CN111431764B - Node determining method, device, system and medium - Google Patents
Node determining method, device, system and medium Download PDFInfo
- Publication number
- CN111431764B CN111431764B CN202010197488.7A CN202010197488A CN111431764B CN 111431764 B CN111431764 B CN 111431764B CN 202010197488 A CN202010197488 A CN 202010197488A CN 111431764 B CN111431764 B CN 111431764B
- Authority
- CN
- China
- Prior art keywords
- node
- score
- shared
- sharing
- internet protocol
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L43/00—Arrangements for monitoring or testing data switching networks
- H04L43/16—Threshold monitoring
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/06—Management of faults, events, alarms or notifications
- H04L41/0631—Management of faults, events, alarms or notifications using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L43/00—Arrangements for monitoring or testing data switching networks
- H04L43/08—Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
- H04L43/0805—Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters by checking availability
- H04L43/0817—Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters by checking availability by checking functioning
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Environmental & Geological Engineering (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
The invention discloses a node determining method, which comprises the following steps: acquiring a target internet protocol address of a shared node and a shared bandwidth; determining the risk score of the target internet protocol address according to a preset internet protocol address risk library; if the risk score is smaller than a preset risk score threshold, counting the abnormal times of the addresses of the sharing nodes in a first preset time period; if the address anomaly times are smaller than a preset time threshold, determining the stability score of the shared node; calculating the sharing score of the sharing node according to the stability score and the sharing bandwidth; and if the sharing score is larger than a preset sharing score threshold value, determining that the sharing node is a high-quality node. The invention also discloses a computer device, a node determining system and a computer readable storage medium.
Description
Technical Field
The present invention relates to the field of computer networks, and in particular, to a method, apparatus, system, and medium for determining nodes.
Background
At present, with the development of internet technology, users have an increasing demand for network traffic, and in general, the demands of users can be met by using idle bandwidth traffic of other users in a node sharing manner. In practice, however, the user may modify the internet protocol address of the shared node or perform other operations, resulting in the shared node disconnecting from the network or failing to provide bandwidth traffic, reducing the overall network stability.
Therefore, how to determine high-quality shared nodes to ensure the stability of the network is a technical problem to be solved.
Disclosure of Invention
The invention mainly aims to provide a node determining method, equipment, a system and a medium, which aim to solve the technical problem of how to determine high-quality shared nodes so as to ensure the stability of a network.
To achieve the above object, the present invention provides a node determining method, the method comprising:
acquiring a target internet protocol address of a shared node and a shared bandwidth;
determining the risk score of the target internet protocol address according to a preset internet protocol address risk library;
if the risk score is smaller than a preset risk score threshold, counting the abnormal times of the addresses of the sharing nodes in a first preset time period;
if the address anomaly times are smaller than a preset time threshold, determining the stability score of the shared node;
calculating the sharing score of the sharing node according to the stability score and the sharing bandwidth;
and if the sharing score is larger than a preset sharing score threshold value, determining that the sharing node is a high-quality node.
As an optional implementation manner, the determining the risk score of the target internet protocol address according to the preset internet protocol address risk library includes:
Calculating the similarity between the target internet protocol address and each internet protocol address in the internet protocol address risk library;
and determining the risk score of the target internet protocol address according to the maximum similarity in the multiple similarities.
As an optional implementation manner, the counting the abnormal number of the addresses of the sharing nodes in the first preset time period includes:
acquiring a current Internet protocol address currently used by the sharing node at intervals of preset time in a first preset time period;
judging whether the current internet protocol address is consistent with the target internet protocol address or not;
if the current internet protocol address is inconsistent with the target internet protocol address, determining that the sharing node has address abnormality, and updating the number of address abnormality times of the sharing node; or (b)
And if the current internet protocol address is consistent with the target internet protocol address, determining that the sharing node has no address abnormality.
As an alternative embodiment, the determining the stability score of the shared node includes:
counting the connection disconnection times of the shared node in a second preset time period, and counting the total connection disconnection time of the shared node in the second preset time period;
And determining the stability score of the shared node according to the connection disconnection times and the total connection disconnection time.
As an alternative embodiment, the method further comprises:
if the risk score is greater than or equal to a preset risk score threshold, determining the sharing node as a risk node;
generating risk alarm information corresponding to the risk node;
and sending the risk alarm information to risk management equipment.
As an alternative embodiment, the method further comprises:
if the address anomaly times are greater than or equal to a preset time threshold, determining the shared node as an anomaly node;
generating abnormal alarm information corresponding to the abnormal node;
and sending the abnormality warning information to an abnormality management device.
As an alternative embodiment, the method further comprises:
if the sharing score is smaller than or equal to a preset sharing score threshold value, determining the sharing node as an alternative node;
and adding the alternative node to an alternative node list.
To achieve the above object, the present invention further provides a computer device comprising a memory and a processor, the memory having stored thereon a computer program executable on the processor, the computer program implementing the node determination method when executed by the processor.
To achieve the above object, the present invention further provides a node determining system comprising:
an obtaining unit, configured to obtain a target internet protocol address and a shared bandwidth of a shared node;
the determining unit is used for determining the risk score of the target internet protocol address according to a preset internet protocol address risk library;
the statistics unit is used for counting the abnormal times of the addresses of the sharing nodes in a first preset time period if the risk score is smaller than a preset risk score threshold;
the determining unit is further configured to determine a stability score of the shared node if the number of address anomalies is less than a preset number of thresholds;
a calculating unit, configured to calculate a sharing score of the sharing node according to the stability score and the sharing bandwidth;
the determining unit is further configured to determine that the shared node is a high-quality node if the shared score is greater than a preset shared score threshold.
