CN109039821A - Network flow monitoring method, device, computer equipment and storage medium - Google Patents
Network flow monitoring method, device, computer equipment and storage medium Download PDFInfo
- Publication number
- CN109039821A CN109039821A CN201810955914.1A CN201810955914A CN109039821A CN 109039821 A CN109039821 A CN 109039821A CN 201810955914 A CN201810955914 A CN 201810955914A CN 109039821 A CN109039821 A CN 109039821A
- Authority
- CN
- China
- Prior art keywords
- network flow
- time point
- sampling time
- historical
- sampling
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L43/00—Arrangements for monitoring or testing data switching networks
- H04L43/08—Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
- H04L43/0876—Network utilisation, e.g. volume of load or congestion level
Landscapes
- Engineering & Computer Science (AREA)
- Environmental & Geological Engineering (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Telephonic Communication Services (AREA)
Abstract
The embodiment of the present application discloses a kind of network flow monitoring method, device, computer equipment and storage medium.This method comprises: obtaining the corresponding historical time section of Rule current time according to preset time period if current time meets preset trigger condition；Obtain the corresponding web-based history data on flows of each historical time in historical time section；According to the corresponding web-based history flow value of all identical sampling time points in historical time section, the corresponding upper limit threshold of each sampling time point and lower threshold are calculated according to default calculation formula；Current network flow data is acquired in real time, and network flow data includes the sampling time point and the corresponding network flow magnitude of the sampling time point；Current network flow is monitored according to the upper limit threshold of sampling time point in the corresponding network flow magnitude of sampling time point, historical time section and lower threshold.The accuracy and applicability of network flow monitoring can be improved in the monitoring method.
Description
Technical field
This application involves field of computer technology more particularly to a kind of network flow monitoring method, device, computer equipments
And storage medium.
Background technique
Current internet monitoring method generally can all preset an announcement when carrying out traffic monitoring to monitored object
Alert threshold value will issue alarm when the present flow rate value for monitoring monitored object is more than preset alarm threshold to prompt to supervise
Control object.
However, existing internet monitoring method, for the business scenario that required flow changes over time, with regard to nothing
Method offer accurately alerts, and reduces the accuracy rate of alarm, meanwhile, this internet monitoring method is in multiple and different business scenarios
On applicability it is poor, the flexibility of monitoring is inadequate.
Summary of the invention
This application provides a kind of network flow monitoring method, device, computer equipment and storage mediums, to improve network
The accuracy of traffic monitoring and improve applicability in different business scene.
In a first aspect, this application provides a kind of network flow monitoring methods comprising: if current time meets default touching
Clockwork spring part, according to the corresponding historical time section of current time described in preset time period acquisition Rule, wherein when the history
Between section include multiple historical times；The corresponding web-based history data on flows of each historical time in the historical time section is obtained,
Wherein, the web-based history data on flows includes multiple sampling time points and the corresponding history net of each sampling time point
Network flow value；According to the corresponding web-based history flow value of all identical sampling time points in the historical time section, according to
Default calculation formula calculates the corresponding upper limit threshold of each sampling time point and lower threshold；Current network is acquired in real time
Data on flows, wherein the network flow data includes the sampling time point and the corresponding network flow of the sampling time point
Magnitude；And according to the sampling time point in the corresponding network flow magnitude of the sampling time point, the historical time section
Upper limit threshold and lower threshold are monitored current network flow.
Second aspect, this application provides a kind of network flow monitoring devices comprising: period acquiring unit is used for
If current time meets preset trigger condition, according to preset time period obtain Rule described in current time corresponding history when
Between section, wherein the historical time section includes multiple historical times；Data capture unit, for obtaining the historical time section
The corresponding web-based history data on flows of interior each historical time, wherein when the web-based history data on flows includes multiple samplings
Between put and the corresponding web-based history flow value of each sampling time point；Threshold computation unit, for according to the history
The corresponding web-based history flow value of all identical sampling time points in period, calculates each institute according to default calculation formula
State the corresponding upper limit threshold of sampling time point and lower threshold；Acquisition unit, for acquiring current network flow data in real time,
Wherein, the network flow data includes the sampling time point and the corresponding network flow magnitude of the sampling time point；And
Monitoring unit, for according to the sampling time in the corresponding network flow magnitude of the sampling time point, the historical time section
The upper limit threshold and lower threshold of point, are monitored current network flow.
The third aspect, the application provide a kind of computer equipment again, including memory, processor and are stored in described deposit
On reservoir and the computer program that can run on the processor, the processor realizes the when executing the computer program
On the one hand the network flow monitoring method provided.
Fourth aspect, present invention also provides a kind of computer readable storage mediums, wherein the computer-readable storage
Media storage has computer program, and the computer program when being executed by a processor mentions the processor execution first aspect
The network flow monitoring method supplied.
The application provides a kind of network flow monitoring method, device, computer equipment and storage medium, when by history
Between web-based history data on flows in section analyzed to obtain the upper limit threshold and lower threshold of different sampling time points, and root
The current corresponding network flow data of sampling time point is carried out according to the upper limit threshold and lower threshold of each sampling time point
Monitoring so that network flow monitoring is more accurate, meet different business scene in different time points on it is different to flow demand
Situation.It, can be according to the web-based history data on flows in respective business scenario to current meanwhile for different business scenarios
Network flow is monitored, and improves the flexibility and applicability of network flow monitoring.In addition, since web-based history data on flows is
Change with the variation of current time, can make the upper limit threshold of different sampling time points and lower threshold can be in this way
Change with time change, the service condition appropriate adjustment upper limit threshold and lower threshold recent according to user is realized, into one
Step improves the accuracy to current network flow monitoring.
Detailed description of the invention
Technical solution in ord to more clearly illustrate embodiments of the present application, below will be to needed in embodiment description
Attached drawing is briefly described, it should be apparent that, the accompanying drawings in the following description is some embodiments of the present application, general for this field
For logical technical staff, without creative efforts, it is also possible to obtain other drawings based on these drawings.
