CN113795031A

CN113795031A - Network node abnormality detection method and device and network equipment

Info

Publication number: CN113795031A
Application number: CN202110905135.2A
Authority: CN
Inventors: 童帆; 李观海
Original assignee: TP Link Technologies Co Ltd
Current assignee: TP Link Technologies Co Ltd
Priority date: 2021-08-06
Filing date: 2021-08-06
Publication date: 2021-12-14

Abstract

The invention discloses a method, a device and network equipment for detecting network node abnormity, which comprises the following steps: acquiring real-time RSSI values of a node to be detected and M network nodes in an initial signal intensity table when the node to be detected is communicated with the M network nodes; respectively calculating to obtain a real-time RSSI difference value between the node to be detected and each network node according to the real-time RSSI value of the node to be detected and the real-time RSSI values of the M network nodes; comparing the real-time RSSI difference values between the node to be detected and the M network nodes with the initial RSSI difference values between the node to be detected and the M network nodes in the initial signal intensity table; and judging whether the node to be detected is abnormal or not according to the comparison result. By adopting the technical scheme of the invention, whether the node in the network is abnormal can be quickly judged, and the abnormal node in the network can be quickly positioned.

Description

Network node abnormality detection method and device and network equipment

Technical Field

The present invention relates to the field of network security technologies, and in particular, to a method and an apparatus for detecting network node anomalies, and a network device.

Background

The Wireless Mesh Network (WMN) is a dynamic self-organizing Network, and nodes in the Network automatically establish and maintain connections with other nodes, so that the Wireless Mesh Network has strong Network robustness, and if a node in the Network, such as a Wireless router, fails, information can be transmitted via other Wireless routers in the Network, and Network failure is not caused. However, if the attenuation of the air channels on other transmission paths is larger, data will be transmitted at a lower wireless rate, which may still reduce the network performance, and when the number of failed nodes in the entire network reaches a certain number, or the abnormal nodes are located at the key positions of the network, the performance of the entire network may even be greatly reduced, so it is very important to perform abnormality or fault detection on the nodes in the wireless Mesh network to perform response and processing of the abnormality according to the detection result.

At present, the robustness or self-repairability of the wireless Mesh network is usually realized by bypassing or abandoning abnormal nodes, the robustness has certain premises or limitations, namely normal nodes in the network are far more than the abnormal nodes, the abnormal nodes are not positioned on a critical path, and when the premises are exceeded, the network still needs to be repaired manually to ensure the throughput of the whole network.

Disclosure of Invention

The technical problem to be solved by the embodiments of the present invention is to provide a method, an apparatus and a network device for detecting network node abnormality, which can quickly determine whether a node in a network is abnormal and quickly locate an abnormal node in the network.

In order to solve the above technical problem, an embodiment of the present invention provides a method for detecting an anomaly of a network node, including:

acquiring real-time RSSI values of a node to be detected and M network nodes in an initial signal intensity table when the node to be detected is communicated with the M network nodes;

respectively calculating to obtain a real-time RSSI difference value between the node to be detected and each network node according to the real-time RSSI value of the node to be detected and the real-time RSSI values of the M network nodes;

comparing the real-time RSSI difference values between the node to be detected and the M network nodes with the initial RSSI difference values between the node to be detected and the M network nodes in the initial signal intensity table;

judging whether the node to be detected is abnormal or not according to the comparison result;

the initial signal intensity table comprises N network nodes meeting preset conditions, initial RSSI values of the nodes to be detected and the N network nodes when the nodes to be detected are communicated with the N network nodes, and initial RSSI difference values between the nodes to be detected and the N network nodes, wherein M is more than or equal to 2 and less than or equal to N.

Further, the method pre-establishes the initial signal strength table by:

before the node to be detected is added into a network to be detected, acquiring signal intensity corresponding to each network node according to information frames sent to the node to be detected by all network nodes in a network coverage range;

sequencing all network nodes according to the sequence of the corresponding signal intensity from large to small, and determining the N network nodes positioned at the top N positions in sequence;

when the node to be detected joins the network to be detected, acquiring initial RSSI values when the node to be detected is used as a receiving node and N initial RSSI values when the node to be detected is used as the receiving node when the node to be detected is communicated with the N network nodes;

respectively calculating and obtaining initial RSSI difference values between the node to be detected and the N network nodes according to the initial RSSI value of the node to be detected and the initial RSSI values of the N network nodes;

and establishing the initial signal intensity table of the node to be detected according to the N network nodes, the initial RSSI value of the node to be detected, the initial RSSI values of the N network nodes and the initial RSSI difference value between the node to be detected and the N network nodes.

