CN112087350A

CN112087350A - Method, device, system and medium for monitoring network access line flow

Info

Publication number: CN112087350A
Application number: CN202010983098.2A
Authority: CN
Inventors: 徐晨灿; 宫晨; 袁宁; 夏刚
Original assignee: Industrial and Commercial Bank of China Ltd ICBC
Current assignee: Industrial and Commercial Bank of China Ltd ICBC
Priority date: 2020-09-17
Filing date: 2020-09-17
Publication date: 2020-12-15
Anticipated expiration: 2040-09-17
Also published as: CN112087350B

Abstract

The present disclosure provides a method for monitoring traffic of a network access line, the method comprising: acquiring historical traffic of a network access line in a historical periods aiming at a target period, wherein the target period comprises b target sub-periods, and each historical period comprises one historical sub-period corresponding to each target sub-period; determining a traffic threshold value of the network access line for each target sub-period according to the historical traffic of a historical sub-periods corresponding to each target sub-period to obtain a group b of traffic threshold values; monitoring the actual flow of the network access line in each target sub-period to obtain a group of actual flows aiming at each target sub-period; and generating alarm information under the condition that the network access line is determined to have abnormity according to the m groups of actual flows and the m groups of flow thresholds aiming at the m sub-periods. The present disclosure also provides a traffic monitoring apparatus of a network access line, a computer system and a computer-readable storage medium.

Description

Method, device, system and medium for monitoring network access line flow

Technical Field

The present disclosure relates to the field of internet technologies, and in particular, to a method, an apparatus, a system, and a medium for monitoring traffic of a network access line.

Background

With the development of the internet, the "internet +" model has penetrated all walks of life. For various industries (e.g., banking), the internet has become an important channel for users to transact business. And the online transaction service carries out the interaction of data inside and outside the enterprise through a network access line. Therefore, in order to ensure the normal use of the service function on the line, it is necessary to monitor the traffic on the network access line.

In implementing the disclosed concept, the inventors found that there are at least the following problems in the related art: in the conventional traffic monitoring, a fixed threshold is manually set for each network access line, and an alarm is generated if the traffic on the line exceeds the threshold. This approach has the disadvantages of being both labor intensive and inaccurate in thresholding. For convenience, the related art also sets a fixed threshold for each line using a percentage of the line bandwidth, e.g., generating an alarm if the line bandwidth exceeds 80% of the maximum. Therefore, each line in the related art only has a fixed threshold value, and cannot adapt to the characteristic that the flow rate changes remarkably along with time. The monitoring mode has a large number of blind areas, which is not beneficial to the rapid discovery and treatment of flow abnormity, and causes great hidden trouble in the operation of the online business handling function.

Disclosure of Invention

In view of the above, the present disclosure provides a method and an apparatus for traffic monitoring of a network access line, which can dynamically adjust a traffic threshold over time.

One aspect of the present disclosure provides a method for monitoring traffic of a network access line, including: acquiring historical traffic of a network access line in a historical periods aiming at a target period, wherein the target period comprises b target sub-periods, and each historical period comprises one historical sub-period corresponding to each target sub-period; determining a traffic threshold value of the network access line for each target sub-period according to the historical traffic of a historical sub-periods corresponding to each target sub-period to obtain a group b of traffic threshold values; monitoring the actual flow of the network access line in each target sub-period to obtain a group of actual flows aiming at each target sub-period; and generating alarm information under the condition that the network access line is determined to have abnormality according to m groups of actual flow and m groups of flow threshold values aiming at m sub-periods, wherein a, b and m are integers which are more than or equal to 2, and the m sub-periods are m target sub-periods which comprise the current sub-period and are adjacent to each other.

Optionally, the obtaining the historical traffic of a historical periods for the target period includes: determining a historical periods aiming at the target period according to the attribute information of the target period, wherein the a historical periods are the historical periods with the attribute information of the target period; and acquiring historical flow of each historical period in the a historical periods, wherein the attribute information of the target period is used for indicating at least one of the following information: the position of the target time period within the preset time period, the target time period belongs to the preset target time period.

Optionally, the determining the traffic threshold for each target sub-period comprises: determining a flow set for each target sub-period according to the historical flow of the a historical sub-periods; determining abnormal flow in the flow set according to the average value of all the flow in the flow set; and determining the flow threshold value for each target sub-period according to the average value of the other flows except the abnormal flow in the flow set.

Optionally, determining the set of flows for each target subinterval comprises: for each of the a history sub-periods: acquiring historical flow of c adjacent historical sub-periods of each historical sub-period to obtain c adjacent flow of each historical sub-period; and taking a flow set consisting of a multiplied by c adjacent flows of a historical subintervals and a historical flows of a historical subintervals as the flow set of each target subinterval, wherein c is an integer greater than or equal to 1.

Optionally, determining the traffic threshold for each target sub-period further comprises: determining the abnormal degree of the abnormal flow according to the abnormal flow and the average value of all the flows in the flow set; determining the coefficient of variation of other flow rates; and determining a flow threshold value for each target sub-period according to the average value, the abnormality degree and the variation coefficient of other flow.

Optionally, determining abnormal traffic in the traffic set comprises: determining the average value of all the flow in the flow set as the first average value mu₁(ii) a Determining flow concentrationGreater than the first mean value mu₁Relative to the first mean value mu₁As the first dispersion index σ_1H(ii) a Determining that the flow concentration is less than the first mean value mu₁Relative to the first mean value mu₁As the second dispersion index σ_1L(ii) a According to the first average value mu₁And a first dispersion indicator σ_1HDetermining that is greater than the first mean value mu₁As a first abnormal flow rate, an abnormal flow rate of the flow rates of (1); and according to the first average value mu₁And a second dispersion indicator σ_1LDetermining that is less than the first mean value mu₁The abnormal flow rate of the flow rates of (1) is set as a second abnormal flow rate.

Optionally, determining the degree of abnormality of the abnormal traffic comprises: determining a plurality of target abnormal traffic in the abnormal traffic; determining each target abnormal flow and the first average value mu₁Obtaining an absolute value for each target abnormal flow; according to the absolute value of the first abnormal flow in the plurality of target abnormal flows and the first discrete index sigma_1HDetermining the degree of abnormality of the first abnormal flow as a first degree of abnormality alpha₁(ii) a And according to the absolute value of the second abnormal flow in the plurality of target abnormal flows and the second discrete index sigma_1LDetermining the degree of abnormality of the second abnormal flow as a second degree of abnormality α₂。

Optionally, determining the coefficient of variation of the other flow rates comprises: determining the average value of other flow rates as the second average value mu₂(ii) a Determining more than two mean values mu of other flow rates₂Relative to the second mean value mu₂As the third dispersion indicator σ for each target sub-period_2H(ii) a Determining the other flow rate to be less than the second average value mu₂Relative to the second mean value mu₂As the fourth discrete index σ for each target sub-period_2L(ii) a Determining a third discrete indicator σ for each target sub-period_2HAnd the second mean value mu₂As the first coefficient of variation beta₁(ii) a And determining for each purposeFourth discrete index σ of scale period_2LAnd the second mean value mu₂As the second coefficient of variation beta₂。

Optionally, the flow threshold comprises an upper threshold H and a lower threshold L. Determining the traffic threshold for each target sub-period comprises: according to the second average value mu₂The third dispersion index σ_2HFirst degree of abnormality α₁And a first coefficient of variation beta₁Determining an upper threshold H for each target sub-period; and; and according to the second average value mu₂The fourth dispersion index σ_2LThe second degree of abnormality alpha₂And a second coefficient of variation beta₂A lower threshold L is determined for each target subinterval.

Optionally, determining the upper threshold H for each target sub-period comprises: respectively normalizing the second average value mu according to a preset normalization method₂First degree of abnormality α₁A first coefficient of variation beta₁And a third discrete index σ for each target sub-period_2HRespectively obtaining a normalized second average value, a normalized first abnormal degree, a normalized first variation coefficient and a normalized third discrete index; determining a weighted sum of the normalized second average value, the normalized first degree of abnormality, the normalized first coefficient of variation, and the normalized third discrete index as the upper ripple coefficient K₂₁(ii) a And according to b third discrete indicators sigma for b target sub-periods_2HAverage value of (d), second average value mu₂Upper coefficient of fluctuation K₂₁And a third discrete index σ for each target sub-period_2HAn upper threshold H is determined for each target sub-period.

Optionally, determining the lower threshold for each target sub-period comprises: respectively normalizing the second average value mu according to a preset normalization method₂The second degree of abnormality alpha₂A second coefficient of variation beta₂And a fourth discrete index σ for each target subinterval_2LRespectively obtaining a normalized second average value, a normalized second abnormal degree, a normalized second variation coefficient and a normalized fourth discrete index; determining normalized secondThe weighted sum of the average value, the normalized second abnormality degree, the normalized second variation coefficient and the normalized fourth discrete index is used as the lower fluctuation coefficient K₂₂(ii) a And according to b fourth discrete indicators sigma for b target sub-periods_2LAverage value of (d), second average value mu₂Lower coefficient of fluctuation K₂₂And a fourth discrete index σ for each target subinterval_2LA lower threshold L is determined for each target subinterval.