Fig. 1 is a kind of schematic flow diagram of network flow monitoring method provided by the embodiments of the present application；
Fig. 2 is a kind of specific schematic flow diagram of network flow monitoring method provided by the embodiments of the present application；
Fig. 3 is a kind of schematic block diagram of network flow monitoring device provided by the embodiments of the present application；
Fig. 4 is a kind of another schematic block diagram of network flow monitoring device provided by the embodiments of the present application；
Fig. 5 is a kind of schematic block diagram of computer equipment provided by the embodiments of the present application.
Specific embodiment
Below in conjunction with the attached drawing in the embodiment of the present application, technical solutions in the embodiments of the present application carries out clear, complete
Site preparation description, it is clear that described embodiment is some embodiments of the present application, instead of all the embodiments.Based on this Shen
Please in embodiment, every other implementation obtained by those of ordinary skill in the art without making creative efforts
Example, shall fall in the protection scope of this application.
It should be appreciated that ought use in this specification and in the appended claims, term " includes " and "comprising" instruction
Described feature, entirety, step, operation, the presence of element and/or component, but one or more of the other feature, whole is not precluded
Body, step, operation, the presence or addition of element, component and/or its set.
It is also understood that mesh of the term used in this present specification merely for the sake of description specific embodiment
And be not intended to limit the application.As present specification and it is used in the attached claims, unless on
Other situations are hereafter clearly indicated, otherwise " one " of singular, "one" and "the" are intended to include plural form.
It will be further appreciated that the term "and/or" used in present specification and the appended claims is
Refer to any combination and all possible combinations of one or more of associated item listed, and including these combinations.
Referring to Fig. 1, Fig. 1 is a kind of schematic flow diagram of network flow monitoring method provided by the embodiments of the present application.It should
Network flow monitoring method is applied in terminal, which can be, for example, the equipment such as desktop computer, laptop computer.Such as Fig. 1 institute
Show, which includes step S101~S105.
If S101, current time meet preset trigger condition, when current according to preset time period acquisition Rule
Between corresponding historical time section, wherein the historical time section includes multiple historical times.
In one embodiment, which may be, for example, the daily zero point moment.For example, when current time is
When the July in 2018 of 00:00 on the 5th, then terminal can determine current time and meet preset trigger condition.At this point, will according to it is default when
Between section obtain the corresponding historical time section of Rule current time.
Specifically, in one embodiment, it obtains long as the preset time of initial time using the previous day of the current time
The period of degree is historical time section.For example, it is assumed that current time is 00:00 on July 5th, 2018, predetermined time period 90
It, then terminal just using 23:59 on July 4th, 2018 as initial time to 00:00 on April 5th, 2018 this 90 days for current time
Historical time section.It is daily a historical time it is understood that will include 90 days in the historical time section.
In addition, it is necessary to which explanation, preset trigger condition are not limited to above-mentioned condition, can be set according to actual needs
It sets, is not particularly limited herein.
S102, the corresponding web-based history data on flows of each historical time in the historical time section is obtained, wherein described
Web-based history data on flows includes multiple sampling time points and the corresponding web-based history flow value of each sampling time point.
In one embodiment, equipment can be acquired by network flow in each historical time according between the regular hour
Every acquisition network flow magnitude, can thus generate multiple sampling time points and the corresponding network flow magnitude of each sampling time point with
Form the corresponding web-based history data on flows of each historical time.For example, it is assumed that carry out within every 5 minutes sampling once, then every
288 sampling time points and corresponding 288 network flow magnitudes will be generated in a historical time.Network flow acquires equipment
The corresponding web-based history data on flows of each historical time of acquisition is sent to terminal.Terminal is corresponding by each historical time
Web-based history data on flows stores in the database.
Step S101 obtain historical time section after, can from database read historical time section in each historical time
Corresponding web-based history data on flows.In addition, in order to enable when web-based history data on flows can preferably react different samplings
Between put upper flow service condition, it is identical that network flow acquires sampling time point of the equipment in different historical times.
In addition, the unit of the web-based history flow value may be, for example, B, KB, MB or GB, it is not particularly limited herein.
S103, according to the corresponding web-based history flow value of all identical sampling time points in the historical time section,
The corresponding upper limit threshold of each sampling time point and lower threshold are calculated according to default calculation formula.
It for example, include 90 historical times in historical time section, the corresponding web-based history data on flows of each historical time
Inside all include the web-based history flow value of sampling time point 00:05 points of acquisitions, 90 00:05 points in historical time section are acquired
Web-based history flow value is input in default calculation formula, calculates the 00:05 points of corresponding upper limit thresholds of this sampling time point
And lower threshold.Specifically, which can be normal state distribution formula.For example, the expression of the default calculation formula
Formula may be, for example:
Wherein, x indicates that network flow magnitude, μ are all identical samplings in historical time section in above-mentioned default calculation formula
The average value of time point corresponding web-based history flow value, σ are standard deviation, and f (x) is normal distyribution function, indicate historical time
The frequency that some network flow magnitude occurs in section.The corresponding normal state of each sampling time point is being calculated according to default calculation formula
After distribution situation, the lower threshold that f (x) is met certain condition is obtained according to the corresponding normal distribution situation of each sampling time point
xminWith upper limit threshold xmax。
In one embodiment, in order to more intuitively show historical traffic service condition, after step s 103, basis is needed
Sampling time point and the corresponding upper limit threshold of each sampling time point and lower threshold in the historical time section, draw
Upper limit early warning curve and lower limit early warning curve processed simultaneously show that the upper limit early warning curve and lower limit early warning are bent in monitoring coordinate diagram
Line.Specifically, in monitoring coordinate diagram, using sampling time point as abscissa, using upper limit threshold and lower threshold as ordinate,
Upper limit early warning curve and lower limit early warning curve are drawn out in monitoring coordinate diagram.It in this way can be more intuitively by monitoring coordinate diagram
Find out the corresponding upper limit threshold of each sampling time point and lower threshold.
S104, current network flow data is acquired in real time, wherein the network flow data includes the sampling time
Point network flow magnitude corresponding with the sampling time point.
