CN101155085A - Method and device for real-time flux prediction and real-time flux monitoring and early warning - Google Patents
Method and device for real-time flux prediction and real-time flux monitoring and early warning Download PDFInfo
- Publication number
- CN101155085A CN101155085A CNA2006101524461A CN200610152446A CN101155085A CN 101155085 A CN101155085 A CN 101155085A CN A2006101524461 A CNA2006101524461 A CN A2006101524461A CN 200610152446 A CN200610152446 A CN 200610152446A CN 101155085 A CN101155085 A CN 101155085A
- Authority
- CN
- China
- Prior art keywords
- flow
- period demand
- mean value
- real
- link
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Images
Abstract
The invention provides a method and device for predicting the real-time flux and a method and device for monitoring and alarming the real-time flux. The method for predicting the real-time flux comprises the following steps: step S102 of obtaining the real-time flux information in given cycle from port or link and determining an average of flux in given cycle and an average of flux at a special time in given cycle; step S104 of setting a first weight for the average of flux in given cycle based on flux characteristic of different service and setting a second weight for the average of flux at a special time in given cycle, based on flux characteristic of different service; and step S106 of weighted averaging the average of flux in given cycle and the average of flux at a special time in given cycle to obtain the predicted flux of port or link at a special time in given cycle.
Description
Technical field
The present invention relates to the network traffics analysis technical field, particularly a kind of real-time traffic Forecasting Methodology and real-time traffic detect method for early warning and device.
Background technology
Discharge model is all extremely important for the unusual discovery of network performance analysis, network planning design, Network Load Balance and network, is the basis of designing high-efficiency network, also is the prerequisite that improves network service quality, guarantees network security stable operation.Growing along with internet, applications, network size is also increasing, and the operation conditions of network and contingent problem all become the problem that people more and more are concerned about.
Discharge model is in the past used for reference the discharge model of PSTN network mostly, adopts the discharge model of data of description network with the Poisson model, also is referred to as classical model, and its three main hypothesis is:
1. the time interval of data source generation flow is that index distributes, and the generation that is to say packet is a Poisson process.
2. data source generates the length of data package obeys index distribution of flow at every turn.
3. the generation time of packet is separate with the length of wrapping at interval.
According to the hypothesis of this discharge model, along with the increase of data source, network traffics will be smooth-out on the convergence-level port/link, and integrated flow is with average flow value of convergence, and these actual conditions with present data network do not meet.The size of packet and the network carrying professional closely-related, cause networks of different type to be used different traffic characteristics is arranged, the continuous expansion of network size simultaneously, the continuous increase of number of network node also makes this model no longer be applicable to the traffic characteristic of analyzing data network.Though the discharge model of a lot of other types had appearred afterwards, and often too complicated, be not suitable for on-line monitoring and early warning at flow.
Discharge model is the description about the traffic characteristic of data network, it is by predicting network traffics the discovery of flow statistical property, this method can be used for the trend of phase-split network flow, but the situation of present method real-time analysis current network flow well can not find timely that the network operation is unusual.
Therefore, need a kind ofly, and, can solve the problem in the above-mentioned correlation technique based on the solution of the flow detection real-time early warning technology of flow benchmark and adaptive threshold at present network operation and the new real-time traffic Forecasting Methodology that presses for.
Summary of the invention
The present invention aims to provide a kind of real-time traffic Forecasting Methodology and a kind of real-time traffic monitoring and warning technical solution, can solve discharge model complexity in the above-mentioned correlation technique, can not in time find problems such as the network operation is unusual.
According to an aspect of the present invention, a kind of real-time traffic Forecasting Methodology is provided, be used for predicting in real time the flow of port or link, this method may further comprise the steps: step S102, obtain real-time traffic information in period demand from port or link, and determine the mean value of the flow in period demand and in period demand a certain particular moment flow mean value; Step S104 is that the mean value of flow in the period demand is provided with first weight according to the flow characteristics of different business, and in the period demand a certain particular moment flow mean value set second weight; And step S106, in the mean value of flow in the period demand and the period demand a certain particular moment flow mean value be weighted on average, to obtain the predicted flow rate of in period demand a certain moment port or link.
In above-mentioned real-time traffic detection method, first weight and second weight are 1.
According to another aspect of the present invention, a kind of real-time traffic monitoring and pre-alarming method is provided, this method may further comprise the steps: step S202, by obtain the flow information of period demand inner port or link from port or link, and in flow mean value in definite period demand and the period demand a certain particular moment flow mean value, the weighted average that calculates the two is to obtain the predicted flow rate of a certain moment port or link; Step S204, set the flow upper limit and flux lower limit and alarm action wherein, be limited to predicted flow rate and target offset amount sum on the flow, flux lower limit is the poor of predicted flow rate and target offset amount, but this flow upper limit and lower limit are the adjustment of benchmark self adaptation with the predicted flow rate; And step S206, in real time the current actual flow of port or link and predicted flow rate with the preceding moment are compared, carry out the alarm action greater than the flow upper limit or under at current actual flow less than the situation of flux lower limit.
