CN109495893B - Mobile communication data flow abnormity monitoring system - Google Patents
Mobile communication data flow abnormity monitoring system Download PDFInfo
- Publication number
- CN109495893B CN109495893B CN201811522835.8A CN201811522835A CN109495893B CN 109495893 B CN109495893 B CN 109495893B CN 201811522835 A CN201811522835 A CN 201811522835A CN 109495893 B CN109495893 B CN 109495893B
- Authority
- CN
- China
- Prior art keywords
- time
- unit
- abnormal
- flow
- real
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W28/00—Network traffic management; Network resource management
- H04W28/02—Traffic management, e.g. flow control or congestion control
- H04W28/0215—Traffic management, e.g. flow control or congestion control based on user or device properties, e.g. MTC-capable devices
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
- H04L63/1425—Traffic logging, e.g. anomaly detection
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1441—Countermeasures against malicious traffic
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/08—Access security
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W28/00—Network traffic management; Network resource management
- H04W28/02—Traffic management, e.g. flow control or congestion control
- H04W28/10—Flow control between communication endpoints
Abstract
The invention discloses a mobile communication data flow abnormity monitoring system, which comprises a flow monitoring unit, an information following unit, a flow analysis unit, a personal database, a processor, a display unit, an event recording unit, a reminding unit and a data confirmation unit, wherein the flow monitoring unit is used for monitoring the flow of mobile communication data; the traffic monitoring unit is used for monitoring communication traffic of the communication equipment, the communication traffic comprises data traffic and real-time rate information, the data traffic is the total amount of data traffic consumption up to the current month, and the real-time rate information is the real-time network speed during network access; the method comprises the steps of monitoring the data traffic service condition of the mobile equipment in real time through a traffic monitoring unit, then transmitting communication traffic to a traffic analysis unit, and then obtaining an instant stable value Qj by combining the traffic analysis unit with an anomaly analysis step; and then calculating a stability difference value according to the instant stability value Qj, and judging whether the data flow access of the user is abnormal or not according to the stability difference value.
Description
Technical Field
The invention belongs to the field of mobile communication, relates to a data traffic abnormity monitoring technology, and particularly relates to a mobile communication data traffic abnormity monitoring system.
Background
At present, with the progress and scientific development of society, mobile phones are more and more intelligent, and corresponding mobile phone functions are more and more powerful, and at the same time, a large part of the corresponding powerful functions are realized based on mobile data traffic, and the "mobile data traffic" refers to data traffic generated by surfing the internet or using related data value-added services through mobile communication technologies such as GPRS, EDGE, TD-SCDMA, HSDPA, WCDMA, LTE and the like, does not include traffic generated by surfing the internet through other modes such as WLAN, CSD and the like, does not include data traffic verified by content-charged data value-added services (multimedia messages, number steward, full-song download, instant messaging and the like), and does not include data traffic generated by group client and industry applications such as Blackberry, Pushmail, M2M and the like.
Mobile data traffic unit conversion relationship: 1024Byte ═ 1 KB; 1024KB 1 MB; 1024 MB-1 GB; 1024GB ═ 1 TB.
However, with the prevalence of access data and mobile data traffic, a lot of troubles are brought at the same time, and due to the opening of a network, a situation that some software maliciously falsifies a mobile phone exists, so that a large amount of data traffic is accessed, and a situation that the mobile data traffic is abnormal occurs due to other reasons, so that a user unconsciously consumes a large amount of data traffic, and meanwhile, high traffic cost is brought; this undoubtedly brings about great trouble and loss to the user; in order to solve the technical problem, a technical means is provided.
Disclosure of Invention
The invention aims to provide a mobile communication data flow abnormity monitoring system.
The technical problem to be solved by the invention is as follows:
(1) how to judge the real-time mobile data traffic abnormal habit;
(2) how to sort out the daily use habits of data traffic of users;
(3) how to judge whether the traffic practical situation of the user is abnormal or not according to the daily use habit of the data traffic of the user.
