CN105095318A - Method and device for realizing hotspot analysis - Google Patents

Abstract

The invention discloses a method and a device for realizing hotspot analysis. The method comprises the following steps of: performing statistical classification on an event set according to the attributes of at least one event, and obtaining a statistical result formed by different event classes; mapping the event classes in the obtained statistical result into corresponding event sub blocks of different event blocks one by one according to the attributes of at least one event class; calculating the aggregation degree deviation of each event sub block in each event block according to the obtained mapping result; and determining the hotspot of each event block according to the calculated aggregation degree deviation of each event sub block and the preset hotspot judgment strategy. The technical scheme provided by the invention has the advantages that on the basis of the aggregation degree of the defined event class, the calculation complexity of the hotspot analysis is effectively improved, so that the requirement of performing hotspot analysis on a great amount of fast generated data in various types can be well met.

Description

A kind of method and apparatus realizing analysis of central issue

Technical field

The present invention relates to data analysis technique, espespecially a kind of method and apparatus realizing analysis of central issue.

Background technology

Along with the develop rapidly of infotech, the scale of the process of information, exchange, analysis and storage presents geometric growth, to produce and each field of life is studied widely and uses the analytical technology of data that are a large amount of, polytype, quick appearance, analysis of central issue is a kind of important technology in data analysis technique.Analysis of central issue technology analyzes a kind of effective ways of potential contact between some particular event, by analysis of central issue, effectively can make regretional analysis and Potential Prediction to event, helps researchist to draw the conclusion of science.In analysis of central issue, usual be concerned about focus is the zonule of event occurrence frequency exception, if find that event occurrence frequency in certain or multiple zonule is significantly higher or lower than normal frequency, be then defined as focus by this zonule.

The analysis of central issue method of existing event adopts the nearest neighbor algorithm in clustering algorithm to analyze focus usually, although this algorithm can analyze focus, but calculated amount needed for it is large and counting yield is low, thus can not meets well the demand of analysis of central issue is carried out to data that are a large amount of, polytype, quick appearance at present.

Summary of the invention

In order to solve the problems of the technologies described above, the invention provides a kind of method and apparatus realizing analysis of central issue, the computation complexity of analysis of central issue can be reduced, meeting analysis of central issue demand.

In order to reach the object of the invention, the invention discloses a kind of method realizing analysis of central issue, comprising the steps:

In measurement period, the attribute according at least one event carries out statistical classification to event sets, obtains the statistics be made up of different event class;

According to the attribute of at least one event class, the event class in the statistics obtained is mapped to one by one in the corresponding event sub-block of different event block;

According to the mapping result obtained, calculate the degree of polymerization deviation of each event sub-block in each event block;

According to the degree of polymerization deviation of the event sub-block calculated and the focus determination strategy that pre-sets, determine the focus in each event block.

Described event sets is made up of event; The attribute of described event at least comprises: identifier, type and grade;

The attribute of described event class at least comprises: the quantity of the number of the event in identifier, type, grade and expression same class event class.

The degree of polymerization deviation of each event sub-block in each event block of described calculating, comprising:

According to grade and the quantity of described event class, calculate the degree of polymerization of each event class in current event block respectively;

According to the degree of polymerization of each event class obtained, calculate the degree of polymerization of each event sub-block in described current event block;

According to the degree of polymerization of the quantity of the event sub-block of described current event block and each event sub-block of acquisition, calculate the average degree of polymerization of described current event block;

According to the average degree of polymerization of acquisition and the degree of polymerization of each event sub-block, calculate the degree of polymerization deviation of each event sub-block in described current event block.

The computing formula of the degree of polymerization A of described event class is: A=log (E*L), and wherein, E is the quantity of described event class, and L is the grade of described event class.

The computing formula of the degree of polymerization As of described event sub-block is: wherein, A _nfor the degree of polymerization of event class n, N is the quantity of the event class of described current event sub-block;

Described average degree of polymerization computing formula be: wherein, As _mfor the degree of polymerization of event sub-block m, M is the quantity of the event sub-block in shown current event block;

The degree of polymerization deviation delta s of described event sub-block m _mcomputing formula be: wherein, As _mfor the degree of polymerization of event sub-block m, for described average degree of polymerization.

The method also comprises: according to the degree of polymerization deviation of event sub-block corresponding to the described focus determined and the abnormal determination strategy that pre-sets, determine the exception level of described focus.

The method also comprises: divide the event area comprising all described event block formations:

The event area comprising all described event block formations is expressed as border circular areas, described border circular areas is divided into multiple annulus that the center of circle is identical;

Described annulus is carried out even decile to obtain multiple fan ring according to the quantity of the event sub-block in event block from the total center of circle to the direction of the excircle of described annulus;

Described event block is corresponded to described annulus, described event sub-block is corresponded to described fan ring, described event class is corresponded to the round dot in described fan ring.

The method also comprises: according to each event class in each described fan ring, round dot described in layout in each fan ring.

In each annulus, in each fan ring, described in layout, round dot comprises:

The quantity of event class in described current fan ring according to described event class is carried out sorting to obtain ranking results by as many as less, and calculates the maximum radius of the round dot that each event class is corresponding in described current fan ring;

According to described maximum radius and the fan ring round dot placement strategy pre-set, calculate the central coordinate of circle set of described current fan ring;

According to the quantity of described event class order from big to small from ranking results, extract described event class one by one, correspondingly random selecting central coordinate of circle from described central coordinate of circle set, it can be used as the central coordinate of circle of the round dot of the correspondence of extracted event class, the round dot radius that the quantity sentencing extracted event class at described central coordinate of circle calculates is that radius determines described round dot.