In above-mentioned real-time traffic alarming method by monitoring, step S202 may further comprise the steps: step S202-2, from port or link obtains the mean value of flow in period demand and in period demand a certain particular moment flow mean value; Step S202-4 is that the mean value of flow in the period demand is provided with first weight according to the flow characteristics of different business, and in the period demand a certain particular moment flow mean value set second weight; Step S202-6, in the mean value of flow in the period demand and the period demand a certain particular moment flow mean value be weighted on average, to obtain the predicted flow rate of in period demand a certain moment port or link.
In above-mentioned real-time traffic alarming method by monitoring, first weight and second weight are 1.
In above-mentioned real-time traffic detection method, in step S206, the data of the mark excess flow upper limit and flux lower limit, and generate the abnormal flow form.
According to another aspect of the present invention, a kind of real-time traffic prediction unit is provided, be used for predicting in real time the flow of each moment port or link, comprise: the flow acquiring unit, be used for obtaining flow information in period demand from port or link, and determine the mean value of the flow in the period demand and in period demand a certain particular moment flow mean value; Weighted units, the flow characteristics according to different business of being used for are that the mean value of flow in the period demand is provided with first weight, and in the period demand a certain particular moment flow mean value set second weight; And the volume forecasting unit, be used in the mean value of flow in the period demand and the period demand a certain particular moment flow mean value be weighted on average, to obtain the predicted flow rate of in period demand a certain moment port or link.
In above-mentioned real-time traffic prediction unit, first weight and second weight are 1.
According to another aspect of the present invention, a kind of real-time traffic monitoring and warning device is provided, comprise: the volume forecasting module, the mean value calculation weighted average that is used for the flow information by obtaining period demand inner port or link from port or link and determines the flow of a certain particular moment in flow mean value and the period demand is predicted the flow of a certain moment port or link; Traffic threshold is provided with module, is used to set the flow upper limit and flux lower limit and alarm action, wherein, is limited to predicted flow rate and target offset amount sum on the flow, and flux lower limit is the poor of predicted flow rate and target offset amount; But this flow upper limit and lower limit are the adjustment of benchmark self adaptation with the predicted flow rate, and flow monitoring module, be used in real time the current actual flow of port or link and the predicted flow rate of current time being compared, carry out the alarm action greater than the flow upper limit or under less than the situation of flux lower limit at current actual flow.
In above-mentioned real-time traffic monitoring and warning device, the volume forecasting module comprises: the flow acquiring unit, be used for from port or link obtain the flow information of period demand inner port or link and determine the mean value of flow in period demand and in period demand a certain particular moment flow mean value; Weighted units, the flow characteristics according to different business of being used for are that the mean value of flow in the period demand is provided with first weight, and in the period demand a certain particular moment flow mean value set second weight; The volume forecasting unit, be used in the mean value of flow in the period demand and the period demand a certain particular moment flow mean value be weighted on average, to obtain described port or link predicted flow rate at a time in period demand.
In above-mentioned real-time traffic monitoring and warning device, first weight and described second weight are 1.
In above-mentioned real-time traffic monitoring and warning device, the data of the flow detection unit mark excess flow upper limit and flux lower limit, and generate the abnormal flow form.
By technique scheme, the present invention has realized following technique effect:
1) adopts the method for the invention, broken through the method for traditional flow monitoring and early warning.In traditional flow monitoring and method for early warning, adopt the mode of fixed threshold that flow is carried out early warning, can not well embody the time dependent characteristic of service traffics, the management of bandwidth and flow is adopted the mode of coarseness.And the mode that the present invention adopts is that benchmark is monitored and early warning flow with the discharge model, thresholding carries out the self adaptation adjustment with benchmark model, the time dependent characteristic of service traffics can be embodied preferably, fine granularity management can be realized preferably bandwidth and flow.
2) additive method of the more current proposition of real-time traffic Forecasting Methodology proposed by the invention has more realizability, simultaneously owing to adopted the real-time update strategy, discharge model has had the learning ability of self, makes model can improve constantly the predicting network flow precision.The definition of discharge model combining adaptive thresholding is for the time dependent real-time monitoring of network traffics and early warning provide foundation, for finding that in time the network operation is unusual, guarantee that network service quality provides assurance.Contrast according to discharge model and the data on flows that collects generates form in addition, and abnormal data comes into plain view, and is to analyze to adjust network operation parameter, and the optimization network configuration provides foundation.
Other features and advantages of the present invention will be set forth in the following description, and, partly from specification, become apparent, perhaps understand by implementing the present invention.Purpose of the present invention and other advantages can realize and obtain by specifically noted structure in the specification of being write, claims and accompanying drawing.
Description of drawings
Accompanying drawing described herein is used to provide further understanding of the present invention, constitutes the application's a part, and illustrative examples of the present invention and explanation thereof are used to explain the present invention, do not constitute improper qualification of the present invention.In the accompanying drawings:
Fig. 1 illustrates the flow chart according to real-time traffic Forecasting Methodology of the present invention;
Fig. 2 illustrates the flow chart according to real-time traffic monitoring and pre-alarming method of the present invention;
Fig. 2 illustrates the block diagram according to real-time traffic prediction unit of the present invention;
Fig. 4 illustrates the block diagram according to real-time traffic monitoring and warning device of the present invention;
Fig. 5 illustrates the flow chart according to the adaptive threshold early warning technology based on the flow benchmark of the present invention;
Fig. 6 illustrates the schematic diagram that use SNMP according to an embodiment of the invention carries out flow collection; And
Fig. 7 illustrates the flow chart of the adaptive threshold early warning technology based on real-time traffic prediction according to an embodiment of the invention.