Optionally, the preset normalization method includes: determining the maximum parameter and the minimum parameter in the b parameters according to the b parameters aiming at the b target subintervals; determining a difference value of the maximum parameter and the minimum parameter as a parameter difference value; and determining the normalized value of each parameter in the b parameters as the ratio of the difference value of each parameter and the minimum parameter to the parameter difference value.

Optionally, determining a plurality of target abnormal traffic of the abnormal traffic comprises: determining that the first abnormal flow rate is less than or equal to (mu)₁+q×σ_1g) The flow of (2) is a target abnormal flow; and determining that the second abnormal flow rate is greater than (mu)₁-q×σ_1L) The flow rate of (a) is a target abnormal flow rate, wherein q is a preset value and q is a number greater than 0.

Optionally, each of the b sets of flow thresholds includes an upper threshold H and a lower threshold L; the method for monitoring the flow of the network access line further comprises the following steps: adjusting b group flow threshold values aiming at a target network access line; including at least one of: adjusting an upper limit threshold H in each group of flow thresholds according to a first preset proportion to obtain b upper limit thresholds aiming at a target access line; and adjusting the lower threshold L in each group of flow thresholds according to a second preset proportion to obtain b lower thresholds aiming at the target access line.

Optionally, each of the b sets of flow thresholds includes an upper threshold H and a lower threshold L; the method for monitoring the flow of the network access line further comprises the following steps: adjusting the b-group flow thresholds for a predetermined target period of time, including at least one of: adjusting an upper limit threshold H in each group of flow thresholds according to a third preset proportion to obtain b upper limit thresholds aiming at a preset target time period; and adjusting the lower limit threshold L in each group of flow thresholds according to a fourth preset proportion to obtain b lower limit thresholds aiming at a preset target time period.

Optionally, the generating the alarm information includes: determining sub-periods with actual flow not meeting the flow threshold value as abnormal sub-periods according to the actual flow and the flow threshold value aiming at each sub-period in the m sub-periods; and under the condition that the m sub-periods comprise at least n abnormal sub-periods, determining that the network access line has abnormality so as to generate the alarm information, wherein n is an integer greater than 2, and m is greater than or equal to n.

Another aspect of the present disclosure provides a traffic monitoring apparatus for a network access line, including: the traffic acquisition module is used for acquiring historical traffic of a historical periods of a target period of a network access line, wherein the target period comprises b target sub-periods, and each historical period comprises one historical sub-period corresponding to each target sub-period; the threshold value determining module is used for determining a traffic threshold value of the network access line aiming at each target sub-period according to the historical traffic of a historical sub-periods corresponding to each target sub-period to obtain a group b of traffic threshold values; the flow monitoring module is used for monitoring the actual flow of the network access line in each target sub-period to obtain a group of actual flows aiming at each target sub-period; and the alarming module is used for generating alarming information under the condition that the abnormality of the network access line is determined according to m groups of actual flow and m groups of flow threshold values aiming at m sub-periods, wherein a, b and m are integers which are more than or equal to 2, and the m sub-periods are m target sub-periods which comprise the current sub-period and are adjacent to each other.

Another aspect of the present disclosure provides a computer system comprising: one or more processors; and a storage device for storing one or more programs, wherein the one or more programs, when executed by the one or more processors, cause the one or more processors to perform the above-described method for traffic monitoring of a network access line.

Another aspect of the present disclosure provides a computer-readable storage medium storing computer-executable instructions, which when executed by a processor, are configured to perform the method for traffic monitoring of a network access line as described above.

Another aspect of the present disclosure provides a computer program comprising computer executable instructions for implementing the method of traffic monitoring of a network access line as described above when executed.

According to the embodiment of the disclosure, the technical problems that the abnormal discovery of the flow rate is not timely and a monitoring blind area exists when a fixed threshold is set for each network access line in the related art can be at least partially avoided. The present disclosure may enable dynamic adjustment of the flow threshold by determining the flow threshold for a future target time period based on historical flow. Furthermore, by dividing the target time interval into a plurality of sub-time intervals and respectively determining the flow threshold value of each sub-time interval, the dynamic adjustment of the flow threshold value with fine granularity can be realized, the determined flow threshold value can adapt to the characteristic that the flow changes remarkably along with the time, and the accuracy and the timeliness of flow monitoring are improved.

Drawings

The foregoing and other objects, features and advantages of the disclosure will be apparent from the following description of embodiments of the disclosure, which proceeds with reference to the accompanying drawings, in which:

fig. 1 schematically illustrates an application scenario of a method, an apparatus, a system and a medium for traffic monitoring of a network access line according to an embodiment of the present disclosure;

fig. 2 schematically illustrates a flow chart of a method of traffic monitoring of a network access line according to an embodiment of the present disclosure;

FIG. 3 schematically shows a flow diagram for obtaining historical traffic for a historical periods of a target period, according to an embodiment of the disclosure;

FIG. 4 schematically illustrates a flow chart for determining a traffic threshold for each target sub-period according to an embodiment of the present disclosure;

FIG. 5 schematically illustrates a flow chart for determining a traffic threshold for each target sub-period according to another embodiment of the present disclosure;

FIG. 6 schematically illustrates a flow chart for determining an upper threshold for each target sub-period in accordance with an embodiment of the present disclosure;

FIG. 7 schematically illustrates a flow chart for determining a lower threshold for each target sub-period according to an embodiment of the present disclosure;

FIG. 8 schematically illustrates a flow chart for generating alert information according to an embodiment of the present disclosure;

fig. 9 schematically shows a block diagram of a traffic monitoring apparatus of a network access line according to an embodiment of the present disclosure; and

fig. 10 schematically shows a block diagram of a computer system adapted to perform a method of traffic monitoring of a network access line according to an embodiment of the present disclosure.

Detailed Description

Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. It should be understood that the description is illustrative only and is not intended to limit the scope of the present disclosure. In the following detailed description, for purposes of explanation, numerous specific details are set forth in order to provide a thorough understanding of the embodiments of the disclosure. It may be evident, however, that one or more embodiments may be practiced without these specific details. Moreover, in the following description, descriptions of well-known structures and techniques are omitted so as to not unnecessarily obscure the concepts of the present disclosure.

The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the disclosure. The terms "comprises," "comprising," and the like, as used herein, specify the presence of stated features, steps, operations, and/or components, but do not preclude the presence or addition of one or more other features, steps, operations, or components.

All terms (including technical and scientific terms) used herein have the same meaning as commonly understood by one of ordinary skill in the art unless otherwise defined. It is noted that the terms used herein should be interpreted as having a meaning that is consistent with the context of this specification and should not be interpreted in an idealized or overly formal sense.

Where a convention analogous to "at least one of A, B and C, etc." is used, in general such a construction is intended in the sense one having skill in the art would understand the convention (e.g., "a system having at least one of A, B and C" would include but not be limited to systems that have a alone, B alone, C alone, a and B together, a and C together, B and C together, and/or A, B, C together, etc.).

The embodiment of the disclosure provides a method for monitoring the flow of a network access line, which comprises the following steps: acquiring historical traffic of a network access line in a historical periods aiming at a target period, wherein the target period comprises b target sub-periods, and each historical period comprises one historical sub-period corresponding to each target sub-period; determining a traffic threshold value of the network access line for each target sub-period according to the historical traffic of a historical sub-periods corresponding to each target sub-period to obtain a group b of traffic threshold values; monitoring the actual flow of the network access line in each target sub-period to obtain b groups of actual flows aiming at the b target sub-periods; and generating alarm information under the condition that the network access line is determined to have abnormity according to the b group actual flow and the b group flow threshold, wherein a and b are integers which are more than or equal to 2.

Fig. 1 schematically illustrates an application scenario of a method, an apparatus, a system, and a medium for monitoring traffic of a network access line according to an embodiment of the present disclosure. It should be noted that fig. 1 is only an example of an application scenario in which the embodiments of the present disclosure may be applied to help those skilled in the art understand the technical content of the present disclosure, but does not mean that the embodiments of the present disclosure may not be applied to other devices, systems, environments or scenarios.

As shown in fig. 1, the application scenario 100 of this embodiment may include, for example, a first terminal device 110, a network 120, a server 130, and a second terminal device 140. Network 120 is the medium used to provide a communication link between first terminal device 110 and server 130. Network 120 may include various connection types, such as wired, wireless communication links, and so forth.

The first terminal device 110 and the second terminal device 140 may be, for example, various electronic devices having a display screen and having processing functions, including but not limited to smart phones, tablets, laptop portable computers, desktop computers, smart wearable devices, and the like. The first terminal device 110 may be, for example, a terminal device used by a user, and the second terminal device 140 may be, for example, a terminal device used by a worker for monitoring network access line traffic.

For example, the first terminal device 110 may be installed with a client application for performing business transaction, and the user may perform online transaction of business through the client application. Wherein, in the process of transacting business online, the first terminal device 110 needs to interact with the server 130 via the network 120. During the interaction, access to the server 130 needs to be achieved via the network access line of the access server 130.

Exemplarily, the second terminal device 140 may be installed with a client application for monitoring a network access line, for example. Through which the staff member can monitor the traffic of the network access line of the access server 130.

The server 130 may be, for example, a server that provides various kinds of support to a client application installed in the first terminal device 110 for business transaction. The query result may be provided to the first terminal device 110 via the network 120, for example, in response to a query request sent by the first terminal device 110.

It should be noted that the traffic monitoring method of the network access line according to the embodiment of the present disclosure may be executed by the second terminal device 140, for example. Accordingly, the traffic monitoring apparatus of the network access line of the embodiment of the present disclosure may be disposed in the second terminal device 140.

It should be understood that the types of the first terminal device, the network, the server and the second terminal device in fig. 1 are merely illustrative. There may be any type of first terminal device, network, server, and second terminal device, as the implementation requires.

The following describes in detail a traffic monitoring method of a network access line provided by the embodiment of the present disclosure with reference to fig. 2 to 8 based on an application scenario described in fig. 1.

Fig. 2 schematically shows a flow chart of a method of traffic monitoring of a network access line according to an embodiment of the present disclosure.

As shown in fig. 2, the method for monitoring traffic of a network access line of this embodiment may include operations S210 to S240.

In operation S210, historical traffic of a network access line in a historical periods for a target period is acquired, the target period includes b target sub-periods, and each historical period includes one historical sub-period corresponding to each target sub-period.

The embodiment of the disclosure can periodically collect the flow of the network access line and store the collected flow into the preset storage space. The network access lines can be multiple, and the collected flows of different network access lines are stored in different preset storage spaces or stored in different storage areas of the same storage space.

Illustratively, the collected flow may include, for example, an incoming flow and an outgoing flow. The incoming traffic may be, for example, traffic entering an enterprise providing business handling functions via a network access line, and the outgoing traffic may be, for example, traffic flowing out of the enterprise providing business handling functions via the network access line.

Illustratively, the collection of the traffic of the Network access line may be performed by running a pre-written script conforming to an SNMP Protocol (Simple Network Management Protocol), for example. It is to be understood that the above-described method of collecting flow is merely an example to facilitate understanding of the present disclosure, and the present disclosure is not limited thereto.

According to an embodiment of the present disclosure, the target period may be a period in the future. The duration of the target period may be, for example, one day, one week, one month, or the like. Illustratively, the target time period may be the next time period to the current time period, e.g., if the day's date is 5 months and 18 days, the target time period may be, e.g., 5 months and 19 days. Alternatively, the target period may be a period before a period having the same attribute information as the current period after the current period, for example, if the current day is wednesday, the target period may be the next week, and so on. In order to enable the flow rate threshold to adapt to the fluctuation of the flow rate over time, the target period may be divided into b target sub-periods, and the duration of each target sub-period may be, for example, 1 minute, 5 minutes, 10 minutes, half an hour, 1 hour, or the like. Wherein b is an integer of 2 or more.

Illustratively, the a history periods for the target period may be, for example, the most recent a history periods with respect to the current time. Each history time interval in the a history time intervals is equal to the target time interval in length, each history time interval is similar to the target time interval and is also divided into b history sub-time intervals, and the b history sub-time intervals are in one-to-one correspondence with the b target sub-time intervals. For example, if the day date is 5-month-18 days, a is 5, and the target period is 5-month-19 days, the a history periods may be 5-month-13 days, 5-month-14 days, 5-month-15 days, 5-month-16 days, and 5-month-17 days, respectively. If the length of each target time period is 1 minute, the length of each history sub-period is also 1 minute. Wherein a is an integer of 2 or more.

In operation S220, a traffic threshold of the network access line for each target sub-period is determined according to the historical traffic of the a historical sub-periods corresponding to each target sub-period, so as to obtain a b-group traffic threshold.

According to an embodiment of the present disclosure, the operation S220 may, for example, first calculate an average value of the historical flow of the a historical sub-periods. The highest value of the historical traffic for the a historical sub-periods is then determined. The final determined flow threshold is the sum of the determined highest value and a predetermined proportion of the historical flow average. The predetermined ratio may be, for example, 0.1, 0.2, etc., and may be determined according to actual requirements.

According to an embodiment of the present disclosure, in order to avoid monitoring blind areas, each set of flow thresholds for each target sub-period determined by the embodiment may include both an upper threshold H and a lower threshold L, for example. Wherein the upper threshold H may be the sum of the above determined highest value and the historical flow average of the first proportion. The lower threshold L is the difference between the lowest value of the historical flow of the a historical subintervals and the average value of the historical flow of the second proportion. The first ratio and the second ratio may have the same value, for example, may be 0.1, 0.2, and the like, and may be determined according to actual requirements.

According to the embodiment of the present disclosure, considering that the network access line includes not only the incoming traffic but also the outgoing traffic, when determining the threshold, the embodiment may also determine the traffic thresholds of the incoming traffic and the outgoing traffic, for example, so as to improve the accuracy of the determined traffic threshold. As such, the historical traffic acquired in operation S210 includes not only the historical incoming traffic but also the historical outgoing traffic. Operation S220 may specifically be to determine to obtain a flow rate threshold for each target sub-period according to the historical flow rates of the a historical sub-periods; and determining and obtaining an inflow threshold value aiming at each target sub-period according to the historical inflow of the a historical sub-periods. And finally, forming a group of flow thresholds by the outlet flow threshold and the inlet flow threshold.

In operation S230, the actual traffic of the network access line is monitored in each target sub-period, resulting in a set of actual traffic for each target sub-period.

According to an embodiment of the present disclosure, the operation S230 may be to run the previously-written script conforming to the SNMP protocol at each target sub-period to collect the traffic of the network access line, so as to obtain the actual traffic for each target sub-period.

Illustratively, the actual flows collected for each target sub-period may include, for example, an incoming flow and an outgoing flow, which make up a set of actual flows.

In operation S240, in case it is determined that there is an abnormality in the network access line according to the m groups of actual traffic and the m groups of traffic thresholds for the m sub-periods, alarm information is generated.

For example, when each set of traffic thresholds includes an upper threshold of incoming traffic and an upper threshold of outgoing traffic, it may be determined that there is an abnormality in the network access line and alarm information is generated in a case where an actual incoming traffic of a certain target sub-period exceeds the upper threshold of incoming traffic for the certain target sub-period or in a case where an actual outgoing traffic exceeds the upper threshold of outgoing traffic for the certain target sub-period.

Illustratively, when each set of traffic thresholds includes not only an upper threshold but also a lower threshold, it may be determined that there is an abnormality in the network access line and alarm information is generated in the case that the actual traffic of a certain target sub-period exceeds the upper threshold for the certain target sub-period or the actual traffic is lower than the lower threshold for the certain target sub-period.

Illustratively, the warning message may be, for example, a text prompt message, an audio prompt message, or the like. The alarm information can be pushed to a handheld terminal of a worker by the second terminal device, so that the worker can know the abnormal condition of the network access line in time.

According to the embodiment of the present disclosure, in order to facilitate observation of workers, the traffic monitoring method for the network access line of the embodiment may further plot actual traffic and a traffic threshold value in a period of time into a graph with an abscissa as time and an ordinate as a value of the traffic, and display the graph. Alternatively, the client application installed on the second terminal device for monitoring the network access line may be provided with a graph display entry, for example, and the graph may be displayed in a display page of the second terminal device by responding to an operation of the display entry.

According to the embodiment of the present disclosure, in consideration of different sensitivity requirements of different users on abnormal situations, a target network access line with high user sensitivity may be preset in the embodiment. In order to meet the requirement of the user with high sensitivity, after the b-group flow threshold is obtained through operation S220, the b-group flow threshold may be adjusted. Specifically, for example, the adjustment may be performed by at least one of the following operations: adjusting an upper limit threshold H in each group of flow thresholds according to a first preset proportion to obtain b upper limit thresholds aiming at a target access line; and adjusting the lower threshold L in each group of flow thresholds according to a second preset proportion to obtain b lower thresholds aiming at the target access line. When the user has high sensitivity to the abnormal condition, in order to avoid the condition that no alarm is generated when the flow is high or low, the first preset proportion is a value smaller than 1 so as to reduce the upper limit threshold; the second predetermined ratio should be a value greater than 1 to increase the lower threshold. The values of the first predetermined proportion and the second predetermined proportion can be specifically set according to actual requirements, and the values are not limited by the disclosure.

According to an embodiment of the present disclosure, in order to meet the special requirement of a specific date, the embodiment may also preset a predetermined target period. For example, a date on which a specific demand for traffic such as the twenty-one shopping festival is made may be used as the predetermined target period. In order to meet the specific requirement of the predetermined target period, after the b-group flow threshold is obtained through operation S220, the b-group flow threshold may be adjusted. Specifically, for example, the adjustment may be performed by at least one of the following operations: adjusting an upper limit threshold H in each group of flow thresholds according to a third preset proportion to obtain b upper limit thresholds aiming at the target access line; and adjusting the lower threshold L in each group of flow thresholds according to a fourth preset proportion to obtain b lower thresholds aiming at the target access line. Wherein, when a large flow is required on a special date, in order to reduce abnormal conditions, the third predetermined ratio should be a value greater than 1 to increase the upper threshold. On a special date (e.g., an end-of-year settlement date), a larger lower threshold may be set, taking into account that the traffic is generally larger. The fourth predetermined ratio should therefore be a value greater than 1, for example, to increase the lower threshold. The values of the third predetermined ratio and the fourth predetermined ratio may be specifically set according to actual requirements, which is not limited by the present disclosure.

For example, if the flow rate is generally high on the weekday versus the weekday, different flow rate thresholds may be set for the weekday and the weekday. The flow rate is also generally low for legal holidays relative to weekdays and the like, and therefore a lower flow rate threshold should also be set when the target time period is a legal holiday period. On weekends that need to be worked due to legal holiday calls, a higher flow threshold should be set because of also belonging to the workday. Thus, to improve the accuracy of the determined flow threshold, the obtained historical flow may be the flow of a historical period of time having the same properties as the target period of time.

Fig. 3 schematically shows a flowchart for obtaining historical traffic for a historical periods of the target period, according to an embodiment of the disclosure.

As shown in fig. 3, operation S210 of acquiring the historical traffic of this embodiment may include, for example, operations S311 to S312.

In operation S311, according to the attribute information of the target period, a history periods for the target period, which are history periods having the attribute information of the target period, are determined.

In operation S312, a history traffic of each of the a history periods is acquired.

According to an embodiment of the present disclosure, the attribute information of the target period may be used to indicate at least one of the following information, for example: the location of the target period within the preset time period, the target period belonging to a predetermined target period, which may include, for example, a legal holiday, a predetermined known special date (e.g., valentine's day, double eleven shopping day, etc.), and a weekend requiring work due to a holiday break in the legal holiday, etc.

Illustratively, if the target period does not relate to a special date such as a statutory holiday or a predetermined target period, a period of the same number of weeks in the last period (e.g., three months) is acquired as the historical period. For example, if the target time interval is wednesday, all wednesdays of the last three months are determined as historical time intervals, and the flow data of all wednesdays of the last three months are acquired as historical data. The statutory holiday and the predetermined target period include a date of vacation due to the statutory holiday, a weekend on duty due to a statutory holiday, a double eleven shopping day, and other traffic burst dates. If a statutory holiday and a predetermined target period are involved, the date corresponding to the last years is preferentially determined as the history period. If there is no date data corresponding to the previous date, the most recent date having similar properties may be used as the history data. For example, if the target date is the first day of spring festival holiday, and the first day of spring festival holiday in the last years is acquired as a history period, the acquired history traffic includes at least one of the following: historical traffic data for the first day of spring festival vacation in the previous years, historical traffic data during statutory holiday vacation in the last period of time, or general weekends. For example, if the target date is the weekend due to a five-one vacation, the acquired traffic data includes at least one of: historical flow data of weekends on holidays scheduled in the last years, weekends on holidays scheduled for legal festivals in the last period of time, and flow data of common dates with the same week number of weekends on weekdays closest to the weekend (friday closest to saturday, monday closest to sunday). For example, if the date is the twenty-one shopping festival, the flow data of the twenty-one shopping festival in the last years or the flow data of other shopping festival in the last period is acquired.

According to the embodiment of the disclosure, in order to avoid the condition that the threshold value determination is inaccurate due to the abnormal traffic existing in the historical traffic, the embodiment can also eliminate the abnormal traffic from the historical traffic of the a historical sub-periods, and then determine the traffic threshold value according to the traffic remaining after the abnormal traffic is eliminated.

Fig. 4 schematically illustrates a flow chart for determining a traffic threshold for each target sub-period according to an embodiment of the present disclosure.

As shown in fig. 4, operation S220 of the embodiment, which determines the flow rate threshold value for each target sub-period, may include, for example, operations S421 to S423.

In operation S421, a flow set for each target sub-period is determined according to the historical flows of the a historical sub-periods.

Illustratively, the traffic set for each target subinterval may be composed of a aggregations of historical traffic for a historical subintervals.

For example, in order to smooth the historical traffic for each target sub-period, and provide a larger data amount, so that the determined threshold can reflect the traffic value condition of each target sub-period more accurately, the operation S421 may, for example, first obtain the historical traffic of c adjacent historical sub-periods of each historical sub-period for each historical sub-period of a historical sub-periods, and obtain the c adjacent traffic for each historical sub-period. And finally, taking a flow set consisting of a multiplied by c adjacent flows of a historical subintervals and a historical flows of a historical subintervals as the flow set of each target subinterval. Wherein c is an integer of 1 or more.

In one embodiment, the most recent rounded-down c/2 flow value for the historical subintervals may be taken forward for each historical subinterval. And backward taking the latest c/2 and rounding up to obtain the flow values of the numerical history sub-periods.

In operation S422, an abnormal flow rate in the flow set is determined according to an average value of all flow rates in the flow set.

For example, a flow rate that is a certain proportion higher than the average value and a flow rate that is a certain proportion lower than the average value may be taken as the abnormal flow rate.

Operation S422 may also determine an average value of all flows in the flow set, for example, to obtain a first average value μ₁. Then determining that the concentration of the flux is greater than the first mean value mu₁Relative to the first mean value mu₁As the first dispersion index σ_1HAnd determining that the flow concentration is less than the first mean value mu₁Relative to the first mean value mu₁As the second dispersion index σ_1L. Finally, according to the first average value mu₁And a first dispersion indicator σ_1HDetermining that is greater than the first mean value mu₁As a first abnormal flow rate, an abnormal flow rate of the flow rates of (1); and according to the first average value mu₁And a second dispersion indicator σ_1LDetermining that is less than the first mean value mu₁The abnormal flow rate of the flow rates of (1) is set as a second abnormal flow rate.

In one embodiment, is greater than the first average value μ₁Relative to the first mean value mu₁The discrete index of (a) can be calculated, for example, in the following manner: firstly, determining that the average value is larger than the first average value mu₁Of at least one flow rate, each flow rate being associated with the mean value mu₁To obtain at least one sum of squares. Finally, the square root of the mean of the at least one sum of squares is taken as the first dispersion indicator σ_1H. In particular, σ_1LThis can be calculated, for example, by the following formula:

wherein n is_1HIndicates a value greater than the first mean value mu₁Number of flows of (1), x_iHIndicates a value greater than the first mean value mu₁The value of the ith flow in the flow of (2). In particular, if n_1HAnd if the first discrete index is 0, the value of the first discrete index is 0. It can be seen from the formula that the calculation method of the first discrete index is similar to the standard deviation, and the difference is that the first discrete index only selects values larger than the average value, and can be seen as adding values of which the values are symmetrical with respect to the average value to the original values (for example, if the values are 5 and 6, and the average value is 4, then adding 3 and 2 to 5, 6, 3 and 2), and then calculating the standard deviation, where the calculated standard deviation is equal to the first discrete index calculated by the above formula.

Similarly, less than the first mean value μ₁Relative to the first mean value mu₁The discrete index of (2) can be calculated by the aforementioned calculation method of the first discrete index. With the difference that it will be greater than the first mean value mu₁Is replaced by a flow rate smaller than the first mean value mu₁The flow rate of (c). The second discrete index in this embodiment may be understood as a downward standard deviation.

In summary, the discrete indicators are calculated by the embodiment respectively for the flow rates larger than the first average value and smaller than the first average value, so as to distinguish the upward fluctuation and the downward fluctuation of the flow rate, because the modes of the upward fluctuation and the downward fluctuation are different, and the discrete indicators are calculated respectively to avoid mutual interference.

According to an embodiment of the present disclosure, after determining the first and second discrete indicators, for example, may be compared to the first average μ₁And taking the flow rate with the first preset discrete proportion higher than the first discrete index as the first abnormal flow rate. Compared with the first average value mu₁And taking the flow rate with the second preset discrete proportion lower than the second discrete index as a second abnormal flow rate.

Illustratively, the flow rate may be greater than (μ)₁+K₁₁*σ_1H) The flow rate of (d) is set to be less than (mu) as the first abnormal flow rate₁+K₁₂*σ_1L) OfThe amount serves as a second abnormal flow rate. Wherein, K₁₁At a first predetermined discrete ratio, K₁₂Is a second predetermined discrete proportion. K₁₁、K₁₂The preset parameter is greater than 0, and can be set according to actual requirements.

Illustratively, the parameter for determining the flow threshold value is adjusted by considering that the degree of abnormality of the abnormal flow is calculated by using the first abnormal flow and the second abnormal flow which are eliminated subsequently, and the preset parameter K₁₁、K₁₂For example, 1 may be taken, or values of 0.8, 0.9, 1.1, 1.2, etc. that are similar to 1.

After the first abnormal traffic and the second abnormal traffic are determined, the first abnormal traffic and the second abnormal traffic can be removed from the traffic set.

According to the embodiment of the present disclosure, after the abnormal traffic is eliminated, operation S423 may be performed to determine the traffic threshold for the target sub-period according to the average value of the other traffic except the abnormal traffic in the traffic set.

For example, the first multiple of the average value of the other flows may be determined to be the upper threshold H. The second multiple of the average value of the other flow rates is the lower threshold L. Wherein the first multiple is a value greater than 1 and the second multiple is a value less than 1. Illustratively, to avoid frequent alarms, the first multiple may take any value greater than 1.5, for example, and the second multiple may take any value less than 0.5, for example.

Illustratively, it is contemplated that the dispersion indicator may reflect the degree to which the flow rate deviates from the average. The operation S423 may determine an average value of other flow rates as the second average value μ₂. Then, a second average value and a first discrete index sigma are determined_1HThird discrete ratio of K₂₁Sum of (mu)₂+K₂₁*σ_1H) Is the upper threshold H. Determining a second mean value and a second dispersion index sigma_1LA fourth discrete ratio K₂₂Difference of (μ)₂-K₂₁*σ_1L) Is the lower threshold L. Wherein the third discrete ratio K₂₁And a fourth discrete proportion K₂₂Can be set according to actual requirements, and the third discrete proportion K is exemplary₂₁And a fourth discrete proportion K₂₂May for example all be a value greater than 1.

According to the embodiment of the present disclosure, it is considered that the rejected abnormal traffic may not be the true existence of the abnormality due to the absence of the manual labeling, but may be caused by the particularity of the historical sub-period. To avoid this, the operation of the embodiment of determining the flow threshold value for each target sub-period may also adjust the parameter of determining the flow threshold value, for example, according to the degree of abnormality of the abnormal flow. The abnormality degree can be used to indicate the degree of abnormality of the abnormal flow rate with respect to the average value of the flow rate concentrated flow rate.

Fig. 5 schematically illustrates a flow chart for determining a traffic threshold for each target sub-period according to another embodiment of the present disclosure.

As shown in fig. 5, operation S220 of determining the flow rate threshold value for each target sub-period of the embodiment may include, for example, operation S524 in addition to the aforementioned operations S421 to S423.

In operation S524, an abnormality degree of the abnormal flow rate is determined based on the abnormal flow rate and an average value of all the flow rates in the flow rate set.

According to an embodiment of the present disclosure, the degree of abnormality of the abnormal flow rate may be determined, for example, according to the magnitude of the difference between the abnormal flow rate and the first average value. The larger the difference from the first average value, the higher the degree of abnormality, and the smaller the difference from the first average value, the lower the degree of abnormality.

According to the embodiment of the present disclosure, the degree of abnormality of the abnormal flow rate may be determined, for example, according to a magnitude relation between a difference value between the abnormal flow rate and the first average value and the discrete index. If the difference is larger than the discrete index, the abnormal flow has larger abnormality degree, and if the difference is smaller than the discrete index, the abnormal flow has smaller abnormality degree. And for abnormal flow smaller than the first average value, the size relation with the discrete index is the size relation with the second discrete index. For abnormal flow rates greater than the first average value, the magnitude relationship with the discrete indicator refers to the magnitude relationship with the first discrete indicator.

For example, in order to avoid that the existence of the excessively abnormal traffic in the abnormal traffic causes a large value of the degree of abnormality, thereby affecting the reliability of the degree of abnormality, when the degree of abnormality is calculated, for example, the excessively abnormal traffic may be first removed from the abnormal traffic. Therefore, operation S524 may first determine a plurality of target abnormal traffic among the abnormal traffic. The target abnormal flow is the remaining abnormal flow after the excessively abnormal flow is eliminated.

In one embodiment, it may be determined that the abnormal flow rate is not greater than (μ)₁+q×σ_1g) Is the target abnormal flow rate, and is not less than (mu)₁-q×σ_1L) The second abnormal traffic of (2) is the target abnormal traffic. Wherein q is a preset value and q is a number greater than 0. Specifically, q may be set according to actual requirements, and q should be greater than the aforementioned first discrete proportion and second discrete proportion. For example, in one embodiment, q may take 5.

After the target abnormal flow rate is determined, the degree of abnormality of the abnormal flow rate may be determined by, for example, the following procedure: firstly, determining each target abnormal flow and the first average value mu₁The absolute value of the difference value of (4) is obtained for each target abnormal flow. Then according to the absolute value of the first abnormal flow in the plurality of target abnormal flows and the first discrete index sigma_1HDetermining the degree of abnormality of the first abnormal flow as a first degree of abnormality alpha₁. According to the absolute value of the second abnormal flow in the plurality of target abnormal flows and the second discrete index sigma_1LDetermining the degree of abnormality of the second abnormal flow as a second degree of abnormality α₂。

Illustratively, when the plurality of target abnormal flows include a plurality of first abnormal flows, the first abnormality degree example α₁For example, the absolute value and the first dispersion indicator σ for each of the plurality of first abnormal flow rates may be set_1HThe ratios are summed. Similarly, when a plurality of second abnormal flows are included in the plurality of target abnormal flows, the second abnormality degree α₂By comparing the absolute value of each second abnormal flow rate with the second dispersion index sigma_1LThe ratios are summed. Specifically, the method comprises the following steps:

wherein x is_HIs the value of the first abnormal flow in the plurality of target abnormal flows, x_LIs a value of a second abnormal flow rate of the plurality of target second flow rates.

According to the embodiment of the disclosure, in order to further improve the accuracy of the determined flow threshold, the difference of other flows after the abnormal flow is eliminated can be considered, and the parameter for determining the flow threshold is adjusted according to the difference. Accordingly, as shown in fig. 5, operation S220 of this embodiment may include operation S525, and the operation S525 may be performed before operation S524 or after operation S524. In an embodiment, operation S220 may also include only operation S525, but not operation S524.

In operation S525, coefficients of variation of other flows are determined.

According to an embodiment of the present disclosure, the operation S525 may represent the coefficient of variation according to a difference of each other flow rate relative to an average value of the other flow rates, for example. The coefficient of variation reflects the difference of other flows.

Exemplarily, the coefficient of variation may be determined by, for example: first, the average value of the other flow rates is determined as the second average value mu₂. Then calculating the average value mu of other flow rates₂Relative to the second mean value mu₂As the third dispersion indicator σ for each target sub-period_2HAnd calculating the average value mu smaller than the second average value in other flow rates₂Relative to the second mean value mu₂As the fourth discrete index σ for each target sub-period_2L. Finally, a third discrete index σ for each target subinterval is determined_2HAnd a firstMean value of μ₂As the first coefficient of variation beta₁. Determining a fourth discrete metric σ for each target subinterval_2LAnd the second mean value mu₂As the second coefficient of variation beta₂. Wherein the third dispersion index σ_2HAnd the first dispersion indicator sigma_1HIs similar to the calculation method of the fourth discrete index sigma_2LAnd the second dispersion indicator σ_1LThe calculation method is similar and will not be described herein again.

After the degree of abnormality and the coefficient of variation are determined, the flow threshold can be determined based on the degree of abnormality and the coefficient of variation. The aforementioned operation S423 may be implemented as operation S523 of determining the flow rate threshold for each target sub-period according to the degree of abnormality, the coefficient of variation, and the second average value.

Illustratively, the degree of abnormality and the coefficient of variation each include a value corresponding to a larger flow rate and a value corresponding to a smaller flow rate, respectively. Accordingly, the operation S523 may include: according to the second average value mu₂The third dispersion index σ_2HFirst degree of abnormality α₁And a first coefficient of variation beta₁Determining an upper threshold H for each target sub-period; and according to the second average value mu₂The fourth dispersion index σ_2LThe second degree of abnormality alpha₂And a second coefficient of variation beta₂A lower threshold L is determined for each target subinterval.

Specifically, when determining the upper threshold H, the operation S523 may be, for example, to perform the second average value μ₂The third dispersion index σ_2HFirst degree of abnormality α₁And a first coefficient of variation beta₁The value obtained by weighted summation is used as the third discrete proportion K₂₁Is used as an upper fluctuation coefficient for representing the upward fluctuation degree of the flow. Finally, the upper threshold H ═ μ is determined₂+K₂₁*σ_2H. The weight in the weighted summation may be set according to actual requirements, for example. For example, if the number of removed abnormal traffic is large, a large weight may be set for the degree of abnormality. The weight at the time of weighted summation may be a value equal to or greater than 1.

Similarly, operation S523 may determine the lower threshold L, for example, to the second average value μ₂The fourth dispersion index σ_2LThe second degree of abnormality alpha₂And a second coefficient of variation beta₂The value obtained by weighted summation is used as the fourth discrete proportion K₂₂Is used as a lower fluctuation coefficient for representing the downward fluctuation degree of the flow. Finally, the lower limit threshold L ═ μ is determined₂-K₂₂*σ_2L. The weight in the weighted summation may be set according to actual requirements, for example. For example, if the number of removed abnormal traffic is large, a large weight may be set for the degree of abnormality. The weight at the time of weighted summation may be a value equal to or greater than 1.

According to the embodiment of the present disclosure, in order to further improve the accuracy of the flow threshold, when determining the flow threshold, for example, the influence of other sub-periods in the target period on the flow of the target sub-period may also be considered. Therefore, when determining the flow rate threshold, the flow rate threshold may also be adjusted according to parameters such as the degree of abnormality, the coefficient of variation, and the like for other sub-periods.

Fig. 6 schematically illustrates a flow chart for determining an upper threshold for each target sub-period according to an embodiment of the present disclosure.

As shown in fig. 6, the operation of determining the upper limit threshold value for each target sub-period of the embodiment may include, for example, operations S6231 to S6233.

In operation S6231, the second average values μ are normalized respectively according to a preset normalization method₂First degree of abnormality α₁A first coefficient of variation beta₁And a third discrete index σ for each target sub-period_2HAnd respectively obtaining a normalized second average value, a normalized first abnormal degree, a normalized first variation coefficient and a normalized third discrete index.

According to an embodiment of the present disclosure, the normalization may be, for example, normalizing the same quantity for b target subintervals. For example, if the target time interval includes 12 target sub-time intervals, the parameters of the 12 target sub-time intervals can be obtained by the aforementioned method, and then the 12 target sub-time intervals are subjected to the above-mentioned methodThe target subinterval normalizes the parameters. Wherein, in the second average value mu₂When normalization processing is performed, the parameter is the second average value mu₂. At the first degree of abnormality alpha₁A first coefficient of variation beta₁And a third dispersion indicator σ_2HWhen normalization processing is respectively carried out, the parameters are respectively the first abnormality degree alpha₁A first coefficient of variation beta₁And a third dispersion indicator σ_2H。

Exemplary normalization methods for normalizing the parameters may include, for example, the following: firstly, according to b parameters aiming at b target subintervals, determining the maximum parameter and the minimum parameter in the b parameters. The difference between the maximum and minimum parameters is then determined as the parameter difference. And finally, determining the normalized value of each parameter in the b parameters as the ratio of the difference value of each parameter and the minimum parameter to the parameter difference value. For example, for the jth second average value of the b second average values, the normalized value may be determined as:

wherein, mu_2jIs the jth second average value, mu_2minIs the minimum of the b second means, μ_2maxIs the maximum of the b second averages.

In a similar manner to the second average, the normalized first degree of abnormality, the normalized first coefficient of variation, and the normalized third discrete index may be obtained.

In operation S6232, a weighted sum of the normalized second average value, the normalized first degree of abnormality, the normalized first coefficient of variation, and the normalized third discrete index is determined as the upper fluctuation coefficient K₂₁. The weight used in determining the weighted sum in this embodiment may be set according to actual requirements, for example.

Obtaining the upper fluctuation coefficient K by weighted summation₂₁Then, the solution can be processed by H ═ mu₂+K₂₁*σ_2HAnd calculating to obtain an upper limit threshold.

According to the embodiment of the disclosure, in order to further reflect the influence of other sub-periods in the target period on the flow of the target sub-period, when the upper limit threshold is calculated, the average value items of the b third discrete indexes for the b target sub-periods can be further increased. The upper threshold may be determined through operation S6233.

In operation S6233, b third dispersion indicators σ according to the b target sub-periods_2HAverage value of (d), second average value mu₂Upper coefficient of fluctuation K₂₁And a third discrete index σ for each target sub-period_2HAn upper threshold H is determined for each target sub-period.

According to the embodiment of the present disclosure, the upper threshold H may be calculated by the following formula:

wherein the content of the first and second substances,

is the average of b third discrete indicators, h₁For preset parameters, h₁Can generally be between 0 and 3.

Fig. 7 schematically shows a flowchart for determining a lower threshold for each target sub-period according to an embodiment of the present disclosure.

As shown in fig. 7, the operation of determining the lower threshold value for each target sub-period of the embodiment may include, for example, operations S7231 to S7233.

Respectively normalizing the second average values mu according to a preset normalization method in operation S7231₂The second degree of abnormality alpha₂A second coefficient of variation beta₂And a fourth discrete index σ for each target subinterval_2LAnd respectively obtaining a normalized second average value, a normalized second abnormal degree, a normalized second variation coefficient and a normalized fourth discrete index.

According to an embodiment of the present disclosure, this operation S7231 may be performed in a similar manner to the aforementioned operation S6231For the second average value mu₂The second degree of abnormality alpha₂A second coefficient of variation beta₂And a fourth discrete index σ for each target subinterval_2LThe normalization process is performed, and is not described herein again.

In operation S7232, a weighted sum of the normalized second average value, the normalized second degree of abnormality, the normalized second coefficient of variation, and the normalized fourth discrete index is determined as the lower fluctuation coefficient K₂₂. The weight used in determining the weighted sum in this embodiment may be set according to actual requirements, for example.

In operation S7233, according to b fourth dispersion indexes σ for b target sub-periods_2LAverage value of (d), second average value mu₂Lower coefficient of fluctuation K₂₂And a fourth discrete index σ for each target subinterval_2LA lower threshold L is determined for each target subinterval.

According to an embodiment of the present disclosure, the lower threshold H may be calculated by the following formula:

wherein the content of the first and second substances,

is the average of b third discrete indicators, h₂For preset parameters, h₂Can generally be between 0 and 3.

According to the embodiment of the disclosure, in order to avoid unnecessary alarm caused by short-time abnormality of traffic (for example, short-time too low traffic caused when the network access line is initially started), the embodiment may determine whether the network access line is abnormal by comprehensively considering actual traffic of a plurality of target sub-periods, so as to determine whether to alarm.

FIG. 8 schematically illustrates a flow chart for generating alert information according to an embodiment of the present disclosure.

As shown in fig. 8, operation S240 of generating the alarm information of this embodiment may include, for example, operations S841 to S842.

In operation S841, a sub-period in which the actual traffic does not satisfy the traffic threshold is determined as an abnormal sub-period, based on the actual traffic for each of the m sub-periods and the traffic threshold.

Illustratively, the m sub-periods are m target sub-periods that include the current sub-period and are adjacent to each other. The operation S841 may be to obtain the actual traffic and the traffic threshold of each of the current target sub-period and m-1 target sub-periods adjacent to the current target sub-period after monitoring the actual traffic of the current target sub-period. And then determining whether each target sub-period is an abnormal sub-period according to the actual flow and the flow threshold of each target sub-period.

According to an embodiment of the present disclosure, when each set of traffic thresholds includes only an upper threshold, the operation S841 may determine that a certain target sub-period is an abnormal sub-period when the actual traffic for the certain target sub-period is greater than the upper threshold. It can be understood that, when the actual flow rate includes an inflow rate and an outflow rate, the actual inflow rate of the certain target sub-period is compared with an upper inflow rate threshold of the flow rate threshold, and the actual outflow rate of the certain target sub-period is compared with an upper outflow rate threshold of the flow rate threshold. And if the actual inflow quantity is higher than the inflow upper limit threshold value and/or the actual outflow quantity is higher than the outflow upper limit threshold value, determining that the actual flow quantity does not meet the flow threshold value.

According to an embodiment of the present disclosure, when each set of traffic thresholds includes not only an upper threshold but also a lower threshold, the operation S841 may determine that a certain target sub-period is an abnormal sub-period when the actual traffic for the certain target sub-period is greater than the upper threshold, and/or determine that the certain target sub-period is an abnormal sub-period when the actual traffic for the certain target sub-period is less than the lower threshold.

In operation S842, in case that at least n abnormal sub-periods are included in the m sub-periods, it is determined that there is an abnormality in the network access line to generate the alarm information. Wherein n is an integer greater than 2, and m is greater than or equal to n.

For example, when the length of each target sub-period is 1 minute, m is 10, and n is 7, operation S842 may be to generate the warning message if the actual flow rate is greater than the corresponding upper threshold value or the actual flow rate is less than the corresponding lower threshold value in 7 or more than 7 consecutive 10 minutes.

Fig. 9 schematically shows a block diagram of a traffic monitoring apparatus of a network access line according to an embodiment of the present disclosure.

As shown in fig. 9, the traffic monitoring apparatus 900 of the network access line of this embodiment may include a traffic acquiring module 910, a threshold determining module 920, a traffic monitoring module 930, and an alarm module 940.

The traffic obtaining module 910 is configured to obtain historical traffic of the network access line in a historical periods for a target period, where the target period includes b target sub-periods, and each historical period includes one historical sub-period corresponding to each target sub-period. In an embodiment, the traffic obtaining module 910 may be configured to perform operation S210 described in fig. 2, for example, and is not described herein again. Wherein a and b are integers of 2 or more.

The threshold determining module 920 is configured to determine a traffic threshold of the network access line for each target sub-period according to the historical traffic of the a historical sub-periods corresponding to each target sub-period, so as to obtain a b-group traffic threshold. In an embodiment, the threshold determining module 920 may be configured to perform operation S220 described in fig. 2, for example, and is not described herein again.

The traffic monitoring module 930 is configured to monitor actual traffic of the network access line in each target sub-period, and obtain a set of actual traffic for each target sub-period. In an embodiment, the traffic monitoring module 930 may be configured to perform operation S230 described in fig. 2, for example, and is not described herein again.

The alarm module 940 is configured to generate alarm information when it is determined that the network access line is abnormal according to the m groups of actual flows and the m groups of flow thresholds for the m sub-periods. Wherein m is an integer greater than or equal to 2, and the m sub-periods are m target sub-periods including the current sub-period and adjacent to each other. In an embodiment, the alarm module 940 may be configured to perform the operation S240 described in fig. 2, for example, and will not be described herein again.

According to an embodiment of the present disclosure, the traffic obtaining module 910 may be configured to perform operations S311 to S312 described in fig. 3, for example, which are not described herein again.

According to an embodiment of the disclosure, the threshold determining module 920 may be configured to perform operations S421 to S423 described in fig. 4, for example, and is not described herein again. In an embodiment, the threshold determining module 920 may also be configured to perform operations S523 to S525 described in fig. 5, which are not described herein again.

According to an embodiment of the present disclosure, the threshold determining module 920 may be specifically configured to perform operations S6231 to S6233 described in fig. 6 and to perform operations S7231 to S7233 described in fig. 7, for example, which are not described herein again.

According to the embodiment of the disclosure, the alarm module 940 may be configured to perform operations S841 to S842 described in fig. 8, for example, which is not described herein again.

Any number of modules, sub-modules, units, sub-units, or at least part of the functionality of any number thereof according to embodiments of the present disclosure may be implemented in one module. Any one or more of the modules, sub-modules, units, and sub-units according to the embodiments of the present disclosure may be implemented by being split into a plurality of modules. Any one or more of the modules, sub-modules, units, sub-units according to embodiments of the present disclosure may be implemented at least in part as a hardware circuit, such as a Field Programmable Gate Array (FPGA), a Programmable Logic Array (PLA), a system on a chip, a system on a substrate, a system on a package, an Application Specific Integrated Circuit (ASIC), or may be implemented in any other reasonable manner of hardware or firmware by integrating or packaging a circuit, or in any one of or a suitable combination of software, hardware, and firmware implementations. Alternatively, one or more of the modules, sub-modules, units, sub-units according to embodiments of the disclosure may be at least partially implemented as a computer program module, which when executed may perform the corresponding functions.

As shown in fig. 10, a computer system 1000 according to an embodiment of the present disclosure includes a processor 1001 that can perform various appropriate actions and processes according to a program stored in a Read Only Memory (ROM)1002 or a program loaded from a storage section 1008 into a Random Access Memory (RAM) 1003. Processor 1001 may include, for example, a general purpose microprocessor (e.g., a CPU), an instruction set processor and/or associated chipset, and/or a special purpose microprocessor (e.g., an Application Specific Integrated Circuit (ASIC)), among others. The processor 1001 may also include onboard memory for caching purposes. The processor 1001 may include a single processing unit or multiple processing units for performing different actions of a method flow according to embodiments of the present disclosure.

In the RAM 1003, various programs and data necessary for the operation of the computer system 1000 are stored. The processor 1001, ROM 1002, and RAM 1003 are connected to each other by a bus 1004. The processor 1001 performs various operations of the method flow according to the embodiments of the present disclosure by executing programs in the ROM 1002 and/or the RAM 1003. Note that the programs may also be stored in one or more memories other than the ROM 1002 and the RAM 1003. The processor 1001 may also perform various operations of the method flows according to embodiments of the present disclosure by executing programs stored in the one or more memories.

Computer system 1000 may also include an input/output (I/O) interface 1005, the input/output (I/O) interface 1005 also being connected to bus 1004, according to an embodiment of the present disclosure. Computer system 1000 may also include one or more of the following components connected to I/O interface 1005: an input section 1006 including a keyboard, a mouse, and the like; an output section 1007 including a display such as a Cathode Ray Tube (CRT), a Liquid Crystal Display (LCD), and the like, and a speaker; a storage portion 1008 including a hard disk and the like; and a communication section 1009 including a network interface card such as a LAN card, a modem, or the like. The communication section 1009 performs communication processing via a network such as the internet. The driver 1010 is also connected to the I/O interface 1005 as necessary. A removable medium 1011 such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, or the like is mounted on the drive 1010 as necessary, so that a computer program read out therefrom is mounted into the storage section 1008 as necessary.

According to embodiments of the present disclosure, method flows according to embodiments of the present disclosure may be implemented as computer software programs. For example, embodiments of the present disclosure include a computer program product comprising a computer program embodied on a computer readable storage medium, the computer program containing program code for performing the method illustrated by the flow chart. In such an embodiment, the computer program may be downloaded and installed from a network through the communication part 1009 and/or installed from the removable medium 1011. The computer program performs the above-described functions defined in the computer system of the embodiment of the present disclosure when executed by the processor 1001. The systems, devices, apparatuses, modules, units, etc. described above may be implemented by computer program modules according to embodiments of the present disclosure.

The present disclosure also provides a computer-readable storage medium, which may be contained in the apparatus/device/system described in the above embodiments; or may exist separately and not be assembled into the device/apparatus/system. The computer-readable storage medium carries one or more programs which, when executed, implement the method according to an embodiment of the disclosure.

According to embodiments of the present disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium, which may include, for example but is not limited to: a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the present disclosure, a computer readable storage medium may be any tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device. For example, according to embodiments of the present disclosure, a computer-readable storage medium may include the ROM 1002 and/or the RAM 1003 described above and/or one or more memories other than the ROM 1002 and the RAM 1003.

The flowchart and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams or flowchart illustration, and combinations of blocks in the block diagrams or flowchart illustration, can be implemented by special purpose hardware-based systems which perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.

Those skilled in the art will appreciate that various combinations and/or combinations of features recited in the various embodiments and/or claims of the present disclosure can be made, even if such combinations or combinations are not expressly recited in the present disclosure. In particular, various combinations and/or combinations of the features recited in the various embodiments and/or claims of the present disclosure may be made without departing from the spirit or teaching of the present disclosure. All such combinations and/or associations are within the scope of the present disclosure.

The embodiments of the present disclosure have been described above. However, these examples are for illustrative purposes only and are not intended to limit the scope of the present disclosure. Although the embodiments are described separately above, this does not mean that the measures in the embodiments cannot be used in advantageous combination. The scope of the disclosure is defined by the appended claims and equivalents thereof. Various alternatives and modifications can be devised by those skilled in the art without departing from the scope of the present disclosure, and such alternatives and modifications are intended to be within the scope of the present disclosure.

Claims

1. A method for monitoring the flow of a network access line comprises the following steps:

acquiring historical traffic of the network access line in a historical periods aiming at a target period, wherein the target period comprises b target sub-periods, and each historical period comprises one historical sub-period corresponding to each target sub-period;

determining a traffic threshold value of the network access line aiming at each target sub-period according to the historical traffic of a historical sub-periods corresponding to each target sub-period to obtain a group b of traffic threshold values;

monitoring the actual flow of the network access line in each target sub-period to obtain a group of actual flows aiming at each target sub-period; and

generating alarm information under the condition that m groups of actual flow and m groups of flow threshold values aiming at m sub-periods determine that the network access line has abnormity,

wherein a, b and m are integers greater than or equal to 2, and the m sub-periods are m target sub-periods which comprise the current sub-period and are adjacent to each other.

2. The method of claim 1, wherein obtaining historical traffic for a historical periods of the target period comprises:

determining a historical periods aiming at the target period according to the attribute information of the target period, wherein the a historical periods are the historical periods with the attribute information of the target period; and

acquiring historical flow of each historical period in the a historical periods,

wherein the attribute information of the target period is used to indicate at least one of the following information: the position of the target time period within the preset time period, the target time period belongs to the preset target time period.

3. The method of claim 1, wherein determining a traffic threshold for the each target sub-period comprises:

determining a flow set for each target sub-period according to the historical flow of the a historical sub-periods;

determining abnormal flow in the flow set according to the average value of all the flow in the flow set; and

and determining a flow threshold value for each target sub-period according to the average value of other flows except the abnormal flow in the flow set.

4. The method of claim 3, wherein determining a flow set for the each target subinterval comprises:

for each of the a history sub-periods: acquiring historical flow of c adjacent historical sub-periods of each historical sub-period to obtain c adjacent flow of each historical sub-period; and

taking a traffic set consisting of a × c neighboring traffic for the a historical subintervals and a historical traffic for the a historical subintervals as the traffic set for each of the target subintervals,

wherein c is an integer of 1 or more.

5. The method of claim 3, determining a traffic threshold for the each target sub-period further comprising:

determining the abnormal degree of the abnormal flow according to the abnormal flow and the average value of all the flows in the flow set;

determining the coefficient of variation of the other flow rates; and

and determining a flow threshold value for each target sub-period according to the average value of the other flow, the abnormality degree and the variation coefficient.

6. The method of claim 5, wherein the determining abnormal traffic in the set of traffic comprises:

determining the average value of all the flow rates in the flow rate set as the first average value mu₁；

Determining that the flow concentration is greater than the first mean value mu₁Relative to the first mean value mu₁As the first dispersion index σ_1H；

Determining that the flow concentration is less than the first mean value mu₁Relative to the first mean value mu₁As the second dispersion index σ_1L；

According to the first average value mu₁And the first dispersion indicator σ_1HDetermining that is greater than the first mean value mu₁As a first abnormal flow rate, an abnormal flow rate of the flow rates of (1); and

according to the first average value mu₁And the second dispersion indicator σ_1LDetermining that is less than the first mean value mu₁The abnormal flow rate of the flow rates of (1) is set as a second abnormal flow rate.

7. The method of claim 6, wherein determining the degree of abnormality of the abnormal traffic comprises:

determining a plurality of target abnormal traffic of the abnormal traffic;

determining each target abnormal flow and the first average value mu₁Obtaining an absolute value for each target abnormal flow;

according to the first discrete index sigma and the absolute value of the first abnormal flow in the plurality of target abnormal flows_1HDetermining the degree of abnormality of the first abnormal flow as a first degree of abnormality α₁(ii) a And

according to the second discrete index sigma and the absolute value of the second abnormal flow in the plurality of target abnormal flows_1LDetermining the degree of abnormality of the second abnormal flow as a second degree of abnormality α₂。

8. The method of any of claims 5 to 7, wherein determining the coefficient of variation of the other flow rates comprises:

determining an average of said other flows as a second average μ₂；

Determining that the other flow rate is greater than the second average value mu₂Relative to the second mean value mu₂As a third dispersion indicator σ for said each target sub-period_2H；

Determining that less than the second average value μ in the other flow rates₂Relative to the second mean value mu₂As a fourth discrete index σ for said each target sub-period_2L；

Determining a third dispersion indicator σ for said each target sub-period_2HAnd the second mean value mu₂As the first coefficient of variation beta₁(ii) a And

determining a fourth dispersion indicator σ for said each target sub-period_2LAnd the second mean value mu₂As the second coefficient of variation beta₂。

9. The method of claim 7, wherein the flow threshold comprises an upper threshold H and a lower threshold L; determining a traffic threshold for the each target sub-period comprises:

according to the second average value mu₂The third dispersion index σ_2HFirst degree of abnormality α₁And a first coefficient of variation beta₁Determining an upper threshold H for said each target sub-period; and

according to the second average value mu₂The fourth dispersion index σ_2LThe second degree of abnormality alpha₂And a second coefficient of variation beta₂Determining a lower threshold value L for said each target sub-period.

10. The method of claim 9, wherein determining an upper threshold H for said each target sub-period comprises:

respectively normalizing the second average value mu according to a preset normalization method₂The first degree of abnormality α₁The first coefficient of variation beta₁And a third discrete index σ for each of the target subintervals_2HRespectively obtaining a normalized second average value, a normalized first abnormal degree, a normalized first variation coefficient and a normalized third discrete index;

determining a weighted sum of the normalized second average value, the normalized first degree of abnormality, the normalized first coefficient of variation, and the normalized third discrete index as the upper ripple coefficient K₂₁(ii) a And

according to b third discrete indicators sigma for said b target sub-periods_2HThe second mean value mu₂The upper fluctuation coefficient K₂₁And a third discrete index σ for each of the target subintervals_2HDetermining an upper threshold H for said each target sub-period.

11. The method of claim 9, wherein determining a lower threshold L for the each target subinterval comprises:

respectively normalizing the second average value mu according to a preset normalization method₂The second degree of abnormality α₂The second coefficient of variation beta₂And a fourth discrete index σ for said each target sub-period_2LRespectively obtaining a normalized second average value, a normalized second abnormal degree, a normalized second variation coefficient and a normalized fourth discrete index;

determining a weighted sum of the normalized second average value, the normalized second degree of abnormality, the normalized second coefficient of variation, and the normalized fourth discrete index as the lower ripple coefficient K₂₂(ii) a And

according to b fourth discrete indexes sigma for the b target sub-periods_2LThe second mean value mu₂The lower coefficient of fluctuation K₂₂And a fourth discrete index σ for said each target sub-period_2LDetermining for each of said purposesA lower threshold L for the beacon period.

12. The method according to claim 10 or 11, wherein the preset normalization method comprises:

determining the maximum parameter and the minimum parameter in the b parameters according to the b parameters aiming at the b target subintervals;

determining a difference value between the maximum parameter and the minimum parameter as a parameter difference value;

and determining the normalized value of each parameter in the b parameters as the ratio of the difference value of each parameter and the minimum parameter to the parameter difference value.

13. The method of claim 7, wherein determining a plurality of target ones of the abnormal traffic comprises:

determining that the first abnormal flow rate is less than or equal to (mu)₁+q×σ_1g) The flow of (2) is a target abnormal flow; and

determining that the second abnormal flow rate is greater than (mu)₁-q×σ_1L) The flow rate of (a) is a target abnormal flow rate,

wherein q is a preset value and is a number greater than 0.

14. The method of claim 1, wherein each of the b sets of flow thresholds comprises an upper threshold H and a lower threshold L; the method further comprises the following steps: adjusting the b-group traffic thresholds for a target network access line; including at least one of:

adjusting an upper limit threshold H in each group of flow thresholds according to a first preset proportion to obtain b upper limit thresholds aiming at the target access line;

and adjusting a lower threshold L in each group of flow thresholds according to a second preset proportion to obtain b lower thresholds aiming at the target access line.

15. The method of claim 1, wherein each of the b sets of flow thresholds comprises an upper threshold H and a lower threshold L; the method further comprises the following steps: adjusting the b-group traffic thresholds for a predetermined target period: including at least one of:

adjusting an upper limit threshold H in each group of flow thresholds according to a third preset proportion to obtain b upper limit thresholds aiming at the preset target time interval; and

and adjusting a lower threshold L in each group of flow thresholds according to a fourth preset proportion to obtain b lower thresholds aiming at the preset target time interval.

16. The method of claim 1, wherein generating alert information comprises:

determining sub-periods with actual flow not meeting the flow threshold value as abnormal sub-periods according to the actual flow and the flow threshold value aiming at each sub-period in the m sub-periods;

determining that there is an abnormality in the network access line to generate the alarm information in a case that the m sub-periods include at least n abnormal sub-periods,

wherein n is an integer greater than 2, and m is greater than or equal to n.

17. A traffic monitoring apparatus of a network access line, comprising:

a traffic obtaining module, configured to obtain historical traffic of the network access line in a historical periods for a target period, where the target period includes b target sub-periods, and each historical period includes one historical sub-period corresponding to each target sub-period;

a threshold determining module, configured to determine, according to historical traffic of a historical sub-periods corresponding to each target sub-period, a traffic threshold of the network access line for each target sub-period, to obtain a set b of traffic thresholds;

a traffic monitoring module, configured to monitor actual traffic of the network access line in each target sub-period to obtain a set of actual traffic for each target sub-period; and

the alarming module is used for generating alarming information under the condition that the abnormality of the network access line is determined according to the m groups of actual flow and m groups of flow threshold values aiming at the m sub-periods,

18. A computer system, comprising:

one or more processors;

a storage device for storing one or more programs,

wherein the one or more programs, when executed by the one or more processors, cause the one or more processors to perform the method of any of claims 1-16.

19. A computer readable storage medium having stored thereon executable instructions which, when executed by a processor, cause the processor to perform the method of any one of claims 1 to 16.