Specifically, equipment is acquired by network flow and acquires current network flow data in real time.For example, current time is
When the July in 2018 of 00:00 on the 5th, then network flow acquisition equipment can at interval of 5 minutes acquisition primary network datas on flows,
Such as, in the 00:05 acquisition time primary network data on flows of on July 5th, 2018 this day, in the primary net of 00:10 acquisition time
Network data on flows.It should be noted that no matter network flow acquisition equipment is acquiring the web-based history flow in historical time section
Data, or the network flow data that acquisition is current, the sampling time point of sampling is all the same, allows for current network in this way
Sampling time point in data on flows is identical as the sampling time point in historical time section.For example, multiple in historical time section
It include 00:05 points of this sampling time points in sampling time point, then current sampling time point also includes that 00:05 divides this to adopt
Sample time point.
In one embodiment, after step s 104, it also needs according to the sampling time point and corresponding network flow
Value draws flow curve in the monitoring coordinate diagram and shows the flow curve.It will be shown in monitoring coordinate diagram in this way
Three curves, respectively upper limit early warning curve, lower limit early warning curve and flow curve are shown.User can be by monitoring coordinate diagram
It more intuitively checks current network flow magnitude and the size relation of corresponding upper limit threshold and lower threshold, works as to understand
The service condition of preceding network flow.
S105, according to the sampling time in the corresponding network flow magnitude of the sampling time point, the historical time section
The upper limit threshold and lower threshold of point, are monitored current network flow.
Specifically, in one embodiment, as shown in Fig. 2, Fig. 2 is a kind of network flow monitoring provided by the embodiments of the present application
The specific schematic flow diagram of method.Step S105 specifically includes step S1051 and S1052.
S1051, judge whether the corresponding network flow magnitude of the sampling time point is more than described in the historical time section
The upper limit threshold and lower threshold of sampling time point simultaneously generate judging result.
S1052, current network flow is monitored according to the judging result.
For example, current sampling time point is 00:10 points, and corresponding network flow magnitude is 50M, sampling in historical time section
Time point is the corresponding upper limit threshold of 00:10 timesharing and lower threshold is respectively 100M and 60M, then can work as by comparing
Preceding network flow magnitude 50M and the size relation of upper limit threshold 100M and lower threshold 60M is monitored network flow.
Specifically, if the corresponding network flow magnitude of sampling time point is less than the upper limit of sampling time point in historical time section
The upper limit threshold of the corresponding network flow magnitude of threshold value and lower threshold, i.e. sampling time point sampling time point in historical time section
Between value and lower threshold, then illustrate that the service condition of current network flow is normal condition.Such as, it is assumed that current sampling
Time point is 00:10 point, and corresponding network flow magnitude is 50M, it is corresponding when sampling time point is 00:10 in historical time section on
It limits threshold value and lower threshold is respectively 100M and 30M, then the corresponding network flow magnitude of current sampling time point is between the upper limit
Between threshold value 100M and lower threshold 30M, illustrate that the service condition of current network flow is normal condition.If sampling time point
Corresponding network flow magnitude is more than the upper limit threshold or lower threshold of sampling time point in historical time section, i.e. sampling time point pair
When the network flow magnitude answered is greater than the upper limit threshold of sampling time point in historical time section or is less than sampling in historical time section
Between the lower threshold put, then illustrate that the service condition of current network flow is abnormality.Such as, it is assumed that when current sampling
Between point be 00:10 minute, corresponding network flow magnitude is 50M, corresponding upper limit when sampling time point is 00:10 in historical time section
Threshold value and lower threshold are respectively 100M and 60M, then the corresponding network flow magnitude of current sampling time point will be less than lower limit
Threshold value 60M determines that the service condition of current network flow is abnormality at this time.
When determining current network flow for abnormality, alarm event will be triggered.Specifically, alarm event is triggered,
Specifically include the contact method for obtaining default contact person；And alarm is sent to the default contact person according to the contact method
Notice.Wherein, contact method may include phone number, E-mail address etc..Then, further according to contact method to default contact person
Send alarm notification.For example, when contact method is E-mail address, alarm email can be sent into E-mail address, with notice
The current network flow of default contact person uses abnormal.
Network flow monitoring method in the present embodiment, by being carried out to the web-based history data on flows in historical time section
Analysis obtains the upper limit threshold and lower threshold of different sampling time points, and according to the upper limit threshold of each sampling time point and
Lower threshold is monitored the current corresponding corresponding network flow data of sampling time point, so that network flow monitoring is more
Accurately, meet different business scene in different time points on the situation different to flow demand.Meanwhile for different business fields
Scape can be monitored current network flow according to the web-based history data on flows in respective business scenario, improve network
The flexibility and applicability of traffic monitoring.In addition, due to the web-based history data on flows in the monitoring method be with it is current when
Between variation and change, can allow so different sampling time points upper limit threshold and lower threshold as the time becomes
Change and change, the realization service condition appropriate adjustment upper limit threshold and lower threshold recent according to user is further increased to working as
The accuracy of preceding network flow monitoring.
The embodiment of the present application also provides a kind of network flow monitoring device, and the network flow monitoring device is aforementioned for executing
Any one network flow monitoring method.Specifically, referring to Fig. 3, Fig. 3 is a kind of network flow prison provided by the embodiments of the present application
Control the schematic block diagram of device.Network flow monitoring device 300 can be configured in terminal.
As shown in figure 3, network flow monitoring device 300 includes period acquiring unit 301, data capture unit 302, threshold
It is worth computing unit 303, acquisition unit 304 and monitoring unit 305.
Period acquiring unit 301 is obtained according to preset time period and is advised if meeting preset trigger condition for current time
Then obtain the corresponding historical time section of the current time, wherein the historical time section includes multiple historical times.
Specifically, in one embodiment, period acquiring unit 301 is specifically used for obtaining with the previous of the current time
It is historical time section the period of the predetermined time period of initial time.
Data capture unit 302, for obtaining the corresponding web-based history stream of each historical time in the historical time section
Measure data, wherein the web-based history data on flows includes that multiple sampling time points and each sampling time point are corresponding
Web-based history flow value.
