WO2018035765A1

WO2018035765A1 - Method and apparatus for detecting network abnormity

Info

Publication number: WO2018035765A1
Application number: PCT/CN2016/096595
Authority: WO
Inventors: 贾云健; 唐亮; 吴玉成
Original assignee: 深圳天珑无线科技有限公司
Priority date: 2016-08-24
Filing date: 2016-08-24
Publication date: 2018-03-01

Abstract

Provided in the embodiments of the present application are a method and an apparatus for detecting a network abnormity. The method for detecting a network abnormity provided in the embodiments of the present application comprises: detecting the operation state of a network and the state of traffic used by services on a network device, and detecting, according to the operation state of the network and the state of traffic used by the services on the network device, whether a traffic abnormity occurs on the network. The method for detecting a network abnormity provided in the embodiments of the present application can integrate and calculate data detected by different modules in a network management system, automatically and quickly determine whether an abnormity occurs on the network, reducing detection time, and improving sensitivity and accuracy.

Description

Network abnormality detecting method and device

Technical field

The present application relates to the field of Internet communication technologies, and in particular, to a method and device for detecting network anomalies.

Background technique

With the rapid development of science and technology, the Internet has become an important means for users to access various resources and query various information, making the network an important infrastructure in human social life and economic life.

Due to the increasing reliance of users on the network, the traffic utilization rate in the network is increasing, the network load is increasing, and the traffic fluctuations are increasingly frequent. Fluctuations in traffic in the network occur frequently, and fluctuations in traffic are generally divided into normal fluctuations and abnormal fluctuations. Normal fluctuations are usually caused by an increase in users in the network or an increase in business usage. This kind of fluctuation is relatively stable and shows an upward trend. As long as the processing is timely, normal fluctuations in traffic will not compromise the stability and security of the network.

However, when traffic in the network fluctuates abnormally in a short period of time, huge traffic may be generated, and even network congestion may occur. In the prior art, methods for quickly identifying the cause of abnormal fluctuations in traffic depend on manual judgment. It is easy to cause problems with low sensitivity and accuracy.

Application content

The present invention provides a method and device for detecting network anomalies. By monitoring various network devices in the network, detecting whether a traffic abnormality occurs in the network, reducing the detection time, and improving the sensitivity and accuracy of the detection.

The embodiment of the present application provides a method for detecting a network abnormality, including:

Detecting the running status of the network and the traffic status used by the services on the network device;

Detecting whether a traffic abnormality occurs in the network according to the running state of the network and the traffic state used by the service on the network device.

Further, in the above method, the network running status includes:

The traffic of the physical link in the network changes, the state of the network devices in the network, and the source of traffic for each IP address.

Further, in the foregoing method, detecting, according to the running status of the network and the traffic status used by the service on the network device, whether the network abnormality occurs, including:

When all the following conditions are met, the traffic abnormality of the network is detected:

The traffic increase of the physical link in the network does not exceed a preset traffic threshold within a specified duration;

The network device operates in the network changes;

Traffic flowing to the same IP address is normal; and,

The traffic used by the services on the network device is reduced.

When at least one of the following conditions is not satisfied, it is detected that no traffic abnormality occurs in the network:

The network device operates in the network changes;

Traffic flowing to the same IP address is normal; and,

The traffic used by the services on the network device is reduced.

Further, in the above method, the method further includes:

When it is detected that the network is abnormal in traffic, it is determined that there is a network device in the network that is faulty.

The embodiment of the present application further provides a network abnormality detecting apparatus, including:

The network monitoring module detects the running status of the network and the traffic status used by the service on the network device;

The abnormality identifying module detects whether a traffic abnormality occurs in the network according to the running state of the network and the traffic state used by the service on the network device.

Further, in the foregoing apparatus, the network running status includes:

The traffic of the physical link in the network changes, the state of the network device in the network, and each The source of traffic for the IP address.

Further, in the above device, the abnormality identification module is specifically configured to:

The network device operates in the network changes;

Traffic flowing to the same IP address is normal;

The traffic used by the services on the network device is reduced.

The network device operates in the network changes;

Traffic flowing to the same IP address is normal;

The traffic used by the services on the network device is reduced.

Further, in the above device, the device further includes:

And a type identifying module, configured to determine that a network device that has failed in the network is detected when a traffic abnormality occurs in the network.

The embodiment of the present invention provides a method and a device for detecting a network abnormality, which is determined by detecting the running state of the network and the number of users using the network, and determining whether the network has abnormal traffic according to the running state of the network and the traffic state used by the service on the network device. The technical solution can integrate and calculate the data detected by different modules in the network management system, automatically determine whether the network has abnormal traffic, reduce the detection time, improve the sensitivity and accuracy, and solve the prior art. The method for identifying network anomalies caused by abnormal traffic is mostly dependent on manual judgment, which is likely to cause problems of low sensitivity, low accuracy, and long detection time.

