CN106850336B - A kind of the data stream merging method and server-side of monitoring system - Google Patents
A kind of the data stream merging method and server-side of monitoring system Download PDFInfo
- Publication number
- CN106850336B CN106850336B CN201611237212.7A CN201611237212A CN106850336B CN 106850336 B CN106850336 B CN 106850336B CN 201611237212 A CN201611237212 A CN 201611237212A CN 106850336 B CN106850336 B CN 106850336B
- Authority
- CN
- China
- Prior art keywords
- monitoring client
- server
- data
- merging
- monitoring
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Expired - Fee Related
Links
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L43/00—Arrangements for monitoring or testing data switching networks
- H04L43/02—Capturing of monitoring data
- H04L43/026—Capturing of monitoring data using flow identification
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W24/00—Supervisory, monitoring or testing arrangements
- H04W24/08—Testing, supervising or monitoring using real traffic
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
- Telephonic Communication Services (AREA)
Abstract
The present invention provides the data stream merging method and server-side of a kind of monitoring system, is related to information security field.Wherein, which comprises server-side receives the environmental data and communication data that at least one monitoring client is obtained according to initial data stream process respectively；Server-side acquires the corresponding signal strength of all devices that each monitoring client is listened to according to the environmental data；Server-side determines the similarity between every two monitoring client according to the corresponding signal strength of all devices that each monitoring client is listened to；Server-side is ranked up at least one monitoring client according to the similarity between every two monitoring client, obtains the sequence results for the communication data for merging at least one monitoring client；Server-side merges the communication data of at least one monitoring client according to the sequence results, to realize the merging of the original data stream of at least one monitoring client.By means of the invention it is possible to effectively mitigate the pressure of server-side, and it can also ensure that the integrality of data stream merging.
Description
Technical field
The present invention relates to information security fields, and in particular, to a kind of the data stream merging method and service of monitoring system
End.
Background technique
Currently, WLAN will be used wider and wider, since the signal of WLAN is by radio wave transmissions,
Theoretically the equipment around wireless access point can receive signal.Due to WLAN open characteristics bring it is all
More problem for security, for example, illegal user's access, information leakage, signal interference, camouflage address, session interception and more
Advanced more complicated attack, can jeopardize the safety of whole network.The monitoring of WLAN is monitored WLAN
Detection is the basis to the network crime investigation and evidence obtaining that are carried out using WLAN, and one WLAN of maintenance
The important means of safety.
Currently, having the research to the monitoring system of WLAN both at home and abroad, since the performance of monitoring client limits, each
Monitoring client can only monitor a channel in the same time, and be only capable of monitoring the data traffic in its signal cover, in addition,
Air interface transmission inevitably packet loss problem will occur, cause to connect vulnerable to environmental disturbances, monitoring client using mode is passively listened
The data flow received is imperfect.And the purpose of the monitoring system of WLAN is the global number that obtain entire WLAN
According to, therefore the monitoring system of single monitoring client is insufficient for monitoring the demand of entire WLAN, distributed wireless office
Domain net monitoring system is come into being.
Distributed WLAN monitoring system can dispose multiple monitoring clients in monitoring range, and it is passive that monitoring client passes through
The mode of monitoring captures data, and there are certain redundancies for monitoring client, to ensure to monitor by redundancy when there is packet loss problem
Collected data are held, complete data flow is pieced together out.The data of monitoring client acquisition are sent to server-side, server-side to data into
Row integration, obtains complete data flow.Complete data flow can be used for subsequent analysis, to find out the prestige in Wireless LAN
The side of body, and then guarantee the normal work and safety of entire Wireless LAN.
In distributed WLAN monitoring system, the Data Integration process of multiple monitoring clients generally comprises following several
A part:
(1) data prediction.In WLAN monitoring system, data needed for subsequent analysis process can be monitoring
The original data stream for holding acquisition, is also possible to data after pretreatment, for example, extracting data frame header, or filters out control
Frame etc..
(2) clock is synchronous and normalizes.Multiple monitoring clients in monitoring system, due to hardware reason, under synchronization
Clock may be not identical, therefore the data flow of orthochronous sequence in order to obtain, needs to carry out clock to multiple monitoring clients same
Step, the relative time that the timestamp and monitoring client of the beacon frame usually issued according to wireless access point listen to data frame are inclined
It moves, is monitored the clock amendment at end.In a wireless local area network, since broadcast frame and re-transmission data packet exist, monitoring system is needed
This kind of duplicate data packet is normalized.
(3) data stream merging.Data flow acquired in each monitoring client is closed after above-mentioned several steps
And line up sequentially in time, obtain a complete global data flow.It is existing than more complete wireless local area
The data merging process of net monitoring system is all chronologically to be combined the data of all central nodes, it is therefore an objective to maximum
Change the data obtained.
The data stream merging scheme of domestic and international existing distributed wireless local area network monitoring system, it is most of to use directly
Combined mode.Specifically, after multiple monitoring clients in distributed monitoring system collect data, according to the need of monitoring system
Ask, after may simply handling data, all data flows collected be transmitted directly to server-side, server-side according to when
Between sequence multiple data flows are merged, finally obtain a global data stream.It is obtained although the program can guarantee to maximize
The data in target LAN are obtained, but there is certain coincidence in the data due to acquiring between monitoring client, possible multiple monitoring clients are supervised
Control the communication data of identical equipment.Especially in the monitoring system for large-scale Wireless LAN, the deployment of monitoring client
Than comparatively dense, registration can be higher.It can have the following deficiencies: so on the one hand, when monitoring client uploads data to central node,
Web database technology is big, be easy to cause network congestion；On the other hand, central node merges in merging data and comes from different monitoring
The registration higher data at end, it is lower to the contribution for being finally fused to partial data stream, but need to expend the same time with
And capital is calculated, it results in waste of resources, inefficiency.