As an optional implementation manner, the determining unit determines the risk score of the target internet protocol address according to a preset internet protocol address risk library specifically by:
Calculating the similarity between the target internet protocol address and each internet protocol address in the internet protocol address risk library;
and determining the risk score of the target internet protocol address according to the maximum similarity in the multiple similarities.
As an optional implementation manner, the statistical unit counts the abnormal number of the addresses of the sharing nodes in the first preset time period specifically includes:
acquiring a current Internet protocol address currently used by the sharing node at intervals of preset time in a first preset time period;
judging whether the current internet protocol address is consistent with the target internet protocol address or not;
if the current internet protocol address is inconsistent with the target internet protocol address, determining that the sharing node has address abnormality, and updating the number of address abnormality times of the sharing node.
As an optional implementation manner, the determining unit determines the stability score of the shared node specifically includes:
counting the connection disconnection times of the shared node in a second preset time period, and counting the total connection disconnection time of the shared node in the second preset time period;
And determining the stability score of the shared node according to the connection disconnection times and the total connection disconnection time.
As an optional implementation manner, the determining unit is further configured to determine the shared node as a risk node if the risk score is greater than or equal to a preset risk score threshold;
the node determination system may further include:
the first generation unit is used for generating risk alarm information corresponding to the risk nodes;
and the first sending unit is used for sending the risk alarm information to the risk management equipment.
As an optional implementation manner, the determining unit is further configured to determine the shared node as an abnormal node if the number of address anomalies is greater than or equal to a preset number of thresholds;
the node determination system may further include:
the second generation unit is used for generating abnormal alarm information corresponding to the abnormal node;
and the second sending unit is used for sending the abnormality warning information to the abnormality management equipment.
As an optional implementation manner, the determining unit is further configured to determine the shared node as an alternative node if the shared score is less than or equal to a preset shared score threshold;
The node determination system may further include:
and the adding unit is used for adding the alternative nodes into an alternative node list.
To achieve the above object, the present invention further provides a computer-readable storage medium having stored thereon a computer program executable by one or more processors to implement the node determining method.
To achieve the above object, the present invention further provides a computer program product comprising computer instructions which, when run on a computer, enable the computer to perform the node determining method.
Based on the technical scheme, the method and the system can determine the shared node with low risk score, less address anomaly times and high shared score (namely high stability score and high shared bandwidth) as the high-quality node to be preferably used, so that the shared node with larger risk can be avoided, meanwhile, the address anomaly times of the shared node are counted, the shared node can be replaced in time or other decisions can be made, further, the stability (stability score) of the shared node is determined, the shared node with high stability score and high shared bandwidth is preferably selected, and the stability of the network is ensured.
Drawings
Fig. 1 is a schematic flow chart of a node determining method disclosed in the present invention.
Fig. 2 is a schematic structural diagram of a computer device implementing a preferred embodiment of the node determining method of the present invention.
Fig. 3 is a functional block diagram of a node determination system of the present disclosure.
Detailed Description
The present invention will be described in further detail with reference to the drawings and examples, in order to make the objects, technical solutions and advantages of the present invention more apparent. It should be understood that the specific embodiments described herein are for purposes of illustration only and are not intended to limit the scope of the invention. All other embodiments, which can be made by those skilled in the art based on the embodiments of the invention without making any inventive effort, are intended to be within the scope of the invention.
The terms "first," "second," "third," "fourth" and the like in the description and in the claims of this application and in the above-described figures, if any, are used for distinguishing between similar objects and not necessarily for describing a particular sequential or chronological order. It is to be understood that the data so used may be interchanged where appropriate, such that the embodiments described herein may be implemented in additional orders other than those illustrated or described herein, and that a feature defining "a first" or "a second" may be explicitly or implicitly included in at least one such feature.
Furthermore, the terms "comprises," "comprising," and "having," and any variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, system, article, or apparatus that comprises a list of steps or elements is not necessarily limited to those steps or elements expressly listed but may include other steps or elements not expressly listed or inherent to such process, method, article, or apparatus.
In addition, the technical solutions of the embodiments may be combined with each other, but it is necessary to base that the technical solutions can be realized by those skilled in the art, and when the technical solutions are contradictory or cannot be realized, the combination of the technical solutions should be considered to be absent and not within the scope of protection claimed in the present invention.
Preferably, the node determining method of the present invention is applied in one or more computer devices. The computer device is a device capable of automatically performing numerical calculation and/or information processing according to a preset or stored instruction, and its hardware includes, but is not limited to, a microprocessor, an application specific integrated circuit (Application Specific Integrated Circuit, ASIC), a programmable gate array (Field-Programmable Gate Array, FPGA), a digital processor (Digital Signal Processor, DSP), an embedded device, and the like.
The computer equipment can be a desktop computer, a notebook computer, a palm computer, a cloud server and other computing equipment. The computer equipment can perform man-machine interaction with a user through a keyboard, a mouse, a remote controller, a touch pad or voice control equipment and the like.
The computer device may be a node that makes up a CDN (Content Delivery Network ) network or a blockchain network.
Example 1
Referring to fig. 1, fig. 1 is a flow chart of a node determining method disclosed in the present invention. In this embodiment, the node determining method is mainly applicable to a computer device, and the order of the steps in the flowchart may be changed according to different requirements, and some steps may be omitted.
S11, obtaining the target internet protocol address of the sharing node and the sharing bandwidth.
The sharing node can be networking equipment of a home user, and the bandwidth (flow) limitation of the sharing node can be shared for other nodes to use through a flow sharing plug-in.