DRAWINGS

In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will be The drawings used in the embodiments or the description of the prior art are briefly introduced. It is obvious that the drawings in the following description are some embodiments of the present application, and no one is creative to those skilled in the art. Other drawings can also be obtained from these drawings on the premise of labor.

1 is a schematic flowchart of Embodiment 1 of a method for detecting network anomaly provided by the present application;

2 is an application scenario diagram of Embodiment 1 of a method for detecting network anomaly according to the present application;

FIG. 3 is a schematic flowchart of Embodiment 2 of a method for detecting network anomaly according to the present application;

4 is a schematic structural diagram of Embodiment 1 of a network abnormality detecting apparatus provided by the present application;

FIG. 5 is a schematic structural diagram of Embodiment 2 of a device for detecting network anomaly according to the present application.

detailed description

The technical solutions in the embodiments of the present application are clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present application. It is a part of the embodiments of the present application, and not all of the embodiments. All other embodiments obtained by a person of ordinary skill in the art based on the embodiments of the present application without departing from the inventive scope are the scope of the present application.

Embodiment 1

FIG. 1 is a schematic flowchart of Embodiment 1 of a network abnormality detecting method provided by the present application, and FIG. 2 is a schematic application diagram of Embodiment 1 of a network abnormality detecting method provided by the present application, as shown in FIG. 1 and FIG. The method for detecting a network abnormality provided by the embodiment may include the following steps:

101. Detect the running status of the network and the traffic status used by the service on the network device.

In order to automatically detect whether an abnormality occurs in the network, a method for detecting a network abnormality that can be applied to the network management system is provided in the embodiment of the present application, so as to automatically detect whether an abnormality occurs in the network by using the network management system.

In the embodiment of the present application, as shown in FIG. 2, the network management system may include a network real-time status monitoring system, a network analysis system, and a DPI (Deep Packet Inspection) system.

The network real-time status monitoring system can monitor all network devices in the network, obtain information of all network devices, real-time traffic of physical links, and network topology. The DPI system can identify the data flow in the physical link in the network to obtain the source and flow of the traffic. The flow can also be carried out for business or type analysis. The network analysis system can monitor whether the number of users changes, IP address utilization changes, traffic history data, and so on.

In the embodiment of the present application, the data information is obtained through the network management system, and the obtained data information is analyzed and calculated, and the analysis and calculation results can reflect the real-time running state of the network, thereby detecting whether an abnormality occurs in the network.

Specifically, in the embodiment of the present application, the network running status may include, but is not limited to:

The traffic of the physical link in the network changes;

The state of the network device in the network;

The source of traffic for each IP address.

In a specific implementation process, the traffic change of the physical link in the network can be monitored by the network real-time state monitoring system. The state of the network device in the network can be monitored by the network real-time state monitoring system, and the traffic source of each IP address can be Monitoring through the DPI system, the number of users using the network can be monitored and statistically analyzed by the network analysis system.

The network management system can perform real-time calculation and analysis on the network real-time status monitoring system, the data information monitored by the DPI system about the network running status, the number of users using the network analyzed by the network analysis system, and update the corresponding results in real time.

102. Detect whether the network has abnormal traffic according to the running status of the network and the traffic status used by the service on the network device.

When a network device in the network runs for a period of time, it may fail due to hardware loss, etc., which directly affects the running state of the network device, which may cause network traffic to fluctuate, or when other network devices attack the network device in the network. In the embodiment of the present application, the network management system performs real-time calculation and analysis on the network running status and the traffic status used by the service on the network device, and detects whether the network generates traffic. abnormal.

In the embodiment of the present application, when all the following conditions are met, the network abnormality is detected:

The network device operates in the network changes;

Traffic flowing to the same IP address is normal;

The traffic used by the services on the network device is reduced.

It should be noted that the network real-time status monitoring system can monitor and store the monitoring result of the physical link in the network, and the stored address can be in the database of the network analysis system, or It is a server in the network and can also be uploaded to the database of the network management system.

It can be understood that the network management system determines whether the traffic increase of the physical link in the network exceeds a preset traffic threshold within a specified duration. In a specific implementation process, the method for judging may be: calculating the traffic increase of the physical link in the network within a specified duration of the monitoring, and then comparing the traffic increase with the preset traffic threshold. If the traffic increase of the physical link in the network is greater than or equal to the traffic threshold, the network may be abnormal. If the traffic of the physical link in the network is smaller than the traffic threshold, the network may not be detected. The traffic is abnormal.

For example, if the specified duration is 5 seconds, the traffic threshold is 80%, and the monitoring time is 8:00:00, if the traffic of the physical link in the network increases by more than 8:00:00 to 8:00:05. Or it is equal to 30% of the normal traffic value of the physical link in the network corresponding to the monitoring time. That is, it can be determined that no traffic abnormality occurs on the network.