Embodiment
Below with reference to the accompanying drawings and in conjunction with the embodiments, describe the present invention in detail.
Fig. 1 illustrates the flow chart according to real-time traffic Forecasting Methodology of the present invention.As shown in Figure 1, be used for predicting in real time that according to of the present invention the real-time traffic Forecasting Methodology of port or link may further comprise the steps:
Step S102 obtains real-time traffic information in period demand from port or link, and determine the mean value of the flow in period demand and in period demand a certain particular moment flow mean value;
Step S104 is that the mean value of flow in the period demand is provided with first weight according to the flow characteristics of different business, and in the period demand a certain particular moment flow mean value set second weight; And
Step S106, in the mean value of flow in the period demand and the period demand a certain particular moment flow mean value be weighted on average, to obtain the predicted flow rate of in period demand a certain moment port or link.
In above-mentioned real-time traffic detection method, first weight and second weight are 1.
Fig. 2 illustrates the flow chart according to real-time traffic alarming method by monitoring of the present invention.As shown in Figure 2, real-time traffic monitoring and pre-alarming method according to the present invention may further comprise the steps:
Step S202, the flow information by obtaining period demand inner port or link from port or link and determine flow mean value in the period demand and period demand in a certain particular moment flow the mean value calculation weighted average obtain the predicted flow rate of a certain moment port or link;
Step S204, set the flow upper limit and flux lower limit and alarm action, wherein, be limited to predicted flow rate and target offset amount sum on the flow, flux lower limit is the poor of predicted flow rate and target offset amount, but this flow upper limit and lower limit are the adjustment of benchmark self adaptation with the predicted flow rate; And
Step S206 falls the current actual flow of port or link and the predicted flow rate of current time in real time and compares, and carries out the alarm action greater than the flow upper limit or under less than the situation of flux lower limit at current actual flow,
In above-mentioned real-time traffic alarming method by monitoring, step S202 may further comprise the steps:
Step S202-2, from port or link obtains the mean value of flow in period demand and in period demand a certain particular moment flow mean value;
Step S202-4 is that the mean value of flow in the period demand is provided with first weight according to the flow characteristics of different business, and in the period demand a certain particular moment flow mean value set second weight;
Step S202-6, in the mean value of flow in the period demand and the period demand a certain particular moment flow mean value be weighted on average, to obtain the predicted flow rate of in period demand a certain moment port or link
In above-mentioned real-time traffic monitoring and pre-alarming method, first weight and second weight are 1.In step S206, the data of the mark excess flow upper limit and flux lower limit, and generate the abnormal flow form.
Fig. 3 illustrates the block diagram according to real-time traffic prediction unit of the present invention.As shown in Figure 3, be used for predicting in real time that according to of the present invention the real-time traffic prediction unit 300 of port or link comprises:
Flow acquiring unit 302 is used for obtaining flow information in period demand from port or link, and determine the mean value of the flow in the period demand and in period demand a certain particular moment flow mean value;
Volume forecasting unit 306, be used in the mean value of flow in the period demand and the period demand a certain particular moment flow mean value be weighted on average, to obtain the predicted flow rate of in period demand a certain moment port or link.
In above-mentioned real-time traffic prediction unit, first weight and second weight are 1.
Fig. 4 illustrates the block diagram according to real-time traffic monitoring alarm of the present invention.As shown in Figure 4, real-time traffic monitoring and warning device according to the present invention comprises:
Volume forecasting module 402 is used for the flow information by obtaining period demand inner port or link from port or link and determines that the mean value calculation weighted average of the flow of a certain particular moment in flow mean value and the period demand obtains the predicted flow rate of a certain moment port or link;
Traffic threshold is provided with module 404, be used to set the flow upper limit and flux lower limit and alarm action, wherein, be limited to predicted flow rate and target offset amount sum on the flow, flux lower limit is the poor of predicted flow rate and target offset amount, but this flow upper limit and lower limit are the adjustment of benchmark self adaptation with the predicted flow rate; And
In above-mentioned real-time traffic monitoring and warning device, volume forecasting module 402 comprises:
Flow acquiring unit 402-2, be used for from port or link obtain the flow information of period demand inner port or link and determine the mean value of flow in period demand and in period demand a certain particular moment flow mean value;
Weighted units 402-4, the flow characteristics according to different business of being used for are that the mean value of flow in the period demand is provided with first weight, and in the period demand a certain particular moment flow mean value set second weight.
Volume forecasting unit 402--6, be used in the mean value of flow in the period demand and the period demand a certain particular moment flow mean value be weighted on average, to obtain the predicted flow rate of in period demand described a certain moment port or link.
In above-mentioned real-time traffic monitoring and warning device, first weight and described second weight are 1.
In above-mentioned real-time traffic monitoring and warning device, the data of the flow detection unit mark excess flow upper limit and flux lower limit, and generate the abnormal flow form.
Describe in detail according to embodiments of the invention to Fig. 7 below in conjunction with Fig. 5.
