处理方法及 DPI设备。 背景技术
随着互联网技术的快速发展， 在网络上承载的内容也越来越丰富， 而 且网络服务供应商给客户提供了越来越多的服务内容。 由于运营商对于网 络流量可管可控的需求的日益增强， 具有 DPI功能的设备在网络中的运用 越来越广泛， DPI设备具备业务数据流识别、 业务数据流控制能力， 工作在 开放式***互联（ OSI, Open System Interconnect )模型的传输层到应用层 (层 2到层 7 ) , 具有高数据流处理能力， 能够对网络所承载的业务进行识 别和流量管理， 是可部署于骨干网、 城域网和企业网内部的网络设备。
DPI设备的目的就是能够做到对网络上的应用及用户做到实时的监控， 并将实时产生的流量及应用数据、 告警等传送给网管***， 网管***再以 图形化的方式显示给网络管理人员， 以助于网络管理人员对网络上的用户 及行为釆取适当的管理措施。 目前， 如图 1所示， DPI设备主要包括策略设 置单元、 老化单元和信息上送单元， 通过该 DPI设备进行告警处理的流程 如图 2所示， 老化单元根据各连接会话的流表， 得到实时带宽、 应用及用 户等信息并进行记录后， 通过信息上送单元将所得到的信息传送给网管系 统， 由网管***进行数据分析和处理， 生成图形化统计信息显示给网络管 理员， 网络管理员根据网管所显示的图形化统计信息， 了解到当前的网络 现状， 在网管***上配置相应的运行策略， 网管***将网络管理员所配置 的运行策略下发到策略设置单元， 策略设置单元将自身已保存的运行策略 更新为所述网管***下发的运行策略， 之后， 所述运行策略可以直接由当 前的用户及应用实施， 或也可以由老化单元进行老化操作时从所述策略设 置单元读取与当前连接相对应的运行策略， 实施到用户及应用中， 满足网 络运行的需求。 上述方案中， DPI设备需要将实时得到的带宽、应用及用户 的相关信息传送给网管***， 之后， 网管***再将网络管理员配置的相应 策略下发给 DPI设备， 数据传送量大， 传送周期长， 在 DPI设备遇到突发 情况时， 响应及处理不及时。 并且， 上述方案中， DPI设备自身将产生告警 的机制与报文的处理流程混杂在一起， 不利于告警机制和种类的扩展、 以 及 DPI设备整体性能的发挥。
专家***是用基于知识的程序设计方法建立起来的***， 它综合集成 了某个特殊领域的专家的知识和经验， 能像人类专家那样运用这些知识， 通过推理模拟人类专家做出决定的过程， 解决人类专家才能解决的复杂问 题。 专家***主要由知识库、 推理机两部分组成， 建立知识库的关键是如 何表示知识， 推理机用于逻辑推理及产生相应的结果。 根据应用不同， 专 家***分为很多种， 例如， 监视专家***。 其中， 监视专家***的任务在 于对通信***、 对象或过程的行为进行不断观察， 并把观察到的行为与其 应当具有的行为进行比较， 发现异常情况时， 发出警报。 监视专家***具 有下列特点： 具有快速反应能力， 在造成事故之前能够及时发出警报； 发 出的警报有很高的准确性； 能够随时间和条件的变化而动态地处理输入专 家***的信息。 发明内容
有鉴于此，本发明的主要目的在于提供一种告警处理方法及 DPI设备， 以解决现有的 DPI设备处理告警时传送数据量大、 传送周期长、 以及响应 及处理不及时的问题。
为达到上述目的， 本发明的技术方案是这样实现的： 本发明提供了一种用于告警处理的 DPI设备， 所述 DPI设备包括： 老 化单元、 策略设置单元和专家单元， 其中，
老化单元， 用于生成当前网络的实时统计信息， 并将所生成的实时统 计信息发送到所述专家单元；
专家单元， 用于对所述老化单元发送的实时统计信息进行分析， 在所 述实时统计信息与当前配置的告警规则匹配时， 产生告警， 并发送告警提 示消息给所述策略设置单元；
策略设置单元， 用于根据所述专家单元发送的告警提示消息， 调整当 前网络的运行策略。