Further, the method further comprises:

acquiring corresponding RSSI values when the node to be detected communicates with all network nodes in a network coverage area according to a preset time period;

and updating the initial signal intensity table according to the obtained RSSI value.

Further, when the node to be detected communicates with M network nodes in the initial signal strength table, the acquiring of the real-time RSSI value of the node to be detected and the real-time RSSI values of the M network nodes specifically includes:

acquiring real-time RSSI values of the node to be detected as a receiving node and real-time RSSI values of the M network nodes as receiving nodes when the node to be detected is communicated with the M network nodes by adopting a BPSK modulation mode; or the like, or, alternatively,

respectively acquiring T RSSI values of the node to be detected as a receiving node and T RSSI values of each network node as a receiving node when the node to be detected is communicated with each network node according to preset test times T; wherein T is more than or equal to 2;

averaging the T RSSI values of the node to be detected, and correspondingly obtaining a real-time RSSI value when the node to be detected is used as a receiving node;

and respectively carrying out averaging processing on the T RSSI values of each network node, and correspondingly obtaining the real-time RSSI value of each network node as a receiving node.

Further, the determining, according to the comparison result, whether the node to be detected is abnormal specifically includes:

and when the real-time RSSI difference value between the node to be detected and the M network nodes is different from the initial RSSI difference value between the node to be detected and the M network nodes, and the change difference value between the real-time RSSI value and the initial RSSI value is larger than a preset threshold value, judging that the node to be detected is abnormal.

Further, the calculating, according to the real-time RSSI values of the node to be detected and the real-time RSSI values of the M network nodes, to obtain a real-time RSSI difference value between the node to be detected and each network node respectively specifically includes:

when the nodes to be detected are used as sending nodes and the M network nodes are used as receiving nodes, according to a formula delta RSSI_REti-REi＝RSSI_REti-REi-RSSI_REi-REtiCalculating to obtain a real-time RSSI difference value delta RSSI between the node to be detected and the ith network node_REti-REi；

When the nodes to be detected are used as receiving nodes and the M network nodes are used as transmitting nodes, according to a formula delta RSSI_REi-REti＝RSSI_REi-REti-RSSI_REti-REiCalculating to obtain a real-time RSSI difference value delta RSSI between the node to be detected and the ith network node_REi-REti；

Wherein the content of the first and second substances,

RSSI_REti-REi、TxPower_REtiand RxGain_REiWhen the ith network node REi is used as a receiving node to communicate with the node REt to be detected, the real-time RSSI value of the ith network node REi, the transmission power of the node REt to be detected and the receiving gain of the ith network node REi are respectively obtained; RSSI_REi-REti、TxPower_REiAnd RxGain_REtiWhen the node REt to be detected is used as a receiving node to communicate with the ith network node REi, the real-time RSSI value of the node REt to be detected, the transmission power of the ith network node REi and the receiving gain of the node REt to be detected are respectively set; AntGain_REiFor the antenna gain, AntGain, of the ith network node REi_REtFor the antenna gain of the node REt to be detected, AirLoss is the air channel attenuation, i is 1, 2, …, M.

Further, when the node to be detected is used as a sending node and the M network nodes are used as receiving nodes, the method further includes:

when the node to be detected is judged to be abnormal, respectively calculating variation difference values between M real-time RSSI difference values and corresponding M initial RSSI difference values;

when the M real-time RSSI difference values are smaller than the M initial RSSI difference values, and the change difference value is larger than a preset threshold value, judging that the PA of the node to be detected is abnormal;

and when the M real-time RSSI difference values are larger than the M initial RSSI difference values and the change difference value is larger than a preset threshold value, judging that the LNA of the node to be detected is abnormal.

Further, the method further comprises:

and when the node to be detected is judged to be abnormal, modifying the SSID of the node to be detected to mark the abnormal node, and performing abnormal alarm.

In order to solve the above technical problem, an embodiment of the present invention further provides a device for detecting an abnormality of a network node, including:

the system comprises a real-time RSSI value acquisition module, a signal intensity measurement module and a signal processing module, wherein the real-time RSSI value acquisition module is used for acquiring the real-time RSSI value of a node to be detected and the real-time RSSI values of M network nodes when the node to be detected communicates with the M network nodes in an initial signal intensity table;

the real-time RSSI difference value acquisition module is used for respectively calculating and acquiring real-time RSSI difference values between the node to be detected and each network node according to the real-time RSSI values of the node to be detected and the real-time RSSI values of the M network nodes;

an RSSI difference comparison module, configured to compare real-time RSSI differences between the node to be detected and the M network nodes with initial RSSI differences between the node to be detected and the M network nodes in the initial signal strength table;

the node abnormity judging module is used for judging whether the node to be detected is abnormal or not according to the comparison result;

An embodiment of the present invention further provides a network device, which includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, where the processor implements any one of the above-mentioned network node abnormality detection methods when executing the computer program.