The object of the present invention is to provide a kind of new flow real-time early warning monitoring technology, solved following two problems:
(1), produces the network traffics benchmark model by statistical analysis to the average characteristics and the burst characteristic of network traffics; And
(2) based on the real-time monitoring and the early warning of the network traffics of benchmark model.
The present invention includes two major parts: real-time traffic Forecasting Methodology and based on the adaptive threshold early warning technology of real-time traffic Forecasting Methodology.
(1) discover method of discharge model:
Network traffics have temporal characteristics, flow is at a time followed two characteristics: burst characteristic and statistical average characteristic, based on above hypothesis, the data on flows that this method collected certain one-period is handled, the component that flow is divided into two time correlations, first is the average weight of the data on flows in a certain collection period, and another is the characteristic time component of particular point in time, and the data of these two components can obtain from the data on flows computation of mean values that periodically collects.The concrete available following formulate of this discharge model:
τ
t(i，j)＝(α(i，j)+β
t(i，j))/2 (1)
Wherein, (i, j) representative begins to a sampling period of j end, τ from i
t(i j) represents according to ((i j) represents the average discharge component to α, i.e. (i, the j) mean value of flow in the cycle, β for i, j) t predicted flow rate constantly in 24 hours of the computation of Period acquisition
t(i j) represents the characteristic time flow component, i.e. (i, j) mean value of all t moment datas on flows in the cycle.Because the network application situation difference in the different moment, cause different flows constantly to exist more different, therefore the flow component that on the basis of average discharge, adds particular moment again weighted average (herein in order to simplify, adopted equivalent average mode, promptly divided by 2 mode), flow that can a certain moment of better prediction, wherein α (i, j) embodied the statistical average characteristic of flow, β
t(i j) has embodied flow in t burst characteristic constantly.
This more general discharge model expression formula can be used formula (2) expression:
τ
t(i，j)＝(μ
1α(i，j)+μ
2β
t(i，j))/(μ
1+μ
2) (2)
Wherein, μ
1And μ
2Be two weighted factors, can select corresponding weights at the flow characteristics of different business, thereby better embody the service traffics characteristic.
This real-time traffic Forecasting Methodology is applied to can find preferably in the traffic statistics of the traffic statistics of port/link or VPN the traffic characteristic model of certain port/link, certain VPN, especially predict for the real-time traffic of the relatively-stationary bearer network link/VPN of loaded service type, have higher precision, can fully find the discharge characteristic that this is professional.
(2) based on the adaptive threshold early warning technology of flow benchmark
According to above-mentioned real-time traffic Forecasting Methodology, whether this discharge model of discharge model that can generate in certain cycle (as every day or specify when busy) to weigh present flow rate normal if can be used as benchmark, by this benchmark and present flow rate are compared, flow and send alarm can note abnormalities rapidly.
Present flow rate and benchmark compared threshold value (comprising upper and lower thresholding) need be set, the method to set up of this thresholding and traditional threshold setting mode difference are that this thresholding is not fixed, but as a departure Δ, at benchmark model (τ
tCarry out the self adaptation adjustment on (i, j)), though promptly the departure Δ is fixed, because benchmark model τ
tTherefore (i is time dependent j), acts on adaptive threshold on the benchmark and also be dynamic change in time, adaptive threshold δ
t=τ
t(i, j)+Δ, surmount adaptive threshold δ at current t flow constantly
tScope, will produce alarm.
With reference to Fig. 5, the idiographic flow of this embodiment is as follows:
Step S502 adopts the method for definition in the formula (1) to calculate discharge model according to the data on flows that collects;
Step S504, the alarm action that thresholding is set and takes;
Step S506 according to the data on flows that collects, upgrades discharge model in these data constantly.Whether this step can be selected to implement when specific implementation, has guaranteed then that as implementing this discharge model has the characteristic that dynamically updates, and the discharge model of discovery embodies up-to-date discharge characteristic.Do not select to realize that then the discharge model of Fa Xianing keeps relative stability.
Step S508 subtracts each other the data in this moment in present flow rate data and the discharge model, and according to difference and threshold value contrast, the data that exceed threshold value are made mark, and alarm according to the action of thresholding definition.
An important aspect of the present invention is the real-time estimate flow, sets up discharge model, owing to adopted the method for simplifying, makes model data to generate fast, for real-time monitoring provides the foundation.This model is along with the continuous collection of data on flows and add the calculating of model in addition, and the continuous model of correction own improves the precision of prediction of model.
Another key of the present invention is to have realized monitoring in real time and early warning based on the flow of changes in flow rate characteristic according to discharge model.By contrasting corresponding data on flows constantly in current data on flows that collects and the discharge model, mark the data on flows that exceeds thresholding, and carry out alarming processing according to the action that defines in the thresholding.
The present invention is based on the embodiment of the adaptive threshold technology of real-time traffic prediction below in conjunction with Fig. 6 and Fig. 7 explanation.Fig. 6 illustrates the schematic diagram that use SNMP according to an embodiment of the invention carries out flow collection.Fig. 7 illustrates the flow chart of the adaptive threshold early warning technology based on real-time traffic prediction according to an embodiment of the invention.