In the embodiment of the invention, the Internet protocol address (Internet Protocol, IP) of the sharing node and the sharing bandwidth can be acquired through the sharing plug-in installed on the sharing node. Such as: the obtained internet protocol address may be: 120.237.95.130. the value of the shared bandwidth may be a value set by a user when using the traffic sharing plug-in.
S12, determining the risk score of the target Internet protocol address according to a preset Internet protocol address risk library.
The risk library of internet protocol addresses may be a database in which known risk internet protocol addresses are stored. These risky internet protocol addresses may be blacklisted by certain servers from which access is prohibited, resulting in the shared nodes using risky internet protocol addresses not having access to these servers, and traffic shared by the shared nodes not being used normally.
As an optional implementation manner, the determining the risk score of the target internet protocol address according to the preset internet protocol address risk library includes:
calculating the similarity between the target internet protocol address and each internet protocol address in the internet protocol address risk library;
and determining the risk score of the target internet protocol address according to the maximum similarity in the multiple similarities.
In this alternative embodiment, the similarity between the target internet address and each internet protocol address in the internet protocol address risk library may be calculated by dividing the number of digits of the same location by the total number of digits, such as: the two IP addresses are respectively: 120.120.120.120, 120.120.121.111. The number of the same numbers at the same position is 9, the total number of the numbers is 12, and the calculated similarity is as follows: 0.75. if the similarity is the maximum similarity, determining that the risk score is 75.
As an alternative embodiment, the method further comprises:
if the risk score is greater than or equal to a preset risk score threshold, determining the sharing node as a risk node;
generating risk alarm information corresponding to the risk node;
and sending the risk alarm information to risk management equipment.
In this alternative embodiment, a risk score may be preset, for example, 60 score, a shared node with a risk score greater than 60 score is determined as a risk node, and when the risk node is detected, risk alarm information may be generated and sent to the corresponding device. The risk management device may collect risk alert information of the shared node.
And S13, if the risk score is smaller than a preset risk score threshold, counting the abnormal times of the addresses of the sharing nodes in a first preset time period.
In the embodiment of the invention, because the sharing node can be the own equipment of other users, the sharing node is controlled by other users, and the other users can modify the internet protocol address of the sharing node in a proxy mode. But the bandwidth speed of the internet protocol address modified by the agent is slower than that of the original internet protocol address, so that the internet surfing quality of the sharing flow user is reduced. Thus, it can be detected whether the internet protocol address of the shared node is modified. A time period, such as 24 hours, may be preset, and the number of address anomalies that occur in the shared node during the continuous 24 hour period may be counted.
Optionally, when the number of address anomalies of the shared node in another preset time period (a third preset time period) is zero, the address anomalies of the shared node can be considered to be recovered to be normal, and the number of address anomalies of the shared node is reset; or when an address exception recovery instruction for the shared node is received, resetting the address exception times of the shared node.
As an optional implementation manner, the counting the abnormal number of the addresses of the sharing nodes in the first preset time period includes:
acquiring a current Internet protocol address currently used by the sharing node at intervals of preset time in a first preset time period;
judging whether the current internet protocol address is consistent with the target internet protocol address or not;
if the current internet protocol address is inconsistent with the target internet protocol address, determining that the sharing node has address abnormality, and updating the number of address abnormality times of the sharing node.
In this alternative embodiment, a time interval may be set to periodically obtain the current internet protocol address used by the sharing node (the current internet protocol address), determine whether the current internet protocol address is consistent with the target internet protocol address, and determine that the internet protocol address of the sharing node has been modified by the user if the current internet protocol address is consistent with the target internet protocol address, which may affect the internet quality. The address exception at this time may be recorded and the number of address exceptions updated. An association of the number of address exceptions with the shared node may be established and saved to a storage node for storing data.
And S14, if the address anomaly times are smaller than a preset time threshold, determining the stability score of the shared node.
In the embodiment of the invention, a threshold value of the number of address anomalies, for example, 1 time, can be preset. If the abnormal number of addresses of the sharing node is smaller than a preset number of times threshold, the stability (the stability score) of the sharing node can be further determined.
As an alternative embodiment, the determining the stability score of the shared node includes:
counting the connection disconnection times of the shared node in a second preset time period, and counting the total connection disconnection time of the shared node in the second preset time period;
and determining the stability score of the shared node according to the connection disconnection times and the total connection disconnection time.
In this alternative embodiment, a shared node is very unstable if the connection to the internet is often broken. A time period (the second preset time period) may be preset, and the number of times that the shared node is connected and disconnected in the second preset time period and the total duration that the shared node is connected and disconnected in the second preset time period are counted. And then according to the preset weight, calculating the stability score of the sharing node. Assuming that the number of times of disconnection of the shared node is 3 in 24 hours, the total duration of disconnection is 2 hours, the weight of the number of times of disconnection is 0.2, the weight of the total duration of disconnection is 0.8, the stability score is 2.2, and the lower the value of the stability score is, the more stable the shared node is.
As an alternative embodiment, the method further comprises:
if the address anomaly times are greater than or equal to a preset time threshold, determining the shared node as an anomaly node;
generating abnormal alarm information corresponding to the abnormal node;
and sending the abnormality warning information to an abnormality management device.
In this alternative embodiment, when the number of address exceptions of the shared node is greater than or equal to a preset number of times threshold, the shared node may be determined as an exception node. And can generate abnormal alarm information to alarm the address of the sharing node for a plurality of abnormal times. The abnormality management device may collect abnormality alert information of the shared node.
S15, calculating the sharing score of the sharing node according to the stable score and the sharing bandwidth.