Described central coordinate of circle set is: when described current fan ring is according to the described maximum round dot of described fan ring round dot placement strategy arrangement, the set of the coordinate in the center of circle of all described maximum round dots in this fan ring;

Wherein, described maximum round dot is the round dot with maximum radius.

Described fan ring round dot placement strategy is: according to the described maximum round dot of center of circle circular arc placement strategy arrangement preset on the ground floor center of circle circular arc of the outer camber line near described current fan ring, according to the described maximum round dot of described center of circle circular arc placement strategy arrangement on the second layer center of circle circular arc near described ground floor center of circle circular arc, by that analogy, according to the described maximum round dot of described center of circle circular arc placement strategy arrangement on the P layer center of circle circular arc of camber line in shown current fan ring, wherein

Described center of circle circular arc placement strategy is: the center of circle of described maximum round dot is on the circular arc of the center of circle, and adjacent two described maximum round dots are tangent, and two of circular arc two ends, the center of circle described maximum round dots are tangent with two straight lines of the contour of described current fan ring respectively,

The value of P is the round values that the ratio of R and 2r rounds downwards, wherein,

R is the radius of described current fan ring, and r is described maximum radius.

The invention also discloses a kind of device realizing analysis of central issue, comprise statistical classification module, statistics mapping block, degree of polymerization deviation computing module and focus judge module, wherein,

Statistical classification module, in measurement period, the attribute according at least one event carries out statistical classification to event sets, obtains the statistics be made up of different event class;

Statistics mapping block, for the attribute according at least one event class, is mapped to the event class in the statistics from statistical classification module in the corresponding event sub-block of different event block one by one;

Degree of polymerization deviation computing module, for according to the mapping result from statistics mapping block, calculates the degree of polymerization deviation of each event sub-block in each event block;

Focus judge module, for according to from the degree of polymerization deviation of the event sub-block of degree of polymerization deviation computing module and the focus determination strategy that pre-sets, determines the focus in each event block.

Described event sets is made up of event; The attribute of described event at least comprises: identifier, type and grade; The attribute of described event class at least comprises: the quantity of the number of the event in identifier, type, grade and expression same class event class.

Described degree of polymerization deviation computing module at least comprises the degree of polymerization deviation computing module of the degree of polymerization computing module of event class, the degree of polymerization computing module of event sub-block, average degree of polymerization computing module and event sub-block, wherein,

Degree of polymerization computing module, for according to the grade of described event class and quantity, calculates the degree of polymerization of each event class in current event block respectively;

The degree of polymerization computing module of event sub-block, for according to the degree of polymerization from each event class of described degree of polymerization computing module, calculates the degree of polymerization of each event sub-block in described current event block;

Average degree of polymerization computing module, the degree of polymerization of each event sub-block of the quantity for the event sub-block according to described current event block and the degree of polymerization computing module from described event sub-block, calculates the average degree of polymerization of described current event block;

The degree of polymerization deviation computing module of event sub-block, for the degree of polymerization of each event sub-block according to the average degree of polymerization from described average degree of polymerization computing module and the degree of polymerization computing module from described event sub-block, calculate the degree of polymerization deviation of each event sub-block in described current event block.

The computing formula of the degree of polymerization A of described event class is: A=log (E*L), and wherein, E is the quantity of described event class, and L is the grade of described event class.

The computing formula of the degree of polymerization As of described event sub-block is: wherein, A _nfor the degree of polymerization of event class n, N is the quantity of the event class of described current event sub-block;

Described average degree of polymerization computing formula be: wherein, As _mfor the degree of polymerization of event sub-block m, M is the quantity of the event sub-block in shown current event block;

The degree of polymerization deviation delta s of described event sub-block m _mcomputing formula be: wherein, As _mfor the degree of polymerization of event sub-block m, for described average degree of polymerization.

Compared with prior art, the method for a kind of analysis of central issue of the present invention, comprising: in measurement period, and the attribute according at least one event carries out statistical classification to event sets, obtains the statistics be made up of different event class; According to the attribute of at least one event class, the event class in the statistics obtained is mapped to one by one in the corresponding event sub-block of different event block; According to the mapping result obtained, calculate the degree of polymerization deviation of each event sub-block in each event block; According to the degree of polymerization deviation of the event sub-block calculated and the focus determination strategy that pre-sets, determine the focus in each event block.Technical scheme provided by the invention based on the degree of polymerization of defined event class, such that analysis of central issue is relatively simple, calculated amount is little and counting yield is high, thus has fallen the computation complexity of low analysis of central issue, meets analysis of central issue demand.

Further, technical solution of the present invention optimizes the coordinate position computing method of event class graph of a correspondence, event class graph of a correspondence more reasonably, is intuitively shown in patterned event area, thus the demand well meeting effective implemention analysis of central issue and event class is intuitively shown.

Other features and advantages of the present invention will be set forth in the following description, and, partly become apparent from instructions, or understand by implementing the present invention.Object of the present invention and other advantages realize by structure specifically noted in instructions, claims and accompanying drawing and obtain.

Accompanying drawing explanation

Accompanying drawing is used to provide the further understanding to technical solution of the present invention, and forms a part for instructions, is used from and explains technical scheme of the present invention, do not form the restriction to technical solution of the present invention with the embodiment one of the application.