Compared with the prior art, the embodiment of the invention provides a method, a device and network equipment for detecting the abnormity of a network node, wherein when a node to be detected is communicated with M network nodes in an initial signal intensity table, the real-time RSSI value of the node to be detected and the real-time RSSI values of the M network nodes are obtained, so that the real-time RSSI difference value between the node to be detected and each network node is respectively calculated and obtained according to the real-time RSSI value of the node to be detected and the real-time RSSI values of the M network nodes, and the real-time RSSI difference value between the node to be detected and the M network nodes is compared with the initial RSSI difference value between the node to be detected and the M network nodes in the initial signal intensity table, so that whether the node to be detected is abnormal or not is judged according to the comparison result; the initial signal intensity table comprises N network nodes meeting preset conditions, initial RSSI values of the nodes to be detected and the N network nodes when the nodes to be detected are communicated with the N network nodes, and initial RSSI difference values between the nodes to be detected and the N network nodes, wherein M is more than or equal to 2 and less than or equal to N; the embodiment of the invention can quickly judge whether the nodes in the network are abnormal or not and quickly position the abnormal nodes in the network.

Drawings

Fig. 1 is a flowchart of a method for detecting an anomaly of a network node according to a preferred embodiment of the present invention;

fig. 2 is a schematic structural diagram of a wireless Mesh network according to an embodiment of the present invention;

fig. 3 is a block diagram of a preferred embodiment of an anomaly detection apparatus for a network node according to the present invention;

fig. 4 is a block diagram of a preferred embodiment of a network device provided by the present invention.

Detailed Description

The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the drawings in the embodiments of the present invention, and it is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without any inventive step, are within the scope of the present invention.

An embodiment of the present invention provides a method for detecting a network node anomaly, which is a flowchart of a preferred embodiment of the method for detecting a network node anomaly provided by the present invention, as shown in fig. 1, and the method includes steps S11 to S14:

step S11, acquiring real-time RSSI values of a node to be detected and M network nodes in an initial signal intensity table when the node to be detected communicates with the M network nodes;

step S12, respectively calculating and obtaining real-time RSSI difference values between the node to be detected and each network node according to the real-time RSSI values of the node to be detected and the real-time RSSI values of the M network nodes;

step S13, comparing the real-time RSSI difference between the node to be detected and the M network nodes with the initial RSSI difference between the node to be detected and the M network nodes in the initial signal strength table;

step S14, judging whether the node to be detected is abnormal or not according to the comparison result; the initial signal intensity table comprises N network nodes meeting preset conditions, initial RSSI values of the nodes to be detected and the N network nodes when the nodes to be detected are communicated with the N network nodes, and initial RSSI difference values between the nodes to be detected and the N network nodes, wherein M is more than or equal to 2 and less than or equal to N.

It should be noted that the embodiment of the present invention is applicable to a network having the following characteristics: any two network nodes in the network can be connected and communicated through a certain network path, for example, a wireless Mesh network and the like; the network node may be a network device such as a wireless router and a relay, and the embodiment of the present invention may be executed by any network node in the network itself, and is configured to implement the function of self-checking an anomaly, and may also be executed by other network devices associated with the network node, and is configured to implement the function of detecting an anomaly of the network node.

Specifically, an initial signal strength table is pre-established and maintained in the node to be detected, the initial signal strength table includes N network nodes whose signal strengths meet a certain preset condition in a coverage area of a network where the node to be detected is located, and also includes N initial RSSI values corresponding to the node to be detected as a receiving node when the node to be detected communicates with the N network nodes respectively, and initial RSSI values corresponding to each of the N network nodes when each of the N network nodes is used as a receiving node respectively, and also includes initial RSSI difference values between the initial RSSI values corresponding to the node to be detected and the initial RSSI values corresponding to each of the N network nodes respectively.

When the anomaly detection is actually carried out, firstly, M (M is more than or equal to 2 and less than or equal to N) network nodes are selected from N network nodes of an initial signal intensity table, and M real-time RSSI values corresponding to the nodes to be detected as receiving nodes when the nodes to be detected respectively carry out wireless data receiving/sending communication with the M network nodes in sequence, and real-time RSSI values corresponding to each network node in the M network nodes when the nodes to be detected are respectively used as the receiving nodes are obtained; that is, when the node to be detected performs wireless data transmission/reception communication with the ith (i ═ 1, 2, …, M) network node, if the node to be detected is used as a receiving node and the ith network node is used as a sending node, the real-time RSSI value corresponding to the node to be detected at this time is acquired and recorded, and if the node to be detected is used as a sending node and the ith network node is used as a receiving node, the real-time RSSI value corresponding to the ith network node at this time is acquired and recorded.