In order to reduce the data redudancy collected of monitoring client in distributed monitoring system, there is scholar to propose based on similar
Spend the prioritization scheme calculated.Specifically, when monitoring system starts for the first time, the initial data of acquisition is sent service by monitoring client
End, server-side calculate the data flow similarity of each pair of monitoring client according to original data content.Then, according to data flow similarity pair
Monitoring client is grouped, and the high monitoring client of similarity is classified as one group, and the data flow of one monitoring client of selection carries out in each grouping
Merge, the collected data flow of remaining monitoring client is without processing.These monitoring clients for having neither part nor lot in data merging can again again
It is deployed in other positions.It can also have the disadvantage in that on the one hand, although the program reduces the data in above scheme in this way
Stream merges step, but its algorithm itself calculates source data that amount is big, causes complexity high, in the requirement relatively of time and hardware
Stating scheme, there is no reductions, and are only applicable to the changeless Wireless LAN of topological structure；On the other hand, for wireless
For LANs-monitoring System, guarantee that the integrality of data flow is particularly significant, only in the case where obtaining partial data stream, prison
Control system can just restore complete Content of Communication, and the program cannot be guaranteed the integrality for finally obtaining data flow.
Summary of the invention
The object of the present invention is to provide the data stream merging methods and server-side of a kind of monitoring system.Wherein, the method
The technical problem to be solved is that: how effectively to mitigate the pressure of server-side in monitoring system, and guarantees that monitoring system is final and obtain
The integrality of the data flow arrived.
To achieve the goals above, the present invention provides a kind of data stream merging method of monitoring system.The described method includes:
The server-side receives the environmental data that at least one described monitoring client is obtained according to initial data stream process respectively
And communication data；
It is right respectively that the server-side according to the environmental data acquires all devices that each monitoring client is listened to
The signal strength answered；
The server-side determines every two according to the corresponding signal strength of all devices that each monitoring client is listened to
Similarity between a monitoring client；
The server-side arranges at least one described monitoring client according to the similarity between the every two monitoring client
Sequence obtains the sequence results for merging the communication data of at least one monitoring client；
The server-side merges the communication data of at least one monitoring client according to the sequence results, to realize institute
The merging of the original data stream of at least one monitoring client is stated,
Wherein, the monitoring system includes at least one monitoring client and the service that connect at least one described monitoring client
End.
Optionally, the corresponding signal strength of all devices that the server-side is listened to according to each monitoring client is true
Determine the similarity between every two monitoring client, comprising:
According to the following formula one the similarity between every two monitoring client is calculated in the server-side:
Wherein, sim (i, j) indicates the similarity between monitoring client i and monitoring client j, Sμ,iIt indicates that monitoring client i is listened to set
The signal strength of standby μ,Indicate that at least one described monitoring client listens to the average value of the signal strength of equipment μ, S respectivelyμ,j
Indicate that monitoring client j listens to the signal strength of equipment μ, U indicates all devices that at least one described monitoring client listens to respectively
Set.
Optionally, the server-side is according to the similarity between the every two monitoring client at least one described monitoring client
It is ranked up, obtains the sequence results for merging the communication data of at least one monitoring client, comprising:
The server-side is using each monitoring client as vertex, using the similarity between every two monitoring client as described in connection
The side length on the corresponding vertex of every two monitoring client, building obtain full connection figure；
The server-side carries out optimizing to the full connection figure using simulated annealing, obtains primary by each vertex
Shortest path；
The server-side is according to the corresponding relationship of the shortest path and vertex and monitoring client at least one described monitoring
End is ranked up, and obtains the sequence results for merging the communication data of at least one monitoring client.
Optionally, the server-side merges the communication data of at least one monitoring client, packet according to the sequence results
It includes:
The server-side identifies to obtain the sequence number in the data frame of the communication data according to the communication data, and will
The sequence number is compared, and obtains the first maximum sequence number and minmal sequence No. the first；
After the server-side merges the communication data of a monitoring client according to the sequence results every time, according to merging number
The sequence number in the data frame of the merging data stream is obtained according to stream identification, and the sequence number is compared, obtains second
Maximum sequence number and minmal sequence No. the second；
The server-side judge second maximum sequence number and the minmal sequence No. second respectively with described first most
Whether big sequence number and the minmal sequence No. first are all the same；
If so, the server-side does not merge the communication data of monitoring client further according to the sequence results, the merging is determined
Data flow is partial data stream, and exports the partial data stream.
Optionally, the server-side according to the sequence results merge at least one monitoring client communication data it
Afterwards, the method also includes:
The server-side judges whether this data stream merging meets and preset recalculates condition；
If it is not, the server-side persistently receives the communication that at least one described monitoring client is obtained according to initial data stream process
Data；
The server-side merges the communication data according to current sequence result.
Optionally, the environmental data includes at least one of following:
What MAC Address, the monitoring client for the equipment that the identification information of monitoring client, the monitoring client listen to listened to sets
The signal strength for the equipment that standby type and the monitoring client listen to.
Correspondingly, the present invention also provides a kind of server-sides.The server-side includes:
Receiving unit, the environment number obtained for receiving at least one described monitoring client respectively according to initial data stream process
According to and communication data；
Acquiring unit is distinguished for acquiring all devices that each monitoring client is listened to according to the environmental data
Corresponding signal strength；
Determination unit, the corresponding signal strength of all devices for being listened to according to each monitoring client determine every
Similarity between two monitoring clients；
Sequencing unit, for being carried out according to the similarity between the every two monitoring client at least one described monitoring client
Sequence obtains the sequence results for merging the communication data of at least one monitoring client；
Combining unit, for merging the communication data of at least one monitoring client according to the sequence results, thus real
The merging of the original data stream of existing at least one monitoring client.