Fig. 1 (a) realizes the process flow diagram of the method for analysis of central issue for the present invention;

Fig. 1 (b) is for calculating the process flow diagram of the method for degree of polymerization deviation in Fig. 1 (a) of the present invention;

Fig. 2 is the schematic diagram that event area of the present invention is expressed as the event area in the embodiment of border circular areas;

Fig. 3 be the present invention on the basis of analysis of central issue in each fan ring the process flow diagram of layout round dot;

Fig. 4 is the schematic diagram realizing the coordinate position in the center of circle calculating round dot corresponding to event class in the embodiment of analysis of central issue and layout round dot in the present invention;

Fig. 5 is the composition structural representation that the present invention realizes analysis of central issue device;

Fig. 6 the present invention is directed to computer network event sets and realizes showing in the embodiment of analysis of central issue and layout round dot the design sketch of the round dot that event class is corresponding.

Embodiment

For making the object, technical solutions and advantages of the present invention clearly understand, hereinafter will be described in detail to embodiments of the invention by reference to the accompanying drawings.It should be noted that, when not conflicting, the embodiment in the application and the feature in embodiment can combination in any mutually.

Can perform in the computer system of such as one group of computer executable instructions in the step shown in the process flow diagram of accompanying drawing.Further, although show logical order in flow charts, in some cases, can be different from the step shown or described by order execution herein.

Analysis of central issue is a kind of technology of event sets being carried out to data analysis.For obtaining event sets, first, carry out feature interpretation to the event in the field of analysis of central issue application, usually, event carries out feature interpretation by multiple attribute.

Usually, by extracting at least one common trait of a certain large class event in above-mentioned field, and using the common trait that the extracts attribute as event, thus achieve the feature interpretation to this large class event.It is clear to the skilled person that, multiple large class event can be comprised to the field of analysis of central issue application, incomplete same attribute can be extracted for often kind of large class event and feature interpretation is carried out to event wherein, and the method for analysis of central issue can be used respectively to carry out analysis of central issue for each large class event.Wherein,

The attribute of event, usually, can define multiple numerical value or the typonym corresponding with numerical value.Such as, the type of event is a kind of attribute of event, and it can comprise application layer, network layer, terminating layer, etc.

Then, gather a certain large class event in the field of analysis of central issue application, the main object of collection is the numerical value of the predefined attribute of event, to realize the feature interpretation to event.Again the event collected is formed set, i.e. event sets.

Fig. 1 is the process flow diagram that the present invention realizes the method for analysis of central issue, as shown in Figure 1, comprising:

Step 101: in measurement period, the attribute according at least one event carries out statistical classification to event sets, obtains the statistics be made up of different event class.Wherein,

Measurement period is the periodic time period corresponding to execution statistical classification pre-set, in measurement period, gather the event collected to be put in the event sets corresponding with this measurement period to event.Such as, measurement period can be set to 30 seconds.

Event sets is made up of event, and event carries out feature interpretation by the attribute of event, and the attribute of event at least comprises: identifier, type and grade.

Event class carries out feature interpretation by the attribute of event class, and the attribute of event class at least comprises: identifier, type, grade and quantity.Wherein, the identifier of event class and type are identifier and the type of the event of its statistics, and the grade of event class is the grade with the event of the highest grade of its statistics, and the quantity of event class is the quantity of the event in the same class event class of its statistics.Like this, all events of event class statistics have identical identifier and type.That is, statistical classification is carried out to event sets, Ke Yishi according to the attribute of at least one event in this step: in measurement period, according to the identifier of event and type, statistical classification is carried out to event sets.

Statistics is made up of several event class, and the size of statistics and the quantity of event class decide primarily of the speed of the length of measurement period and the appearance speed of event.

Statistics can be kept at least one Hash table.Wherein, use Hash table to safeguard and preserve the conventional techniques means that data are those skilled in the art, the protection domain be not intended to limit the present invention, repeats no more here.

Step 102: according to the attribute of at least one event class, is mapped in the corresponding event sub-block of different event block one by one by the event class in the statistics obtained.Wherein,

Event block is made up of at least one event sub-block, and the quantity of event block is at least 1.

Specifically, according to the type of event class, the event class in statistics can be mapped in each event block one by one.Therefore, the quantity of event block is that the quantity of numerical value included by the type of event class or typonym determines.Such as, if the type of event class comprises application layer type, network layer type and terminating layer type, then the quantity of event block is 3, and these 3 event block are respectively application-layer events block, network layer event block and terminating layer event block.

The generation extracted from the identifier of event class or the environment attribute receiving this type of event can be called the environment of event class.In each event block, that the event class being mapped to current event block is mapped to one by one this event block according to the environment of event class with numerical value that the is environment of event class or typonym one to one in each event sub-block, that is, there is the numerical value of the environment of how many event class, correspondingly, how many event sub-blocks are just had.Therefore, the quantity of the event sub-block in each event block is that the quantity of numerical value or the environment title comprised by the environment of event class determines.Such as, the environment being mapped to the event class of certain event block comprises object environment 1, object environment 2, object environment 3 and object environment 4, then the quantity of the event sub-block of this event block is 4, and these 4 event sub-blocks are respectively event sub-block 1, event sub-block 2, event sub-block 3 and event sub-block 4.