Threshold computation unit 303, for corresponding according to all identical sampling time points in the historical time section
Web-based history flow value calculates the corresponding upper limit threshold of each sampling time point and lower limit threshold according to default calculation formula
Value.
In one embodiment, which can be normal state distribution formula.
Acquisition unit 304, for acquiring current network flow data in real time, wherein the network flow data includes
The sampling time point and the corresponding network flow magnitude of the sampling time point.
Monitoring unit 305, for according to institute in the corresponding network flow magnitude of the sampling time point, the historical time section
The upper limit threshold and lower threshold for stating sampling time point, are monitored current network flow.
Specifically, in one embodiment, monitoring unit 305 is specifically used for judging the corresponding network flow of the sampling time point
Whether magnitude is more than the upper limit threshold and lower threshold of the sampling time point and to generate judging result in the historical time section；
And current network flow is monitored according to the judging result.
Further, in one embodiment, monitoring unit 305 according to the judging result to current network flow into
When row monitoring, if being less than in the historical time section described adopt specifically for the corresponding network flow magnitude of the sampling time point
The upper limit threshold and lower threshold at sample time point then determine current network flow for normal condition；If the sampling time point
Corresponding network flow magnitude is more than the upper limit threshold or lower threshold of the sampling time point in the historical time section, then determines
Current network flow is abnormality, and triggers alarm event.
Further, in one embodiment, monitoring unit 305 is specifically used for obtaining default connection when triggering alarm event
It is the contact method of people；And alarm notification is sent to the default contact person according to the contact method.
In one embodiment, as shown in figure 4, Fig. 4 is a kind of network flow monitoring device provided by the embodiments of the present application
Another schematic block diagram.The network flow monitoring device 300 further includes Drawing of Curve unit 306.
Drawing of Curve unit 306, for according to the sampling time point and each sampling in the historical time section
Time point corresponding upper limit threshold and lower threshold draw upper limit early warning curve and lower limit early warning curve and in monitoring coordinate diagram
Show the upper limit early warning curve and lower limit early warning curve.
The Drawing of Curve unit 306 is also used to according to the sampling time point and corresponding network flow magnitude, described
Flow curve is drawn in monitoring coordinate diagram and shows the flow curve.
It should be noted that it is apparent to those skilled in the art that, for convenience of description and succinctly,
The network flow monitoring device 300 of foregoing description and the specific work process of each unit can refer to aforementioned network traffic monitoring
Corresponding process in embodiment of the method, details are not described herein.
Network flow monitoring device 300 in the present embodiment, by the web-based history data on flows in historical time section
It is analyzed to obtain the upper limit threshold and lower threshold of different sampling time points, and according to the upper limit threshold of each sampling time point
Value and lower threshold are monitored the current corresponding corresponding network flow data of sampling time point, so that network flow monitoring
It is more accurate, meet different business scene in different time points on the situation different to flow demand.Meanwhile for different industry
Business scene, can be monitored current network flow according to the web-based history data on flows in respective business scenario, improve
The flexibility and applicability of network flow monitoring.In addition, due to the web-based history data on flows in the monitoring device 300 be with
The variation of current time and change, can allow so different sampling time points upper limit threshold and lower threshold with
Time change and change, realize the service condition appropriate adjustment upper limit threshold and lower threshold recent according to user, further mention
Accuracy of the height to current network flow monitoring.
Above-mentioned network flow monitoring device can be implemented as a kind of form of computer program, which can be
It is run in computer equipment as shown in Figure 5.
Referring to Fig. 5, Fig. 5 is a kind of schematic block diagram of computer equipment provided by the embodiments of the present application.The computer
500 equipment of equipment can be terminal.
Refering to Fig. 5, which includes processor 502, memory and the net connected by system bus 501
Network interface 505, wherein memory may include non-volatile memory medium 503 and built-in storage 504.
The non-volatile memory medium 503 can storage program area 5031 and computer program 5032.The computer program
5032 include program instruction, which is performed, and processor 502 may make to execute a kind of network flow monitoring method.
The processor 502 supports the operation of entire computer equipment 500 for providing calculating and control ability.
The built-in storage 504 provides environment for the operation of the computer program 5032 in non-volatile memory medium 503, should
When computer program 5032 is executed by processor 502, processor 502 may make to execute a kind of network flow monitoring method.
The network interface 505 such as sends the task dispatching of distribution for carrying out network communication.Those skilled in the art can manage
It solves, structure shown in Fig. 5, only the block diagram of part-structure relevant to application scheme, is not constituted to the application side
The restriction for the computer equipment 500 that case is applied thereon, specific computer equipment 500 may include more than as shown in the figure
Or less component, perhaps combine certain components or with different component layouts.
Wherein, the processor 502 is for running computer program 5032 stored in memory, to realize following function
Can: if current time meets preset trigger condition, current time is corresponding according to preset time period acquisition Rule is gone through
The history period, wherein the historical time section includes multiple historical times；Obtain each historical time in the historical time section
Corresponding web-based history data on flows, wherein the web-based history data on flows includes multiple sampling time points and each institute
State the corresponding web-based history flow value of sampling time point；According to all identical sampling time points pair in the historical time section
The web-based history flow value answered calculates the corresponding upper limit threshold of each sampling time point and lower limit according to default calculation formula
Threshold value；Current network flow data is acquired in real time, wherein the network flow data includes the sampling time point and described
The corresponding network flow magnitude of sampling time point；And when according to the corresponding network flow magnitude of the sampling time point, the history
Between in section the sampling time point upper limit threshold and lower threshold, current network flow is monitored.
In one embodiment, processor 502 is being executed according to the corresponding network flow magnitude of the sampling time point, described is being gone through
The upper limit threshold and lower threshold of the sampling time point in the history period, when being monitored to current network flow, specifically
It implements function such as: judging whether the corresponding network flow magnitude of the sampling time point is more than described in the historical time section adopt
The upper limit threshold and lower threshold at sample time point simultaneously generate judging result；And according to the judging result to current network flow
Amount is monitored.