Optionally, the determination unit, is specifically used for:
One the similarity between every two monitoring client is calculated according to the following formula:
Wherein, sim (i, j) indicates the similarity between monitoring client i and monitoring client j, Sμ,iIt indicates that monitoring client i is listened to set
The signal strength of standby μ,Indicate that at least one described monitoring client listens to the average value of the signal strength of equipment μ, S respectivelyμ,j
Indicate that monitoring client j listens to the signal strength of equipment μ, U indicates all devices that at least one described monitoring client listens to respectively
Set.
Optionally, the sequencing unit, is specifically used for:
Using each monitoring client as vertex, monitored using the similarity between every two monitoring client as the every two is linked
The side length on corresponding vertex is held, building obtains full connection figure；
Optimizing is carried out to the full connection figure using simulated annealing, obtains the shortest path primary by each vertex
Diameter；
At least one described monitoring client is ranked up according to the corresponding relationship of the shortest path and vertex and monitoring client,
Obtain the sequence results for merging the communication data of at least one monitoring client.
Optionally, the combining unit, is specifically used for:
Identify to obtain the sequence number in the data frame of the communication data according to the communication data, and by the sequence number
It is compared, obtains the first maximum sequence number and minmal sequence No. the first；
After the communication data for merging a monitoring client every time according to the sequence results, identified according to merging data stream
To the sequence number in the data frame of the merging data stream, and the sequence number is compared, obtains the second maximum sequence number
With minmal sequence No. the second；
Judge second maximum sequence number and the minmal sequence No. second respectively with first maximum sequence number and
Whether the minmal sequence No. first is all the same；
If so, not merging the communication data of monitoring client further according to the sequence results, determine that the merging data stream has been
Entire data stream, and export the partial data stream.
As shown from the above technical solution, server-side receives at least one described monitoring client according to initial data stream process respectively
Obtained environmental data and communication data；And it all is set according to what the environmental data acquired that each monitoring client listened to
Standby corresponding signal strength；It is determined further according to the corresponding signal strength of all devices that each monitoring client is listened to
Similarity between every two monitoring client；Further according to the similarity between the every two monitoring client at least one described monitoring
End is ranked up, and obtains the sequence results for merging the communication data of at least one monitoring client；Further according to the sequence results
Merge the communication data of at least one monitoring client, to realize the conjunction of the original data stream of at least one monitoring client
And it can not only effectively mitigate the pressure of server-side in monitoring system, and can also ensure that the finally obtained number of monitoring system
According to the integrality of stream.
Detailed description of the invention
In order to more clearly explain the embodiment of the invention or the technical proposal in the existing technology, to embodiment or will show below
There is attached drawing needed in technical description to be briefly described.It should be evident that the accompanying drawings in the following description is only this
Some embodiments of invention for those of ordinary skill in the art without creative efforts, can be with
Other attached drawings are obtained according to these figures.
Fig. 1 is the flow chart of the data stream merging method for the monitoring system that one embodiment of the invention provides；
Fig. 2 is the flow chart of the data stream merging method for the monitoring system that further embodiment of this invention provides；
Fig. 3 is the structural schematic diagram for the server-side that one embodiment of the invention provides；
Fig. 4 is the structural schematic diagram for the server-side that further embodiment of this invention provides.
Specific embodiment
Following will be combined with the drawings in the embodiments of the present invention, and technical solution in the embodiment of the present invention carries out clear, complete
Site preparation description, it is clear that described embodiments are only a part of the embodiments of the present invention, instead of all the embodiments.It is based on
Embodiment in the present invention, it is obtained by those of ordinary skill in the art without making creative efforts every other
Embodiment shall fall within the protection scope of the present invention.
Fig. 1 is the flow chart of the data stream merging method for the monitoring system that one embodiment of the invention provides.As shown in Figure 1,
The data stream merging method of monitoring system that one embodiment of the invention provides includes:
In step s101, the server-side receives at least one described monitoring client respectively and is obtained according to initial data stream process
The environmental data and communication data arrived.
In a particular embodiment, the n monitoring client of deployed in areas for needing to monitor in monitoring system, n monitoring client
The data in monitoring area are begun listening for and acquired, obtain original data stream, n monitoring client is respectively to the original data stream of itself
It is pre-processed to obtain environmental data and communication data.Then, the environmental data and communication number that each monitoring client obtains processing
According to being uploaded to server-side.The processing of original data stream is locally completed in monitoring client, reduces service end data calculation amount.Wherein,
Monitoring system includes at least one monitoring client and the server-side that connect at least one monitoring client.
Then, in step s 102, the server-side acquires each monitoring client according to the environmental data and is monitored
The corresponding signal strength of all devices arrived.
Wherein, the environmental data includes at least one of following: the identification information of monitoring client, the monitoring client are monitored
To equipment the type of equipment that listens to of MAC Address, the monitoring client and the signal of equipment that listens to of the monitoring client
Intensity.
And then, in step s 103, all devices that the server-side is listened to according to each monitoring client are right respectively
The signal strength answered determines the similarity between every two monitoring client.
Specifically, which includes: that the server-side one is calculated between every two monitoring client according to the following formula
Similarity:
Wherein, sim (i, j) indicates the similarity between monitoring client i and monitoring client j, Sμ,iIt indicates that monitoring client i is listened to set
The signal strength of standby μ,Indicate that at least one described monitoring client listens to the average value of the signal strength of equipment μ, S respectivelyμ,j
Indicate that monitoring client j listens to the signal strength of equipment μ, U indicates all devices that at least one described monitoring client listens to respectively
Set.