Step 103: according to the mapping result obtained, calculates the degree of polymerization deviation of each event sub-block in each event block.The idiographic flow of this step realizes as Fig. 1 (b), and as shown in Fig. 1 (b), this step specifically comprises the steps:

Step 103-1: according to grade and the quantity of event class, calculates the degree of polymerization of each event class in current event block respectively.Wherein,

The calculating of the degree of polymerization A of event class as shown in formula (1),

A＝log(E*L)(1)

In formula (1), E is the quantity of event class, and L is the grade of event class.

Step 103-2: according to the degree of polymerization of each event class obtained, calculate the degree of polymerization of each event sub-block.Wherein,

The calculating of the degree of polymerization As of event sub-block as shown in formula (2),

$\mathrm{As}=\underset{n=1}{\overset{N}{\mathrm{\Σ}}}{A}_n---\left(2\right)$

In formula (2), A _nfor the degree of polymerization of event class n, N is the quantity of the event class of current event sub-block.

Step 103-3: according to the degree of polymerization of the quantity of the event sub-block in event block and the event sub-block of acquisition, calculates the average degree of polymerization of current event block.Wherein,

The average degree of polymerization of event block calculating as shown in formula (3),

$\stackrel{\‾}{A}=\frac{\underset{m=1}{\overset{M}{\mathrm{\Σ}}}{\mathrm{As}}_m}{M}---\left(3\right)$

In formula (3), As _mfor the degree of polymerization of event sub-block m, M is the quantity of the event sub-block in current event block.

Step 103-4: according to the average degree of polymerization of acquisition and the degree of polymerization of event sub-block, calculate the degree of polymerization deviation of each event sub-block.Wherein,

The degree of polymerization deviation delta s of event sub-block m _mcalculating as shown in formula (4),

$\mathrm{\Δ}{s}_m=\frac{{\mathrm{As}}_m-\stackrel{\‾}{A}}{\stackrel{\‾}{A}}*100\%---\left(4\right)$

In formula (4), As _mfor the degree of polymerization of event sub-block m, for average degree of polymerization, the span of m be 1,2 ..., M}.

Step 104, according to the degree of polymerization deviation of the event sub-block calculated and the focus determination strategy that pre-sets, determines the focus in each event block.

Wherein, focus determination strategy can be: if the degree of polymerization deviation delta of event sub-block _sbe greater than 0, then corresponding event sub-block is focus, otherwise the event sub-block of correspondence is not focus.

After determining focus, anomaly analysis can also be carried out according to the abnormal determination strategy shown in table 1 to focus further, to distinguish the exception level of focus.

Δ sScope	The exception level of focus
		0≤Δ s<50	Normally
50≤Δ s<100	Low
		100≤Δ s<150	In
150≤Δ s<200	Middle height
		Δ s≥200	High

Table 1

Further, the event area that the inventive method also comprises comprising all event block formation divides, to optimize the coordinate position computing method of event class graph of a correspondence, event class graph of a correspondence more reasonably, is intuitively shown in patterned event area, thus the demand well meeting effective implemention analysis of central issue and event class is intuitively shown.Specifically comprise:

The event area comprising all event block formation is expressed as border circular areas, border circular areas is divided into multiple annulus that the center of circle is identical, annulus is drawn cut-off rule according to the quantity of the event sub-block in event block from the total center of circle to the direction of the excircle of annulus and carries out even decile to obtain multiple fan ring, Fig. 2 is the schematic diagram that event area of the present invention is expressed as the event area in the embodiment of border circular areas, as shown in Figure 2, event block is corresponded to annulus, event sub-block is corresponded to fan ring, event class is corresponded to the round dot in fan ring.

As shown in Figure 2, the identical annulus in 3 centers of circle is divided into for event area.Wherein, the annulus of innermost layer is application layer annulus, it should be noted that the annulus of innermost layer is actually circular shape, for convenience of description and unified, the circle of innermost layer and two outside layers annulus thereof is referred to as annulus.Wherein,

The radius of each annulus determines the area of each annulus, can select the radius of each annulus according to the annular radii selection strategy preset.Such as, annular radii selection strategy can be: first according to the radius of the indication range determination border circular areas of border circular areas, then the radius of border circular areas is carried out decile according to the quantity of the annulus of border circular areas, the numerical value through decile obtained is the radius of each annulus.

As shown in Figure 2, the annulus in middle layer is network layer annulus.Outermost annulus is terminating layer annulus.Each annulus is made up of the fan ring that the shape of 4 area equation is identical, it should be noted that equally, innermost layer fan ring is actually and fan-shapedly forms by 4, for convenience of description and unified, the fan ring of the fan-shaped of innermost layer annulus and two outside layers annulus thereof is referred to as fan ring.

As shown in Figure 2, according to an embodiment, 4 fan rings that networking layer annulus comprises are called subnet one, subnet two, subnet three and subnet four.That is, the environment being mapped to the event class in network layer annulus comprises 4 numerical value, and their title is divided into subnet one, subnet two, subnet three and subnet four.

Correspondingly,

The inventive method can also comprise: safeguard the statistics that measurement period is corresponding at least one times recently, and statistics is preserved in the historical data.Specifically,

The statistics that nearest 10 measurement periods of the Hash table queue maintenance formed to use 10 Hash tables are corresponding, wherein, is called the oldest statistics by statistics corresponding for the measurement period the longest with the last measurement period interval.In this example embodiment,

Before execution step 101, first the oldest statistics can be preserved in the historical data, then will be used in above-mentioned Hash table queue safeguarding that the Hash table of the oldest statistics shifts out from this Hash table queue, and the Hash table that generation one is new in this Hash table queue be for safeguarding the statistics in current statistic cycle.