In the embodiment of the invention, the corresponding positive sharing score can be set for the sharing bandwidth, for example: the positive sharing score corresponding to the shared bandwidth 100M is 10, the positive sharing score corresponding to the shared bandwidth 200M is 20, and the corresponding negative sharing score is set for different stability scores, such as negative sharing score of-10 for stability score 1 and negative sharing score of-20 for stability score 2. And adding the positive sharing score corresponding to the sharing node with the negative sharing score to obtain the sharing score of the sharing node, wherein the positive sharing score of the sharing node is 20, the negative sharing score is-10, and the final sharing score is 10.
S16, if the sharing score is larger than a preset sharing score threshold, determining that the sharing node is a high-quality node.
In the embodiment of the invention, a sharing score threshold value can be preset, and when the sharing score of a sharing node is greater than the preset sharing score threshold value, the sharing node is determined to be a high-quality node. The high-quality nodes are sharing nodes with low risk coefficient, less address anomaly times, high stability and more sharing bandwidth. And the high-quality nodes are preferably selected, so that the stability of the whole network can be improved.
As an alternative embodiment, the method further comprises:
if the sharing score is smaller than or equal to a preset sharing score threshold value, determining the sharing node as an alternative node;
and adding the alternative node to an alternative node list.
In this alternative embodiment, if the sharing score of the sharing node is less than or equal to the preset sharing score threshold, the sharing node may be determined to be an alternative node. The candidate nodes may be nodes with low risk coefficients and fewer address anomaly times.
In summary, in the present invention, the shared node with low risk score, small number of address anomalies and high shared score (high stability score and high shared bandwidth) can be determined as a high-quality node for preferential use, so that the shared node with larger risk can be avoided, meanwhile, the number of address anomalies of the shared node is counted, the shared node can be replaced in time or other decisions can be made, further, the stability (stability score) of the shared node is determined, the shared node with high stability score and high shared bandwidth is preferentially selected, and the stability of the network is ensured.
Example two
Referring to fig. 2, fig. 2 is a schematic structural diagram of a computer device implementing a preferred embodiment of a node determining method according to the present invention.
In this embodiment, the computer device 1 may be a PC (Personal Computer ), or may be a terminal device such as a smart phone, a tablet computer, a palm computer, or a portable computer.
The computer device 1 may include a memory 11, a processor 12, and a bus 13.
The memory 11 includes at least one type of readable storage medium including flash memory, a hard disk, a multimedia card, a card memory (e.g., SD or DX memory, etc.), a magnetic memory, a magnetic disk, an optical disk, etc. The memory 11 may in some embodiments be an internal storage unit of the computer device 1, such as a hard disk of the computer device 1. The memory 11 may in other embodiments also be an external storage device of the computer device 1, such as a plug-in hard disk, a Smart Media Card (SMC), a Secure Digital (SD) Card, a Flash Card (Flash Card) or the like, which are provided on the computer device 1. Further, the memory 11 may also include both an internal storage unit and an external storage device of the computer device 1. The memory 11 may be used not only for storing application software installed in the computer device 1 and various types of data, such as code of a computer program, but also for temporarily storing data that has been output or is to be output.
Processor 12 may in some embodiments be a central processing unit (Central Processing Unit, CPU), controller, microcontroller, microprocessor or other data processing chip for executing program code or processing data stored in memory 11.
The bus 13 may be a peripheral component interconnect standard (peripheral component interconnect, PCI) bus, or an extended industry standard architecture (extended industry standard architecture, EISA) bus, among others. The bus may be classified as an address bus, a data bus, a control bus, etc. For ease of illustration, only one thick line is shown in fig. 2, but not only one bus or one type of bus.
Further, the computer device may also comprise a network interface, which may optionally comprise a wired interface and/or a wireless interface (e.g. WI-FI interface, bluetooth interface, etc.), typically used to establish a communication connection between the computer device 1 and other electronic devices.
Optionally, the computer device 1 may further comprise a user interface, which may comprise a Display (Display), an input unit such as a Keyboard (Keyboard), and optionally a standard wired interface, a wireless interface. Alternatively, in some embodiments, the display may be an LED display, a liquid crystal display, a touch-sensitive liquid crystal display, an OLED (Organic Light-Emitting Diode) touch, or the like. The display may also be referred to as a display screen or display unit, as appropriate, for displaying information processed in the computer device 1 and for displaying a visual user interface.
Fig. 2 shows only a computer device 1 with components 11-13, it being understood by those skilled in the art that the structure shown in fig. 2 does not constitute a limitation of the computer device 1, and may include fewer or more components than shown, or may combine certain components, or a different arrangement of components.
In connection with fig. 1, the memory 11 in the computer device 1 stores a plurality of instructions to implement a node determining method, the processor 12 being executable to implement:
acquiring a target internet protocol address of a shared node and a shared bandwidth;
determining the risk score of the target internet protocol address according to a preset internet protocol address risk library;
if the risk score is smaller than a preset risk score threshold, counting the abnormal times of the addresses of the sharing nodes in a first preset time period;
if the address anomaly times are smaller than a preset time threshold, determining the stability score of the shared node;
calculating the sharing score of the sharing node according to the stability score and the sharing bandwidth;
and if the sharing score is larger than a preset sharing score threshold value, determining that the sharing node is a high-quality node.
In particular, the specific implementation method of the above instructions by the processor 12 may refer to the description of the relevant steps in the corresponding embodiment of fig. 1, which is not repeated herein.
In the computer device 1 described in fig. 2, the shared node with low risk score, small number of address anomalies and high shared score (high stability score and high shared bandwidth) can be determined as a high-quality node for optimal use, so that the shared node with larger risk can be avoided, meanwhile, the number of address anomalies of the shared node is counted, the shared node can be replaced in time or other decisions can be made, further, the stability (stability score) of the shared node is determined, the shared node with high stability score and high shared bandwidth is preferably selected, and the stability of the network is ensured.