It should be noted that the operation of the network device in the network may be changed by the running status of each network device in the network monitored by the network real-time state monitoring system. The running state of the network device includes a fault or stops running, and the network state real-time monitoring system An alarm is generated for the device status change, and the IP address of the faulty device is unreachable.

Traffic flowing to the same IP address can be understood as the number of packets sent by the user to the same IP address is less than the preset number threshold.

The traffic reduction used by the service on the network device can be understood as the number of traffic drops of the physical link connected to the network device within a specified duration exceeds the drop threshold or falls to zero.

In the embodiment of the present application, it is considered that when the above four conditions are satisfied simultaneously within a specified time period, the network abnormality may be detected.

Similarly, when at least one of the above four conditions is not satisfied, it is detected that no traffic abnormality occurs in the network.

The embodiment of the present application provides a network abnormality detecting method, which is configured to detect a network running state and a number of users using a network, where the network running state may include a traffic change of a physical link in the network, a state of the network device in the network, and each IP address traffic source, then based on The network running status and the traffic status used by the service on the network device to determine whether the network has abnormal traffic. This technical solution can integrate and calculate the data detected by different modules in the network management system, and automatically detect whether the network is abnormal. Quickly judge, reduce the detection time, improve the sensitivity and accuracy, and solve the prior art methods for identifying network anomalies caused by abnormal traffic, relying on manual judgment, which is easy to cause lower sensitivity and lower accuracy. And the problem of long detection time.

Embodiment 2

FIG. 3 is a schematic flowchart of a method for detecting a network abnormality according to a second embodiment of the present invention. As shown in FIG. 3, the method for detecting a network abnormality provided by the embodiment of the present application may include the following steps:

201. Detect a network running state and a traffic state used by a service on the network device.

In the embodiment of the present application, the specific process of step 201 is described in detail in step 101 in the foregoing embodiment. The principle and implementation process in the embodiment of the present application are the same, and details are not described herein again.

202. Detect whether the network has abnormal traffic according to the running state of the network and the traffic state used by the service on the network device.

In the embodiment of the present application, the specific process of step 202 is described in detail in step 102 in the foregoing embodiment. The principle and implementation process in the embodiment of the present application are the same, and details are not described herein again.

203. When it is detected that a traffic abnormality occurs in the network, determine that the network device that is faulty exists in the network.

In the embodiment of the present application, the cause of the traffic abnormality may be that the network device is faulty, such as the device hardware alarm, the IP unreachable, or the like, or may be caused by other devices actively attacking the network device in the network.

When the traffic of the physical link in the network is within the traffic threshold and the traffic to the same IP address is normal, the probability that other devices actively attack the network devices in the network is low. Moreover, the operation of the network device in the network changes, such as the alarm that the network status real-time monitoring system sends a network device status change, and because the IP address of the faulty device is unreachable, the data packet sent by the user to the IP address cannot be received, resulting in the network. The traffic used by the business on the device is reduced. Therefore, in the embodiment of the present application, when it is detected that the traffic abnormality occurs in the network, it may be determined that the traffic abnormality caused by the network is caused by a network device failure in the network.

The embodiment of the present application provides a network abnormality detecting method, which is configured to detect a network running state and a number of users using a network, where the network running state may include a traffic change of a physical link in the network, a state of the network device in the network, and each The traffic source of the IP address can be determined to be a network abnormality caused by a network device failure in the network after the traffic abnormal state is determined, and the network device is faulty. The data detected by different modules in the network management system is integrated and calculated, which automatically determines whether the network is abnormal or not, improves the reliability of the network, reduces the detection time, improves the sensitivity and accuracy, and solves the existing In the technology, the method for identifying network anomalies caused by abnormal traffic is mostly dependent on manual judgment, which is likely to cause problems of low sensitivity, low accuracy, and long detection time.

Embodiment 3

FIG. 4 is a schematic structural diagram of Embodiment 1 of a network abnormality detecting apparatus provided by the present application. As shown in FIG. 4, the network abnormality detecting apparatus provided by the embodiment of the present application may include: a network monitoring module 11 and an abnormality identifying module 12.

The network monitoring module 11 detects the running status of the network and the traffic status used by the service on the network device;

The abnormality identification module 12 detects whether the network has abnormal traffic according to the network running status monitored by the network monitoring module 11 and the traffic status used by the service on the network device.

Specifically, in the embodiment of the present application, the network running status includes:

The change in traffic of physical links in the network, the state of network devices in the network, and the source of traffic for each IP address.

In the embodiment of the present application, the abnormality identification module 12 is specifically configured to:

A traffic anomaly on the network is detected when all of the following conditions are met:

The network device operates in the network changes;

Traffic flowing to the same IP address is normal;

The traffic used by the services on the network device is reduced.