Correspondingly,

After execution step 104, the inventive method can also comprise: according to each event class in each fan ring, layout round dot in each fan ring, Fig. 3 be the present invention on the basis of analysis of central issue in each fan ring the process flow diagram of layout round dot, as shown in Figure 3, comprising:

Step 301: the event class in fan ring is carried out sorting to obtain ranking results by as many as according to the quantity of event class less, and calculates the maximum radius of the round dot that each event class is corresponding in current fan ring.

Here; can be sorted less by as many as according to the quantity of event class to the event class in current fan ring by the mode of chained list; use the conventional techniques means that the technology of linked list maintenance and preservation ranking results is those skilled in the art, the protection domain be not intended to limit the present invention, repeats no more here.

Based on ranking results, be easy to the maximal value of the event number of the event class extracted in current fan ring.Based on the radius scale parameter of the radius of the event number of the event class the pre-set round dot corresponding with event class, calculate the product of radius scale parameter and above-mentioned maximal value, the product value of gained is the maximum radius of the round dot in this fan ring.

Step 302: according to maximum radius and the fan ring round dot placement strategy preset, calculate the central coordinate of circle set of fan ring.Wherein,

Central coordinate of circle set is when current fan ring arranges maximum round dot according to fan ring round dot placement strategy, the set of the coordinate in the center of circle of all maximum round dots in this fan ring.Wherein,

Maximum round dot is the round dot with maximum radius.

Fan ring round dot placement strategy is, ground floor center of circle circular arc arranges maximum round dot according to the center of circle circular arc placement strategy preset, second layer center of circle circular arc arranges maximum round dot according to center of circle circular arc placement strategy, by that analogy, P layer center of circle circular arc arranges maximum round dot according to center of circle circular arc placement strategy.Wherein, the value of P is the i.e. round values that rounds downwards of the ratio of R and 2r, wherein, R is the radius of current fan ring, i.e. any one length in two straight lines of the contour of current fan ring, r is maximum radius.Wherein,

Center of circle circular arc placement strategy is, the center of circle of maximum round dot is on the circular arc of the center of circle, and adjacent two maximum round dots are tangent, and two maximum round dots at circular arc two ends, the center of circle are tangent with two straight lines of the contour of current fan ring respectively.

Ground floor center of circle circular arc be through all round dots tangent with the external arc of current fan ring the center of circle, two end points are the circular arc in the center of circle of two round dots in the above-mentioned round dot tangent with the straight line of the contour of current fan ring.Wherein,

The maximum round dot corresponding with ground floor center of circle circular arc is called ground floor round dot, is called ground floor tangent arc by with ground floor round dot at the circular arc that direction, the total center of circle is tangent.

Second layer center of circle circular arc be through all round dots tangent with ground floor tangent arc the center of circle, two end points are the circular arc in the center of circle of two round dots in the above-mentioned round dot tangent with the straight line of the contour of current fan ring.

With reference to the definition of second layer center of circle circular arc, class releases third layer round dot circular arc, the 4th layer of round dot circular arc ..., the definition of P layer round dot circular arc.Wherein,

The definition of reference ground floor round dot and ground floor tangent arc, class releases second layer round dot, third layer round dot ..., the definition of P layer round dot, and second layer tangent arc, third layer tangent arc ..., the definition of P layer tangent arc.

According to ground floor center of circle circular arc, second layer center of circle circular arc ..., the definition of P layer center of circle circular arc, can be easy to the radius R obtaining a kth center of circle circular arc _kcomputing formula: R _k=R-(2k-1) * r, wherein, the span of k be 1,2 ..., P}, R _kfor the total center of circle is to the arc radius of a kth center of circle circular arc.

Fig. 4 is the schematic diagram realizing the coordinate position in the center of circle calculating round dot corresponding to event class in the embodiment of analysis of central issue and layout round dot in the present invention, as shown in Figure 4, in order to obtain the central coordinate of circle set of this fan ring,

First, radian set { E is calculated ₁, E ₂..., E _j, wherein, J is the quantity of current annulus middle fan ring, radian E in radian set _jcalculating as shown in formula (5), wherein, the span of j be 1,2 ..., J}, in conjunction with in embodiment as shown in Figure 4, the value of J is 4.

$E_j=\left(\frac{2\mathrm{\π}}{J}\right)*j---\left(5\right)$

According to radian set, radian corresponding for current fan ring is expressed as [E _j-1, E _j], wherein, E ₀value be 0.And then, the arc range that kth layer center of circle circular arc is corresponding can be obtained: for convenience of description, [D is expressed as further _j-1, D _j], wherein θ _kfor deflection angle, its definition is with reference to the description of formula (7) and correspondence thereof below.

As shown in Figure 4, the exemplary multiple round dots with maximum radius r drawn, wherein, the total center of circle is the center of circle of 3 annulus as shown in Figure 4.

As shown in Figure 4, the coordinate position in the center of circle of maximum round dot is (x _i, y _i), x _iand y _ibetween relation as shown in formula (6).Wherein, the x as shown in formula (6) _iand y _ispan representative (x _i, y _i) be in current fan ring.

x _i+y _i＝R _i ²(6)

Wherein, R _k* cosD _j≤ x _i≤ R _k* cosD _j-1, R _k* sinD _j-1≤ y _i≤ R _k* sinD _j

Then, deflection angle θ is calculated _k, it is that the center of circle of two tangent maximum round dots on a kth center of circle circular arc is relative to centered deflection angle altogether.As shown in Figure 4, deflection angle be the total center of circle to the straight line of center of circle A and the total center of circle to the straight line of center of circle B between angle, round dot A and round dot B is tangent, and all tangent with the external arc of current fan ring, and all has maximum radius r, deflection angle θ _kthe face that is calculated as follows formula (7) shown in.

${\mathrm{\θ}}_k=\arcsin \left(\frac{r}{R_k}\right)*2---\left(7\right)$

As shown in formula (7), θ _kwith R _kone_to_one corresponding, a kth center of circle circular arc has the θ corresponding with it _kwith R _k.

Then, calculate center of circle stepping, by between the circular arc of the adjacent two layers center of circle, distance on the external arc direction of the total center of circle to current fan ring is called center of circle stepping.As shown in Figure 4, the center of circle stepping between the round dot C on the round dot B on the circular arc of the ground floor center of circle and second layer center of circle circular arc is the air line distance between center of circle B and center of circle C, and its orbicular spot C and round dot B is tangent.The calculating of center of circle stepping Δ V is as shown in formula (8).

ΔV＝r*2(8)

Finally, central coordinate of circle the set { (xi of current fan ring is calculated according to formula (5), formula (6), formula (7), formula (8), yi) }, calculate as shown in formula (9-1) and (9-2), wherein, h is a kth center of circle circular arc upper deflecting θ in current fan ring _kdeflection number of times, the span of h is the definition of each variable of formula (9-1) and (9-2) and span are with reference to the description of formula (5) above, formula (6), formula (7) and formula (8) and correspondence thereof.

Work as D _j-T _k* h>D _j-1time (9-1)

$x_i=R_k*\cos (D_j-{\mathrm{\θ}}_k*h),y_i=\sqrt{R_k^2-{(R_k*\cos (D_j-{\mathrm{\θ}}_k*h))}^2};$

Work as D _j-T _k* h≤D _j-1time (9-2)

$x_i=(R_k-\mathrm{\Δk})*\cos (D_j-{\mathrm{\θ}}_k*h),y_i=\sqrt{{(R_k-\mathrm{\ΔV})}^2-{((R_k-\mathrm{\ΔV})*\cos (D_j-{\mathrm{\θ}}_k*h))}^2}$

Step 303: according to the quantity of event class order from big to small from ranking results, extract event class one by one, correspondingly random selecting central coordinate of circle from central coordinate of circle set, it can be used as the central coordinate of circle of the round dot of the correspondence of extracted event class, the round dot radius that the quantity sentencing extracted event class at central coordinate of circle in current fan ring calculates is radius determination round dot.

By a kind of random algorithm as pseudo-random algorithm random selecting central coordinate of circle from central coordinate of circle set, for a person skilled in the art, can select multiple random algorithm, these random algorithms are conventional techniques means of those skilled in the art, repeat no more here.

Calculate the product of above-mentioned radius scale parameter and the event number of event class extracted, the product value of gained is the round dot radius of round dot corresponding to this event class.

When all event class in ranking results are all extracted, or when all central coordinate of circle in central coordinate of circle set all correspond to the event class extracted, the layout round dot in current fan ring terminates.

Correspondingly,

The color of round dot can be set from shallow to deep, represent the grade of the event class of its correspondence respectively from low to high.

According to an embodiment, further by the background color in the region of annulus corresponding for judged focus, different colors can be designated as, such as red, thus focus is shown intuitively in obvious mode in event area.

Further,

Step 303, can also comprise: the event class in statistics preserved in the historical data with corresponding central coordinate of circle.

Fig. 5 is the composition structural representation that the present invention realizes analysis of central issue device, as shown in Figure 5, at least comprises statistical classification module 501, statistics mapping block 502, degree of polymerization deviation computing module 503 and focus judge module 504, wherein,

Statistical classification module 501, in measurement period, the attribute according at least one event carries out statistical classification to event sets, obtains the statistics be made up of different event class;

Statistics mapping block 502, for the attribute according at least one event class, is mapped to the event class in the statistics from statistical classification module 501 in the corresponding event sub-block of different event block one by one;

Degree of polymerization deviation computing module 503, for according to the mapping result from statistics mapping block 502, calculates the degree of polymerization deviation of each event sub-block in each event block;

Focus judge module 504, for according to from the degree of polymerization deviation of the event sub-block of degree of polymerization deviation computing module 503 and the focus determination strategy that pre-sets, determines the focus in each event block.

Further,

Event sets is made up of event; The attribute of event at least comprises: identifier, type and grade; The attribute of event class at least comprises: the quantity of the number of the event in identifier, type, grade and expression same class event class.

Wherein, degree of polymerization deviation computing module 503 at least comprises: the degree of polymerization deviation computing module 503-4 of the degree of polymerization computing module 503-1 of event class, degree of polymerization computing module 503-2, the average degree of polymerization computing module 503-3 of event sub-block and event sub-block, wherein

Degree of polymerization computing module 503-1, for according to the grade of event class and quantity, calculates the degree of polymerization of each event class in current event block respectively;

The degree of polymerization computing module 503-2 of event sub-block, for according to the degree of polymerization from each event class of degree of polymerization computing module 503-1, calculates the degree of polymerization of each event sub-block in current event block;

Average degree of polymerization computing module 503-3, the degree of polymerization of each event sub-block of the quantity for the event sub-block according to current event block and the degree of polymerization computing module 503-2 from event sub-block, calculates the average degree of polymerization of current event block;

The degree of polymerization deviation computing module 503-4 of event sub-block, for the degree of polymerization of each event sub-block according to the average degree of polymerization from average degree of polymerization computing module 503-3 and the degree of polymerization computing module 503-2 from event sub-block, calculate the degree of polymerization deviation of each event sub-block in current event block.