Example III
Referring to fig. 3, fig. 3 is a functional block diagram of a preferred embodiment of a node determination system according to the present disclosure. The node determination system includes: acquisition unit 201, determination unit 202, statistics unit 203, and calculation unit 204. The unit referred to in the present invention refers to a series of computer program segments capable of being executed by the processor 12 and of performing a fixed function, which are stored in the memory 11. In the present embodiment, the functions of the respective units will be described in detail in the following embodiments.
An obtaining unit 201, configured to obtain a target internet protocol address of the shared node and a shared bandwidth.
The sharing node can be networking equipment of a home user, and the bandwidth (flow) limitation of the sharing node can be shared for other nodes to use through a flow sharing plug-in.
In the embodiment of the invention, the Internet protocol address (Internet Protocol, IP) of the sharing node and the sharing bandwidth can be acquired through the sharing plug-in installed on the sharing node. Such as: the obtained internet protocol address may be: 120.237.95.130. the value of the shared bandwidth may be a value set by a user when using the traffic sharing plug-in.
A determining unit 202, configured to determine a risk score of the target internet protocol address according to a preset internet protocol address risk library.
The risk library of internet protocol addresses may be a database in which known risk internet protocol addresses are stored. These risky internet protocol addresses may be blacklisted by certain servers from which access is prohibited, resulting in the shared nodes using risky internet protocol addresses not having access to these servers, and traffic shared by the shared nodes not being used normally.
And the statistics unit 203 is configured to, if the risk score is smaller than a preset risk score threshold, count abnormal times of the address of the shared node in a first preset time period.
In the embodiment of the invention, because the sharing node can be the own equipment of other users, the sharing node is controlled by other users, and the other users can modify the internet protocol address of the sharing node in a proxy mode. But the bandwidth speed of the internet protocol address modified by the agent is slower than that of the original internet protocol address, so that the internet surfing quality of the sharing flow user is reduced. Thus, it can be detected whether the internet protocol address of the shared node is modified. A time period, such as 24 hours, may be preset, and the number of address anomalies that occur in the shared node during the continuous 24 hour period may be counted.
Optionally, when the number of address anomalies of the shared node in another preset time period (a third preset time period) is zero, the address anomalies of the shared node can be considered to be recovered to be normal, and the number of address anomalies of the shared node is reset; or when an address exception recovery instruction for the shared node is received, resetting the address exception times of the shared node.
The determining unit 202 is further configured to determine a stability score of the shared node if the number of address anomalies is less than a preset number of thresholds.
In the embodiment of the invention, a threshold value of the number of address anomalies, for example, 1 time, can be preset. If the abnormal number of addresses of the sharing node is smaller than a preset number of times threshold, the stability (the stability score) of the sharing node can be further determined.
A calculating unit 204, configured to calculate a sharing score of the sharing node according to the stability score and the sharing bandwidth.
In the embodiment of the invention, the corresponding positive sharing score can be set for the sharing bandwidth, for example: the positive sharing score corresponding to the shared bandwidth 100M is 10, the positive sharing score corresponding to the shared bandwidth 200M is 20, and the corresponding negative sharing score is set for different stability scores, such as negative sharing score of-10 for stability score 1 and negative sharing score of-20 for stability score 2. And adding the positive sharing score corresponding to the sharing node with the negative sharing score to obtain the sharing score of the sharing node, wherein the positive sharing score of the sharing node is 20, the negative sharing score is-10, and the final sharing score is 10.
The determining unit 202 is further configured to determine that the shared node is a high-quality node if the shared score is greater than a preset shared score threshold.
In the embodiment of the invention, a sharing score threshold value can be preset, and when the sharing score of a sharing node is greater than the preset sharing score threshold value, the sharing node is determined to be a high-quality node. The high-quality nodes are sharing nodes with low risk coefficient, less address anomaly times, high stability and more sharing bandwidth. And the high-quality nodes are preferably selected, so that the stability of the whole network can be improved.
As an optional implementation manner, the determining unit 202 determines the risk score of the target internet protocol address according to a preset internet protocol address risk library specifically:
calculating the similarity between the target internet protocol address and each internet protocol address in the internet protocol address risk library;
and determining the risk score of the target internet protocol address according to the maximum similarity in the multiple similarities.
In this alternative embodiment, the similarity between the target internet address and each internet protocol address in the internet protocol address risk library may be calculated by dividing the number of digits of the same location by the total number of digits, such as: the two IP addresses are respectively: 120.120.120.120, 120.120.121.111. The number of the same numbers at the same position is 9, the total number of the numbers is 12, and the calculated similarity is as follows: 0.75. if the similarity is the maximum similarity, determining that the risk score is 75.
As an optional implementation manner, the statistics unit 203 counts the abnormal number of the addresses of the sharing nodes within the first preset period of time specifically includes:
acquiring a current Internet protocol address currently used by the sharing node at intervals of preset time in a first preset time period;
judging whether the current internet protocol address is consistent with the target internet protocol address or not;
if the current internet protocol address is inconsistent with the target internet protocol address, determining that the sharing node has address abnormality, and updating the number of address abnormality times of the sharing node.
In this alternative embodiment, a time interval may be set to periodically obtain the current internet protocol address used by the sharing node (the current internet protocol address), determine whether the current internet protocol address is consistent with the target internet protocol address, and determine that the internet protocol address of the sharing node has been modified by the user if the current internet protocol address is consistent with the target internet protocol address, which may affect the internet quality. The address exception at this time may be recorded and the number of address exceptions updated. An association of the number of address exceptions with the shared node may be established and saved to a storage node for storing data.