During calculating similarity, the calculating data of use are not the primitive network communication datas that monitoring client is captured
Stream, because this data volume is bigger, Space-time Complexity required for calculating is all very high.Calculate the input data of similarity
It is environmental data, which is to carry out local pretreatment after collecting original data stream by monitoring client to obtain, and incite somebody to action
Environmental data uploads to server-side.The environmental data includes the MAC Address for the equipment that each monitoring client can listen to, equipment class
Type (access point or terminal), equipment correspond to the mark of signal strength and monitoring client.
Then, in step S104, the server-side according to the similarity between the every two monitoring client to it is described extremely
A few monitoring client is ranked up, and obtains the sequence results for merging the communication data of at least one monitoring client.
Specifically, which includes: the server-side using each monitoring client as vertex, will be between every two monitoring client
Similarity obtains full connection figure as the side length for linking the corresponding vertex of the every two monitoring client, building；The service
End carries out optimizing to the full connection figure using simulated annealing, obtains the shortest path primary by each vertex；It is described
Server-side is ranked up at least one described monitoring client according to the corresponding relationship of the shortest path and vertex and monitoring client, obtains
To the sequence results for the communication data for merging at least one monitoring client.
Finally, in step s105, the server-side merges at least one monitoring client according to the sequence results
Communication data, to realize the merging of the original data stream of at least one monitoring client.
Specifically, after this step, the method also includes: the server-sides to judge whether this data stream merging is full
Foot is preset to recalculate condition；If it is not, the server-side persistently receives at least one described monitoring client according to original data stream
Handle obtained communication data；The server-side merges the communication data according to current sequence result.Wherein, it is preset again
Design conditions can be time threshold or flow threshold.
In an embodiment of the present invention, server-side by this data stream merging monitoring client acquisition data time and when
Between threshold value be compared, if in this data stream merging monitoring client acquisition data time be less than or equal to time threshold,
Be unsatisfactory for it is preset recalculate condition, otherwise, meet and preset recalculate condition.
In another embodiment of the present invention, server-side is by the flow of partial data stream obtained in this data stream merging
Value is compared with flow threshold, if the flow value of partial data stream obtained in this data stream merging is less than or equal to stream
Measure threshold value, then be unsatisfactory for it is preset recalculate condition, otherwise, meet and preset recalculate condition.
The present embodiment receives what at least one described monitoring client was obtained according to initial data stream process by server-side respectively
Environmental data and communication data；And all devices that each monitoring client is listened to are acquired according to the environmental data and are distinguished
Corresponding signal strength；Every two is determined further according to the corresponding signal strength of all devices that each monitoring client is listened to
Similarity between monitoring client；At least one described monitoring client is carried out further according to the similarity between the every two monitoring client
Sequence obtains the sequence results for merging the communication data of at least one monitoring client；Merge institute further according to the sequence results
The communication data of at least one monitoring client is stated, to realize the merging of the original data stream of at least one monitoring client, not only
The pressure of server-side in monitoring system can effectively be mitigated, and can also ensure that the complete of the finally obtained data flow of monitoring system
Whole property.
Preferably, the server-side merges the communication data of at least one monitoring client, packet according to the sequence results
Include: the server-side identifies to obtain the sequence number in the data frame of the communication data according to the communication data, and will be described
Sequence number is compared, and obtains the first maximum sequence number and minmal sequence No. the first；The server-side is according to the sequence results
After the communication data for merging a monitoring client every time, identified to obtain the data frame of the merging data stream according to merging data stream
In sequence number, and the sequence number is compared, obtains the second maximum sequence number and minmal sequence No. the second；The service
End judge second maximum sequence number and the minmal sequence No. second respectively with first maximum sequence number and described the
Whether minmal sequence No. one is all the same；If so, the server-side does not merge the communication number of monitoring client further according to the sequence results
According to determining that the merging data stream is partial data stream, and export the partial data stream.Whereby, difference can rationally be utilized
The redundant data of monitoring client acquisition, reduces the merging number of communication data, reduces the waste of resource, and the calculating number of algorithm
It is small according to measuring, while reducing computation complexity, obtain maximized partial data stream.
Fig. 2 is the flow chart of the data stream merging method for the monitoring system that further embodiment of this invention provides.Such as Fig. 2 institute
Show, it is provided in this embodiment can guaranteed efficiency can guarantee that the data stream merging method of integrality includes: again
In step 1, when monitoring system starts, n monitoring client is disposed in the region monitored, and start to supervise
It listens, acquire data.Data after pretreatment, are divided into environmental data and communication data.Meanwhile server-side maintains one and is initially
Empty equipment list, for storing MAC (Medium Access Control, the matchmaker of all devices that all monitoring clients are listened to
Body access control) address and an empty sequence table, it is suitable for storing the merging of communication data for the monitoring client being calculated
Sequence sequence.
In step 2, the environmental data that monitoring client will listen to, the MAC Address including equipment, device class (for example,
Access point or terminal), (Received Signal Strength Indicator, received signal strength refer to signal strength RSSI
Show device) it is sent to server-side；Server-side updates preset equipment list according to environmental data, is stored in the MAC Address of new equipment.
In step 3, it is assumed that the MAC Address for sharing n equipment in equipment list at this time, then the result of each monitoring client
Data are treated as the vector (k of n dimension in server-side1, k2..., kn) wherein kiIndicate that the monitoring client listens to equipment i's
Signal strength.Signal due to wireless access point (wireless access point, AP) than general equipment (such as mobile phone) is sent out
It is big to penetrate power, it is easier to it is monitored, therefore before subsequent calculating, the signal strength indication of AP is normalized, so that
It obtains suitable with the signal strength of general equipment.Then, every two in n monitoring client can be calculated according to above-mentioned formula one to supervise
Control the similarity at end.
In step 4, according to the similarity calculation of step 3 as a result, obtaining the similarity value of monitoring client between any two, root
A full connection figure can be constructed according to these values, wherein vertex is the number of each monitoring client, and the edge lengths between two vertex are
Similarity calculation result between the corresponding monitoring client in two vertex.Sequencing problem is thus modeled as TSP
(Travelling Salesman Problem, traveling salesman problem) problem.