In one embodiment, processor 502 is monitored current network flow according to the judging result in execution
When, it is implemented as follows function: if the corresponding network flow magnitude of the sampling time point is less than institute in the historical time section
The upper limit threshold and lower threshold for stating sampling time point then determine current network flow for normal condition；If when the sampling
Between put upper limit threshold or lower threshold of the corresponding network flow magnitude more than the sampling time point in the historical time section, then
Determine that current network flow for abnormality, and triggers alarm event.
In one embodiment, processor 502 is implemented as follows function when executing triggering alarm event: obtaining default
The contact method of contact person；And alarm notification is sent to the default contact person according to the contact method.
In one embodiment, processor 502 was executed according to all identical sampling times in the historical time section
The corresponding web-based history flow value of point, according to default calculation formula calculate the corresponding upper limit threshold of each sampling time point and
It after lower threshold, also implements function such as: according to the sampling time point and each sampling in the historical time section
Time point corresponding upper limit threshold and lower threshold draw upper limit early warning curve and lower limit early warning curve and in monitoring coordinate diagram
Show the upper limit early warning curve and lower limit early warning curve.
Correspondingly, processor 502 also implements function such as after execution acquires current network flow data in real time:
According to the sampling time point and corresponding network flow magnitude, flow curve is drawn in the monitoring coordinate diagram and shows institute
State flow curve.
In one embodiment, processor 502 is executing the current time pair according to preset time period acquisition Rule
When the historical time section answered, it is implemented as follows function: obtaining using the previous day of the current time as the default of initial time
The period of time span is historical time section.
In one embodiment, the default calculation formula is normal state distribution formula.
It should be appreciated that in the embodiment of the present application, processor 502 can be central processing unit
(CentralProcessing Unit, CPU), which can also be other general processors, digital signal processor
(Digital Signal Processor, DSP), specific integrated circuit (Application Specific
IntegratedCircuit, ASIC), ready-made programmable gate array (Field-Programmable Gate Array, FPGA)
Either other programmable logic device, discrete gate or transistor logic, discrete hardware components etc..Wherein, general procedure
Device can be microprocessor or the processor is also possible to any conventional processor etc..
A kind of computer readable storage medium is provided in another embodiment of the application.The computer readable storage medium
It is stored with computer program, so that processor is executed following procedure when wherein computer program is executed by processor: if current time
Meet preset trigger condition, according to the corresponding historical time section of current time described in preset time period acquisition Rule, wherein
The historical time section includes multiple historical times；Obtain the corresponding web-based history of each historical time in the historical time section
Data on flows, wherein the web-based history data on flows includes multiple sampling time points and each sampling time point pair
The web-based history flow value answered；According to the corresponding web-based history stream of all identical sampling time points in the historical time section
Magnitude calculates the corresponding upper limit threshold of each sampling time point and lower threshold according to default calculation formula；Acquisition in real time
Current network flow data, wherein the network flow data includes the sampling time point and the sampling time point pair
The network flow magnitude answered；And it is adopted according to described in the corresponding network flow magnitude of the sampling time point, the historical time section
The upper limit threshold and lower threshold at sample time point, are monitored current network flow.
In one embodiment, which is executed by processor according to the corresponding network flow of the sampling time point
The upper limit threshold and lower threshold of the sampling time point, supervise current network flow in value, the historical time section
When control, following procedure is specifically executed: judging whether the corresponding network flow magnitude of the sampling time point is more than the historical time
The upper limit threshold of the sampling time point and lower threshold and judging result is generated in section；And according to the judging result to working as
Preceding network flow is monitored.
In one embodiment, which is executed by processor according to the judging result to current network flow
When being monitored, following procedure is specifically executed: if the corresponding network flow magnitude of the sampling time point is less than the history
Between in section the sampling time point upper limit threshold and lower threshold, then determine current network flow for normal condition；If institute
State upper limit threshold of the corresponding network flow magnitude of sampling time point more than the sampling time point in the historical time section or under
Threshold value is limited, then determines that current network flow for abnormality, and triggers alarm event.
In one embodiment, when which is executed by processor triggering alarm event, following procedure is specifically executed:
Obtain the contact method of default contact person；And alarm notification is sent to the default contact person according to the contact method.
In one embodiment, which is executed by processor according to all identical in the historical time section
The corresponding web-based history flow value of sampling time point, according to default calculation formula calculate each sampling time point it is corresponding on
After limiting threshold value and lower threshold, following procedure is also executed: according to the sampling time point in the historical time section and each
The corresponding upper limit threshold of the sampling time point and lower threshold are drawn upper limit early warning curve and lower limit early warning curve and are being monitored
The upper limit early warning curve and lower limit early warning curve are shown in coordinate diagram.
Correspondingly, which is executed by processor acquire current network flow data in real time after, also execute
Following procedure: according to the sampling time point and corresponding network flow magnitude, it is bent that flow is drawn in the monitoring coordinate diagram
Line simultaneously shows the flow curve.
In one embodiment, the computer program be executed by processor according to preset time period obtain Rule described in when
When preceding time corresponding historical time section, also execution following procedure: obtain using the previous day of the current time as initial time
Predetermined time period period be historical time section.
In one embodiment, the default calculation formula is normal state distribution formula.
The storage medium can be USB flash disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), magnetic disk or
The various media that can store program code such as person's CD.
Those of ordinary skill in the art may be aware that list described in conjunction with the examples disclosed in the embodiments of the present disclosure
Member and algorithm steps, can be realized with electronic hardware, computer software, or a combination of the two, in order to clearly demonstrate hardware
With the interchangeability of software, each exemplary composition and step are generally described according to function in the above description.This
A little functions are implemented in hardware or software actually, the specific application and design constraint depending on technical solution.Specially
Industry technical staff can use different methods to achieve the described function each specific application, but this realization is not
It is considered as beyond scope of the present application.
In several embodiments provided herein, it should be understood that disclosed device and method can pass through it
Its mode is realized.For example, the apparatus embodiments described above are merely exemplary.For example, the division of each unit, only
Only a kind of logical function partition, there may be another division manner in actual implementation.Such as multiple units or components can be tied
Another system is closed or is desirably integrated into, or some features can be ignored or not executed.