Data on flows among this embodiment adopts mode shown in Figure 6, pass through snmp protocol by network management system, regularly gather and be kept in the database in equipment, the real-time traffic predicting subsystem in the network management system is according to the discharge model of these historical data on flows dynamic calculation/each port/link/VPN of renewal.Idiographic flow is as shown in Figure 7:
Step S702 according to principle shown in Fig. 6, gathers flow and preservation;
Step S704 according to formula (1), carries out statistical analysis to the historical data on flows that collects to step S706, finds the discharge model of each port/link/VPN.
Step S708 is to step S710, calculate discharge model after, utilize the new data on flows that at every turn collects to upgrade discharge model.Discharge model after the renewal will compare as flow benchmark and present flow rate.
Step S712 takes the action of needs after need defining the permission fluctuation range of a flow value and exceed this scope during the definition thresholding.This thresholding is a departure, and it is to act on a time dependent adaptive threshold on the benchmark model.
Step S714, collect present flow rate at every turn after, with this current flow with and the flow benchmark model in the data in this moment make comparisons, if their difference has surpassed the scope that thresholding defines, just trigger the alarm that defines in the thresholding and move.
Step S716 selects the data on flows in a period of time, and compares with the flow benchmark model, marks the data that exceed thresholding and generates the abnormal flow form.
By above method, employing can be found the time dependent application/traffic performance of flow rapidly, exactly based on the adaptive threshold technology of real-time traffic prediction, traffic performance with flow is that benchmark is monitored in real time to flow, help improving network service quality at service application, improve monitoring efficiency, improvement is to the precision of prediction of service traffics variation tendency, for the network planning provides effective supporting method.
The above is the preferred embodiments of the present invention only, is not limited to the present invention, and for a person skilled in the art, the present invention can have various changes and variation.Within the spirit and principles in the present invention all, any modification of being done, be equal to replacement, improvement etc., all should be included within protection scope of the present invention.
Claims (12)
1. real-time traffic Forecasting Methodology is used for predicting in real time the flow of port or link, it is characterized in that, said method comprising the steps of:
Step S102 obtains real-time traffic information in period demand from port or link, and determine the mean value of the flow in described period demand and in described period demand a certain particular moment flow mean value;
Step S104 is that the mean value of flow in the described period demand is provided with first weight according to the flow characteristics of different business, and in the described period demand a certain particular moment flow mean value set second weight; And
Step S106, in the mean value of flow in the described period demand and the described period demand a certain particular moment flow mean value be weighted on average, to obtain the predicted flow rate of in described period demand described port of a certain moment or link.
2. real-time traffic Forecasting Methodology according to claim 1 is characterized in that, described first weight and described second weight are 1.
3. a real-time traffic monitoring and pre-alarming method is characterized in that, described method comprises:
Step S202, the flow information by obtaining described port in the period demand or link from port or link and determine flow mean value in the described period demand and period demand in a certain particular moment flow the mean value calculation weighted average obtain the predicted flow rate of described port of a certain moment or link;
Step S204, set the flow upper limit and flux lower limit and alarm action, wherein, be limited to described predicted flow rate and target offset amount sum on the described flow, described flux lower limit is the poor of described predicted flow rate and described target offset amount, but this flow upper limit and lower limit are the adjustment of benchmark self adaptation with the predicted flow rate; And
Step S206 compares the current actual flow of described port or link and the predicted flow rate of current time in real time, carries out the alarm action greater than the described flow upper limit or under less than the situation of described flux lower limit at described current actual flow.
4. real-time traffic monitoring and pre-alarming method according to claim 3 is characterized in that, described step S202 comprises:
Step S202-2, from port or link obtains the mean value of flow in period demand and in described period demand a certain particular moment flow mean value;
Step S202-4 is that the mean value of flow in the described period demand is provided with first weight according to the flow characteristics of different business, and in the described period demand a certain particular moment flow mean value set second weight;
Step S202-6, in the mean value of flow in the described period demand and the described period demand a certain particular moment flow mean value be weighted on average, to obtain the predicted flow rate of in described period demand described port of a certain moment or link.
5. real-time traffic alarming method by monitoring according to claim 3 is characterized in that, described first weight and described second weight are 1.
6. real-time traffic according to claim 3 detects method for early warning, it is characterized in that in described step S206, mark exceeds the data of the described flow upper limit and described flux lower limit, and generates the abnormal flow form.
7. real-time traffic prediction unit is used for predicting in real time the flow of port or link, it is characterized in that comprising:
The flow acquiring unit is used for obtaining flow information in period demand from port or link, and determine the mean value of the flow in the described period demand and in described period demand a certain particular moment flow mean value;
Weighted units, the flow characteristics according to different business of being used for are that the mean value of flow in the described period demand is provided with first weight, and in the described period demand a certain particular moment flow mean value set second weight; And
The volume forecasting unit, be used in the mean value of flow in the described period demand and the described period demand a certain particular moment flow mean value be weighted on average, to obtain the predicted flow rate of in described period demand described port of a certain moment or link.
8. real-time traffic prediction unit according to claim 7 is characterized in that, described first weight and described second weight are 1.