When at least one of the following conditions is not met, it is detected that no traffic abnormality occurs in the network:

The network device operates in the network changes;

Traffic flowing to the same IP address is normal;

The traffic used by the services on the network device is reduced.

The device in this embodiment may be used to implement the technical solution of the method embodiment shown in FIG. 1 , and the implementation principle and technical effects are similar, and details are not described herein again.

Embodiment 4

FIG. 5 is a schematic structural diagram of a second embodiment of a network abnormality detecting apparatus according to the present application. As shown in FIG. 5, the network abnormality detecting apparatus provided by the embodiment of the present application may further include: a type according to the foregoing third embodiment. The module module 13 is identified.

The type identification module module 13 is configured to determine that a network device that has a fault exists in the network when the network detecting module 12 detects that a traffic abnormality occurs in the network.

The device in this embodiment may be used to implement the technical solution of the method embodiment shown in FIG. 3, and the implementation principle and technical effects are similar, and details are not described herein again.

One of ordinary skill in the art will appreciate that all or part of the steps to implement the various method embodiments described above may be accomplished by hardware associated with the program instructions. The aforementioned program can be stored in a computer readable storage medium. The program, when executed, performs the steps including the foregoing method embodiments; and the foregoing storage medium includes various media that can store program codes, such as a ROM, a RAM, a magnetic disk, or an optical disk.

The device embodiments described above are merely illustrative, wherein the units illustrated as separate components may or may not be physically separate, and the components displayed as units may or may not be physical units, ie may be located in one place. Or it can be distributed to at least two network elements. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of the embodiment. Those of ordinary skill in the art can understand and implement without deliberate labor.

Finally, it should be noted that the above embodiments are only used to illustrate the technical solution of the present application, and not The present invention has been described in detail with reference to the foregoing embodiments, and those skilled in the art should understand that the technical solutions described in the foregoing embodiments may be modified, or some or all of the technologies may be modified. The features are equivalently substituted; and the modifications or substitutions do not detract from the essence of the technical solutions of the embodiments of the present application.

Claims

A method for detecting network anomalies, comprising:

Detecting the running status of the network and the traffic status used by the services on the network device;

Detecting whether a traffic abnormality occurs in the network according to the running state of the network and the traffic state used by the service on the network device.
The method of claim 1, wherein the network operating state comprises:

The traffic of the physical link in the network changes, the state of the network devices in the network, and the source of traffic for each IP address.
The method according to claim 2, wherein detecting whether the network has abnormal traffic occurs according to the network operating state and the traffic state used by the service on the network device, including:

When all the following conditions are met, the traffic abnormality of the network is detected:

The traffic increase of the physical link in the network does not exceed a preset traffic threshold within a specified duration;

The network device operates in the network changes;

Traffic flowing to the same IP address is normal; and,

The traffic used by the services on the network device is reduced.
The method according to claim 2, wherein detecting whether the network has abnormal traffic occurs according to the network operating state and the traffic state used by the service on the network device, including:

When at least one of the following conditions is not satisfied, it is detected that no traffic abnormality occurs in the network:

The traffic increase of the physical link in the network does not exceed a preset traffic threshold within a specified duration;

The network device operates in the network changes;

Traffic flowing to the same IP address is normal; and,

The traffic used by the services on the network device is reduced.
The method according to any one of claims 1 to 3, further comprising:

When it is detected that the network is abnormal in traffic, it is determined that there is a network device in the network that is faulty.
A device for detecting network anomalies, comprising:

The network monitoring module detects the running status of the network and the traffic status used by the service on the network device;

The abnormality identifying module detects whether a traffic abnormality occurs in the network according to the running state of the network and the traffic state used by the service on the network device.
The device according to claim 6, wherein the network operating state comprises:

The traffic of the physical link in the network changes, the state of the network devices in the network, and the source of traffic for each IP address.
The device according to claim 7, wherein the abnormality identifying module is specifically configured to:

When all the following conditions are met, the traffic abnormality of the network is detected:

The traffic increase of the physical link in the network does not exceed a preset traffic threshold within a specified duration;

The network device operates in the network changes;

Traffic flowing to the same IP address is normal;

The traffic used by the services on the network device is reduced.
The device according to claim 7, wherein the abnormality identifying module is specifically configured to:

When at least one of the following conditions is not satisfied, it is detected that no traffic abnormality occurs in the network:

The traffic increase of the physical link in the network does not exceed a preset traffic threshold within a specified duration;

The network device operates in the network changes;

Traffic flowing to the same IP address is normal;

The traffic used by the services on the network device is reduced.
The device according to any one of claims 6 to 8, wherein the device further comprises:

And a type identifying module, configured to determine that a network device that has failed in the network is detected when a traffic abnormality occurs in the network.