Step in the embodiment of the present application method can be sequentially adjusted, merged and deleted according to actual needs.This Shen
Please the unit in embodiment device can be combined, divided and deleted according to actual needs.In addition, in each implementation of the application
Each functional unit in example can integrate in one processing unit, is also possible to each unit and physically exists alone, can also be with
It is that two or more units are integrated in one unit.Above-mentioned integrated unit both can take the form of hardware realization,
It can also realize in the form of software functional units.
If the integrated unit is realized in the form of SFU software functional unit and when sold or used as an independent product,
It can store in one storage medium.Based on this understanding, the technical solution of the application is substantially in other words to existing skill
The all or part of part or the technical solution that art contributes can be embodied in the form of software products, the meter
Calculation machine software product is stored in a storage medium, including some instructions are used so that a computer equipment (can be a
People's computer, terminal or network equipment etc.) execute each embodiment the method for the application all or part of the steps.
The above, the only specific embodiment of the application, but the protection scope of the application is not limited thereto, it is any
Those familiar with the art within the technical scope of the present application, can readily occur in various equivalent modifications or replace
It changes, these modifications or substitutions should all cover within the scope of protection of this application.Therefore, the protection scope of the application should be with right
It is required that protection scope subject to.
Claims (10)
1. a kind of network flow monitoring method characterized by comprising
If current time meets preset trigger condition, current time is corresponding according to preset time period acquisition Rule is gone through
The history period, wherein the historical time section includes multiple historical times；
Obtain the corresponding web-based history data on flows of each historical time in the historical time section, wherein the web-based history
Data on flows includes multiple sampling time points and the corresponding web-based history flow value of each sampling time point；
According to the corresponding web-based history flow value of all identical sampling time points in the historical time section, according to pre-designed
It calculates formula and calculates the corresponding upper limit threshold of each sampling time point and lower threshold；
Current network flow data is acquired in real time, wherein the network flow data includes the sampling time point and described
The corresponding network flow magnitude of sampling time point；And
According to the upper limit threshold of the sampling time point in the corresponding network flow magnitude of the sampling time point, the historical time section
Value and lower threshold, are monitored current network flow.
2. network flow monitoring method according to claim 1, which is characterized in that described according to the sampling time point pair
The upper limit threshold and lower threshold of the sampling time point in the network flow magnitude answered, the historical time section, to current net
Network flow is monitored, comprising:
Judge whether the corresponding network flow magnitude of the sampling time point is more than the sampling time point in the historical time section
Upper limit threshold and lower threshold and generate judging result；And
Current network flow is monitored according to the judging result.
3. network flow monitoring method according to claim 2, which is characterized in that it is described according to the judging result to working as
Preceding network flow is monitored, comprising:
If the corresponding network flow magnitude of the sampling time point is less than the upper of the sampling time point in the historical time section
Threshold value and lower threshold are limited, then determines current network flow for normal condition；And
If the corresponding network flow magnitude of the sampling time point is more than the upper limit of the sampling time point in the historical time section
Threshold value or lower threshold then determine that current network flow for abnormality, and triggers alarm event.
4. network flow monitoring method according to claim 3, which is characterized in that the triggering alarm event, comprising:
Obtain the contact method of default contact person；And
Alarm notification is sent to the default contact person according to the contact method.
5. network flow monitoring method according to claim 1, which is characterized in that described according to the historical time section
In the corresponding web-based history flow value of all identical sampling time points, calculate each sampling according to default calculation formula
After time point corresponding upper limit threshold and lower threshold, further includes: according to the sampling time point in the historical time section with
And the corresponding upper limit threshold of each sampling time point and lower threshold, draw upper limit early warning curve and lower limit early warning curve simultaneously
The upper limit early warning curve and lower limit early warning curve are shown in monitoring coordinate diagram；
After the current network flow data of the real-time acquisition, further includes: according to the sampling time point and corresponding
Network flow magnitude draws flow curve in the monitoring coordinate diagram and shows the flow curve.
6. network flow monitoring method according to claim 1, which is characterized in that the default calculation formula is normal state point
Cloth formula.
7. network flow monitoring method according to claim 1, which is characterized in that described obtained according to preset time period is advised
Then obtain the corresponding historical time section of the current time, comprising: obtain using the previous day of the current time as initial time
Predetermined time period period be historical time section.
8. a kind of network flow monitoring device characterized by comprising
Period acquiring unit obtains Rule according to preset time period if meeting preset trigger condition for current time
The corresponding historical time section of the current time, wherein the historical time section includes multiple historical times；
Data capture unit, for obtaining the corresponding web-based history data on flows of each historical time in the historical time section,
Wherein, the web-based history data on flows includes multiple sampling time points and the corresponding history net of each sampling time point
Network flow value；
Threshold computation unit, for according to the corresponding web-based history of all identical sampling time points in the historical time section
Flow value calculates the corresponding upper limit threshold of each sampling time point and lower threshold according to default calculation formula；
Acquisition unit, for acquiring current network flow data in real time, wherein the network flow data includes the sampling
Time point and the corresponding network flow magnitude of the sampling time point；And
Monitoring unit, for according to the sampling in the corresponding network flow magnitude of the sampling time point, the historical time section
The upper limit threshold and lower threshold at time point, are monitored current network flow.
9. a kind of computer equipment, including memory, processor and it is stored on the memory and can be on the processor
The computer program of operation, which is characterized in that the processor realizes such as claim 1 to 7 when executing the computer program
Any one of network flow monitoring method.