As an optional implementation manner, the determining unit 202 determines the stability score of the shared node specifically is:
counting the connection disconnection times of the shared node in a second preset time period, and counting the total connection disconnection time of the shared node in the second preset time period;
and determining the stability score of the shared node according to the connection disconnection times and the total connection disconnection time.
In this alternative embodiment, a shared node is very unstable if the connection to the internet is often broken. A time period (the second preset time period) may be preset, and the number of times that the shared node is connected and disconnected in the second preset time period and the total duration that the shared node is connected and disconnected in the second preset time period are counted. And then according to the preset weight, calculating the stability score of the sharing node. Assuming that the number of times of disconnection of the shared node is 3 in 24 hours, the total duration of disconnection is 2 hours, the weight of the number of times of disconnection is 0.2, the weight of the total duration of disconnection is 0.8, the stability score is 2.2, and the lower the value of the stability score is, the more stable the shared node is.
As an optional implementation manner, the determining unit 202 is further configured to determine the shared node as a risk node if the risk score is greater than or equal to a preset risk score threshold;
the node determination system may further include:
the first generation unit is used for generating risk alarm information corresponding to the risk nodes;
and the first sending unit is used for sending the risk alarm information to the risk management equipment.
In this alternative embodiment, a risk score may be preset, for example, 60 score, a shared node with a risk score greater than 60 score is determined as a risk node, and when the risk node is detected, risk alarm information may be generated and sent to the corresponding device. The risk management device may collect risk alert information of the shared node.
As an optional implementation manner, the determining unit 202 is further configured to determine the shared node as an abnormal node if the number of address anomalies is greater than or equal to a preset number of thresholds;
the node determination system may further include:
the second generation unit is used for generating abnormal alarm information corresponding to the abnormal node;
And the second sending unit is used for sending the abnormality warning information to the abnormality management equipment.
In this alternative embodiment, when the number of address exceptions of the shared node is greater than or equal to a preset number of times threshold, the shared node may be determined as an exception node. And can generate abnormal alarm information to alarm the address of the sharing node for a plurality of abnormal times. The abnormality management device may collect abnormality alert information of the shared node.
As an optional implementation manner, the determining unit 202 is further configured to determine the shared node as the candidate node if the shared score is less than or equal to a preset shared score threshold;
the node determination system may further include:
and the adding unit is used for adding the alternative nodes into an alternative node list.
In this alternative embodiment, if the sharing score of the sharing node is less than or equal to the preset sharing score threshold, the sharing node may be determined to be an alternative node. The candidate nodes may be nodes with low risk coefficients and fewer address anomaly times.
In summary, in the present invention, the shared node with low risk score, small number of address anomalies and high shared score (high stability score and high shared bandwidth) can be determined as a high-quality node for preferential use, so that the shared node with larger risk can be avoided, meanwhile, the number of address anomalies of the shared node is counted, the shared node can be replaced in time or other decisions can be made, further, the stability (stability score) of the shared node is determined, the shared node with high stability score and high shared bandwidth is preferentially selected, and the stability of the network is ensured.
Example IV
The present embodiment provides a computer-readable storage medium having stored thereon a computer program executable by one or more processors to implement a node determining method, the computer program executable by the one or more processors to implement:
acquiring a target internet protocol address of a shared node and a shared bandwidth;
determining the risk score of the target internet protocol address according to a preset internet protocol address risk library;
if the risk score is smaller than a preset risk score threshold, counting the abnormal times of the addresses of the sharing nodes in a first preset time period;
if the address anomaly times are smaller than a preset time threshold, determining the stability score of the shared node;
calculating the sharing score of the sharing node according to the stability score and the sharing bandwidth;
and if the sharing score is larger than a preset sharing score threshold value, determining that the sharing node is a high-quality node.
Alternatively, the computer program, when executed by one or more processors, performs the functions of the modules/units in the above-described node determination system embodiments, e.g., units 201-204 in fig. 3:
An obtaining unit 201, configured to obtain a target internet protocol address of the shared node and a shared bandwidth.
The determining unit 202 is further configured to determine a risk score of the target internet protocol address according to a preset internet protocol address risk library.
And the statistics unit 203 is configured to, if the risk score is smaller than a preset risk score threshold, count abnormal times of the address of the shared node in a first preset time period.
The determining unit 202 is further configured to determine a stability score of the shared node if the number of address anomalies is less than a preset number of thresholds.
A calculating unit 204, configured to calculate a sharing score of the sharing node according to the stability score and the sharing bandwidth.
The determining unit 202 is further configured to determine that the shared node is a high-quality node if the shared score is greater than a preset shared score threshold.
In summary, the shared node with low risk score, small number of address anomalies and high shared score (high stability score and high shared bandwidth) can be determined as a high-quality node for optimal use, so that the shared node with larger risk can be avoided, meanwhile, the number of address anomalies of the shared node is counted, the shared node can be replaced in time or other decisions can be made, further, the stability (stability score) of the shared node is determined, the shared node with high stability score and high shared bandwidth is preferably selected, and the stability of the network is ensured.
In the above embodiments, it may be implemented in whole or in part by software, hardware, firmware, or any combination thereof. When implemented in software, may be implemented in whole or in part in the form of a computer program product.
The computer program product includes one or more computer instructions. When loaded and executed on a computer, produces a flow or function in accordance with embodiments of the present invention, in whole or in part. The computer may be a general purpose computer, a special purpose computer, a computer network, or other programmable apparatus. The computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transmitted from one website, computer, server, or data center to another website, computer, server, or data center by a wired (e.g., coaxial cable, fiber optic, digital Subscriber Line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.). The computer readable storage medium may be any available medium that can be stored by a computer or a data storage device such as a server, data center, etc. that contains an integration of one or more available media. The usable medium may be a magnetic medium (e.g., floppy Disk, hard Disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid State Disk (SSD)), etc.