Then, respectively calculating and obtaining real-time RSSI difference values between the real-time RSSI values corresponding to the nodes to be detected and the real-time RSSI values corresponding to each network node according to the M real-time RSSI values corresponding to the nodes to be detected when the nodes to be detected are used as receiving nodes and the real-time RSSI values corresponding to each network node in the M network nodes; that is, when the node to be detected performs wireless data transmission/reception communication with the ith network node, a difference between the real-time RSSI value recorded at this time when the node to be detected serves as the receiving node and the real-time RSSI value recorded when the ith network node serves as the receiving node is calculated and used as the real-time RSSI difference between the node to be detected and the ith network node.

And finally, correspondingly comparing the real-time RSSI difference value between the obtained real-time RSSI value corresponding to the node to be detected and the real-time RSSI value corresponding to each network node in the M network nodes with the initial RSSI difference value between the initial RSSI value corresponding to the node to be detected in the initial signal intensity table and the initial RSSI value corresponding to each network node in the M network nodes, namely comparing the real-time RSSI difference value between the node to be detected and the ith network node with the initial RSSI difference value between the node to be detected and the ith network node corresponding to the initial signal intensity table, and judging whether the node to be detected is abnormal or not according to the comparison result.

It can be understood that the initial signal strength table records an initial RSSI difference between the node to be detected and each of the M network nodes, and theoretically, as long as the obtained real-time RSSI difference between the node to be detected and each of the M network nodes is different from the corresponding initial RSSI difference, it indicates that the node to be detected is abnormal, but the change of the real-time RSSI difference may also be caused by the abnormality of the M network nodes, so that at least 2 network nodes (i.e., M is required to be greater than or equal to 2, for example, M is 3 or 5, etc.) are required to participate in the abnormality detection to improve the accuracy of the abnormality determination result, and it can be indicated that the node to be detected is abnormal only if the real-time RSSI differences between the node to be detected and the at least 2 network nodes are different from the corresponding initial RSSI differences.

In addition, not only the abnormal condition of the node to be detected or the abnormal condition of the M network nodes can cause the change of the corresponding real-time RSSI value, but also the change of the position of the network node can cause the change of the real-time RSSI value, therefore, in order to avoid the influence of the position change of the network node on the abnormal judgment result, the real-time RSSI value is subtracted, the corresponding real-time RSSI difference value between the node to be detected and the network node is compared with the initial RSSI difference value recorded in the initial signal intensity table, the influence caused by the path change (path attenuation loss) can be eliminated, and the abnormal judgment result is not influenced by the position change of the network node.

The method for detecting the network node abnormality provided by the embodiment of the invention respectively carries out corresponding comparison by acquiring the real-time RSSI difference value between the real-time RSSI value corresponding to the node to be detected and the real-time RSSI value corresponding to each network node in M network nodes, and the initial RSSI difference value between the initial RSSI value corresponding to the node to be detected in the initial signal intensity table and the initial RSSI value corresponding to each network node in M network nodes, so that whether the node to be detected in the network is abnormal or not can be quickly judged according to the comparison result, the abnormal node in the network can be quickly positioned, and the accuracy of the judgment result is higher.

In another preferred embodiment, the method pre-establishes the initial signal strength table by:

Specifically, with reference to the above embodiment, an initial signal intensity table corresponding to the node to be detected is established when the node to be detected joins the network to be detected, and is used to record the relevant initial parameters of the node to be detected, and serve as a judgment basis for performing subsequent anomaly detection; the specific establishment steps are as follows:

firstly, before a node to be detected joins a network to be detected, information frames (such as Beacon frames) sent by all network nodes within the coverage area of the network to be detected are received, the signal intensity corresponding to each network node can be correspondingly obtained through the received Beacon frames sent by all network nodes, all network nodes are sorted according to the sequence of the corresponding signal intensity from large to small, N network nodes located at the first N positions in the sorting mode are selected, and N network nodes with the strongest signal intensity are obtained; or a signal strength threshold may be set, the signal strength corresponding to each network node is compared with the signal strength threshold, and the N network nodes with the signal strengths greater than the signal strength threshold are selected as the N network nodes with the strongest signal strengths.

And then, when the node to be detected is newly added into the network to be detected, sequentially performing wireless data receiving/sending tests with the N network nodes with strongest signals in the network coverage area, correspondingly acquiring N initial RSSI values corresponding to the node to be detected as a receiving node, and an initial RSSI value corresponding to each of the N network nodes respectively as the receiving node, and respectively calculating and acquiring an initial RSSI difference value between the initial RSSI value corresponding to the node to be detected and the initial RSSI value corresponding to each network node according to the N initial RSSI values corresponding to the node to be detected as the receiving node and the initial RSSI values corresponding to each of the N network nodes respectively as the receiving node.