In step 5, the TSP solution of an approximate global optimum is provided using simulated annealing, method is such as
Under:
1) initial temperature T is selected0, initial path S0；
2) current path Si=S0, Current Temperatures Tk=T0, current iteration number k=0；
3) if current iteration number reaches interior circulation stop condition, go to 4), otherwise turns 5)；
4) from SiNeighborhood in randomly choose Sj, calculate the difference Δ f=f (S of the distance function of two pathsj)-f(Si), if
Δ f < 0, current path Si=SjIf otherwiseThen current path Si=Sj, repeat 3)；
5) k=k+1, Tk+1=d (Tk), if meeting termination condition, stopping is calculated, current path is exported, otherwise goes to
3)。
Wherein, SiAnd SjIndicate path, random (0,1) indicates random function, d (Tk) indicate cooling function.
In step 6, according to the sort algorithm of step 5, a sequence results (r has been obtained1,r2,…,rn), wherein ri
The monitoring client number come in i-th bit is represented, according to this sequence results renewal sequence table.To monitoring client priority ordered, come
The data of the monitoring client high from priority first merge, and while guaranteeing to maximize fused data, reduce server-side data fusion
Calculation amount.
In step 7, the work merged at this time sequentially merges one according to the sequence results in step 6 every time
The communication data of a monitoring client not merged, and judge whether obtained complete global data at this time, if condition is set up, that
The monitoring client not merged all no longer merges, the maximized partial data stream that can be exported at this time；If also not
Complete data are obtained, then continue to merge until obtaining complete data.
In step 8, after the completion of this data stream merging, whether judgement meets at this time preset is recalculated condition.Weight
Design conditions can be time threshold or flow threshold etc..If conditions are not met, so each monitoring client will be continued for clothes
Business end sends communication data, and is merged according to current sequence table sequence；Preset item is recalculated if met at this time
Part calculates then from the beginning method reruns and renewal sequence table, communication data is merged according to new sequence table at this time.
Final server-side has obtained the collected partial data stream of monitoring client.Whereby, entire method continuous service, and it is continuous according to condition
Combined sequence table is updated, deviation can be reduced to the greatest extent in this way, obtain accurate result.Additionally it is possible to adapt to topological structure
The Wireless LAN of variation.
The present embodiment passes through similarity calculation algorithm first, finds out the monitoring client of acquisition set of metadata of similar data, this kind of monitoring client institute
The data flow height of monitoring is similar, and data content multiplicity is high, generally will not preferentially the monitoring client high to similarity merge.
Then by sort algorithm, a high-efficient collating sequence is obtained, is merged according to the sequence, finally obtains partial data
Stream not only reduces the data in distributed monitoring system and merges number, but also mitigates the load at data service end.
Data stream merging method provided in this embodiment, suitable for the WLAN monitoring system of the current overwhelming majority,
The speed for improving data fusion can be promoted to a certain extent, reduces monitoring system expense, reduced hard to equipment in monitoring system
Part requires and network bandwidth requirement.
For embodiment of the method, for simple description, therefore, it is stated as a series of action combinations, but this field
Technical staff should be aware of, and embodiment of that present invention are not limited by the describe sequence of actions, because implementing according to the present invention
Example, some steps may be performed in other sequences or simultaneously.Secondly, those skilled in the art should also know that, specification
Described in embodiment belong to preferred embodiment, the actions involved are not necessarily necessary for embodiments of the present invention.
Fig. 3 is the structural schematic diagram for the server-side that one embodiment of the invention provides.As shown in figure 3, one embodiment of the invention
The server-side of offer includes receiving unit 201, acquiring unit 202, determination unit 203, sequencing unit 204 and combining unit 205,
Wherein:
Receiving unit 201, the ring obtained for receiving at least one described monitoring client respectively according to initial data stream process
Border data and communication data；
Acquiring unit 202, for acquiring all devices that each monitoring client is listened to according to the environmental data
Corresponding signal strength；
Determination unit 203, the corresponding signal strength of all devices for being listened to according to each monitoring client are true
Determine the similarity between every two monitoring client；
Sequencing unit 204, for according to the similarity between the every two monitoring client at least one described monitoring client
It is ranked up, obtains the sequence results for merging the communication data of at least one monitoring client；
Combining unit 205, for merging the communication data of at least one monitoring client according to the sequence results, thus
Realize the merging of the original data stream of at least one monitoring client.
Server-side provided in this embodiment is suitable for the data stream merging method of the corresponding monitoring system of above embodiments, In
This is repeated no more.
The present embodiment provides a kind of server-side, receiving unit 201 receives at least one described monitoring client according to original respectively
The environmental data and communication data that Data Stream Processing obtains；Acquiring unit 202 acquires each prison according to the environmental data
The corresponding signal strength of all devices that control end is listened to；Determination unit 203 is listened to according to each monitoring client
The corresponding signal strength of all devices determines the similarity between every two monitoring client；Sequencing unit 204 is according to described every
Similarity between two monitoring clients is ranked up at least one described monitoring client, obtains merging at least one described monitoring client
Communication data sequence results；Combining unit 205 merges the communication of at least one monitoring client according to the sequence results
Data can not only effectively mitigate in monitoring system to realize the merging of the original data stream of at least one monitoring client
The pressure of server-side, and can also ensure that the integrality of the finally obtained data flow of monitoring system.
In an optional embodiment of the invention, the determination unit 203 is specifically used for:
One the similarity between every two monitoring client is calculated according to the following formula:
Wherein, sim (i, j) indicates the similarity between monitoring client i and monitoring client j, Sμ,iIt indicates that monitoring client i is listened to set
The signal strength of standby μ,Indicate that at least one described monitoring client listens to the average value of the signal strength of equipment μ, S respectivelyμ,j
Indicate that monitoring client j listens to the signal strength of equipment μ, U indicates all devices that at least one described monitoring client listens to respectively
Set.
In an optional embodiment of the invention, the sequencing unit 204 is specifically used for:
Using each monitoring client as vertex, monitored using the similarity between every two monitoring client as the every two is linked
The side length on corresponding vertex is held, building obtains full connection figure；
Optimizing is carried out to the full connection figure using simulated annealing, obtains the shortest path primary by each vertex
Diameter；
At least one described monitoring client is ranked up according to the corresponding relationship of the shortest path and vertex and monitoring client,
Obtain the sequence results for merging the communication data of at least one monitoring client.
In an optional embodiment of the invention, the combining unit 205 is specifically used for:
Identify to obtain the sequence number in the data frame of the communication data according to the communication data, and by the sequence number
It is compared, obtains the first maximum sequence number and minmal sequence No. the first；
After the communication data for merging a monitoring client every time according to the sequence results, identified according to merging data stream
To the sequence number in the data frame of the merging data stream, and the sequence number is compared, obtains the second maximum sequence number
With minmal sequence No. the second；
Judge second maximum sequence number and the minmal sequence No. second respectively with first maximum sequence number and
Whether the minmal sequence No. first is all the same；
If so, not merging the communication data of monitoring client further according to the sequence results, determine that the merging data stream has been
Entire data stream, and export the partial data stream.
Fig. 4 is the structural schematic diagram for the server-side that further embodiment of this invention provides.As shown in figure 4, the server-side packet
It includes: processor (processor) 301, memory (memory) 302, communication interface (Communications Interface)
303 and communication bus 304；
Wherein, the processor 301, memory 302, communication interface 303 are completed each other by the communication bus 304
Communication；
The communication interface 303 is for the information transmission between the server-side and at least one monitoring client；
The processor 301 is used to call the program instruction in the memory 302, to execute above-mentioned each method embodiment
Provided method, for example, the server-side receives at least one described monitoring client according to initial data stream process respectively
Obtained environmental data and communication data；The server-side acquires each monitoring client according to the environmental data and is listened to
The corresponding signal strength of all devices；The server-side is right respectively according to all devices that each monitoring client is listened to
The signal strength answered determines the similarity between every two monitoring client；The server-side is according between the every two monitoring client
Similarity is ranked up at least one described monitoring client, obtains the sequence for merging the communication data of at least one monitoring client
As a result；The server-side merges the communication data of at least one monitoring client according to the sequence results, thus described in realizing
The merging of the original data stream of at least one monitoring client.
The present embodiment discloses a kind of computer program product, and the computer program product includes being stored in non-transient calculating
Computer program on machine readable storage medium storing program for executing, the computer program include program instruction, when described program instruction is calculated
When machine executes, computer is able to carry out method provided by above-mentioned each method embodiment, for example, the server-side connects respectively
Receive environmental data and communication data that at least one described monitoring client is obtained according to initial data stream process；The server-side according to
The environmental data acquires the corresponding signal strength of all devices that each monitoring client is listened to；The server-side
The corresponding signal strength of all devices listened to according to each monitoring client determines similar between every two monitoring client
Degree；The server-side is ranked up at least one described monitoring client according to the similarity between the every two monitoring client, obtains
To the sequence results for the communication data for merging at least one monitoring client；The server-side merges institute according to the sequence results
The communication data of at least one monitoring client is stated, to realize the merging of the original data stream of at least one monitoring client.
The present embodiment provides a kind of non-transient computer readable storage medium, the non-transient computer readable storage medium
Computer instruction is stored, the computer instruction makes the computer execute method provided by above-mentioned each method embodiment, example
The server-side as described in including: receive respectively as described in the environmental data that is obtained according to initial data stream process of at least one monitoring client and
Communication data；It is right respectively that the server-side according to the environmental data acquires all devices that each monitoring client is listened to
The signal strength answered；The server-side is determined according to the corresponding signal strength of all devices that each monitoring client is listened to
Similarity between every two monitoring client；The server-side according to the similarity between the every two monitoring client to it is described at least
One monitoring client is ranked up, and obtains the sequence results for merging the communication data of at least one monitoring client；The server-side
Merge the communication data of at least one monitoring client according to the sequence results, to realize at least one monitoring client
The merging of original data stream.
Those of ordinary skill in the art will appreciate that: realize that all or part of the steps of above method embodiment can pass through
The relevant hardware of program instruction is completed, and program above-mentioned can be stored in a computer readable storage medium, the program
When being executed, step including the steps of the foregoing method embodiments is executed；And storage medium above-mentioned includes: ROM, RAM, magnetic disk or light
The various media that can store program code such as disk.
The embodiments such as server-side described above are only schematical, wherein described single as illustrated by the separation member
Member may or may not be physically separated, and component shown as a unit may or may not be physics
Unit, it can it is in one place, or may be distributed over multiple network units.It can select according to the actual needs
Some or all of the modules therein achieves the purpose of the solution of this embodiment.Those of ordinary skill in the art are not paying creation
In the case where the labour of property, it can understand and implement.
Through the above description of the embodiments, those skilled in the art can be understood that each embodiment can
It realizes by means of software and necessary general hardware platform, naturally it is also possible to pass through hardware.Based on this understanding, on
Stating technical solution, substantially the part that contributes to existing technology can be embodied in the form of software products in other words, should
Computer software product may be stored in a computer readable storage medium, such as ROM/RAM, magnetic disk, CD, including several fingers
It enables and using so that a computer equipment (can be personal computer, server or the network equipment etc.) executes each implementation
Method described in certain parts of example or embodiment.
Finally, it should be noted that the above various embodiments is only to illustrate the technical solution of the embodiment of the present invention, rather than it is right
It is limited；Although the embodiment of the present invention is described in detail referring to foregoing embodiments, the ordinary skill of this field
Personnel are it is understood that it is still possible to modify the technical solutions described in the foregoing embodiments, or to part
Or all technical features are equivalently replaced；And these are modified or replaceed, it does not separate the essence of the corresponding technical solution
The range of each embodiment technical solution of the embodiment of the present invention.
Claims (10)
1. a kind of data stream merging method of monitoring system, the monitoring system include at least two monitoring clients and with the monitoring
Hold the server-side of connection, which is characterized in that the described method includes:
The server-side receives the environmental data and communication data that the monitoring client is obtained according to initial data stream process respectively；
It is corresponding that the server-side according to the environmental data acquires all devices that each monitoring client is listened to
Signal strength；
The server-side determines that every two is supervised according to the corresponding signal strength of all devices that each monitoring client is listened to
Control the similarity between end；
The server-side is ranked up the monitoring client according to the similarity between the every two monitoring client, obtains merging institute
State the sequence results of the communication data of monitoring client；
The server-side merges the communication data of the monitoring client according to the sequence results, to realize the original of the monitoring client
The merging of beginning data flow.
2. the data stream merging method of monitoring system according to claim 1, which is characterized in that the server-side is according to every
The corresponding signal strength of all devices that a monitoring client is listened to determines the similarity between every two monitoring client, packet
It includes:
According to the following formula one the similarity between every two monitoring client is calculated in the server-side:
Wherein, sim (i, j) indicates the similarity between monitoring client i and monitoring client j, Sμ,iIndicate that monitoring client i listens to equipment μ's
Signal strength,Indicate that the monitoring client listens to the average value of the signal strength of equipment μ, S respectivelyμ,jIndicate that monitoring client j is monitored
To the signal strength of equipment μ, U indicates the set for all devices that the monitoring client listens to respectively.
3. the data stream merging method of monitoring system according to claim 1, which is characterized in that the server-side is according to institute
The similarity stated between every two monitoring client is ranked up the monitoring client, obtains the communication data for merging the monitoring client
Sequence results, comprising:
The server-side is using each monitoring client as vertex, using the similarity between every two monitoring client as connection described every two
The side length on the corresponding vertex of a monitoring client, building obtain full connection figure；
The server-side carries out optimizing to the full connection figure using simulated annealing, obtains primary most by each vertex
Short path；
The server-side is ranked up the monitoring client according to the corresponding relationship of the shortest path and vertex and monitoring client, obtains
To the sequence results for the communication data for merging the monitoring client.
4. the data stream merging method of monitoring system according to claim 1, which is characterized in that the server-side is according to institute
State the communication data that sequence results merge the monitoring client, comprising:
The server-side identifies to obtain the sequence number in the data frame of the communication data according to the communication data, and will be described
Sequence number is compared, and obtains the first maximum sequence number and minmal sequence No. the first；
After the server-side merges the communication data of a monitoring client according to the sequence results every time, according to merging data stream
Identification obtains the sequence number in the data frame of the merging data stream, and the sequence number is compared, and obtains the second maximum
Sequence number and minmal sequence No. the second；
The server-side judge second maximum sequence number and the minmal sequence No. second respectively with the described first maximum sequence
Whether row number and the minmal sequence No. first are all the same；
If so, the server-side does not merge the communication data of monitoring client further according to the sequence results, the merging data is determined
Stream is partial data stream, and exports the partial data stream.
5. the data stream merging method of monitoring system according to claim 1, which is characterized in that the server-side is according to institute
After stating the communication data that sequence results merge the monitoring client, the method also includes:
The server-side judges whether this data stream merging meets and preset recalculates condition；
If it is not, the server-side persistently receives the communication data that the monitoring client is obtained according to initial data stream process；
The server-side merges the communication data according to current sequence result.
6. the data stream merging method of monitoring system described in any one of -5 claims according to claim 1, feature
It is, the environmental data includes at least one of following:
The equipment that the MAC Address and the monitoring client for the equipment that the identification information of monitoring client, the monitoring client listen to listen to
Type.
7. a kind of server-side, which is characterized in that the server-side includes:
Receiving unit, the environmental data and communication data obtained for receiving monitoring client respectively according to initial data stream process；
Acquiring unit is respectively corresponded for acquiring all devices that each monitoring client is listened to according to the environmental data
Signal strength；
Determination unit, the corresponding signal strength of all devices for being listened to according to each monitoring client determine every two
Similarity between monitoring client；
Sequencing unit is closed for being ranked up according to the similarity between the every two monitoring client to the monitoring client
And the sequence results of the communication data of the monitoring client；
Combining unit, for merging the communication data of the monitoring client according to the sequence results, to realize the monitoring client
Original data stream merging.
8. server-side according to claim 7, which is characterized in that the determination unit is specifically used for:
One the similarity between every two monitoring client is calculated according to the following formula:
Wherein, sim (i, j) indicates the similarity between monitoring client i and monitoring client j, Sμ,iIndicate that monitoring client i listens to equipment μ's
Signal strength,Indicate that the monitoring client listens to the average value of the signal strength of equipment μ, S respectivelyμ,jIndicate that monitoring client j is monitored
To the signal strength of equipment μ, U indicates the set for all devices that the monitoring client listens to respectively.
9. server-side according to claim 7, which is characterized in that the sequencing unit is specifically used for:
Using each monitoring client as vertex, divide using the similarity between every two monitoring client as the every two monitoring client is linked
The side length on not corresponding vertex, building obtain full connection figure；
Optimizing is carried out to the full connection figure using simulated annealing, obtains the shortest path primary by each vertex；
The monitoring client is ranked up according to the corresponding relationship of the shortest path and vertex and monitoring client, is obtained described in merging
The sequence results of the communication data of monitoring client.
10. server-side according to claim 7, which is characterized in that the combining unit is specifically used for:
It identifies to obtain the sequence number in the data frame of the communication data according to the communication data, and the sequence number is carried out
Compare, obtains the first maximum sequence number and minmal sequence No. the first；
After the communication data for merging a monitoring client every time according to the sequence results, identified to obtain institute according to merging data stream
The sequence number in the data frame of merging data stream is stated, and the sequence number is compared, obtains the second maximum sequence number and
Minmal sequences No. two；
Judge second maximum sequence number and the minmal sequence No. second respectively with first maximum sequence number and described
Whether minmal sequence No. the first is all the same；
If so, not merging the communication data of monitoring client further according to the sequence results, determine that the merging data stream is complete number
According to stream, and export the partial data stream.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201611237212.7A CN106850336B (en) | 2016-12-28 | 2016-12-28 | A kind of the data stream merging method and server-side of monitoring system |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201611237212.7A CN106850336B (en) | 2016-12-28 | 2016-12-28 | A kind of the data stream merging method and server-side of monitoring system |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN106850336A CN106850336A (en) | 2017-06-13 |
| CN106850336B true CN106850336B (en) | 2019-12-03 |
Family
ID=59115317
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201611237212.7A Expired - Fee Related CN106850336B (en) | 2016-12-28 | 2016-12-28 | A kind of the data stream merging method and server-side of monitoring system |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN106850336B (en) |
Families Citing this family (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111083067B (en) * | 2018-10-19 | 2023-04-25 | 百度在线网络技术（北京）有限公司 | Method and device for splicing data streams, storage medium and terminal equipment |
| CN113434738B (en) * | 2020-03-23 | 2023-04-21 | 未来穿戴技术有限公司 | Data processing method and device of wearable device, computer device and medium |
Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US6226789B1 (en) * | 1996-01-29 | 2001-05-01 | Compaq Computer Corporation | Method and apparatus for data flow analysis |
| CN101814112A (en) * | 2010-01-11 | 2010-08-25 | 北京世纪高通科技有限公司 | Method and device for processing data |
| CN102957579A (en) * | 2012-09-29 | 2013-03-06 | 北京邮电大学 | Network anomaly traffic monitoring method and device |
| CN106060039A (en) * | 2016-05-27 | 2016-10-26 | 广东工业大学 | Classification detection method facing network abnormal data flow |
-
2016
- 2016-12-28 CN CN201611237212.7A patent/CN106850336B/en not_active Expired - Fee Related
Patent Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US6226789B1 (en) * | 1996-01-29 | 2001-05-01 | Compaq Computer Corporation | Method and apparatus for data flow analysis |
| CN101814112A (en) * | 2010-01-11 | 2010-08-25 | 北京世纪高通科技有限公司 | Method and device for processing data |
| CN102957579A (en) * | 2012-09-29 | 2013-03-06 | 北京邮电大学 | Network anomaly traffic monitoring method and device |
| CN106060039A (en) * | 2016-05-27 | 2016-10-26 | 广东工业大学 | Classification detection method facing network abnormal data flow |
Non-Patent Citations (1)
| Title |
|---|
| Mining Both Frequent and Rare Episodes in Multiple Data Streams;Zhongyi Hu，Wei Liu，Hongan Wang;《2013 10th International Conference on Fuzzy Systems and Knowledge Discovery (FSKD)》;20140519;第753-761页 * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN106850336A (en) | 2017-06-13 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN106357305B (en) | A kind of automatic network-building method, the apparatus and system of tree structure network | |
| Alam et al. | Convergence of MANET in communication among smart devices in IoT | |
| CN108964960A (en) | A kind of processing method and processing device of alarm event | |
| Alkhamisi et al. | A cross-layer framework for sensor data aggregation for IoT applications in smart cities | |
| CN107294745B (en) | Network topology automatic discovery method and device | |
| WO2016090770A1 (en) | Sending method and device for frequency point measurement message | |
| CN105790990B (en) | A kind of method and its system for supervising adapted telecommunication business | |
| CN107979810A (en) | Indoor orientation method, server and system | |
| CN106850336B (en) | A kind of the data stream merging method and server-side of monitoring system | |
| CN108184260A (en) | The network state identification method and device of Zigbee nodes | |
| US9794122B2 (en) | Method for propagating network management data for energy-efficient IoT network management and energy-efficient IoT node apparatus | |
| CN113411766A (en) | Intelligent Internet of things comprehensive sensing system and method | |
| Li et al. | Layered fault management scheme for end-to-end transmission in internet of things | |
| CN107404737A (en) | MTC terminal residence reselecting, apparatus and system | |
| CN115118647A (en) | System and method for perceiving and announcing computing power information in computing power network | |
| CN106603722B (en) | Management equipment determining method and device | |
| CN101938785A (en) | Method for balancing wireless local area network load by wireless access controller | |
| CN104053159B (en) | The frequency collocation method and device of a kind of Multi-Carrier basestation | |
| CN113660687A (en) | Network difference cell processing method, device, equipment and storage medium | |
| CN113259251A (en) | Routing networking method and device for multimode converged communication | |
| CN113131971B (en) | Networking transmission method and system of power line carrier communication gateway device based on IPv6 | |
| CN105657808B (en) | A kind of radio frequency resource control method and device | |
| Ye et al. | A security architecture based on immune agents for MANET | |
| CN110337131A (en) | A kind of method, apparatus and system of wireless distributed ad hoc network | |
| CN114040463A (en) | Networking method and device, computer readable storage medium and processor |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant | ||
| CF01 | Termination of patent right due to non-payment of annual fee |
Granted publication date: 20191203 Termination date: 20211228 |
|
| CF01 | Termination of patent right due to non-payment of annual fee |