It will be clear to those skilled in the art that, for convenience and brevity of description, specific working procedures of the above-described systems, apparatuses and units may refer to corresponding procedures in the foregoing method embodiments, which are not repeated herein.
In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods may be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative, e.g., the division of the units is merely a logical function division, and there may be additional divisions when actually implemented, e.g., multiple units or components may be combined or integrated into another system, or some features may be omitted or not performed. Alternatively, the coupling or direct coupling or communication connection shown or discussed with each other may be an indirect coupling or communication connection via some interfaces, devices or units, which may be in electrical, mechanical or other form.
The units described as separate units may or may not be physically separate, and units shown as units may or may not be physical units, may be located in one place, or may be distributed on a plurality of network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.
In addition, each functional unit in each embodiment of the present application may be integrated in one processing unit, or each unit may exist alone physically, or two or more units may be integrated in one unit. The integrated units may be implemented in hardware or in software functional units.
The integrated units, if implemented in the form of software functional units and sold or used as stand-alone products, may be stored in a computer readable storage medium. Based on such understanding, the technical solution of the present application may be embodied in essence or a part contributing to the prior art or all or part of the technical solution in the form of a software product stored in a storage medium, including several instructions to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in the embodiments of the present application. And the aforementioned storage medium includes: a U-disk, a removable hard disk, a Read-Only Memory (ROM), a random access Memory (RAM, random Access Memory), a magnetic disk, or an optical disk, or other various media capable of storing program codes.
It should be noted that, the foregoing reference numerals of the embodiments of the present invention are merely for describing the embodiments, and do not represent the advantages and disadvantages of the embodiments. And the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, apparatus, article, or method that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, apparatus, article, or method. Without further limitation, an element defined by the phrase "comprising one … …" does not exclude the presence of other like elements in a process, apparatus, article or method that comprises the element.
The foregoing description is only of the preferred embodiments of the present invention, and is not intended to limit the scope of the invention, but rather is intended to cover any equivalents of the structures or equivalent processes disclosed herein or in the alternative, which may be employed directly or indirectly in other related arts.
Claims (10)
1. A method of node determination, the method comprising:
acquiring a target internet protocol address of a shared node and a shared bandwidth;
Determining a risk score of the target internet protocol address according to a preset internet protocol address risk library, wherein the risk score is used for determining a risk node in the sharing nodes;
if the risk score is smaller than a preset risk score threshold, counting the abnormal times of the addresses of the sharing nodes in a first preset time period;
if the address anomaly times are smaller than a preset times threshold, determining a stability score of the shared node, wherein the stability score is used for determining the stability of the shared node;
calculating a shared score of the shared nodes according to the stable score and the shared bandwidth, wherein the shared score is used for determining high-quality nodes in the shared nodes;
and if the sharing score is larger than a preset sharing score threshold value, determining that the sharing node is a high-quality node.
2. The method according to claim 1, wherein determining the risk score of the target internet protocol address according to the preset internet protocol address risk library comprises:
calculating the similarity between the target internet protocol address and each internet protocol address in the internet protocol address risk library;
And determining the risk score of the target internet protocol address according to the maximum similarity in the multiple similarities.
3. The method of determining a node according to claim 1, wherein the counting the number of address anomalies of the shared node within the first preset time period includes:
acquiring a current Internet protocol address currently used by the sharing node at intervals of preset time in a first preset time period;
judging whether the current internet protocol address is consistent with the target internet protocol address or not;
if the current internet protocol address is inconsistent with the target internet protocol address, determining that the sharing node has address abnormality, and updating the number of address abnormality times of the sharing node.
4. The node determination method of claim 1, wherein the determining the stability score of the shared node comprises:
counting the connection disconnection times of the shared node in a second preset time period, and counting the total connection disconnection time of the shared node in the second preset time period;
and determining the stability score of the shared node according to the connection disconnection times and the total connection disconnection time.
5. The node determination method according to any one of claims 1 to 4, characterized in that the method further comprises:
if the risk score is greater than or equal to a preset risk score threshold, determining the sharing node as a risk node;
generating risk alarm information corresponding to the risk node;
and sending the risk alarm information to risk management equipment.
6. The node determination method according to any one of claims 1 to 4, characterized in that the method further comprises:
if the address anomaly times are greater than or equal to a preset time threshold, determining the shared node as an anomaly node;
generating abnormal alarm information corresponding to the abnormal node;
and sending the abnormality warning information to an abnormality management device.
7. The node determination method according to any one of claims 1 to 4, characterized in that the method further comprises:
if the sharing score is smaller than or equal to a preset sharing score threshold value, determining the sharing node as an alternative node;
and adding the alternative node to an alternative node list.
8. A computer device, characterized in that it comprises a memory and a processor, on which a computer program is stored which is executable on the processor, which computer program, when being executed by the processor, implements the node determination method according to any of claims 1 to 7.
9. A node determination system, the system comprising:
an obtaining unit, configured to obtain a target internet protocol address and a shared bandwidth of a shared node;
the determining unit is used for determining a risk score of the target internet protocol address according to a preset internet protocol address risk library, and the risk score is used for determining a risk node in the sharing nodes;
the statistics unit is used for counting the abnormal times of the addresses of the sharing nodes in a first preset time period if the risk score is smaller than a preset risk score threshold;
the determining unit is further configured to determine a stability score of the shared node if the number of address anomalies is less than a preset number of thresholds, where the stability score is used to determine stability of the shared node;
a calculation unit, configured to calculate a shared score of the shared nodes according to the stable score and the shared bandwidth, where the shared score is used to determine a high-quality node among the shared nodes;
the determining unit is further configured to determine that the shared node is a high-quality node if the shared score is greater than a preset shared score threshold.