10. a kind of computer readable storage medium, which is characterized in that the computer-readable recording medium storage has computer journey
Sequence, the computer program execute the processor as described in any one of claims 1 to 7
Network flow monitoring method.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201810955914.1A CN109039821A (en) | 2018-08-21 | 2018-08-21 | Network flow monitoring method, device, computer equipment and storage medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201810955914.1A CN109039821A (en) | 2018-08-21 | 2018-08-21 | Network flow monitoring method, device, computer equipment and storage medium |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN109039821A true CN109039821A (en) | 2018-12-18 |
Family
ID=64627397
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201810955914.1A Pending CN109039821A (en) | 2018-08-21 | 2018-08-21 | Network flow monitoring method, device, computer equipment and storage medium |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN109039821A (en) |
Cited By (20)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN109120543A (en) * | 2018-08-30 | 2019-01-01 | 平安科技（深圳）有限公司 | Monitoring method, device, computer equipment and the storage medium of network flow |
| CN109660430A (en) * | 2018-12-27 | 2019-04-19 | 努比亚技术有限公司 | A kind of flux monitoring method, terminal and computer readable storage medium |
| CN110490639A (en) * | 2019-07-22 | 2019-11-22 | 精硕科技（北京）股份有限公司 | A kind of data volume monitoring method, modification method, system and computer equipment |
| CN110544130A (en) * | 2019-09-05 | 2019-12-06 | 广州时代数据服务有限公司 | flow transaction monitoring method and device, computer equipment and storage medium |
| CN110650060A (en) * | 2019-10-16 | 2020-01-03 | 中国联合网络通信集团有限公司 | Processing method, equipment and storage medium for flow alarm |
| CN111785392A (en) * | 2020-07-01 | 2020-10-16 | 医渡云（北京）技术有限公司 | Population number early warning method and device, electronic equipment and computer readable medium |
| CN111817896A (en) * | 2020-07-16 | 2020-10-23 | 中国民航信息网络股份有限公司 | Interface monitoring method and device |
| CN112751722A (en) * | 2019-10-31 | 2021-05-04 | 上海哔哩哔哩科技有限公司 | Data transmission quality monitoring method and system |
| CN112787866A (en) * | 2021-01-22 | 2021-05-11 | 北京网瑞达科技有限公司 | Method and device for determining network topological relation, electronic equipment and storage medium |
| CN113411829A (en) * | 2020-03-17 | 2021-09-17 | 中国联合网络通信集团有限公司 | Carrier configuration method, device, apparatus and storage medium |
| CN113810743A (en) * | 2021-08-26 | 2021-12-17 | 微梦创科网络科技（中国）有限公司 | Live broadcast room flow monitoring method and device |
| CN114143822A (en) * | 2021-11-05 | 2022-03-04 | 阳光电源股份有限公司 | Traffic management method, operation management platform, charging pile and storage medium |
| CN114338429A (en) * | 2021-12-30 | 2022-04-12 | 中国工商银行股份有限公司 | Network bandwidth determination method and device and electronic equipment |
| CN114726758A (en) * | 2022-06-01 | 2022-07-08 | 山东云天安全技术有限公司 | Industrial network abnormity determining method and device, computer equipment and storage medium |
| CN115022206A (en) * | 2022-06-01 | 2022-09-06 | 山东云天安全技术有限公司 | Network stability determination method and device, computer equipment and readable storage medium |
| CN115174254A (en) * | 2022-07-22 | 2022-10-11 | 科来网络技术股份有限公司 | Flow abnormity warning method and device, electronic equipment and storage medium |
| CN115208741A (en) * | 2022-07-06 | 2022-10-18 | 中国联合网络通信集团有限公司 | Fault monitoring method, device, equipment and medium based on network equipment |
| CN115514686A (en) * | 2021-06-23 | 2022-12-23 | 深信服科技股份有限公司 | Flow acquisition method and device, electronic equipment and storage medium |
| CN116740838A (en) * | 2023-08-08 | 2023-09-12 | 山东华光新材料技术有限公司 | Gas consumption data acquisition method and system for optical fiber preform production |
| CN117319322A (en) * | 2023-12-01 | 2023-12-29 | 成都睿众博芯微电子技术有限公司 | Bandwidth allocation method, device, equipment and storage medium |
Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| JP2006245993A (en) * | 2005-03-03 | 2006-09-14 | Mitsubishi Electric Corp | Network diagnostic equipment |
| CN105406991A (en) * | 2015-10-26 | 2016-03-16 | 上海华讯网络系统有限公司 | Method and system for generating service threshold by historical data based on network monitoring indexes |
| CN107086944A (en) * | 2017-06-22 | 2017-08-22 | 北京奇艺世纪科技有限公司 | A kind of method for detecting abnormality and device |
| CN107888441A (en) * | 2016-09-30 | 2018-04-06 | 全球能源互联网研究院 | A kind of network traffics baseline self study adaptive approach |
-
2018
- 2018-08-21 CN CN201810955914.1A patent/CN109039821A/en active Pending
Patent Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| JP2006245993A (en) * | 2005-03-03 | 2006-09-14 | Mitsubishi Electric Corp | Network diagnostic equipment |
| CN105406991A (en) * | 2015-10-26 | 2016-03-16 | 上海华讯网络系统有限公司 | Method and system for generating service threshold by historical data based on network monitoring indexes |
| CN107888441A (en) * | 2016-09-30 | 2018-04-06 | 全球能源互联网研究院 | A kind of network traffics baseline self study adaptive approach |
| CN107086944A (en) * | 2017-06-22 | 2017-08-22 | 北京奇艺世纪科技有限公司 | A kind of method for detecting abnormality and device |
Cited By (28)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN109120543B (en) * | 2018-08-30 | 2023-06-02 | 平安科技（深圳）有限公司 | Network traffic monitoring method and device, computer equipment and storage medium |
| CN109120543A (en) * | 2018-08-30 | 2019-01-01 | 平安科技（深圳）有限公司 | Monitoring method, device, computer equipment and the storage medium of network flow |
| CN109660430A (en) * | 2018-12-27 | 2019-04-19 | 努比亚技术有限公司 | A kind of flux monitoring method, terminal and computer readable storage medium |
| CN110490639A (en) * | 2019-07-22 | 2019-11-22 | 精硕科技（北京）股份有限公司 | A kind of data volume monitoring method, modification method, system and computer equipment |