The purpose of the invention can be realized by the following technical scheme:
a mobile communication data flow abnormity monitoring system comprises a flow monitoring unit, an information following unit, a flow analysis unit, a personal database, a processor, a display unit, an event recording unit, a reminding unit and a data confirmation unit;
the traffic monitoring unit is used for monitoring communication traffic of the communication equipment, the communication traffic comprises data traffic and real-time rate information, the data traffic is the total amount of data traffic consumption up to the current month, and the real-time rate information is the real-time network speed during network access;
the flow monitoring unit is used for transmitting the communication flow to the information following unit and the flow analysis unit;
the traffic analysis unit is used for receiving the communication traffic transmitted by the traffic monitoring unit and performing anomaly analysis on the communication traffic, and the anomaly analysis steps are specifically represented as follows:
the method comprises the following steps: the method comprises the steps that a traffic monitoring unit is used for collecting communication traffic of a user, and real-time rate information of network access of the user is collected once every preset time T1; t1 is a preset value;
step two: acquiring front X1 groups of real-time rate information, taking the front X1 groups of real-time rate information as basic real-time rate information, and marking the basic real-time rate information as Vi, i is 1.. X1;
step three: and calculating an initial stable value Qz of the basic real-time rate information according to a formula, wherein the specific calculation process is as follows:
s1: first, the basic mean value of the basic real-time rate information is calculated according to a formulaCalculating to obtain a basic average value;
s2: according to the formulaCalculating to obtain an initial stable value Qz;
step four: continuously collecting real-time speed information to obtain VX1+jN, j ═ 1.. n; the verification operation is carried out when the real-time rate information after the basic real-time rate information is collected, and the method specifically comprises the following steps:
s1: calculating an instantaneous mean value P2 using the formula
S2: calculating an instant stable value Qj, j being 1.. n;
is calculated by the formula
Step five: and judging the instant stable value Qj, wherein the specific judgment process is as follows:
s1: calculating a first stable difference value Qc1 using the formula Qc1 ═ Q1-Qz | when j is equal to 1, and generating an abnormality confirmation signal when Qc1 is greater than a preset value X2;
s2: when j is greater than 1, using formula Qcj＝|Qj-Qj-1Calculating to obtain an instant stability difference value Qcj, wherein j is 1.. n;
s3: generating an abnormal confirmation signal when the immediate stability difference Qcj is greater than a preset value X2;
the flow analysis unit transmits an abnormal confirmation signal to the processor when generating the abnormal confirmation signal, the processor transmits the confirmation signal to the reminding unit when receiving the abnormal confirmation signal transmitted by the flow analysis unit, the reminding unit sends an alarm when receiving the confirmation signal transmitted by the processor, reminds a user of paying attention to the abnormal flow and transmits the confirmation signal to the data confirmation unit to remind the user of confirming the current flow consumption, the user inputs confirmation information through the data confirmation unit, the confirmation information comprises continuous access and access refusal, network access is continued when the user transmits the continuous access to the processor through the data confirmation unit, and the network access is interrupted when the user transmits the access refusal to the processor through the data confirmation unit;
the processor transmits an abnormal flow signal to the display unit when receiving the abnormal confirmation signal transmitted by the flow analysis unit, and the display unit receives the abnormal flow signal transmitted by the processor and displays the abnormal flow consumption in real time, please notice the word;
the information following unit is used for following and analyzing the communication flow to obtain the user flow consumption habit, and the specific following and analyzing steps are as follows:
the method comprises the following steps: when the monitoring starts, the initial month is a habit observation period;
step two: and monitoring the access habits of the user in a habit observation period, wherein the specific monitoring process is as follows:
s1: firstly, receiving communication flow transmitted by a flow monitoring unit by using an information following unit;
s2: acquiring the average flow consumption value of a user every day in an observation period and marking the average consumption value as Jz;
s3: acquiring real-time rate information in the communication flow, comparing the real-time rate information with a preset rate Vy, and marking a time period which exceeds the preset rate Vy every day and is kept for more than a preset time as a high-speed time period Gpi, wherein i is 1.
S4: obtaining a plurality of high speed time periods Gpi, defining the same high speed time period and the occurrence frequency, wherein the specific definition is as follows:
F. optionally for a period of time;
G. judging the crossing condition between the time period and other time periods;
H. when the time period is not crossed with other time periods, judging that the two time periods are not crossed, and enabling the two corresponding time periods to appear once;
I. when the time period is crossed with other time periods, the starting time of the time period is changed to the ending time of other time periods, a new high-speed time period is positioned, and the occurrence frequency of the new high-speed time period is marked as one time;
J. selecting the next time period, repeating the steps B-E until all the high-speed time periods are defined, and obtaining a new high-speed time period and corresponding occurrence times;
s4: sorting the high-speed time periods from large to small according to the occurrence times of the high-speed time periods, and marking X3 names before ranking as common time periods, wherein X3 is a preset value;
step three: taking a month as a boundary after the habit observation period, bringing the month into the habit observation period every month, and repeating the step two;
the information following unit is used for transmitting the common time period and the consumption average value Jz to the personal database for storage;
the flow analysis unit is also used for monitoring and analyzing the real-time communication flow of the next month after the habit observation period according to the personal database, and the specific analysis steps are as follows:
the method comprises the following steps: acquiring real-time rate information in communication traffic;
step two: when the real-time rate information exceeds a preset value, the current time can be automatically acquired;
step three: acquiring a common time period and a consumption average value Jz in a personal database;
step four: comparing the current time with the common time period, and generating an abnormal time period signal when the current time is more than a preset time away from the common time period;
step five: and meanwhile, acquiring a real-time average value of the data flow in the month, and generating an abnormal consumption signal when the real-time average value is larger than the consumption average value Jz and the difference value is more than a preset value.
Further, the flow analysis unit transmits the abnormal period signal to the processor when generating the abnormal period signal, and the processor drives the display unit to display the word "abnormal period access overspeed" when receiving the abnormal period signal transmitted by the flow analysis unit.
Further, the processor transmits a time interval abnormal signal to the reminding unit when receiving an abnormal time interval signal transmitted by the flow analysis unit, the reminding unit interrupts the current network access and transmits a confirmation signal to the data confirmation unit when receiving the time interval abnormal signal transmitted by the processor, the data confirmation unit is used for a user to confirm continuous access when receiving the confirmation signal, and the user continues to access the network only when transmitting the confirmation signal to the processor through the data confirmation unit;
and the processor can be used for stamping the abnormal time period signal transmitted by the flow analysis unit and storing the abnormal time period signal in the time recording unit when receiving the abnormal time period signal.
Further, the flow analysis unit transmits the abnormal consumption signal to the processor when generating the abnormal consumption signal, the processor transmits the abnormal consumption information to the display unit when receiving the abnormal consumption signal transmitted by the flow analysis unit, and the display unit displays that the average consumed flow value does not conform to personal habits and please notice when receiving the abnormal consumption information transmitted by the processor.
The invention has the beneficial effects that:
(1) the method comprises the steps of monitoring the data traffic service condition of the mobile equipment in real time through a traffic monitoring unit, then transmitting communication traffic to a traffic analysis unit, and then obtaining an instant stable value Qj by combining the traffic analysis unit with an anomaly analysis step; then, calculating a stability difference value according to the instant stability value Qj, and judging whether the data flow access of the user is abnormal or not according to the stability difference value;
(2) the invention can continuously track the flow use condition of the user through the setting of the information following unit, and takes an initial month as a habit observation period from the beginning of monitoring by means of a following analysis step; monitoring the access habits of the users in a habit observation period, and obtaining the average consumption value and the common time period of the users when the users access the data traffic by monitoring the access habits of the users;
(3) after the average consumption value and the common time period of the user during data flow access are obtained, the real-time access condition of the user is supervised according to the flow analysis unit, if the abnormal data flow high-speed access condition inconsistent with the habit of the user occurs, the access is immediately and temporarily interrupted, the user is reminded to confirm the data access, and the user can continue to access only after confirming; meanwhile, after the first habit observation period passes and a month passes, the just-passed month is brought into the habit observation period of the user, so that habit data of the user is continuously corrected, and the judgment precision is improved; meanwhile, the event recording unit can record the abnormal access condition of the user and summarize the abnormal condition of the user through the timestamp; the invention is simple, effective and easy to use.
Drawings
In order to facilitate understanding for those skilled in the art, the present invention will be further described with reference to the accompanying drawings.
FIG. 1 is a block diagram of the system of the present invention.
Detailed Description
As shown in fig. 1, a mobile communication data traffic anomaly monitoring system includes a traffic monitoring unit, an information following unit, a traffic analyzing unit, a personal database, a processor, a display unit, an event recording unit, a reminding unit, and a data confirming unit;
the traffic monitoring unit is used for monitoring communication traffic of the communication equipment, the communication traffic comprises data traffic and real-time rate information, the data traffic is the total amount of data traffic consumption up to the current month, and the real-time rate information is the real-time network speed during network access;
the flow monitoring unit is used for transmitting the communication flow to the information following unit and the flow analysis unit;
the traffic analysis unit is used for receiving the communication traffic transmitted by the traffic monitoring unit and performing anomaly analysis on the communication traffic, and the anomaly analysis steps are specifically represented as follows:
the method comprises the following steps: the method comprises the steps that a traffic monitoring unit is used for collecting communication traffic of a user, and real-time rate information of network access of the user is collected once every preset time T1; t1 is a preset value;
step two: acquiring front X1 groups of real-time rate information, taking the front X1 groups of real-time rate information as basic real-time rate information, and marking the basic real-time rate information as Vi, i is 1.. X1;
step three: and calculating an initial stable value Qz of the basic real-time rate information according to a formula, wherein the specific calculation process is as follows:
s1: first, the basic mean value of the basic real-time rate information is calculated according to a formulaCalculating to obtain a basic average value;
s2: according to the formulaCalculating to obtain an initial stable value Qz;
step four: continuously collecting real-time speed information to obtain VX1+jN, j ═ 1.. n; the verification operation is carried out when the real-time rate information after the basic real-time rate information is collected, and the method specifically comprises the following steps:
s1: calculating an instantaneous mean value P2 using the formula
S2: calculating an instant stable value Qj, j being 1.. n;
is calculated by the formula
Step five: and judging the instant stable value Qj, wherein the specific judgment process is as follows:
s1: calculating a first stable difference value Qc1 using the formula Qc1 ═ Q1-Qz | when j is equal to 1, and generating an abnormality confirmation signal when Qc1 is greater than a preset value X2;
s2: when j is greater than 1, using formula Qcj＝|Qj-Qj-1Calculating to obtain an instant stability difference value Qcj, wherein j is 1.. n;
s3: generating an abnormal confirmation signal when the immediate stability difference Qcj is greater than a preset value X2;
the flow analysis unit transmits an abnormal confirmation signal to the processor when generating the abnormal confirmation signal, the processor transmits the confirmation signal to the reminding unit when receiving the abnormal confirmation signal transmitted by the flow analysis unit, the reminding unit sends an alarm when receiving the confirmation signal transmitted by the processor, reminds a user of paying attention to the abnormal flow and transmits the confirmation signal to the data confirmation unit to remind the user of confirming the current flow consumption, the user inputs confirmation information through the data confirmation unit, the confirmation information comprises continuous access and access refusal, network access is continued when the user transmits the continuous access to the processor through the data confirmation unit, and the network access is interrupted when the user transmits the access refusal to the processor through the data confirmation unit;
the processor transmits an abnormal flow signal to the display unit when receiving the abnormal confirmation signal transmitted by the flow analysis unit, and the display unit receives the abnormal flow signal transmitted by the processor and displays the abnormal flow consumption in real time, please notice the word;
the information following unit is used for following and analyzing the communication flow to obtain the user flow consumption habit, and the specific following and analyzing steps are as follows:
the method comprises the following steps: when the monitoring starts, the initial month is a habit observation period;
step two: and monitoring the access habits of the user in a habit observation period, wherein the specific monitoring process is as follows:
s1: firstly, receiving communication flow transmitted by a flow monitoring unit by using an information following unit;
s2: acquiring the average flow consumption value of a user every day in an observation period and marking the average consumption value as Jz;
s3: acquiring real-time rate information in the communication flow, comparing the real-time rate information with a preset rate Vy, and marking a time period which exceeds the preset rate Vy every day and is kept for more than a preset time as a high-speed time period Gpi, wherein i is 1.
S4: obtaining a plurality of high speed time periods Gpi, defining the same high speed time period and the occurrence frequency, wherein the specific definition is as follows:
K. optionally for a period of time;
l, judging the crossing condition between the time period and other time periods;
m, when the time period is not crossed with other time periods, judging that the two time periods are not crossed and corresponding to the two time periods once;
n, when the time period is crossed with other time periods, the starting time of the time period is changed to the ending time of the other time periods, a new high-speed time period is positioned, and the occurrence frequency of the new high-speed time period is marked as one time;
o, selecting the next time period, repeating the steps B-E until all the high-speed time periods are defined, and obtaining a new high-speed time period and corresponding occurrence times;
s4: sorting the high-speed time periods from large to small according to the occurrence times of the high-speed time periods, and marking X3 names before ranking as common time periods, wherein X3 is a preset value;
step three: taking a month as a boundary after the habit observation period, bringing the month into the habit observation period every month, and repeating the step two;
the information following unit is used for transmitting the common time period and the consumption average value Jz to the personal database for storage;
the flow analysis unit is also used for monitoring and analyzing the real-time communication flow of the next month after the habit observation period according to the personal database, and the specific analysis steps are as follows:
the method comprises the following steps: acquiring real-time rate information in communication traffic;
step two: when the real-time rate information exceeds a preset value, the current time can be automatically acquired;
step three: acquiring a common time period and a consumption average value Jz in a personal database;
step four: comparing the current time with the common time period, and generating an abnormal time period signal when the current time is more than a preset time away from the common time period;
step five: meanwhile, acquiring a real-time average value of the data flow in the month, and generating an abnormal consumption signal when the real-time average value is larger than the consumption average value Jz and the difference value is more than a preset value;
the flow analysis unit transmits an abnormal time period signal to the processor when generating the abnormal time period signal, and the processor drives the display unit to display an 'abnormal time period access overspeed' word eye when receiving the abnormal time period signal transmitted by the flow analysis unit; the processor transmits a time interval abnormal signal to the reminding unit when receiving an abnormal time interval signal transmitted by the flow analysis unit, the reminding unit interrupts the current network access and transmits a confirmation signal to the data confirmation unit when receiving the time interval abnormal signal transmitted by the processor, the data confirmation unit is used for a user to confirm continuous access when receiving the confirmation signal, and the user can continue to access the network only when transmitting the confirmation signal to the processor through the data confirmation unit;
the processor can stamp the abnormal time interval signal transmitted by the flow analysis unit and store the abnormal time interval signal in the time recording unit when receiving the abnormal time interval signal;
the flow analysis unit transmits the abnormal consumption signal to the processor when generating the abnormal consumption signal, the processor transmits the abnormal consumption information to the display unit when receiving the abnormal consumption signal transmitted by the flow analysis unit, and the display unit displays that the consumption flow average value does not accord with personal habits and please notice when receiving the abnormal consumption information transmitted by the processor.
A mobile communication data flow abnormity monitoring system, when working, firstly detecting communication flow in real time through a flow monitoring unit, then carrying out abnormity analysis on the communication flow through a flow analysis unit, if the real-time communication flow is judged to be abnormal according to the abnormity analysis, reminding a user to pay attention through a reminding unit, and determining whether to continue to carry out data network access; the data flow access is continued only when the user selects to continue the access; then, a habit observation period is established through an information following unit, the flow use condition of the user is known, and the habit observation period is recorded as data; taking the data as reference, detecting the traffic use condition of the user in one month after the habit observation period according to the traffic analysis unit, and reminding when abnormal conditions occur, so as to prevent the data traffic from exceeding the standard under the condition that the user is not aware of;
the invention has the following beneficial effects:
(1) the method comprises the steps of monitoring the data traffic service condition of the mobile equipment in real time through a traffic monitoring unit, then transmitting communication traffic to a traffic analysis unit, and then obtaining an instant stable value Qj by combining the traffic analysis unit with an anomaly analysis step; then, calculating a stability difference value according to the instant stability value Qj, and judging whether the data flow access of the user is abnormal or not according to the stability difference value;
(2) the invention can continuously track the flow use condition of the user through the setting of the information following unit, and takes an initial month as a habit observation period from the beginning of monitoring by means of a following analysis step; monitoring the access habits of the users in a habit observation period, and obtaining the average consumption value and the common time period of the users when the users access the data traffic by monitoring the access habits of the users;
(3) after the average consumption value and the common time period of the user during data flow access are obtained, the real-time access condition of the user is supervised according to the flow analysis unit, if the abnormal data flow high-speed access condition inconsistent with the habit of the user occurs, the access is immediately and temporarily interrupted, the user is reminded to confirm the data access, and the user can continue to access only after confirming; meanwhile, after the first habit observation period passes and a month passes, the just-passed month is brought into the habit observation period of the user, so that habit data of the user is continuously corrected, and the judgment precision is improved; meanwhile, the event recording unit can record the abnormal access condition of the user and summarize the abnormal condition of the user through the timestamp; the invention is simple, effective and easy to use.
The foregoing is merely exemplary and illustrative of the present invention and various modifications, additions and substitutions may be made by those skilled in the art to the specific embodiments described without departing from the scope of the invention as defined in the following claims.
Claims (4)
1. A mobile communication data flow abnormity monitoring system is characterized by comprising a flow monitoring unit, an information following unit, a flow analysis unit, a personal database, a processor, a display unit, an event recording unit, a reminding unit and a data confirmation unit;
the traffic monitoring unit is used for monitoring communication traffic of the communication equipment, the communication traffic comprises data traffic and real-time rate information, the data traffic is the total amount of data traffic consumption up to the current month, and the real-time rate information is the real-time network speed during network access;
the flow monitoring unit is used for transmitting the communication flow to the information following unit and the flow analysis unit;
the traffic analysis unit is used for receiving the communication traffic transmitted by the traffic monitoring unit and performing anomaly analysis on the communication traffic, and the anomaly analysis steps are specifically represented as follows:
the method comprises the following steps: the method comprises the steps that a traffic monitoring unit is used for collecting communication traffic of a user, and real-time rate information of network access of the user is collected once every preset time T1; t1 is a preset value;
step two: obtained to X1Group real-time rate information, will front X1The group real-time rate information is used as basic real-time rate information, and the basic real-time rate information is marked as Vi，i＝1...X1；
Step three: calculating to obtain an initial stable value Q of basic real-time rate information according to a formulazThe specific calculation process is as follows:
s1: first, the basic mean value of the basic real-time rate information is calculated according to a formulaCalculating to obtain a basic average value;
s2: according to the formulaCalculating to obtain an initial stable value Qz；
Step four: continuously collecting real-time rate information to obtainN 1.. n; the verification operation is carried out when the real-time rate information after the basic real-time rate information is collected, and the method specifically comprises the following steps:
s1: calculating an instantaneous mean value P2 using the formula
S2: calculating the instantaneous stability value Qj ，j＝1...n；
Is calculated by the formula
Step five: for the real-time stable value QjAnd (3) judging, wherein the specific judging process is as follows:
s1: when j equals 1, utilizeFormula Qc1＝|Q1-QzI calculate a first stable difference value Qc1When Q isc1Generating an abnormal confirmation signal when the value is larger than a preset value X2;
s2: when j is greater than 1, using formula Qcj＝|Qj-Qj-1I calculating to obtain an instant stable difference value Qcj，j＝1...n；
S3: when-the-time stable difference QcjGenerating an abnormal confirmation signal when the value is larger than a preset value X2;
the flow analysis unit transmits an abnormal confirmation signal to the processor when generating the abnormal confirmation signal, the processor transmits the confirmation signal to the reminding unit when receiving the abnormal confirmation signal transmitted by the flow analysis unit, the reminding unit sends an alarm when receiving the confirmation signal transmitted by the processor, reminds a user of paying attention to the abnormal flow and transmits the confirmation signal to the data confirmation unit to remind the user of confirming the current flow consumption, the user inputs confirmation information through the data confirmation unit, the confirmation information comprises continuous access and access refusal, network access is continued when the user transmits the continuous access to the processor through the data confirmation unit, and the network access is interrupted when the user transmits the access refusal to the processor through the data confirmation unit;
the processor transmits an abnormal flow signal to the display unit when receiving the abnormal confirmation signal transmitted by the flow analysis unit, and the display unit receives the abnormal flow signal transmitted by the processor and displays the abnormal flow consumption in real time, please notice the word;
the information following unit is used for following and analyzing the communication flow to obtain the user flow consumption habit, and the specific following and analyzing steps are as follows:
the method comprises the following steps: when the monitoring starts, the initial month is a habit observation period;
step two: and monitoring the access habits of the user in a habit observation period, wherein the specific monitoring process is as follows:
s1: firstly, receiving communication flow transmitted by a flow monitoring unit by using an information following unit;
s2: acquiring the average flow consumption value of a user every day in an observation period and marking the average consumption value as Jz;
s3: acquiring real-time rate information in the communication flow, comparing the real-time rate information with a preset rate Vy, and marking a time period which exceeds the preset rate Vy every day and is kept for more than a preset time as a high-speed time period Gpi, wherein i is 1.
S4: obtaining a plurality of high speed time periods Gpi, defining the same high speed time period and the occurrence frequency, wherein the specific definition is as follows:
A. optionally for a period of time;
B. judging the crossing condition between the time period and other time periods;
C. when the time period is not crossed with other time periods, judging that the two time periods are not crossed, and enabling the two corresponding time periods to appear once;
D. when the time period is crossed with other time periods, the starting time of the time period is changed to the ending time of other time periods, a new high-speed time period is positioned, and the occurrence frequency of the new high-speed time period is marked as one time;
E. selecting the next time period, repeating the steps B-E until all the high-speed time periods are defined, and obtaining a new high-speed time period and corresponding occurrence times;
s5: sorting the high-speed time periods from large to small according to the occurrence times of the high-speed time periods, and marking X3 names before ranking as common time periods, wherein X3 is a preset value;
step three: taking a month as a boundary after the habit observation period, bringing the month into the habit observation period every month, and repeating the step two;
the information following unit is used for transmitting the common time period and the consumption average value Jz to the personal database for storage;
the flow analysis unit is also used for monitoring and analyzing the real-time communication flow of the next month after the habit observation period according to the personal database, and the specific analysis steps are as follows:
the method comprises the following steps: acquiring real-time rate information in communication traffic;
step two: when the real-time rate information exceeds a preset value, the current time can be automatically acquired;
step three: acquiring a common time period and a consumption average value Jz in a personal database;
step four: comparing the current time with the common time period, and generating an abnormal time period signal when the current time is more than a preset time away from the common time period;
step five: and meanwhile, acquiring a real-time average value of the data flow in the month, and generating an abnormal consumption signal when the real-time average value is larger than the consumption average value Jz and the difference value is more than a preset value.
2. The system as claimed in claim 1, wherein the traffic analysis unit transmits the abnormal time period signal to the processor when generating the abnormal time period signal, and the processor drives the display unit to display the word "abnormal time period access overspeed" when receiving the abnormal time period signal transmitted by the traffic analysis unit.
3. The system according to claim 2, wherein the processor transmits a period abnormal signal to the reminding unit when receiving the abnormal period signal transmitted by the flow analysis unit, the reminding unit interrupts the current network access and transmits a confirmation signal to the data confirmation unit when receiving the period abnormal signal transmitted by the processor, the data confirmation unit is used for a user to confirm the continued access when receiving the confirmation signal, and the user continues to access the network only when transmitting the confirmation signal to the processor through the data confirmation unit;
and the processor can be used for stamping the abnormal time period signal transmitted by the flow analysis unit and storing the abnormal time period signal in the time recording unit when receiving the abnormal time period signal.
4. The system as claimed in claim 1, wherein the traffic analysis unit transmits the abnormal consumption signal to the processor when generating the abnormal consumption signal, the processor transmits the abnormal consumption information to the display unit when receiving the abnormal consumption signal transmitted by the traffic analysis unit, and the display unit displays that the average consumed traffic value does not conform to personal habits and please note when receiving the abnormal consumption information transmitted by the processor.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201811522835.8A CN109495893B (en) | 2018-12-13 | 2018-12-13 | Mobile communication data flow abnormity monitoring system |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201811522835.8A CN109495893B (en) | 2018-12-13 | 2018-12-13 | Mobile communication data flow abnormity monitoring system |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN109495893A CN109495893A (en) | 2019-03-19 |
| CN109495893B true CN109495893B (en) | 2019-12-24 |
Family
ID=65710101
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201811522835.8A Active CN109495893B (en) | 2018-12-13 | 2018-12-13 | Mobile communication data flow abnormity monitoring system |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN109495893B (en) |
Families Citing this family (9)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN109819470B (en) * | 2019-03-20 | 2022-03-01 | 安徽威尔信通信科技有限责任公司 | WIFI flow distribution system based on big data analysis |
| CN109903185B (en) * | 2019-04-01 | 2022-12-23 | 国家电网有限公司 | Power communication unified resource management system based on cloud computing |
| CN110031371B (en) * | 2019-04-29 | 2022-05-06 | 李旭 | Environmental monitoring device that building engineering used |
| CN110445564B (en) * | 2019-08-16 | 2021-12-07 | 广西电网有限责任公司 | Electric power wireless private network interference monitoring system based on Internet of things |
| CN110795306B (en) * | 2019-10-15 | 2024-02-02 | 深圳市高德信通信股份有限公司 | Network security management and control system based on real-time monitoring |
| CN110798850B (en) * | 2019-10-15 | 2022-09-06 | 深圳市高德信通信股份有限公司 | Operator network access method |
| CN110830464B (en) * | 2019-10-31 | 2021-06-29 | 深圳市高德信通信股份有限公司 | Network flow abnormity detection system |
| CN110855840B (en) * | 2019-11-29 | 2022-02-11 | 合肥开元埃尔软件有限公司 | Mobile phone safety switching system based on combination of network pushing and active scanning |
| CN115396295A (en) * | 2021-05-24 | 2022-11-25 | 中兴通讯股份有限公司 | Equipment operation and maintenance method, network equipment and storage medium |
Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2015170452A1 (en) * | 2014-05-08 | 2015-11-12 | パナソニック インテレクチュアル プロパティ コーポレーション オブ アメリカ | In-car network system, electronic control unit and update processing method |
| CN106664254A (en) * | 2014-08-21 | 2017-05-10 | 七网络有限责任公司 | Optimizing network traffic management in a mobile network |
| CN107231348A (en) * | 2017-05-17 | 2017-10-03 | 桂林电子科技大学 | A kind of network flow abnormal detecting method based on relative entropy theory |
-
2018
- 2018-12-13 CN CN201811522835.8A patent/CN109495893B/en active Active
Patent Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2015170452A1 (en) * | 2014-05-08 | 2015-11-12 | パナソニック インテレクチュアル プロパティ コーポレーション オブ アメリカ | In-car network system, electronic control unit and update processing method |
| CN106664254A (en) * | 2014-08-21 | 2017-05-10 | 七网络有限责任公司 | Optimizing network traffic management in a mobile network |
| CN107231348A (en) * | 2017-05-17 | 2017-10-03 | 桂林电子科技大学 | A kind of network flow abnormal detecting method based on relative entropy theory |
Non-Patent Citations (1)
| Title |
|---|
| 网络流量测量与识别关键技术研究;侯颖;《中国博士学位论文全文数据库 信息科技辑》;20160731;全文 * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN109495893A (en) | 2019-03-19 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN109495893B (en) | Mobile communication data flow abnormity monitoring system | |
| CN107169744B (en) | Time limit monitoring method and system for electronic work order | |
| CN112653636B (en) | Network data intelligent distribution service system | |
| CN111553633A (en) | Engineering cost management system and method | |
| CN104883705B (en) | A kind of the problem of data service is complained localization method and device | |
| CN103197660A (en) | Electronic display board system for production management and display method thereof | |
| CN109858807A (en) | A kind of method and system of enterprise operation monitoring | |
| US20130117275A1 (en) | Index monitoring system, index monitoring method and program | |
| CN110262955B (en) | Application performance monitoring tool based on pinpoint | |
| WO2019237534A1 (en) | System component display method and apparatus, and readable storage medium and terminal device | |
| US20010047416A1 (en) | Network administration system and method of re-arranging network resources | |
| CN112785276B (en) | Engineering consultation management system and method | |
| CN110689381B (en) | Early warning method and device | |
| CN110399242B (en) | Information maintenance management system based on Hadoop platform | |
| CN110838952B (en) | Network flow monitoring management system and method | |
| CN113065894A (en) | Data collection method and device based on user portrait and order analysis and storage medium | |
| CN112000551A (en) | Machine tool monitoring method, device, system, electronic device and storage medium | |
| CN111626881A (en) | Annuity combination risk management system, method, server and storage medium | |
| CN107301484A (en) | A kind of control point method to set up and device | |
| CN110989454A (en) | Energy consumption management system and method based on cloud platform | |
| CN110309153B (en) | Method, system, equipment and storage medium for processing monitoring data of call center | |
| CN116052404B (en) | 5G communication technology-based power grid data interaction system | |
| CN117634750B (en) | Carbon emission index information generation method and device, electronic equipment and medium | |
| CN113986911B (en) | Information acquisition method and system for monitoring racing field operation | |
| CN105101243B (en) | A kind of method, apparatus and system distributing alarm work order |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant | ||
| TA01 | Transfer of patent application right | ||
| TA01 | Transfer of patent application right |
Effective date of registration: 20191204 Address after: Room 308, building a, 3 / F, Tianhui building, Donghuan 1st Road, Fukang community, Longhua street, Longhua District, Shenzhen City, Guangdong Province Applicant after: Shenzhen meikela Network Technology Co., Ltd Address before: 438700 Xingang No.2 Road, Huangzhou District, Huanggang City, Hubei Province, 146 Applicant before: Ye Donghai |