And finally, establishing an initial signal intensity table of the node to be detected according to the obtained N network nodes, the N initial RSSI values corresponding to the node to be detected, the initial RSSI value corresponding to each network node in the N network nodes and the initial RSSI difference value between the node to be detected and each network node in the N network nodes.

It should be noted that the coverage area of the network to be detected (e.g., a wireless Mesh network) refers to a range in which an SSID of the network can be searched and a Wi-Fi connection is established with any network node in the network, and for an AP that is not a Mesh network, the coverage area refers to a range in which an SSID of the AP can be searched and a Wi-Fi connection is established with the SSID.

With reference to fig. 2, it is a schematic structural diagram of a wireless Mesh network provided in an embodiment of the present invention, and it is assumed that a newly added node RE11 in fig. 2 is used as a node to be detected, and it has been determined that, of all network nodes in a coverage area of the wireless Mesh network, the first 5 network nodes with the strongest signal strength corresponding to RE11 are RE1, RE2, RE3, RE4, and RE5 in fig. 2, respectively, when RE11 is newly added to the wireless Mesh network, wireless data transmission/reception tests are sequentially performed with five network nodes RE1 to RE5 with the strongest signals in the network, and 5 initial RSSI values corresponding to RE11 as a receiving node are correspondingly obtained, and an initial RSSI value corresponding to each network node in RE1 to RE5 as a receiving node is specifically as follows:

when RE11 is used as a receiving node, if RE1 is used as a transmitting node, the initial RSSI value corresponding to RE11 at this time is acquired and recorded as RSSI_{Initial-RE1-RE11}If the RE2 is used as the transmitting node, the initial RSSI value corresponding to the RE11 at this time is acquired and recorded as the RSSI_{Initial-RE2-RE11}If the RE3 is used as the transmitting node, the initial RSSI value corresponding to the RE11 at this time is acquired and recorded as the RSSI_{Initial-RE3-RE11}If the RE4 is used as the transmitting node, the initial RSSI value corresponding to the RE11 at this time is acquired and recorded as the RSSI_{Initial-RE4-RE11}If the RE5 is used as the transmitting node, the initial RSSI value corresponding to the RE11 at this time is acquired and recorded as the RSSI_{Initial-RE5-RE11}；

When RE11 is used as a transmitting node, if RE1 is used as a receiving node, the initial RSSI value corresponding to RE1 at this time is acquired and recorded as RSSI_{Initial-RE11-RE1}If the RE2 is used as the receiving node, the initial RSSI value corresponding to the RE2 at this time is acquired and recorded as the RSSI_{Initial-RE11-RE2}If the RE3 is used as the receiving node, the initial RSSI value corresponding to the RE3 at this time is acquired and recorded as the RSSI_{Initial-RE11-RE3}If the RE4 is used as the receiving node, the initial RSSI value corresponding to the RE4 at this time is acquired and recorded as the RSSI_{Initial-RE11-RE4}If the RE5 is used as the receiving node, the initial RSSI value corresponding to the RE5 at this time is acquired and recorded as the RSSI_{Initial-RE11-RE5}。

According to the obtained 5 initial RSSI values corresponding to the RE11 serving as the receiving node and the initial RSSI values corresponding to each network node of the RE1 to RE5 serving as the receiving node, respectively calculating and obtaining an initial RSSI difference value between the initial RSSI value corresponding to the RE11 and the initial RSSI value corresponding to each network node of the RE1 to RE5, which is specifically as follows:

when RE11 is used as a receiving node, if RE1 is used as a transmitting node, the difference value of the initial RSSI corresponding to RE11 and RE1 is calculated to be delta RSSI_{Initial-RE1-RE11}＝RSSI_{Initial-RE1-RE11}-RSSI_{Initial-RE11-RE1}If RE2 is used as the sending node, the initial RSSI difference value corresponding to RE11 and RE2 is calculated to be delta RSSI_{Initial-RE2-RE11}＝RSSI_{Initial-RE2-RE11}-RSSI_{Initial-RE11-RE2}If RE3 is used as the sending node, the initial RSSI difference value corresponding to RE11 and RE3 is calculated to be delta RSSI_{Initial-RE3-RE11}＝RSSI_{Initial-RE3-RE11}-RSSI_{Initial-RE11-RE3}If RE4 is used as the sending node, the initial RSSI difference value corresponding to RE11 and RE4 is calculated to be delta RSSI_{Initial-RE4-RE11}＝RSSI_{Initial-RE4-RE11}-RSSI_{Initial-RE11-RE4}If, ifRE5 is used as a sending node, and the initial RSSI difference value corresponding to RE11 and RE5 is calculated to be delta RSSI_{Initial-RE5-RE11}＝RSSI_{Initial-RE5-RE11}-RSSI_{Initial-RE11-RE5}；

When RE11 is used as a sending node, if RE1 is used as a receiving node, the difference value of the initial RSSI corresponding to RE11 and RE1 is calculated to be delta RSSI_{Initial-RE11-RE1}＝RSSI_{Initial-RE11-RE1}-RSSI_{Initial-RE1-RE11}If RE2 is used as the receiving node, the difference between the initial RSSI corresponding to RE11 and RE2 is calculated as delta RSSI_{Initial-RE11-RE2}＝RSSI_{Initial-RE11-RE2}-RSSI_{Initial-RE2-RE11}If RE3 is used as the receiving node, the difference between the initial RSSI corresponding to RE11 and RE3 is calculated as delta RSSI_{Initial-RE11-RE3}＝RSSI_{Initial-RE11-RE3}-RSSI_{Initial-RE3-RE11}If RE4 is used as the receiving node, the difference between the initial RSSI corresponding to RE11 and RE4 is calculated as delta RSSI_{Initial-RE11-RE4}＝RSSI_{Initial-RE11-RE4}-RSSI_{Initial-RE4-RE11}If RE5 is used as the receiving node, the difference between the initial RSSI corresponding to RE11 and RE5 is calculated as delta RSSI_{Initial-RE11-RE5}＝RSSI_{Initial-RE11-RE5}-RSSI_{Initial-RE5-RE11}。

An initial signal strength table of the RE11 is established according to the obtained 5 initial RSSI values corresponding to the 5 network nodes RE 1-RE 5 and RE11, the initial RSSI value corresponding to each network node of the RE 1-RE 5 and the initial RSSI difference value between each network node of the RE11 and the RE 1-RE 5, as shown in table 1.

Table 1 initial signal strength table of network node RE11

It should be noted that the two initial RSSI differences between RE11 and the same network node are exactly opposite, e.g., Δ RSSI_{Initial-RE1-RE11}And Δ RSSI_{Initial-RE11-RE1}The initial RSSI difference values corresponding to the same network node in table 1 can be the same as the initial RSSI difference valuesOnly one of which is recorded.

In addition, because the wireless Mesh network can be expanded infinitely, when the number of network nodes increases, the information in the initial signal intensity table increases exponentially, therefore, the relevant initial parameters of all network nodes are managed without considering using a general table, a plurality of sub-tables are stored in each network node in a distributed manner, when each network node joins the wireless Mesh network, an initial signal intensity table relevant to the network node is established, and the network node updates and maintains the work subsequently.

As an improvement of the above, the method further comprises:

Specifically, with reference to the above embodiment, after the initial signal strength table is established for the node to be detected, the RSSI value corresponding to the node to be detected when communicating with all network nodes in the current network coverage area may be obtained according to a preset time period (the time period is an update period of the initial signal strength table and may be set according to actual needs), and the pre-established initial signal strength table is updated according to the obtained RSSI value.

It can be understood that, when the network node in the network to be detected changes, for example, the location of the network node changes, a new network node joins the network to be detected, or an added network node leaves the network to be detected, and the like, it cannot be ensured that the signal strengths corresponding to the N network nodes included in the pre-established initial signal strength table are still the strongest, and therefore, the initial signal strength table needs to be updated and maintained periodically.

For example, as shown in fig. 2 and table 1, assuming that a new network node RE20 is added in the current wireless Mesh network, the RE11 finds that the 5 network nodes with the strongest signals around the RE11 in the periodic scanning are RE1, RE2, RE3, RE5, and RE20, respectively, and then the RE20 and its corresponding nodes are used as the network nodesRSSI of_{Initial-RE20-RE11}、RSSI_{Initial-RE11-RE20}、ΔRSSI_{Initial-RE20-RE11}＝RSSI_{Initial-RE20-RE11}-RSSI_{Initial-RE11-RE20}And Δ RSSI_{Initial-RE11-RE20}＝RSSI_{Initial-RE11-RE20}-RSSI_{Initial-RE20-RE11}Add to table 1 and delete RE4 in the original table 1 and its corresponding initial RSSI value and initial RSSI difference value from table 1.

It should be noted that, when a certain network node in the network coverage of the network to be detected is determined as an abnormal node, the abnormal node may be marked, and the newly added network node and the existing network node in the network coverage do not need to perform transmission/reception test and communication with the abnormal node.

In another preferred embodiment, when the obtaining of the real-time RSSI values of the node to be detected and the real-time RSSI values of the M network nodes in the initial signal strength table includes:

Specifically, with the above embodiment, the measurement of the real-time RSSI value is interfered by external environmental noise, and in order to avoid the influence of the external environmental noise interference on the reliability of the abnormal detection result, the following measures may be adopted:

when the real-time RSSI values are actually obtained, performing data transmission by adopting a BPSK modulation mode, and using a 20MHz bandwidth to obtain M real-time RSSI values corresponding to the nodes to be detected as receiving nodes when the nodes to be detected respectively perform wireless data receiving/transmitting communication with the M network nodes in sequence, and a real-time RSSI value corresponding to each of the M network nodes when the network node to be detected is respectively used as a receiving node; the BPSK modulation mode is a modulation mode commonly used in the prior art, has high anti-noise interference characteristics, can effectively utilize given channel bandwidth, ensures that signals are demodulated under a certain interference degree, and obtains a reliable real-time RSSI value; besides BPSK modulation, other modulation methods commonly used in the art, such as QPSK modulation, may be used to improve the interference rejection.

Or, when the real-time RSSI values are actually obtained, measuring for many times at certain time intervals to obtain an average value, that is, when the node to be detected communicates with each of the M network nodes respectively according to a preset test time T (T is greater than or equal to 2), for example, testing for 1 time every 500ms, and testing for 10 times in total, T RSSI values corresponding to the node to be detected when the node to be detected serves as a receiving node and T RSSI values corresponding to each network node when the network node serves as a receiving node are obtained, averaging processing is performed on the T RSSI values corresponding to the node to be detected, accordingly, the real-time RSSI value corresponding to the node to be detected when the node to be detected serves as a receiving node is obtained, averaging processing is performed on the T RSSI values corresponding to each network node respectively, and accordingly, the real-time RSSI value corresponding to each network node when the network node serves as a receiving node is obtained; the averaging process can minimize the effect of the instantaneous interference signal superimposed on the measured real-time RSSI value.

It should be noted that, when the real-time RSSI value is obtained, the above measures may be adopted to perform corresponding processing to obtain a reliable real-time RSSI value, so as to improve the accuracy of the abnormality detection determination result.

In another preferred embodiment, the determining whether the node to be detected is abnormal according to the comparison result specifically includes:

Specifically, with reference to the foregoing embodiment, after the real-time RSSI difference between the node to be detected and each of the M network nodes is respectively and correspondingly compared with the initial RSSI difference between the node to be detected and each of the M network nodes recorded in the initial signal strength table, if each real-time RSSI difference is different from the corresponding initial RSSI difference, and the variation difference between each real-time RSSI difference and the corresponding initial RSSI difference is greater than the preset threshold, it can be determined that the node to be detected is abnormal.

For example, referring to fig. 2 and table 1, assuming RE11 as the node to be detected, and M network nodes are RE1, RE2 and RE3 in table 1, respectively, the real-time RSSI difference between RE11 and RE1 obtained by the above embodiment is Δ RSSI_RE1-RE11And Δ RSSI_RE11-RE1The corresponding real-time RSSI difference between RE11 and RE2 is Δ RSSI_RE2-RE11And Δ RSSI_RE11-RE2The corresponding real-time RSSI difference between RE11 and RE3 is Δ RSSI_RE3-RE11And Δ RSSI_RE11-RE3Then Δ RSSI_RE1-RE11And Δ RSSI in Table 1_{Initial-RE1-RE11}Comparing the delta RSSI_RE11-RE1And Δ RSSI in Table 1_{Initial-RE11-RE1}Comparing the delta RSSI_RE2-RE11And Δ RSSI in Table 1_{Initial-RE2-RE11}Comparing the delta RSSI_RE11-RE2And Δ RSSI in Table 1_{Initial-RE11-RE2}Comparing the delta RSSI_RE3-RE11And Δ RSSI in Table 1_{Initial-RE3-RE11}Comparing the delta RSSI_RE11-RE3And Δ RSSI in Table 1_{Initial-RE11-RE3}Making a comparison, when judgingΔRSSI_RE1-RE11And Δ RSSI_{Initial-RE1-RE11}Different, and Δ RSSI_RE11-RE1And Δ RSSI_{Initial-RE11-RE1}Different, and Δ RSSI_RE2-RE11And Δ RSSI_{Initial-RE2-RE11}Different, and Δ RSSI_RE11-RE2And Δ RSSI_{Initial-RE11-RE2}Different, and Δ RSSI_RE3-RE11And Δ RSSI_{Initial-RE3-RE11}Different, and Δ RSSI_RE11-RE3And Δ RSSI_{Initial-RE11-RE3}And when the variation difference value between each real-time RSSI difference value and the corresponding initial RSSI difference value is larger than the preset threshold value, determining that the RE11 is abnormal.