10. A computer-readable storage medium, having stored thereon a computer program executable by one or more processors to implement the node determination method of any of claims 1 to 7.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010197488.7A CN111431764B (en) | 2020-03-19 | 2020-03-19 | Node determining method, device, system and medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010197488.7A CN111431764B (en) | 2020-03-19 | 2020-03-19 | Node determining method, device, system and medium |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN111431764A CN111431764A (en) | 2020-07-17 |
| CN111431764B true CN111431764B (en) | 2023-07-21 |
Family
ID=71549636
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202010197488.7A Active CN111431764B (en) | 2020-03-19 | 2020-03-19 | Node determining method, device, system and medium |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN111431764B (en) |
Families Citing this family (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN113485862B (en) * | 2021-07-13 | 2022-07-15 | 北京三快在线科技有限公司 | Method and device for managing service faults, electronic equipment and storage medium |
Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN105472707A (en) * | 2014-09-09 | 2016-04-06 | 中国移动通信集团公司 | Traffic sharing method and device |
| CN107911334A (en) * | 2017-08-31 | 2018-04-13 | 上海壹账通金融科技有限公司 | Ip address risk monitoring method and application server |
| CN107944602A (en) * | 2017-11-09 | 2018-04-20 | 重庆大学 | The evaluation of cloud manufacturing service and matching process based on trust model |
| CN108768700A (en) * | 2018-05-11 | 2018-11-06 | 北京奇虎科技有限公司 | Reward distribution method, apparatus and system in a kind of block chain |
| CN109688067A (en) * | 2019-01-08 | 2019-04-26 | 深圳市网心科技有限公司 | Based on income distribution method, server and the storage medium for sharing flow |
Family Cites Families (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US6597775B2 (en) * | 2000-09-29 | 2003-07-22 | Fair Isaac Corporation | Self-learning real-time prioritization of telecommunication fraud control actions |
| US8040863B2 (en) * | 2007-05-31 | 2011-10-18 | International Business Machines Corporation | Demand pull and supply push communication methodologies |
| US8874763B2 (en) * | 2010-11-05 | 2014-10-28 | At&T Intellectual Property I, L.P. | Methods, devices and computer program products for actionable alerting of malevolent network addresses based on generalized traffic anomaly analysis of IP address aggregates |
-
2020
- 2020-03-19 CN CN202010197488.7A patent/CN111431764B/en active Active
Patent Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN105472707A (en) * | 2014-09-09 | 2016-04-06 | 中国移动通信集团公司 | Traffic sharing method and device |
| CN107911334A (en) * | 2017-08-31 | 2018-04-13 | 上海壹账通金融科技有限公司 | Ip address risk monitoring method and application server |
| CN107944602A (en) * | 2017-11-09 | 2018-04-20 | 重庆大学 | The evaluation of cloud manufacturing service and matching process based on trust model |
| CN108768700A (en) * | 2018-05-11 | 2018-11-06 | 北京奇虎科技有限公司 | Reward distribution method, apparatus and system in a kind of block chain |
| CN109688067A (en) * | 2019-01-08 | 2019-04-26 | 深圳市网心科技有限公司 | Based on income distribution method, server and the storage medium for sharing flow |
Also Published As
| Publication number | Publication date |
|---|---|
| CN111431764A (en) | 2020-07-17 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| KR102238612B1 (en) | DoS/DDoS attack detection method, device, server and storage medium | |
| CN111786950B (en) | Network security monitoring method, device, equipment and medium based on situation awareness | |
| CN108390856B (en) | DDoS attack detection method and device and electronic equipment | |
| CN115277566B (en) | Load balancing method and device for data access, computer equipment and medium | |
| CN109309735B (en) | Connection processing method, server, system and storage medium | |
| CN111669379B (en) | Behavior abnormity detection method and device | |
| CN113765873A (en) | Method and apparatus for detecting abnormal access traffic | |
| CN114095567A (en) | Data access request processing method and device, computer equipment and medium | |
| CN107819745B (en) | Method and device for defending against abnormal traffic | |
| CN111431764B (en) | Node determining method, device, system and medium | |
| CN111338888A (en) | Data statistical method and device, electronic equipment and storage medium | |
| CN110851334A (en) | Flow statistical method, electronic device, system and medium | |
| CN114157480A (en) | Method, device, equipment and storage medium for determining network attack scheme | |
| CN114091704A (en) | Alarm suppression method and device | |
| US11005797B2 (en) | Method, system and server for removing alerts | |
| CN112130944A (en) | Page abnormity detection method, device, equipment and storage medium | |
| CN116545905A (en) | Service health detection method and device, electronic equipment and storage medium | |
| CN111193804A (en) | Distributed storage method and device, network node and storage medium | |
| CN110971697B (en) | Redis single instance protection processing method and device, computer equipment and storage medium | |
| CN113553074B (en) | Applet distribution control method, device, electronic equipment and storage medium | |
| CN113676531B (en) | E-commerce flow peak clipping method and device, electronic equipment and readable storage medium | |
| CN114661562A (en) | Data warning method, device, equipment and medium | |
| CN111614675B (en) | Request execution method, device, system and medium | |
| CN111753162A (en) | Data crawling method, device, server and storage medium | |
| CN114650252B (en) | Routing method and device based on enterprise service bus and computer equipment |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |