CN108696389B - Network flow and protocol message analysis platform based on mass data - Google Patents

Network flow and protocol message analysis platform based on mass data Download PDF

Info

Publication number
CN108696389B
CN108696389B CN201810375418.9A CN201810375418A CN108696389B CN 108696389 B CN108696389 B CN 108696389B CN 201810375418 A CN201810375418 A CN 201810375418A CN 108696389 B CN108696389 B CN 108696389B
Authority
CN
China
Prior art keywords
data
network
storage
data unit
address
Prior art date
Application number
CN201810375418.9A
Other languages
Chinese (zh)
Other versions
CN108696389A (en
Inventor
李雨泰
陈亮
程杰
尚智婕
董希杰
王洋
Original Assignee
国家电网有限公司信息通信分公司
国网电力信息通信有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 国家电网有限公司信息通信分公司, 国网电力信息通信有限公司 filed Critical 国家电网有限公司信息通信分公司
Priority to CN201810375418.9A priority Critical patent/CN108696389B/en
Publication of CN108696389A publication Critical patent/CN108696389A/en
Application granted granted Critical
Publication of CN108696389B publication Critical patent/CN108696389B/en

Links

Classifications

    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00Arrangements for maintenance or administration or management of packet switching networks
    • H04L41/14Arrangements for maintenance or administration or management of packet switching networks involving network analysis or design, e.g. simulation, network model or planning
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00Arrangements for maintenance or administration or management of packet switching networks
    • H04L41/06Arrangements for maintenance or administration or management of packet switching networks involving management of faults or events or alarms
    • H04L41/0631Alarm or event or notifications correlation; Root cause analysis
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00Arrangements for maintenance or administration or management of packet switching networks
    • H04L41/14Arrangements for maintenance or administration or management of packet switching networks involving network analysis or design, e.g. simulation, network model or planning
    • H04L41/147Arrangements for maintenance or administration or management of packet switching networks involving network analysis or design, e.g. simulation, network model or planning for prediction of network behaviour
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00Arrangements for monitoring or testing packet switching networks
    • H04L43/02Arrangements for monitoring or testing packet switching networks involving a reduction of monitoring data
    • H04L43/028Arrangements for monitoring or testing packet switching networks involving a reduction of monitoring data using filtering
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00Arrangements for monitoring or testing packet switching networks
    • H04L43/04Processing of captured monitoring data
    • H04L43/045Processing of captured monitoring data for graphical visualization of monitoring data
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L47/00Traffic regulation in packet switching networks
    • H04L47/10Flow control or congestion control
    • H04L47/24Flow control or congestion control depending on the type of traffic, e.g. priority or quality of service [QoS]
    • H04L47/2441Flow classification
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00Network-specific arrangements or communication protocols supporting networked applications
    • H04L67/28Network-specific arrangements or communication protocols supporting networked applications for the provision of proxy services, e.g. intermediate processing or storage in the network
    • H04L67/2842Network-specific arrangements or communication protocols supporting networked applications for the provision of proxy services, e.g. intermediate processing or storage in the network for storing data temporarily at an intermediate stage, e.g. caching

Abstract

The invention provides a network flow and protocol message analysis platform based on mass data, which is used for processing and storing data in a network, and comprises: the system comprises a network flow collector, a flow data memory and an ETL data extraction tool. The invention can realize the storage of mass data of information intranet and internet outlets and the rapid backtracking analysis of historical data, so that the network analysis breaks through the time limit, and is more accurate and efficient in the aspects of data mining, tracking positioning, safety evidence obtaining and the like, thereby improving the network operation and maintenance level.

Description

Network flow and protocol message analysis platform based on mass data

Technical Field

The invention relates to the field of communication, in particular to a network flow and protocol message analysis platform based on mass data.

Background

In recent years, with continuous innovation and development of informatization of a national power grid company in company power production and operation management, various network applications emerge endlessly, and informatization technicians have more and more demands on various application systems. These applications also pose increasing problems while meeting the needs of power information services.

More and more security holes are brought by application, and the security holes become potential safety hazards of all personnel; meanwhile, some applications upload personal privacy information, which causes personal information leakage.

Some applications devote network bandwidth and affect the use of the network by other office personnel: for example, the traffic of P2P, video downloading and on-demand can occupy bandwidth resources, causing the blocking or unavailable use of key applications of other office staff, such as MAIL, ERP and the like; especially, the continuous evolution of the P2P protocol adopts the dynamic negotiation, data message encryption and other modes in the operation process, which provides more serious challenges for the identification of applications.

With the concern of an application layer in the security protection process, a deep packet detection technology and a deep stream detection technology are indispensable.

Companies have built over two hundred sets of business systems including cooperative office, mail, economic law, marketing system, and network university, covering hundreds of thousands or even millions of users throughout the company. The operation and inspection center controls some network traffic of the current network, such as port control, QOS control and the like.

However, as P2P, network video and individual application systems have a large traffic ratio in the national grid company internet outlet, some application systems have slow access or even cannot be opened.

When the network is congested, the delay of accessing the webpage is often large (about 200 ms); the time for receiving and sending the mails is slow, and more than 3 times of time is needed when the large mails are flat;

however, expanding the egress bandwidth of the intranet and the internet cannot fundamentally solve the problems of normal access of part of application systems, and the like, and all traffic needs to be collected and analyzed. In addition, in order to ensure traceability of subsequent network security problems, network traffic data needs to be stored periodically or in real time, which occupies a huge storage space, and a corresponding address information table needs to be established during storage, which also occupies system resources and causes addressing difficulty.

Disclosure of Invention

Aiming at the defects of the prior art, the invention mainly solves two problems, namely acquisition and analysis of network traffic data and storage of the traffic data.

Based on the network flow and protocol message analysis platform based on mass data, the network flow and protocol message analysis platform analyzes all network data flows (such as flows between data centers, power companies and headquarters in provinces, daily office flows and the like) and even protocol messages of the flows, and has important significance for statistics of application systems and flow protocol classification of future of national power grid companies.

Specifically, the present invention provides a mass data-based network traffic and protocol packet analysis platform, which is characterized in that the network traffic and protocol packet analysis platform comprises: the system comprises a network flow collector, a flow data memory and an ETL data extraction tool.

Preferably, the network traffic and protocol packet analysis platform further includes a data processing device, and the data processing device includes: the system comprises a user portrait module, an application portrait module, a relation analysis module and a flow prediction module.

Preferably, the data processing apparatus further comprises: and a pushing module.

Preferably, the traffic data store comprises a virtualized network storage device.

Preferably, the virtualized network storage device comprises a virtualized storage access device and a plurality of physical storages.

On the other hand, the invention provides a network traffic data processing and storing method based on mass data, which is characterized by comprising the following steps:

step 1, collecting network flow data by using a network flow collector;

step 2, caching the collected network flow data;

step 3, extracting the acquired network flow data by using an ETL data extraction tool;

step 4, classifying the extracted network flow data;

step 5, compressing the collected original data and the network flow data of each category;

and 6, classifying and storing the compressed network flow data.

The invention can realize the storage of mass data of information intranet and internet outlets and the rapid backtracking analysis of historical data, so that the network analysis breaks through the time limit, and is more accurate and efficient in the aspects of data mining, tracking positioning, safety evidence obtaining and the like, thereby improving the network operation and maintenance level.

(1) The network state is comprehensively mastered. Through the construction of the platform, the centralized monitoring management of the network is realized, various key flow data are comprehensively mastered, and particularly, key services and the running state of key network links are mastered.

(2) Network failures are quickly reproduced. Through the construction of the platform, according to the time of the fault occurrence, the fault recovery is rapidly carried out, the network fault phenomenon is reproduced, the passive mode is changed into the active mode, the reason of the fault occurrence is analyzed, and the same fault is prevented from occurring again.

Finally, the invention improves the network operation and maintenance efficiency and the operation and maintenance level by comprehensively mastering the network state, rapidly reproducing the network fault and other operation and maintenance targets.

Drawings

FIG. 1 is a schematic diagram of an analysis platform according to the present invention.

Detailed Description

The invention is described in detail below with reference to the drawings and the embodiments thereof, but the scope of the invention is not limited thereto.

Example 1

The invention provides a massive data-based network flow and protocol message analysis platform for processing and storing data in a network, aiming at the problems of storage and analysis of network flow and protocol messages of massive data exported from an information intranet and the Internet of a national network company.

The network flow and protocol message analysis platform comprises: the network flow collector, the flow data memory and the ETL data extraction tool are mutually interconnected, and a user can select according to the requirement, (1) directly store the data collected by the network flow collector and then extract the data through the ETL data extraction tool, or (2) extract the ETL data collected by the network flow collector and store the extracted data, or (3) store the data of (1) and (2).

The network flow collector is used for collecting the flow in the internet outlet of the target network, determining the destination address and the related application related to the outlet flow, and counting the flow size, the service time and the detailed flow information of each application.

The flow data memory is used for storing the data collected by the network flow collector.

The ETL data extraction tool can adopt data extraction tools such as Datastage, informatica and the like, and uses mainstream data extraction technology and analysis method to optimize operation and maintenance in the subsequent process, so that the difficulty of the existing system is solved, the storage framework with large data volume and the multi-dimensional analysis of data real-time performance and data are flexibly realized, and meanwhile, protocol message analysis is carried out on flow, so that the high-value relation is found out.

The ETL data extraction tool may be used to extract traffic trend predictions for a specified link, for a specified application, or for a specified period of time (e.g., a full day period, or a day period) for a specified period (e.g., five years later) for a specified application or class of applications.

In addition, the platform of the invention can also comprise a data display device, and through the visualization capability of the system, a user can perform graphical display of the data extraction result through interface selection operation (for example, selecting a designated cycle and a designated time period on the interface).

Preferably, the data processing device is further included, and the data processing device is configured to establish, based on the extracted data, a business model that needs to be used by the whole business scenario: applying image and flow prediction.

In the implementation of the whole service scene, the used analysis method comprises the following steps:

● simple statistics class: traffic of a link in a specified period, traffic of a specified application in a specified period, user access volume, cross-domain access volume, and the like

● data mining class: the flow direction trend of the link and the user regional distribution of the application distribution application of the link;

● Intelligent analysis class: a prediction of the classified flow of images is applied.

Preferably, the data processing apparatus may further include a message analysis apparatus, and the message analysis may be implemented by using wirereshark. By the message analysis device (module), protocol message analysis can be performed on massive data in outlet flow of an intranet and the internet, deep analysis on a TCP data stream and a UDP data stream is realized, deep analysis is performed on the transmission condition of the data and the transaction processing process of application, and the transmission process of the data is clearly shown; the method can perform key analysis on the interaction process of the protocol, find the root cause of network access abnormity and other faults in the interaction process of the protocol, and realize the rapid positioning and restoration of the network faults.

Preferably, the system further comprises a traffic intelligent scheduling module, wherein the traffic intelligent scheduling module is configured to:

1) and (3) planning the flow of the whole network: by applying visualization of the figures and visualization capacity of the flow, the current situation of the whole network flow can be analyzed integrally, and the flow planning of the whole network can be appointed by checking the flow direction information of the link and the specific application classification condition on the link. Flow control rules are generated through real-time analysis data and prediction data, statistics including link flow trend, link flow direction trend and link application classification in the analysis method, intelligent analysis including whole network flow trend prediction and application classification.

2) And generating a flow strategy according to the plan, and if the link flow is detected not to conform to the flow plan, reminding a flow user in a precise pushing mode. The traffic planning strategy may include a time-share bandwidth requirement of the traffic, a regional bandwidth requirement of the application, and a link bandwidth threshold requirement.

3) Emergency traffic control, wherein when congestion occurs in the network or is predicted, a user is notified or a traffic control strategy is issued directly to the collector, so as to control or groom low-value applications (CAR, label-printing is forwarded through strategy routing), and service strategy guarantee is performed on high-value applications (Qos strategy is configured)

4) The service model used by the whole service needs: flow trend analysis, application portrait, accurate push and intelligent flow control.

The traffic is managed and controlled by making different scheduling and management schemes according to network requirements of different applications. For example, for real-time applications sensitive to network delay, a higher bandwidth is provided to ensure transmission quality, for applications insensitive to network speed, the occupied bandwidth is dynamically limited according to time intervals or according to bandwidth utilization rate, under the premise of ensuring normal use of the applications, intranet bandwidth resources are reasonably utilized, for data transmission in backup and non-working time intervals, data transmission is scheduled to be transmitted in non-busy hours, and for data transmission in local time intervals, the data transmission is rich in local data resources, related local resource information is pushed, and remote inquiry or downloading is avoided, wide area network resources are occupied, and the like.

Preferably, an application intelligent security module for:

1) through analysis of the application system, the bandwidth situation used by the whole application system and the bandwidth situation supporting the application system are analyzed, a QoE strategy is issued to the collector, and the bandwidth for providing external services for the application system and the bandwidth for supporting the application system are guaranteed.

2) The whole analysis adopts a statistical method to support the bandwidth use condition of the system. The mining and intelligent analysis method is adopted for application relation and flow trend prediction.

The overall architecture diagram of the invention is shown in fig. 1, and the network flow collector collects real-time flow data, and the real-time flow data collection module stores the collected flow data locally, and then the ETL tool of the big data platform is used to complete data extraction and arrangement.

Example 2

In this embodiment, the storage of the network traffic data is mainly focused, the data size of the network traffic data is huge, and if a storage device is separately configured for the network traffic data, the cost is high. The storage virtualization access device referred to herein may employ a virtual storage controller or other device. When the network traffic data needs to be stored, the network traffic data is compressed into a compressed packet with a preset size and sent to the virtual storage controller, the virtual storage controller is used for controlling a storage of an analyzed target, the virtual storage controller stores the network traffic data compressed packet in a corresponding physical storage, and the plurality of physical storages form distributed storage through the virtual storage controller.

In the process of data storage by using distributed storage, a storage pool needs to be established by a plurality of storage devices through a virtual storage controller, and storage resources in the storage pool are uniformly managed and allocated. When the storage pool is managed, because distributed storage is adopted, a huge address mapping table needs to be established, each string of data of each user needs to be subjected to address mapping, and a large number of data addressing mapping tables need to be established, so that resources of the virtual storage controller are occupied, and the access efficiency is reduced.

In view of the above problems in the existing virtualized storage, the present embodiment provides a new storage method, which is particularly suitable for storing network traffic data.

The data storage method of the embodiment comprises the following steps:

step 1, storing network flow data into a single file in a compressed packet mode according to a preset size;

and 2, sending the network flow data compression packet to the virtualized storage access device.

And 3, receiving the data by the virtualization storage device, caching the data in a temporary cache (storing the data while caching), judging the size of the data compression packet, searching a blank sector in the physical storage device based on the size of the obtained total data, distributing a corresponding target storage area, and obtaining an address table of the target storage area. Then, the data compression packet is divided into a plurality of data units, when a target storage area is allocated to the data compression packet, each storage block corresponds to one data unit, when the storage area is allocated, a certain byte of storage space is reserved for at least one block in each continuous storage block (namely, the storage capacity of the storage block is slightly larger than the size of the corresponding data unit), and then, a mapping table of the target storage data and the target storage block is established. Next, the virtualized storage access device encapsulates each data unit in the received data compression packet by a storage block. When packaging, judging whether addresses of storage blocks allocated to adjacent data units are continuous or not, if the addresses allocated to the adjacent data units are continuous, directly storing the data units, and if the address of a storage area allocated to a certain data unit is not continuous with the address allocated to the previous data unit, when packaging the previous data unit, taking original written data as a data main body, and adding associated address information at the tail (or hand end) of the data main body, wherein the associated address information is stored in a storage space of reserved bytes. For example, during data storage, for a written first data unit, it is first determined whether a storage address allocated to a second data unit subsequent to the written first data unit is continuous with a storage address thereof, if so, no processing is performed, and the data unit is directly stored, if not, pre-allocated storage address information of the second data unit (or an address of a data unit stored discontinuously next) is added at the end of the data unit, and for the second data unit, it is determined whether a storage address allocated to a third data unit subsequent to the written first data unit is continuous with a storage address thereof, if so, no processing is performed, and the data unit is directly stored, if not, address information of the third data unit is added at the end of the data unit, and so on, address information of the first data unit is added at the end of the last data unit, so as to form a closed loop. And then, storing the encapsulated data according to a target storage area pre-allocated previously, deleting an address mapping table except for the address mapping table of the first data unit in the virtualized storage device, and updating only the storage address of the first data unit and the information of the whole write data into the address mapping table of the virtualized storage device.

If the user needs to read the network flow data, the operation mode is opposite to the storage mode.

Determining a first address of data to be read by a virtualization storage device, then judging whether the read data is a network flow data compression packet or not by the virtualization storage device, if not, reading normally, if so, acquiring an address corresponding to a first data unit in a single large file from an address mapping table when the network flow data compression packet is read, reading the address to a cache space, unpacking the first data unit, returning an original first data unit to a user, then judging whether the first data unit contains associated address information or not, if so, reading a next data unit according to associated address information added when the first data unit is packed, and if not, reading a second data unit in a next sequential address of the first data unit, it is returned to the user via the cloud server and so on until the last data unit is read out.

The embodiment can greatly simplify the address mapping table, so that the address mapping relation is clearer, and for the occupation condition of the address, the occupation condition of the address can be marked only by one 0-1 marking bit without being completely marked in the address mapping table, or the statistics can be carried out through the address occupation table.

The foregoing is considered as illustrative and not restrictive, and all changes that come within the spirit and scope of the invention are intended to be embraced therein.

While the principles of the invention have been described in detail in connection with the preferred embodiments thereof, it will be understood by those skilled in the art that the foregoing embodiments are merely illustrative of exemplary implementations of the invention and are not limiting of the scope of the invention. The details of the embodiments are not to be interpreted as limiting the scope of the invention, and any obvious changes, such as equivalent alterations, simple substitutions and the like, based on the technical solution of the invention, can be interpreted without departing from the spirit and scope of the invention.

Claims (3)

1. A network flow and protocol message analysis platform based on mass data is characterized in that the network flow and protocol message analysis platform is used for collecting and storing flow data in a network, and comprises: a network flow collector, a flow data memory, an ETL data extraction tool,
the traffic data store comprises a virtualized network storage device comprising a virtualized storage access device and a plurality of physical stores, the virtualized network storage device performing network traffic data storage by:
storing the network flow data into a single file in a compressed packet mode according to a preset size;
sending the network flow data compression packet to a virtualized storage access device;
the virtualized storage device receives the data, caches the data in a temporary cache, judges the size of the data compression packet, searches for a blank sector in the physical storage device based on the size of the obtained total data, allocates a corresponding target storage area, and obtains an address table of the target storage area; then, dividing the data compression packet into a plurality of data units, when a target storage area is allocated to the data compression packet, each storage block corresponds to one data unit, when the storage area is allocated, a certain byte storage space is reserved for at least one block in each continuous storage block, and then, a mapping table of target storage data and the target storage block is established;
next, the virtualized storage access device encapsulates each data unit in the received data compression packet according to a storage block, during encapsulation, determines whether addresses of the storage blocks allocated to adjacent data units are continuous, if the addresses allocated to the adjacent data units are continuous, the data units are directly stored, if the address of a storage area allocated to a certain data unit is discontinuous with the address allocated to the previous data unit, during encapsulation of the previous data unit, the original write data is used as a data main body, associated address information is added at the tail of the data main body, the associated address information is stored in a reserved byte storage space, and so on, the address information of a first data unit is added at the tail of the last data unit to form a closed loop; then, storing the packaged data according to the target storage area pre-allocated before, then deleting the address mapping table except the address mapping table of the first data unit in the virtualized storage device, only updating the storage address of the first data unit and the information of the whole write data into the address mapping table of the virtualized storage device,
when data is read, the virtualized storage device determines the first address of the data to be read, then the virtualized storage device judges whether the read data is a network flow data compression packet, if not, the read data is read normally, if the read data is the network flow data compression packet, when the read data is the network flow data compression packet, the address corresponding to the first data unit in the single large file is obtained from the address mapping table, the address is read to the cache space, the first data unit is unpacked, the original first data unit is returned to the user, then whether the first data unit contains the associated address information is judged, if the first data unit contains the associated address information, the next data unit is read according to the associated address information added when the first data unit is packed, if not, the second data unit is read in the next sequential address of the first data unit, it is returned to the user via the cloud server and so on until the last data unit is read out.
2. The network traffic and protocol message analysis platform of claim 1, further comprising a data processing device, the data processing device comprising: the system comprises a user portrait module, an application portrait module, a relation analysis module and a flow prediction module.
3. The network traffic and protocol message analysis platform of claim 2, wherein the data processing apparatus further comprises: and a pushing module.
CN201810375418.9A 2018-04-24 2018-04-24 Network flow and protocol message analysis platform based on mass data CN108696389B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN201810375418.9A CN108696389B (en) 2018-04-24 2018-04-24 Network flow and protocol message analysis platform based on mass data

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN201810375418.9A CN108696389B (en) 2018-04-24 2018-04-24 Network flow and protocol message analysis platform based on mass data

Publications (2)

Publication Number Publication Date
CN108696389A CN108696389A (en) 2018-10-23
CN108696389B true CN108696389B (en) 2020-01-03

Family

ID=63845674

Family Applications (1)

Application Number Title Priority Date Filing Date
CN201810375418.9A CN108696389B (en) 2018-04-24 2018-04-24 Network flow and protocol message analysis platform based on mass data

Country Status (1)

Country Link
CN (1) CN108696389B (en)