在上述方案中， 所述老化单元还用于， 周期性地获取当前网络的流表， 并根据所获取的流表， 生成当前网络的实时统计信息， 将所生成的实时统 计信息发送给所述专家单元； 所述专家单元包括： 规则库和匹配模块， 其 中， 规则库， 用于保存当前配置的告警规则； 匹配模块， 用于接收所述老 化单元发送的实时统计信息， 并遍历所述规则库中保存的所有告警规则， 查询是否有与所述实时统计信息匹配的告警规则， 如果有， 则根据所查询 到的告警规则， 产生告警， 并发送告警提示消息给所述策略设置单元， 否 则， 不动作； 所述策略设置单元还用于， 接收所述专家单元发送的告警提 示消息， 根据所接收到的告警提示消息， 遍历当前网络中配置的运行策略 表项， 重新设置当前网络中配置的、 与所述告警提示消息相关的运行策略 表项。
在上述方案中， 所述专家单元， 还包括： 规则转换模块， 用于接收网 管***下发的告警策略， 并按照预先设定的规则格式， 将所接收到的告警 策略转换成所述匹配模块能够识别的告警规则， 并将转换得到的告警规则 保存到所述规则库中。
在上述方案中， 所述匹配模块， 还用于， 实时或周期性地将所产生的 告警上报到网管***。
在上述方案中， 所述老化单元， 还用于， 周期性地遍历当前网络的流 表， 并获取所述策略设置单元重新设置的、 需要实施到各连接或会话的运 行策略表项， 根据所获取的运行策略表项更新所述流表中各连接的运行策 略表项。
在上述方案中， 所述 DPI设备还包括： 信息上送单元， 用于将所述老 化单元生成的实时统计信息实时或周期性的上报到网管***。
本发明还提供了一种告警处理方法， 所述方法包括： 生成当前网络的 实时统计信息； 对所生成的实时统计信息进行分析， 在所述实时统计信息 与当前配置的告警规则匹配时， 产生告警， 并发送告警提示消息； 根据所 述告警提示消息， 调整当前网络的运行策略。
在上述方案中， 所述方法包括： 老化单元周期性地获取当前网络的流 表， 并根据所获取的流表， 生成当前网络的实时统计信息， 将所生成的实 时统计信息发送给所述专家单元； 专家单元接收所述老化单元发送的实时 统计信息； 遍历当前保存的所有告警规则， 查询是否有与所述实时统计信 息匹配的告警规则， 如果有， 则根据所查询到的告警规则， 产生告警， 并 发送告警提示消息给策略设置单元， 否则， 不动作； 策略设置单元接收专 家单元发送的告警提示消息， 根据所接收到的告警提示消息， 遍历当前网 络中配置的运行策略表项， 重新设置当前网络中配置的、 与所述告警提示 消息相关的运行策略表项。
在上述方案中， 所述方法还包括： 专家单元接收网管***下发的告警 策略， 并按照预先设定的规则格式， 将所接收到的告警策略转换成自身能 够识别的告警规则后保存。
在上述方案中， 在所述策略设置单元调整当前网络的运行策略之后， 所述方法还包括： 老化单元周期性地遍历当前网络的流表， 并获取所述策 略设置单元重新设置的、 需要实施到各连接或会话的运行策略表项， 根据 所获取的运行策略表项更新所述流表中各连接的运行策略表项。
本发明提供的告警处理方法及 DPI设备， 通过在现有的 DPI设备中增 加专家单元， 将特殊事件处理、 告警产生和实时策略设置的功能和机制集 成到专家单元中， 减少了 DPI设备处理告警的步骤， 从而减少了告警处理 过程的数据传送量， 缩短了告警处理的周期， 并且保证了数据处理、 告警 产生及对应策略实施的实时性， 使得 DPI设备能够对网络中的用户和应用 进行实时的监控， 并对特定的事件进行及时响应和处理， 提高了 DPI设备 的工作效率， 达到了更好的网络管控效果。 附图说明
图 1为现有技术中 DPI设备的组成结构示意图；
图 2为现有技术中 DPI设备的告警处理流程图；
图 3为本发明的 DPI设备的组成结构示意图；
图 4为本发明的告警处理方法的实现过程示意图。 具体实施方式
本发明的基本思想是： 在 DPI设备中增加专家单元， 该专家单元用于 生成告警、 并进行告警的相关处理， 从而将告警的产生处理机制从 DPI的 报文处理流程中分离出来， 并将网管对部分实时信息的处理及实时策略的 下发执行和告警的生成及处理下放到 DPI设备侧进行处理， 从而有效缩短 告警产生处理机制的实现流程和时间， 使告警的产生和处理及时， 体现了 DPI实时性的特点， 能更加有效地管理网络。
本发明所提供的用于告警处理的 DPI设备， 参照图 3所示， 主要包括： 老化单元、 策略设置单元和专家单元， 其中， 老化单元， 用于生成当前网 络的实时统计信息， 并将所生成的实时统计信息发送到专家单元； 专家单 元， 用于对所述老化单元发送的实时统计信息进行分析， 在所述实时统计 信息与当前配置的告警规则匹配时， 产生告警， 并发送告警提示消息给所 述策略设置单元； 策略设置单元， 用于根据所述专家单元发送的告警提示 消息， 调整当前网络的运行策略。
其中， 老化单元具体可以用于周期性地获取当前网络的流表， 并根据 所获取的流表， 生成当前网络的实时统计信息， 将所生成的实时统计信息 发送给专家单元。 这里， 老化单元获取流表的周期一般比较短， 例如， 可 以设置获取流表的周期为两分钟， 如此， 老化单元就能够每隔两分钟获取 一次当前网络的流表。
这里， 所述流表与当前网络所存在的连接或会话相关， 所述流表为当 前网络的所有连接的集合， 流表中可以包含有当前所有连接的信息或所有 连接上所承载会话的信息， 例如用户信息、 流量信息、 包数、 应用信息等。 所述老化单元周期性地对获取到的流表中各连接的信息进行统计分析， 生 成所述实时统计信息， 生成的实时统计信息可以包括： 各用户下的连接数 或会话数、 各用户下每种应用的带宽、 各用户的总带宽、 总用户数、 总连 接数或总会话数等信息。
这里， 老化单元可以将所生成的实时统计信息以事件的形式、 周期性 地或实时发送给所述专家单元。 例如， 每个用户的实时统计信息可以包含 以下信息： 用户 IP 10.85.13.26、 总流量 36M、 HTTP流量 2M、 PPLIVE流 量 16M、 迅雷下载流量 18M、 统计周期 30s、 平均带宽 1.2M/s, 将上述这 些信息以特定的消息格式发送给专家单元， 这里特定的消息格式可以根据 实际应用的需要、 以及 DPI设备中专家单元本身的类型来确定， 具体为本 领域常用技术手段， 在此不再赘述。
这里， 所述 DPI装置还可以包括： 信息上送单元， 用于将所述老化单 元生成的实时统计信息实时或周期性的上报到网管***， 便于网管***能 够及时更新自身显示的图像化统计信息， 使得网络管理员能够根据网管系 统所显示的图像化统计信息及时准确地估计当前的网络状况。
其中， 专家单元可以包括： 规则库和匹配模块， 规则库用于保存当前 配置的告警规则； 匹配模块用于接收老化单元发送的实时统计信息， 并遍 历所述规则库中保存的所有告警规则， 查询是否有与所述实时统计信息匹 配的告警规则， 如果有， 则根据所查询到的告警规则， 产生告警， 并发送 告警提示消息给所述策略设置单元， 否则， 不动作。
具体地， 专家单元将老化单元发送来的事件与规则库中的告警规则进 行关联匹配， 规则库中可能会包含有多个告警规则， 事件与告警规则的匹 配可以釆用特定的匹配算法， 规则库中的告警规则釆用相应特定的语法进 行描述。 例如， 规则库中可以包含告警规则 "如果用户的带宽超过 lM/s , 则产生用户带宽超过 lM/s的告警"， 专家单元的匹配模块就将老化单元送 来的事件和该告警规则匹配， 将所述事件中的平均带宽与告警规则中限定 的值进行比较， 如果超过告警规则中限定的 lM/s , 则匹配， 从所述事件中 取出用户的 IP10.85.13.26, 产生针对用户 10.85.13.26的、 带宽超过 lM/s的 告警提示消息。
其中， 专家单元可以根据所查询到的告警规则， 产生告警， 再根据所 产生告警的类型， 发送相应的告警提示消息给策略配置单元。 这里， 所述 告警提示消息可以包括： 所查询到的告警规则中的规则条件、 实时统计信 息中用户的标识信息如 IP地址等信息。
具体地， 告警类型可以是在告警规则中预先设定的告警号， 例如， 规 则库中的告警规则 1产生的告警编号为 1 ,发送预先定义好的告警提示消息 1给策略设置单元， 告警规则 2产生告警 2, 发送告警提示消息 2给策略设 置单元， 依此类推。 例如， 告警 1可以预先定义为该用户带宽超过 lM/s , 告警提示消息 1可以定义为将某用户的带宽限制在 1M/S之内， 这样， 专家 单元在告警规则 1匹配后产生告警 1 ,并从老化单元发送的事件中提取出用 户的 IP,将用户的 IP信息填充到告警提示消息 1中，生成告警提示消息 "将 用户 10.85.13.26的带宽设置在 lM/s之内" 并发送给策略配置单元。
这里， 专家单元还包括规则转换模块， 用于接收网管***下发的告警 策略， 按照预先设定的规则格式， 将所接收的告警策略转换成所述匹配模 块能够识别的告警规则， 并将转换得到的告警规则保存到所述规则库中。 实际应用中， 可以通过网管***在所述专家单元的规则库中配置告警规则。 具体地， 网络管理员根据网管***当前显示的图形化统计信息、 以及告警， 了解当前网络状况， 根据当前网络状况、 实际需求以及告警经验， 网络管 理员在所述网管***中配置告警策略， 之后， 网管***将告警策略下发到
DPI设备的专家单元，专家单元中的规则转换单元按照预设的规则格式，将 所述网管***下发的告警策略转换成所述匹配模块能够识别的告警规则， 并保存到所述规则库中。
具体地， 专家单元规则库中的告警规则有特定的语法描述方式， 与所 述专家单元自身能够识别的语法有关， 可以根据实际需要来确定。 例如， 网管***将 "用户带宽： lM/s" 的告警策略下发给专家单元， 专家单元将 根据该告警策略生成自身能够识别的告警规则 "如果用户的带宽超过 lM/s , 则产生用户带宽超过 lM/s的告警"。
这里， 所述专家单元， 还用于， 将所产生的告警上报到网管***， 便 于网管***能够及时更新所显示的告警， 使得网络管理员能够及时准确地 了解当前的网络状况。
其中， 策略设置单元具体用于， 接收所述专家单元发送的告警提示消 息， 根据所接收到的告警提示消息， 遍历当前网络中配置的运行策略表项， 重新设置当前网络配置的、 与所述告警提示消息相关的运行策略表项。
这里， 策略设置单元根据所接收到的告警提示消息， 重新设置当前网 络配置的运行策略表项， 具体过程可以包括： 策略设置单元与专家单元事 先可以进行协商， 在策略设置单元预先配置运行策略， 在专家单元预先配 置告警提示消息， 并通过协商将运行策略与告警提示消息对应起来， 使得 策略设置单元可以接收到告警提示消息后， 在自身预先配置的运行策略中 查找到与该告警提示消息对应的运行策略， 并将查找的运行策略更新到当 前网络配置的运行策略表项中； 或者， 也可以是： 策略设置单元从所接收 到的告警提示消息， 根据其中的用户信息， 在当前网络配置的运行策略表 项中查询到对应的运行策略， 并将所查找到的运行策略进行修改， 使得修 改后的运行策略与所述告警提示消息中所包含的规则条件相一致。
例如， 当发送给策略设置单元的告警提示信息为 "将用户 10.85.13.26 的带宽限制在 lM/s" 时， 策略设置单元便会遍历用户表， 其中， 用户表中 保存有用户 IP以及用户的限速策略，查询到与所述告警提示消息用户 IP相 对应的用户表项， 将该用户表项中的限速策略值修改为 "不超过 lM/s" , 修 改后， 新的限速策略便可生效， 在后续的网络运行中， 用户 10.85.13.26的 带宽将不会超过 lM/s。
实际应用中， 运行策略不同， 运行策略在调整后生效的时间也会不一 样， 具体实施调整该运行策略的过程也会不同。 实际应用中， 部分运行策 略是在重新设置策略表项后立即生效的， 另一部分运行策略是在连接或会 话的策略表项被更新后才能够生效。
具体地， 所述老化单元， 还用于周期性地遍历当前网络的流表， 并获 取所述策略设置单元重新设置的、 需要实施到各连接或会话的运行策略表 项， 根据所获取的运行策略表项更新所述流表中各连接的运行策略表项。
实际应用中， 策略设置单元根据告警提示消息， 重新设置当前网络内 存表项中配置的运行策略。 其中， 对于需要实施到各连接或会话的运行策 略， 老化单元周期性地遍历流表时， 逐个访问流表中各连接的相关信息表 项， 包括各连接的运行策略表项； 同时， 老化单元读取内存表项中的、 与 各连接对应的运行策略， 将所述流表中当前各连接的运行策略与所读取的 运行策略进行比较， 如果不同， 则将所述流表中连接的运行策略更新为所 读取的运行策略， 如果相同， 则不进行更新， 使得重新设置后的运行策略 能够实施到相应的连接或会话中。 对于当前网络能够直接通过读取内存表 项来执行的运行策略， 则在策略设置单元重新设置后即可实施。
相应地， 本发明还提供了一种告警处理方法， 所述方法主要以下步骤： 步骤 1 : 生成当前网络的实时统计信息；
步骤 2: 对所述实时统计信息进行分析， 在所述实时统计信息与当前配 置的告警规则匹配时， 产生告警， 并发送告警提示消息；
步骤 3: 根据所述告警提示消息， 调整当前网络的运行策略。
具体地， 告警处理过程的具体实现过程参照图 4所示， 流程如下： S401 , 网管***向所述专家单元下发所述告警策略；
具体地， 网络管理员在网管***上根据实际需求、 以及经验编写针对 突发事件的告警策略并保存。 之后， 网管***将配置在自身的告警策略下 发给 DPI设备的专家单元。 其中， 网络管理员可以在网管***上通过简单 的添加和编辑一些选项， 来完成告警策略的配置， 可以通过向网管***输 入下发命令， 使得网管***将所配置的告警策略下发给 DPI设备的专家单 元。
其中， 网管***还对 DPI设备的老化单元通过信息上送单元上报的实 时数据、 日志信息等实时统计信息， 进行分析和处理， 处理生成带宽分布 图、 应用分布图等， 分析日志等数据后， 再得到日报、 月报、 年报等， 以 报表的形式直观地显示， 供网络管理人员查看， 也将专家单元上送的告警 提供给网络管理人员查看， 以便能够实时了解当前网络的运行状况， 及时 更新告警策略。 网络管理员可以随时查看和分析网管***接收到的告警及 其对应的处理措施， 了解网络现状， 根据需要， 修改、 删减、 或增加在网 管***中配置的告警策略， 实时更新现有的告警策略， 网管***可以实时 将告警策略下发给 DPI设备的专家单元， 使新的告警策略在后续网络监管 中发挥作用。
这里， 该步骤还可以包括： 网络管理员查看和分析网管***显示的信 息， 根据网络现状， 通过网管***配置运行策略到策略设置单元， 具体过 程为本领域常用技术手段， 在此不再赘述。
5402 , 专家单元接收网管***下发的告警策略， 并按照预先设定的规 则格式， 将所接收到的告警策略转换成自身能够识别的告警规则后保存。
5403 , 老化单元周期性地获取当前网络的流表， 并根据所获取的流表， 生成当前网络的实时统计信息， 并将所生成的实时统计信息以事件的形式、 周期性地或实时发送给专家单元； 同时， 老化单元还可以将实时生成的实 时统计信息， 通过信息上送单元实时或周期性地上 4艮给网管***；
具体地， 当 DPI设备工作时， 老化单元周期性地读取内存中的流表， 并对所获取流表中的信息进行统计分析， 周期性的生成用户下的连接数、 用户下每种应用的带宽、 用户的总带宽、 DPI设备上总的用户数、 总的连接 数（会话数）等实时统计信息， 同时生成和记录监控日志， 除了将实时产 生的实时统计信息和监控日志传送给信息上送单元， 信息上送单元将实时 统计信息和监控日志上送给网管***， 供网管***进行后续的分析和处理； 老化单元还将其中的实时统计信息传送给专家单元， 供专家单元进行数据 分析、 产生告警并提示进行告警处理。
5404, 专家单元接收老化单元发送的实时统计信息； 遍历当前保存的 所有告警规则， 查询是否有与所述实时统计信息匹配的告警规则， 如果有， 则根据所查询到的告警规则， 产生告警， 并发送告警提示消息给策略设置 单元， 继续 S405 , 同时， 专家单元还可以将所产生的告警实时、 或周期性 地上报到网管***， 如果没有查询到与所述实时统计信息匹配的告警规则， 则不动作， 返回 S403;
实际应用中， 网管***将告警策略下发给 DPI设备的专家单元， DPI 的专家单元将所述告警策略转换成告警规则并保存， 形成知识库； 老化单 元周期性生成的实时统计信息， 以事件的形式放入专家单元中； 专家单元 将事件与知识库中的告警规则进行对比和逻辑推理， 如果有告警规则与所 述事件匹配， 则产生告警， 并发送相应的告警提示消息给策略设置单元， 策略设置单元根据告警提示消息进行运行策略的调整， 同时也可以将告警 上报给网管***， 供网络管理人员分析和了解网络的状况， 如果没有告警 规则与所述事件匹配， 不产生告警， 也不做任何操作， 如此， 能够有效减 少网络中的数据传输量， 减少网络管理人员处理的数据量， 可以对网络中 的突发事件进行及时处理， 有效避免网络故障的产生。
5405 , 策略设置单元接收专家单元发送的告警提示消息， 根据所接收 到的告警提示消息， 遍历当前网络中配置的运行策略表项， 重新设置当前 网络中配置的、 与所述告警提示消息相关的运行策略表项；
具体地， 策略设置单元根据接收到的告警提示消息的类型及其中包含 的用户等信息， 根据预先配置的运行策略中、 与所述告警提示消息对应的 运行策略， 修改当前网络中对应的运行策略表项， 从而起到调整和控制网 络运行的作用， 例如， 可以对 DPI上的用户及流量进行管控。 运行策略表 项修改后， 应用到用户及带宽等的运行策略将发生变化， 部分运行策略需 要在 S406执行后才能生效。 部分运行策略， 是实时生效的， 例如带宽限制 策略。 实际应用中， 根据运行策略的类型和所要求的实时性来确定运行策 略的生效时间、 以及生效方式等。
5406, 老化单元周期性地遍历当前网络的流表， 并获取所述策略设置 单元重新设置的、 需要实施到各连接或会话的运行策略表项， 根据所获取 的运行策略表项更新所述流表中各连接的运行策略表项。
这里， 老化单元周期性的进行老化操作， 每次进行老化操作时， 都要 从内存中读取各连接对应的运行策略， 并将所读取的运行策略与所述流表 中相应连接的运行策略进行比较， 在读取的运行策略与流表中相应的运行 策略不同时， 进行运行策略表项的更新。 每次老化都要进行此项操作， 是 因为老化间隔周期内， 策略有可能发生变化， 因此老化时需要读取相应策 略进行策略实施， 确保策略的一致性。 这里， 上述的老化操作包括老化单 元获取流表、 生成实时统计信息等操作过程。
实际应用中， 上述的告警处理流程是一个不断循环进行的流程， 网管 ***不断接收专家单元上报的告警、 以及老化单元通过信息传送单元上传 的实时统计信息， 并不断更新自身显示的图像化统计信息等信息， 网络管 理员可以根据网络***所显示的信息， 及时了解当前网络的状况， 实时、 或者周期性的、 或者在需要时重新编写网管***中配置的告警策略， 实时 更新网管***中的告警策略， 使得 DPI设备能够根据网管***实时下发的 告警策略， 更新告警规则， 调整告警的具体处理过程。
例如， 网络管理员可以在网管***配置告警策略 "带宽不能超过 4MB/s"。 之后， 网管***将上述的告警策略下发到专家单元， 专家单元可 以对所述策略进行规则转换， 转换成自身能够识别的告警规则 "如果 DPI 设备上某用户的带宽超过 4MB/S , 则对其进行限速"， 保存到规则库中。 老 化单元统计得到所述用户的带宽信息为 5MB/S , 传送给专家单元， 专家单 元将所述用户的带宽信息与自身规则库中的告警规则进行匹配， 查询到有 与所述用户及带宽信息相匹配的告警规则 "如果 DPI设备上某用户的带宽 超过 4MB/S , 则对其进行限速"， 则专家单元产生限制用户带宽的告警， 并 发送用于提示所述用户调整带宽的告警提示消息 "将所述用户的带宽控制 在 2MB/S以内" 给策略设置单元， 策略设置单元根据所述告警提示消息， 从内存表项中查询到所述用户的限速策略， 并将该限速策略修改为 "不超 过 2MB/S" , 该限速策略修改后即可生效， 之后， 网络运行中用户的带宽被 降低到 2MB/s。
以上所述， 仅为本发明的较佳实施例而已， 并非用于限定本发明的保 护范围， 凡在本发明的精神和原则之内所作的任何修改、 等同替换和改进 等， 均应包含在本发明的保护范围之内。

Claims

权利要求书
1、 一种用于告警处理的深度报文检测 （DPI )设备， 其特征在于， 所 述 DPI设备包括： 老化单元、 策略设置单元和专家单元， 其中，
老化单元， 用于生成当前网络的实时统计信息， 并将所生成的实时统 计信息发送到所述专家单元；
专家单元， 用于对所述老化单元发送的实时统计信息进行分析， 在所 述实时统计信息与当前配置的告警规则匹配时， 产生告警， 并发送告警提 示消息给所述策略设置单元；
策略设置单元， 用于根据所述专家单元发送的告警提示消息， 调整当 前网络的运行策略。
2、 根据权利要求 1所述的用于告警处理的 DPI设备， 其特征在于， 所述老化单元， 还用于周期性地获取当前网络的流表， 并根据所获取 的流表， 生成当前网络的实时统计信息， 将所生成的实时统计信息发送给 所述专家单元；
所述专家单元包括： 规则库和匹配模块， 其中， 规则库， 用于保存当 前配置的告警规则； 匹配模块， 用于接收所述老化单元发送的实时统计信 息， 并遍历所述规则库中保存的所有告警规则， 查询是否有与所述实时统 计信息匹配的告警规则， 如果有， 则根据所查询到的告警规则， 产生告警， 并发送告警提示消息给所述策略设置单元， 否则， 不动作；
所述策略设置单元， 还用于接收所述专家单元发送的告警提示消息， 根据所接收到的告警提示消息， 遍历当前网络中配置的运行策略表项， 重 新设置当前网络中配置的、 与所述告警提示消息相关的运行策略表项。
3、 根据权利要求 2所述的用于告警处理的 DPI设备， 其特征在于， 所 述专家单元， 还包括： 规则转换模块， 用于接收网管***下发的告警策略， 并按照预先设定的规则格式， 将所接收到的告警策略转换成所述匹配模块 能够识别的告警规则， 并将转换得到的告警规则保存到所述规则库中。
4、 根据权利要求 2所述的用于告警处理的 DPI设备， 其特征在于， 所 述匹配模块， 还用于实时或周期性地将所产生的告警上报到网管***。
5、 根据权利要求 1所述的用于告警处理的 DPI设备， 其特征在于， 所 述老化单元， 还用于周期性地遍历当前网络的流表， 并获取所述策略设置 单元重新设置的、 需要实施到各连接或会话的运行策略表项， 根据所获取 的运行策略表项更新所述流表中各连接的运行策略表项。
6、 根据权利要求 1至 5任一项所述的用于告警处理的 DPI设备， 其特 征在于， 所述 DPI设备还包括： 信息上送单元， 用于将所述老化单元生成 的实时统计信息实时或周期性的上 "^到网管***。
7、 一种告警处理方法， 其特征在于， 所述方法包括：
生成当前网络的实时统计信息；
对所生成的实时统计信息进行分析， 在所述实时统计信息与当前配置 的告警规则匹配时， 产生告警， 并发送告警提示消息；
根据所述告警提示消息， 调整当前网络的运行策略。
8、根据权利要求 7所述的告警处理方法，其特征在于， 所述方法包括： 老化单元周期性地获取当前网络的流表， 并根据所获取的流表， 生成 当前网络的实时统计信息， 将所生成的实时统计信息发送给所述专家单元； 专家单元接收所述老化单元发送的实时统计信息； 遍历当前保存的所 有告警规则， 查询是否有与所述实时统计信息匹配的告警规则， 如果有， 则根据所查询到的告警规则， 产生告警， 并发送告警提示消息给策略设置 单元， 否则， 不动作；
策略设置单元接收专家单元发送的告警提示消息， 根据所接收到的告 警提示消息， 遍历当前网络中配置的运行策略表项， 重新设置当前网络中 配置的、 与所述告警提示消息相关的运行策略表项。
9、 根据权利要求 8所述的告警处理方法， 其特征在于， 所述方法还包 括：
专家单元接收网管***下发的告警策略， 并按照预先设定的规则格式， 将所接收到的告警策略转换成自身能够识别的告警规则后保存。
10、 根据权利要求 7至 9任一项所述的告警处理方法， 其特征在于， 在调整当前网络的运行策略之后， 所述方法还包括：
老化单元周期性地遍历当前网络的流表， 并获取所述策略设置单元重 新设置的、 需要实施到各连接或会话的运行策略表项， 根据所获取的运行 策略表项更新所述流表中各连接的运行策略表项。
PCT/CN2011/076258 2010-12-20 2011-06-24 一种告警处理方法及dpi设备 WO2012083662A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201010596880.5A CN102035685B (zh) 2010-12-20 2010-12-20 一种告警处理方法及dpi设备
CN201010596880.5 2010-12-20

Publications (1)

Publication Number Publication Date
WO2012083662A1 true WO2012083662A1 (zh) 2012-06-28

Family

ID=43888052

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2011/076258 WO2012083662A1 (zh) 2010-12-20 2011-06-24 一种告警处理方法及dpi设备

Country Status (2)

Country Link
CN (1) CN102035685B (zh)
WO (1) WO2012083662A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111953554A (zh) * 2019-05-16 2020-11-17 北京车和家信息技术有限公司 一种数据流量管理方法及装置

Families Citing this family (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102035685B (zh) * 2010-12-20 2014-08-13 中兴通讯股份有限公司 一种告警处理方法及dpi设备
CN102833099A (zh) * 2012-08-15 2012-12-19 曙光信息产业(北京)有限公司 一种可扩展的告警应急处理***及其控制方法
CN102882705B (zh) * 2012-09-03 2015-03-25 青岛海信传媒网络技术有限公司 终端设备上报日志的方法及日志上报***
CN103227756B (zh) * 2013-04-17 2017-07-14 华为技术有限公司 在线协议优化方法和装置
CN103560978B (zh) * 2013-10-14 2017-12-15 北京邮电大学 光接入网带宽动态分配的方法和装置
CN103747026A (zh) * 2013-10-29 2014-04-23 盛科网络（苏州）有限公司 openflow流表的告警方法及告警装置
CN103618643B (zh) * 2013-11-26 2017-06-16 北京京东尚科信息技术有限公司 一种消息队列动态报警监控方法及装置
CN107171876A (zh) * 2017-07-26 2017-09-15 成都科来软件有限公司 一种基于流量统计数据的访问告警方法
CN110121188B (zh) * 2018-02-07 2023-03-31 成都鼎桥通信技术有限公司 一种高负荷告警方法
CN111931066B (zh) * 2020-09-11 2021-09-07 四川新网银行股份有限公司 一种实时推荐***设计方法
CN114650218B (zh) * 2020-12-17 2023-12-12 中移(苏州)软件技术有限公司 一种数据获取方法、设备、***及存储介质

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101350781A (zh) * 2008-07-31 2009-01-21 成都市华为赛门铁克科技有限公司 一种流量监控的方法、设备和***
CN101414939A (zh) * 2008-11-28 2009-04-22 武汉虹旭信息技术有限责任公司 一种基于动态深度包检测的互联网应用识别方法
CN101420367A (zh) * 2007-10-24 2009-04-29 中国电信股份有限公司 P2p流量控制***及方法
CN102035685A (zh) * 2010-12-20 2011-04-27 中兴通讯股份有限公司 一种告警处理方法及dpi设备

Family Cites Families (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1937623A (zh) * 2006-10-18 2007-03-28 华为技术有限公司 一种控制网络业务的方法及***

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101420367A (zh) * 2007-10-24 2009-04-29 中国电信股份有限公司 P2p流量控制***及方法
CN101350781A (zh) * 2008-07-31 2009-01-21 成都市华为赛门铁克科技有限公司 一种流量监控的方法、设备和***
CN101414939A (zh) * 2008-11-28 2009-04-22 武汉虹旭信息技术有限责任公司 一种基于动态深度包检测的互联网应用识别方法
CN102035685A (zh) * 2010-12-20 2011-04-27 中兴通讯股份有限公司 一种告警处理方法及dpi设备

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111953554A (zh) * 2019-05-16 2020-11-17 北京车和家信息技术有限公司 一种数据流量管理方法及装置
CN111953554B (zh) * 2019-05-16 2022-09-27 北京车和家信息技术有限公司 一种数据流量管理方法及装置

Also Published As

Publication number Publication date
CN102035685A (zh) 2011-04-27
CN102035685B (zh) 2014-08-13

Similar Documents

Publication Publication Date Title
WO2012083662A1 (zh) 一种告警处理方法及dpi设备
US11171853B2 (en) Constraint-based event-driven telemetry
EP3780523B1 (en) Network traffic identification method and related device
US10484406B2 (en) Data visualization in self-learning networks
US7606895B1 (en) Method and apparatus for collecting network performance data
JP4653407B2 (ja) 通信ネットワーク設備用のローカルな保証管理装置
US11870696B2 (en) Method and system for triggering augmented data collection on a network device based on traffic patterns
US8705371B2 (en) Locally diagnosing and troubleshooting service issues
KR20150105436A (ko) 향상된 스트리밍 방법과 네트워크 메타데이터를 처리하기 위한 시스템
CN113438129A (zh) 数据采集方法及装置
US10986213B2 (en) Method and system for streaming management information base data using simple network management protocol
US20170187575A1 (en) System and method for customizing standard device-orientated services within a high scale deployment
CN105025006A (zh) 一种积极的信息安全运维平台
CN103618623A (zh) 一种基于网管***的资源管控方法
US12040990B2 (en) Packet programmable flow telemetry profiling and analytics
EP3791543B1 (en) Packet programmable flow telemetry profiling and analytics
WO2016138576A1 (en) System, apparatus and method for providing improved performance of aggregated/bonded network connections with cloud provisioning
CN112968861A (zh) 一种DDoS攻击封堵判定方法和***
KR20070084776A (ko) 네트워크 시스템의 관리 정보 모니터링 방법 및 그 장치
CN111178901A (zh) 智能网联特种车售后服务云平台***

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 11850461

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 11850461

Country of ref document: EP

Kind code of ref document: A1