| CN110544130A (en) * | 2019-09-05 | 2019-12-06 | 广州时代数据服务有限公司 | flow transaction monitoring method and device, computer equipment and storage medium |
| CN110650060A (en) * | 2019-10-16 | 2020-01-03 | 中国联合网络通信集团有限公司 | Processing method, equipment and storage medium for flow alarm |
| CN112751722A (en) * | 2019-10-31 | 2021-05-04 | 上海哔哩哔哩科技有限公司 | Data transmission quality monitoring method and system |
| CN113411829A (en) * | 2020-03-17 | 2021-09-17 | 中国联合网络通信集团有限公司 | Carrier configuration method, device, apparatus and storage medium |
| CN111785392B (en) * | 2020-07-01 | 2024-02-09 | 医渡云（北京）技术有限公司 | Population quantity early warning method and device, electronic equipment and computer readable medium |
| CN111785392A (en) * | 2020-07-01 | 2020-10-16 | 医渡云（北京）技术有限公司 | Population number early warning method and device, electronic equipment and computer readable medium |
| CN111817896A (en) * | 2020-07-16 | 2020-10-23 | 中国民航信息网络股份有限公司 | Interface monitoring method and device |
| CN112787866A (en) * | 2021-01-22 | 2021-05-11 | 北京网瑞达科技有限公司 | Method and device for determining network topological relation, electronic equipment and storage medium |
| CN112787866B (en) * | 2021-01-22 | 2022-10-14 | 北京网瑞达科技有限公司 | Method and device for determining network topological relation, electronic equipment and storage medium |
| CN115514686A (en) * | 2021-06-23 | 2022-12-23 | 深信服科技股份有限公司 | Flow acquisition method and device, electronic equipment and storage medium |
| CN113810743A (en) * | 2021-08-26 | 2021-12-17 | 微梦创科网络科技（中国）有限公司 | Live broadcast room flow monitoring method and device |
| CN113810743B (en) * | 2021-08-26 | 2024-06-18 | 微梦创科网络科技（中国）有限公司 | Live broadcasting room flow monitoring method and device |
| CN114143822A (en) * | 2021-11-05 | 2022-03-04 | 阳光电源股份有限公司 | Traffic management method, operation management platform, charging pile and storage medium |
| CN114143822B (en) * | 2021-11-05 | 2023-08-15 | 阳光电源股份有限公司 | Flow management method, operation management platform, charging pile and storage medium |
| CN114338429A (en) * | 2021-12-30 | 2022-04-12 | 中国工商银行股份有限公司 | Network bandwidth determination method and device and electronic equipment |
| CN114338429B (en) * | 2021-12-30 | 2024-01-30 | 中国工商银行股份有限公司 | Network bandwidth determining method and device and electronic equipment |
| CN115022206A (en) * | 2022-06-01 | 2022-09-06 | 山东云天安全技术有限公司 | Network stability determination method and device, computer equipment and readable storage medium |
| CN114726758A (en) * | 2022-06-01 | 2022-07-08 | 山东云天安全技术有限公司 | Industrial network abnormity determining method and device, computer equipment and storage medium |
| CN115208741A (en) * | 2022-07-06 | 2022-10-18 | 中国联合网络通信集团有限公司 | Fault monitoring method, device, equipment and medium based on network equipment |
| CN115174254B (en) * | 2022-07-22 | 2023-10-31 | 科来网络技术股份有限公司 | Flow abnormality warning method and device, electronic equipment and storage medium |
| CN115174254A (en) * | 2022-07-22 | 2022-10-11 | 科来网络技术股份有限公司 | Flow abnormity warning method and device, electronic equipment and storage medium |
| CN116740838A (en) * | 2023-08-08 | 2023-09-12 | 山东华光新材料技术有限公司 | Gas consumption data acquisition method and system for optical fiber preform production |
| CN117319322A (en) * | 2023-12-01 | 2023-12-29 | 成都睿众博芯微电子技术有限公司 | Bandwidth allocation method, device, equipment and storage medium |
| CN117319322B (en) * | 2023-12-01 | 2024-02-27 | 成都睿众博芯微电子技术有限公司 | Bandwidth allocation method, device, equipment and storage medium |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN109039821A (en) | Network flow monitoring method, device, computer equipment and storage medium | |
| CN107066365B (en) | System abnormity monitoring method and device | |
| US9471544B1 (en) | Anomaly detection in a signal | |
| US10061677B2 (en) | Fast automated detection of seasonal patterns in time series data without prior knowledge of seasonal periodicity | |
| US20190147300A1 (en) | Anomaly detection in multidimensional time series data | |
| CN110291541B (en) | Cognitive content filtering | |
| JP6526907B2 (en) | Performance monitoring of distributed storage systems | |
| CN109448862A (en) | A kind of health monitoring method for early warning and device | |
| CN109634819B (en) | Alarm root cause positioning method and device and electronic equipment | |
| US10949811B2 (en) | Health condition monitoring and action | |
| WO2014129983A1 (en) | Methods, systems, and devices for managing a plurality of alarms | |
| CN109743295A (en) | Access thresholds method of adjustment, device, computer equipment and storage medium | |
| CN111971942A (en) | Anomaly detection and processing of seasonal data | |
| US20180329406A1 (en) | Electrical device degradation determination | |
| CN105979532A (en) | Performance-capacity analysis early warning method and device for service processing system | |
| CN114708717A (en) | Association alarm method and device for system monitoring | |
| CN109213651A (en) | A kind of object monitor method and device, electronic equipment | |
| CN110673973A (en) | Application programming interface API (application programming interface) abnormity determining method and device | |
| JP2018093432A (en) | Determination system, determination method, and program | |
| CN111932348B (en) | Alarm method and device for abnormal order, electronic equipment and readable medium | |
| US20160174912A1 (en) | Long term harm detection wearable device | |
| CN113722177B (en) | Timing index anomaly detection method, apparatus, system, device and storage medium | |
| CN112491585B (en) | Micro-service health degree evaluation method and device | |
| CN115187364A (en) | Method and device for monitoring deposit risk under bank distributed scene | |
| JP2013182471A (en) | Load evaluation device for plant operation |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| RJ01 | Rejection of invention patent application after publication |
Application publication date: 20181218 |
|
| RJ01 | Rejection of invention patent application after publication |