9. real-time traffic monitoring and warning device is characterized in that comprising:
The volume forecasting module is used for the flow information by obtaining described port in the period demand or link from port or link and determines that the mean value calculation weighted average of the flow of a certain particular moment in flow mean value and the period demand obtains the predicted flow rate of described port of a certain moment or link;
Traffic threshold is provided with module, be used to set the flow upper limit and flux lower limit and alarm action, wherein, be limited to described predicted flow rate and target offset amount sum on the described flow, described flux lower limit is the poor of described predicted flow rate and described target offset amount, but this flow upper limit and lower limit are the adjustment of benchmark self adaptation with the predicted flow rate; And
The flow monitoring module is used in real time the current actual flow of described port or link and the predicted flow rate of current time being compared, and carries out the alarm action greater than the described flow upper limit or under less than the situation of described flux lower limit at described current actual flow.
10. real-time traffic monitoring and warning device according to claim 9 is characterized in that, described volume forecasting module comprises:
The flow acquiring unit, be used for from port or link obtain the flow information of in period demand described port or link and determine the mean value of flow in described period demand and in described period demand a certain particular moment flow mean value;
Weighted units, the flow characteristics according to different business of being used for are that the mean value of flow in the described period demand is provided with first weight, and in the described period demand a certain particular moment flow mean value set second weight;
The volume forecasting unit, be used in the mean value of flow in the described period demand and the described period demand a certain particular moment flow mean value be weighted on average, to obtain the predicted flow rate of in described period demand described port of a certain moment or link.
11. real-time traffic monitoring and warning device according to claim 10 is characterized in that, described first weight and described second weight are 1.
12. real-time traffic monitoring and warning device according to claim 9 is characterized in that, described flow detection unit mark exceeds the data of the described flow upper limit and described flux lower limit, and generates the abnormal flow form.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN2006101524461A CN101155085B (en) | 2006-09-29 | 2006-09-29 | Method and device for real-time flux prediction and real-time flux monitoring and early warning |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN2006101524461A CN101155085B (en) | 2006-09-29 | 2006-09-29 | Method and device for real-time flux prediction and real-time flux monitoring and early warning |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN101155085A true CN101155085A (en) | 2008-04-02 |
| CN101155085B CN101155085B (en) | 2011-05-11 |
Family
ID=39256536
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN2006101524461A Expired - Fee Related CN101155085B (en) | 2006-09-29 | 2006-09-29 | Method and device for real-time flux prediction and real-time flux monitoring and early warning |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN101155085B (en) |
Cited By (26)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102231285A (en) * | 2011-05-18 | 2011-11-02 | 成都市华为赛门铁克科技有限公司 | Method and device for storing data |
| CN102369689A (en) * | 2011-08-11 | 2012-03-07 | 华为技术有限公司 | Long-term forecasting method and device of network flow |
| CN102711177A (en) * | 2012-04-26 | 2012-10-03 | 北京邮电大学 | Service prediction based load balancing method |
| CN102752123A (en) * | 2011-04-20 | 2012-10-24 | 中国移动通信集团设计院有限公司 | Method and device for forecasting flow and configuring capacity of network equipment interface |
| CN102843700A (en) * | 2012-08-21 | 2012-12-26 | 国网电力科学研究院 | Flow model of LTE230M power wireless communication and realizing method of flow model |
| CN102882895A (en) * | 2012-10-31 | 2013-01-16 | 杭州迪普科技有限公司 | Method and device for identifying message attack |
| CN103546319A (en) * | 2013-10-18 | 2014-01-29 | 中国南方电网有限责任公司 | Flow alarming method and system of network equipment |
| CN103580905A (en) * | 2012-08-09 | 2014-02-12 | 中兴通讯股份有限公司 | Method and system for flow forecasting and method and system for flow monitoring |
| CN104734995A (en) * | 2015-02-28 | 2015-06-24 | 华为技术有限公司 | Link aggregation traffic upper limit setting method and network controller |
| CN104753733A (en) * | 2013-12-31 | 2015-07-01 | 中兴通讯股份有限公司 | Method and device for detecting abnormal network traffic data |
| CN104767651A (en) * | 2014-01-07 | 2015-07-08 | 中国移动通信集团黑龙江有限公司 | Multi-service merging and processing method, system and device |
| CN105049279A (en) * | 2015-06-19 | 2015-11-11 | 国家电网公司 | Communication trend flexibility configuration method and system |