Further,

The computing formula of the degree of polymerization A of event class is: A=log (E*L), and wherein, E is the quantity of event class, and L is the grade of event class.

Further,

The computing formula of the degree of polymerization As of event sub-block is: wherein, A _nfor the degree of polymerization of event class n, N is the quantity of the event class of current event sub-block;

Average degree of polymerization computing formula be: wherein, As _mfor the degree of polymerization of event sub-block m, M is the quantity of the event sub-block in shown current event block.

The degree of polymerization deviation delta s of event sub-block m _mcomputing formula be: wherein, As _mfor the degree of polymerization of event sub-block m, for average degree of polymerization.

Apparatus of the present invention can be arranged in various analysis of central issue equipment.

An application of the present invention is the device realizing analysis of central issue in computer network facility.Fig. 6 the present invention is directed to computer network event sets and realizes showing in the embodiment of analysis of central issue and layout round dot the design sketch of the round dot that event class is corresponding.Wherein,

The identifier of event is computer network message initial corresponding source IP address and object IP address when generating in the generation equipment generating this message, and the type of event is made a living the type of forming apparatus, the grade that the grade of event marks for above-mentioned message.Correspondingly, the identifier of event class is computer network message initial corresponding source IP address and object IP address when generating in the generation equipment generating this message, the type of event class is made a living the type of forming apparatus, the grade that the grade of event class marks for the message having greatest level in above-mentioned message, the quantity of event class is the quantity of computer network message in event sets with identical source IP address, object IP address and event type, and the environment of event class is the subnet address gone out from its object IP address extraction.Wherein,

As shown in Figure 6, the type of event class comprises application layer, network layer and terminating layer, and the subnet address of event class comprises subnet one, subnet two, subnet three and subnet four.

As shown in Figure 6, the division of event area is identical with the event area shown in Fig. 2, repeats no more here.In each fan ring of the annulus of three shown in Fig. 6, depict the round dot that the event class that is mapped to this fan ring is corresponding, and the color of round dot represents the grade of the event class of its correspondence from low to high from shallow to deep, and the size of round dot represents the size of the numerical value of the quantity of the event class of its correspondence.

Although the embodiment disclosed by the present invention is as above, the embodiment that described content only adopts for ease of understanding the present invention, and be not used to limit the present invention.Those of skill in the art belonging to any the present invention; under the prerequisite not departing from the spirit and scope disclosed by the present invention; any amendment and change can be carried out in the form implemented and details; but scope of patent protection of the present invention, the scope that still must define with appending claims is as the criterion.

Claims (16)

1. realize a method for analysis of central issue, it is characterized in that, comprising:

In measurement period, the attribute according at least one event carries out statistical classification to event sets, obtains the statistics be made up of different event class;

According to the attribute of at least one event class, the event class in the statistics obtained is mapped to one by one in the corresponding event sub-block of different event block;

According to the mapping result obtained, calculate the degree of polymerization deviation of each event sub-block in each event block;

According to the degree of polymerization deviation of the event sub-block calculated and the focus determination strategy that pre-sets, determine the focus in each event block.

2. method according to claim 1, is characterized in that, described event sets is made up of event; The attribute of described event at least comprises: identifier, type and grade;

The attribute of described event class at least comprises: the quantity of the number of the event in identifier, type, grade and expression same class event class.

3. method according to claim 2, is characterized in that, the degree of polymerization deviation of each event sub-block in each event block of described calculating, comprising:

According to grade and the quantity of described event class, calculate the degree of polymerization of each event class in current event block respectively;

According to the degree of polymerization of each event class obtained, calculate the degree of polymerization of each event sub-block in described current event block;

According to the degree of polymerization of the quantity of the event sub-block of described current event block and each event sub-block of acquisition, calculate the average degree of polymerization of described current event block;

According to the average degree of polymerization of acquisition and the degree of polymerization of each event sub-block, calculate the degree of polymerization deviation of each event sub-block in described current event block.

4. method according to claim 3, is characterized in that, the computing formula of the degree of polymerization A of described event class is: A=log (E*L), and wherein, E is the quantity of described event class, and L is the grade of described event class.

5. method according to claim 3, is characterized in that:

The computing formula of the degree of polymerization As of described event sub-block is: wherein, A _nfor the degree of polymerization of event class n, N is the quantity of the event class of described current event sub-block;

Described average degree of polymerization computing formula be: wherein, As _mfor the degree of polymerization of event sub-block m, M is the quantity of the event sub-block in shown current event block;

The degree of polymerization deviation delta s of described event sub-block m _mcomputing formula be: wherein, As _mfor the degree of polymerization of event sub-block m, for described average degree of polymerization.

6. method according to claim 3, is characterized in that, the method also comprises:

According to the degree of polymerization deviation of event sub-block corresponding to the described focus determined and the abnormal determination strategy that pre-sets, determine the exception level of described focus.