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102045363A (en) * 2010-12-31 2011-05-04 成都市华为赛门铁克科技有限公司 Establishment, identification control method and device for network flow characteristic identification rule
CN104079651A (en) * 2014-06-27 2014-10-01 东南大学 Broadcasting and television multi-export intelligent scheduling system and method based on SDN frame
CN106059960A (en) * 2016-05-24 2016-10-26 北京交通大学 Software defined network-based space network QoS guarantee method and management center

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN100423491C (en) * 2006-03-08 2008-10-01 杭州华三通信技术有限公司 Virtual network storing system and network storing equipment thereof
CN103152352B (en) * 2013-03-15 2016-02-10 北京邮电大学 A kind of perfect information security forensics monitor method based on cloud computing environment and system
US9838512B2 (en) * 2014-10-30 2017-12-05 Splunk Inc. Protocol-based capture of network data using remote capture agents
CN106878092A (en) * 2017-03-28 2017-06-20 上海以弈信息技术有限公司 A kind of network O&M monitor in real time of multi-source heterogeneous data fusion is presented platform with analysis
CN107846409A (en) * 2017-11-17 2018-03-27 广州葵翼信息科技有限公司 A kind of smart city network integration and safety management system

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102045363A (en) * 2010-12-31 2011-05-04 成都市华为赛门铁克科技有限公司 Establishment, identification control method and device for network flow characteristic identification rule
CN104079651A (en) * 2014-06-27 2014-10-01 东南大学 Broadcasting and television multi-export intelligent scheduling system and method based on SDN frame
CN106059960A (en) * 2016-05-24 2016-10-26 北京交通大学 Software defined network-based space network QoS guarantee method and management center

Also Published As

Publication number Publication date
CN108696389A (en) 2018-10-23

Similar Documents

Publication Publication Date Title
Kayacik et al. On the capability of an SOM based intrusion detection system
KR100523486B1 (en) Traffic measurement system and traffic analysis method thereof
Zeydan et al. Big data caching for networking: Moving from cloud to edge
CN104521199B (en) For the adaptation method of the distributed virtual switch, device and equipment
JP2008502044A (en) Performance management system and performance management method in multi-tier computing environment
EP2556632B1 (en) Real-time adaptive processing of network data packets for analysis
CN102484653B (en) Measuring attributes of client-server applications
Verma et al. A survey on network methodologies for real-time analytics of massive IoT data and open research issues
CN105005274B (en) Big data in management process control system
JP2014225237A (en) Collecting data and delivering data to big data machine in process control system
CN103609071B (en) Systems and methods for tracking application layer flow via a multi-connection intermediary device
Liu et al. Monitoring and analyzing big traffic data of a large-scale cellular network with Hadoop
US8542695B1 (en) System and method for storing/caching, searching for, and accessing data
CN104025549B (en) Postpone the related technology of information to server transaction
EP3072260B1 (en) Methods, systems, and computer readable media for a network function virtualization information concentrator
CN103392314B (en) For the system and method that the N nuclear statistics information that can expand is polymerized
TW201424305A (en) CDN load balancing in the cloud
Lichodzijewski et al. Dynamic intrusion detection using self-organizing maps
CN105224445A (en) Distributed tracking system
CN104885431A (en) Content based traffic engineering in software defined information centric networks
CN103416025A (en) Systems and methods for VLAN tagging via cloud bridge
CN104717137A (en) Managing data flows in overlay networks
CN104769582A (en) Real-time data management for a power grid
CN104052789A (en) Load balancing for a virtual networking system
CN104283948B (en) Server cluster system and its implementation of load balancing

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
CB02 Change of applicant information

Address after: 100761 room 2307, building two, No. 1, Bai Guang road, Xicheng District, Beijing.

Applicant after: State Grid Corporation Limited information and communication branch

Address before: 100761 room 2307, building two, No. 1, Bai Guang road, Xicheng District, Beijing.

Applicant before: STATE GRID INFORMATION & TELECOMMUNICATION BRANCH

CB02 Change of applicant information
TA01 Transfer of patent application right

Effective date of registration: 20190606

Address after: 100761 room 2307, building two, No. 1, Bai Guang road, Xicheng District, Beijing.

Applicant after: State Grid Corporation Limited information and communication branch

Applicant after: State Grid Power Information Communication Co., Ltd.

Address before: 100761 room 2307, building two, No. 1, Bai Guang road, Xicheng District, Beijing.

Applicant before: State Grid Corporation Limited information and communication branch

TA01 Transfer of patent application right
GR01 Patent grant
GR01 Patent grant