| CN106059942A (en) * | 2016-08-02 | 2016-10-26 | 浪潮集团有限公司 | Traffic control method based on load prediction in SDN network |
| CN107276808A (en) * | 2017-06-21 | 2017-10-20 | 北京华创网安科技股份有限公司 | A kind of optimization method of Traffic Anomaly monitoring |
| CN107295539A (en) * | 2016-03-30 | 2017-10-24 | 中国移动通信集团江苏有限公司 | A kind of surfing flow service condition method for pushing and device |
| CN107579981A (en) * | 2017-09-08 | 2018-01-12 | 北京神州绿盟信息安全科技股份有限公司 | A kind of network flow monitoring method and system |
| CN107743135A (en) * | 2017-12-01 | 2018-02-27 | 江彩莲 | Flow monitoring method |
| CN108234162A (en) * | 2016-12-14 | 2018-06-29 | 中国铁路总公司 | TDCS/CTC system early warning methods based on port data flow monitoring |
| CN105049279B (en) * | 2015-06-19 | 2018-08-31 | 国家电网公司 | A kind of communication trend flexible collocation method and system |
| CN109413071A (en) * | 2018-10-31 | 2019-03-01 | 新华三信息安全技术有限公司 | A kind of anomalous traffic detection method and device |
| CN109450672A (en) * | 2018-10-22 | 2019-03-08 | 网宿科技股份有限公司 | A kind of method and apparatus of identification bandwidth demand burst |
| CN109887272A (en) * | 2018-12-26 | 2019-06-14 | 阿里巴巴集团控股有限公司 | A kind of prediction technique and device of traffic flow of the people |
| CN110730099A (en) * | 2019-10-21 | 2020-01-24 | 电子科技大学 | Flow prediction method based on historical flow data time sequence |
| CN111510324A (en) * | 2020-03-27 | 2020-08-07 | 烽火通信科技股份有限公司 | Circuit capacity adjusting method and system |
| CN113381941A (en) * | 2020-02-25 | 2021-09-10 | 深信服科技股份有限公司 | Task scheduling method and device, electronic equipment and computer storage medium |
| CN114124733A (en) * | 2020-08-27 | 2022-03-01 | 中国电信股份有限公司 | Service flow prediction method and device |
Family Cites Families (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1545245A (en) * | 2003-11-12 | 2004-11-10 | 中国科学院计算技术研究所 | Online prediction method for data network flow |
| CN1271803C (en) * | 2004-08-12 | 2006-08-23 | 上海交通大学 | Self adaptive channel reservation and searching method in light burst exchange |
-
2006
- 2006-09-29 CN CN2006101524461A patent/CN101155085B/en not_active Expired - Fee Related
Cited By (40)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102752123A (en) * | 2011-04-20 | 2012-10-24 | 中国移动通信集团设计院有限公司 | Method and device for forecasting flow and configuring capacity of network equipment interface |
| CN102752123B (en) * | 2011-04-20 | 2014-11-05 | 中国移动通信集团设计院有限公司 | Method and device for forecasting flow and configuring capacity of network equipment interface |
| CN102231285B (en) * | 2011-05-18 | 2014-05-07 | 华为数字技术（成都）有限公司 | Method and device for storing data |
| CN102231285A (en) * | 2011-05-18 | 2011-11-02 | 成都市华为赛门铁克科技有限公司 | Method and device for storing data |
| CN102369689A (en) * | 2011-08-11 | 2012-03-07 | 华为技术有限公司 | Long-term forecasting method and device of network flow |
| WO2012149705A1 (en) * | 2011-08-11 | 2012-11-08 | 华为技术有限公司 | Long-term prediction method and apparatus of network traffic |
| CN102711177A (en) * | 2012-04-26 | 2012-10-03 | 北京邮电大学 | Service prediction based load balancing method |
| WO2014023245A1 (en) * | 2012-08-09 | 2014-02-13 | 中兴通讯股份有限公司 | Flow prediction method and system and flow monitoring method and system |
| CN103580905A (en) * | 2012-08-09 | 2014-02-12 | 中兴通讯股份有限公司 | Method and system for flow forecasting and method and system for flow monitoring |
| CN103580905B (en) * | 2012-08-09 | 2017-05-31 | 中兴通讯股份有限公司 | A kind of method for predicting, system and flow monitoring method, system |
| CN102843700B (en) * | 2012-08-21 | 2016-08-10 | 国网电力科学研究院 | The discharge model of a kind of LTE230M electric power radio communication and implementation method |
| CN102843700A (en) * | 2012-08-21 | 2012-12-26 | 国网电力科学研究院 | Flow model of LTE230M power wireless communication and realizing method of flow model |
| CN102882895A (en) * | 2012-10-31 | 2013-01-16 | 杭州迪普科技有限公司 | Method and device for identifying message attack |
| CN103546319A (en) * | 2013-10-18 | 2014-01-29 | 中国南方电网有限责任公司 | Flow alarming method and system of network equipment |
| CN103546319B (en) * | 2013-10-18 | 2017-03-29 | 中国南方电网有限责任公司 | The alarming flow method and system of the network equipment |
| CN104753733B (en) * | 2013-12-31 | 2019-08-13 | 南京中兴软件有限责任公司 | The detection method and device of exception of network traffic data |
| CN104753733A (en) * | 2013-12-31 | 2015-07-01 | 中兴通讯股份有限公司 | Method and device for detecting abnormal network traffic data |
| CN104767651A (en) * | 2014-01-07 | 2015-07-08 | 中国移动通信集团黑龙江有限公司 | Multi-service merging and processing method, system and device |
| CN104734995B (en) * | 2015-02-28 | 2018-02-23 | 华为技术有限公司 | A kind of method to set up and network controller of link aggregation flow rate upper limit |
| CN104734995A (en) * | 2015-02-28 | 2015-06-24 | 华为技术有限公司 | Link aggregation traffic upper limit setting method and network controller |
| CN105049279A (en) * | 2015-06-19 | 2015-11-11 | 国家电网公司 | Communication trend flexibility configuration method and system |
| CN105049279B (en) * | 2015-06-19 | 2018-08-31 | 国家电网公司 | A kind of communication trend flexible collocation method and system |
| CN107295539A (en) * | 2016-03-30 | 2017-10-24 | 中国移动通信集团江苏有限公司 | A kind of surfing flow service condition method for pushing and device |
| CN106059942A (en) * | 2016-08-02 | 2016-10-26 | 浪潮集团有限公司 | Traffic control method based on load prediction in SDN network |
| CN108234162A (en) * | 2016-12-14 | 2018-06-29 | 中国铁路总公司 | TDCS/CTC system early warning methods based on port data flow monitoring |
| CN107276808A (en) * | 2017-06-21 | 2017-10-20 | 北京华创网安科技股份有限公司 | A kind of optimization method of Traffic Anomaly monitoring |
| CN107579981A (en) * | 2017-09-08 | 2018-01-12 | 北京神州绿盟信息安全科技股份有限公司 | A kind of network flow monitoring method and system |
| CN107743135A (en) * | 2017-12-01 | 2018-02-27 | 江彩莲 | Flow monitoring method |
| CN109450672A (en) * | 2018-10-22 | 2019-03-08 | 网宿科技股份有限公司 | A kind of method and apparatus of identification bandwidth demand burst |
| CN109413071A (en) * | 2018-10-31 | 2019-03-01 | 新华三信息安全技术有限公司 | A kind of anomalous traffic detection method and device |
| CN109413071B (en) * | 2018-10-31 | 2021-08-06 | 新华三信息安全技术有限公司 | Abnormal flow detection method and device |
| CN109887272A (en) * | 2018-12-26 | 2019-06-14 | 阿里巴巴集团控股有限公司 | A kind of prediction technique and device of traffic flow of the people |
| CN109887272B (en) * | 2018-12-26 | 2021-08-13 | 创新先进技术有限公司 | Traffic pedestrian flow prediction method and device |
| CN110730099A (en) * | 2019-10-21 | 2020-01-24 | 电子科技大学 | Flow prediction method based on historical flow data time sequence |
| CN110730099B (en) * | 2019-10-21 | 2022-02-08 | 电子科技大学 | Flow prediction method based on historical flow data time sequence |
| CN113381941A (en) * | 2020-02-25 | 2021-09-10 | 深信服科技股份有限公司 | Task scheduling method and device, electronic equipment and computer storage medium |
| CN113381941B (en) * | 2020-02-25 | 2022-09-30 | 深信服科技股份有限公司 | Task scheduling method and device, electronic equipment and computer storage medium |
| CN111510324A (en) * | 2020-03-27 | 2020-08-07 | 烽火通信科技股份有限公司 | Circuit capacity adjusting method and system |
| CN111510324B (en) * | 2020-03-27 | 2022-02-22 | 烽火通信科技股份有限公司 | Circuit capacity adjusting method and system |
| CN114124733A (en) * | 2020-08-27 | 2022-03-01 | 中国电信股份有限公司 | Service flow prediction method and device |
Also Published As
| Publication number | Publication date |
|---|---|
| CN101155085B (en) | 2011-05-11 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN101155085B (en) | Method and device for real-time flux prediction and real-time flux monitoring and early warning | |
| CN102025733B (en) | Health degree evaluation method based on cognitive network | |
| KR101123020B1 (en) | High-speed traffic measurement and analysis methodologies and protocols | |
| US9015312B2 (en) | Network management system and method for identifying and accessing quality of service issues within a communications network | |
| CN103580905B (en) | A kind of method for predicting, system and flow monitoring method, system | |
| CN102882745B (en) | A kind of method and apparatus for monitoring business server | |
| CN101536428B (en) | Method for tracking network parameters | |
| CN100356729C (en) | Method and system for monitoring network service performance | |
| WO2003084133A1 (en) | Forward looking infrastructure re-provisioning | |
| CN104410582A (en) | Traffic balancing method for electric power communication network based on traffic prediction | |
| CN108600038A (en) | Adaptive low-cost SDN Business Streams based on ARIMA are handled up measuring method and system | |
| CN117057670A (en) | Property intelligent energy management system based on Internet of things | |
| CN101267446A (en) | Time domain data amalgamation method for wireless sensor network | |
| TW201628384A (en) | Traffic prediction and resource scheduling automatic analyzing system of mobile network base station and method thereof | |
| CN104852831B (en) | A kind of Forecasting Methodology of hierarchical network RTT | |
| CN106789429A (en) | A kind of self adaptation low-cost SDN link utilization measuring method and system | |
| CN113438116B (en) | Power communication data management system and method | |
| EP3025452A1 (en) | Monitoring network use of resources | |
| CN109495315B (en) | Metropolitan area network analysis and prediction method under big data environment and readable storage medium | |
| CN109981392B (en) | Method and device for predicting flow speed, electronic equipment and storage medium | |
| Oruganti et al. | Analyzing robust active queue management schemes: a comparative study of predictors and controllers | |
| CN109286524A (en) | A kind of risk management device of powerline network | |
| WO2017030515A1 (en) | A method for estimating flow size distributions | |
| KR101240059B1 (en) | System and method for adjusting network traffic measurement interval | |
| KR20070015808A (en) | Traffic Conrtol Method of Network |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| C14 | Grant of patent or utility model | ||
| GR01 | Patent grant | ||
| CF01 | Termination of patent right due to non-payment of annual fee | ||
| CF01 | Termination of patent right due to non-payment of annual fee |
Granted publication date: 20110511 Termination date: 20200929 |