7. the method according to any one of claim 1 ~ 6, is characterized in that, the method also comprises: divide the event area comprising all described event block formations:

The event area comprising all described event block formations is expressed as border circular areas, described border circular areas is divided into multiple annulus that the center of circle is identical;

Described annulus is carried out even decile to obtain multiple fan ring according to the quantity of the event sub-block in event block from the total center of circle to the direction of the excircle of described annulus;

Described event block is corresponded to described annulus, described event sub-block is corresponded to described fan ring, described event class is corresponded to the round dot in described fan ring.

8. method according to claim 7, is characterized in that, the method also comprises: according to each event class in each described fan ring, round dot described in layout in each fan ring.

9. method according to claim 8, is characterized in that, in each annulus, in each fan ring, described in layout, round dot comprises:

The quantity of event class in described current fan ring according to described event class is carried out sorting to obtain ranking results by as many as less, and calculates the maximum radius of the round dot that each event class is corresponding in described current fan ring;

According to described maximum radius and the fan ring round dot placement strategy pre-set, calculate the central coordinate of circle set of described current fan ring;

According to the quantity of described event class order from big to small from ranking results, extract described event class one by one, correspondingly random selecting central coordinate of circle from described central coordinate of circle set, it can be used as the central coordinate of circle of the round dot of the correspondence of extracted event class, the round dot radius that the quantity sentencing extracted event class at described central coordinate of circle calculates is that radius determines described round dot.

10. method according to claim 9, is characterized in that, described central coordinate of circle set is:

When described current fan ring is according to the described maximum round dot of described fan ring round dot placement strategy arrangement, the set of the coordinate in the center of circle of all described maximum round dots in this fan ring;

Wherein, described maximum round dot is the round dot with maximum radius.

11. methods according to claim 10, is characterized in that, described fan ring round dot placement strategy is:

According to the described maximum round dot of center of circle circular arc placement strategy arrangement preset on the ground floor center of circle circular arc of the outer camber line near described current fan ring, according to the described maximum round dot of described center of circle circular arc placement strategy arrangement on the second layer center of circle circular arc near described ground floor center of circle circular arc, by that analogy, according to the described maximum round dot of described center of circle circular arc placement strategy arrangement on the P layer center of circle circular arc of camber line in shown current fan ring, wherein

Described center of circle circular arc placement strategy is: the center of circle of described maximum round dot is on the circular arc of the center of circle, and adjacent two described maximum round dots are tangent, and two of circular arc two ends, the center of circle described maximum round dots are tangent with two straight lines of the contour of described current fan ring respectively,

The value of P is the round values that the ratio of R and 2r rounds downwards, wherein,

R is the radius of described current fan ring, and r is described maximum radius.

The device of 12. 1 kinds of analysiss of central issue, it is characterized in that, comprise statistical classification module (501), statistics mapping block (502), degree of polymerization deviation computing module (503) and focus judge module (504), wherein

Statistical classification module (501), in measurement period, the attribute according at least one event carries out statistical classification to event sets, obtains the statistics be made up of different event class;

Statistics mapping block (502), for the attribute according at least one event class, is mapped to the event class in the statistics from statistical classification module (501) in the corresponding event sub-block of different event block one by one;

Degree of polymerization deviation computing module (503), for according to the mapping result from statistics mapping block (502), calculates the degree of polymerization deviation of each event sub-block in each event block;

Focus judge module (504), for according to from the degree of polymerization deviation of the event sub-block of degree of polymerization deviation computing module (503) and the focus determination strategy that pre-sets, determines the focus in each event block.

13. devices according to claim 12, is characterized in that, described event sets is made up of event; The attribute of described event at least comprises: identifier, type and grade; The attribute of described event class at least comprises: the quantity of the number of the event in identifier, type, grade and expression same class event class.

14. devices according to claim 13, it is characterized in that, described degree of polymerization deviation computing module (503) at least comprises the degree of polymerization deviation computing module (503-4) of the degree of polymerization computing module (503-1) of event class, the degree of polymerization computing module (503-2) of event sub-block, average degree of polymerization computing module (503-3) and event sub-block, wherein

Degree of polymerization computing module (503-1), for according to the grade of described event class and quantity, calculates the degree of polymerization of each event class in current event block respectively;

The degree of polymerization computing module (503-2) of event sub-block, for according to the degree of polymerization from each event class of described degree of polymerization computing module (503-1), calculates the degree of polymerization of each event sub-block in described current event block;

Average degree of polymerization computing module (503-3), the degree of polymerization of each event sub-block of the quantity for the event sub-block according to described current event block and the degree of polymerization computing module (503-2) from described event sub-block, calculates the average degree of polymerization of described current event block;

The degree of polymerization deviation computing module (503-4) of event sub-block, for the degree of polymerization of each event sub-block according to the average degree of polymerization from described average degree of polymerization computing module (503-3) and the degree of polymerization computing module (503-2) from described event sub-block, calculate the degree of polymerization deviation of each event sub-block in described current event block.

15. devices according to claim 14, is characterized in that, the computing formula of the degree of polymerization A of described event class is: A=log (E*L), and wherein, E is the quantity of described event class, and L is the grade of described event class.

16. devices according to claim 15, is characterized in that:

The computing formula of the degree of polymerization As of described event sub-block is: wherein, A _nfor the degree of polymerization of event class n, N is the quantity of the event class of described current event sub-block;

Described average degree of polymerization computing formula be: wherein, As _mfor the degree of polymerization of event sub-block m, M is the quantity of the event sub-block in shown current event block;

The degree of polymerization deviation delta s of described event sub-block m _mcomputing formula be: wherein, As _mfor the degree of polymerization of event sub-block m, for described average degree of polymerization.