It should be noted that, considering that the degree of abnormality of the network nodes is different and the degree of influence on the network performance is different, on one hand, the influence on the overall throughput of the network is smaller for the case that the network node performance is slightly reduced, that is, the degree of abnormality is smaller, and on the other hand, the accuracy of the RSSI value measurement is more or less influenced by the wireless channel, therefore, when the embodiment of the present invention determines whether the network node is abnormal, the important concern is that the network node performance is seriously reduced and the degree of abnormality is larger, by setting the determination threshold, only when the real-time RSSI difference is different from the corresponding initial RSSI difference and the variation difference between the real-time RSSI difference and the corresponding initial RSSI difference is larger than the determination threshold, the node to be detected is considered to be abnormal, it can be understood that even if the real-time RSSI difference is determined to be different from the corresponding initial RSSI difference, however, the variation difference between the real-time RSSI difference and the corresponding initial RSSI difference is not greater than the judgment threshold, and the node to be detected is considered to be normal, but the performance of the node to be detected is slightly reduced.

In another preferred embodiment, the calculating, according to the real-time RSSI values of the node to be detected and the real-time RSSI values of the M network nodes, to obtain a real-time RSSI difference value between the node to be detected and each network node respectively includes:

Wherein the content of the first and second substances,

Specifically, with reference to the foregoing embodiment, when calculating the real-time RSSI difference between the node to be detected and each of the M network nodes, if the node to be detected is used as the sending node and the M network nodes are all used as the receiving nodes, the RSSI can be calculated according to the formula Δ RSSI_REti-REi＝RSSI_REti-REi-RSSI_REi-REtiCalculating to obtain a corresponding real-time RSSI difference value delta RSSI between the node to be detected and the ith network node_REti-REiSimilarly, the corresponding real-time RSSI difference between the node to be detected and each of the M network nodes can be calculated; if the node to be detected is used as a receiving node and M network nodes are all used as transmitting nodes, the delta RSSI can be obtained according to a formula_REi-REti＝RSSI_REi-REti-RSSI_REti-REiCalculating to obtain a corresponding real-time RSSI difference value delta RSSI between the node to be detected and the ith network node_REi-REtiSimilarly, the corresponding real-time RSSI difference between the node to be detected and each of the M network nodes can be calculated.

The real-time RSSI value is respectively determined by the transmitting power, the receiving gain, the antenna gain and the air channel attenuation of the two transmitting and receiving nodes; RSSI_REti-REiWhen the node REt to be detected is taken as a sending node and the ith network node REi is taken as a receiving node, the real-time RSSI value corresponding to the ith network node REi and the RSSI_REti-REi＝TxPower_REti+RxGain_REi+AntGain_REi+AntGain_REt-AirLoss，TxPower_REtiIndicating the transmitting power, RxGain, of the node REt to be detected when the node REt to be detected is taken as the sending node and the ith network node REi is taken as the receiving node_REiIndicating the reception gain, AntGain, of the ith network node REi when the node REt to be detected is taken as the sending node and the ith network node REi is taken as the receiving node_REiRepresenting the antenna gain, AntGain, of the ith network node REi_REtRepresents the antenna gain of the node REt to be detected, and AirLoss represents the air channel attenuation; RSSI_REi-REtiWhen the node REt to be detected is taken as the receiving node and the ith network node REi is taken as the sending node, the RSSI value corresponding to the node REt to be detected is shown, and the RSSI value is_REi-REti＝TxPower_REi+RxGain_REti+AntGain_REi+AntGain_REt-AirLoss，TxPower_REiIndicating that the node REt to be detected is used as the receiving node and the ith network node REi is used as the sending node, the transmitting power of the ith network node REi, RxGain_REtiWhen the node REt to be detected is regarded as a receiving node and the ith network node REi is regarded as a sending node, the receiving gain, i, of the node REt to be detected is 1, 2, … and M.

Accordingly, the RSSI_REti-REiAnd RSSI_REi-REtiIs substituted into delta RSSI_REti-REiAnd Δ RSSI_REi-REtiIn the calculation formula (2), it can be obtained:

it can be understood that, according to the above calculation formula, when the transmission powers of two network nodes are the same and the receiving gains are the same, the corresponding real-time RSSI difference between the two network nodes is 0.

It should be noted that the air channel attenuation AirLoss refers to attenuation of electromagnetic wave energy caused by various objects (walls, metals, etc.) and media (air) on a propagation path when electromagnetic waves (Wi-Fi signals) are transmitted by taking air as a medium, in the embodiment of the present invention, a real-time RSSI value is reduced, in the embodiment of the present invention, a real-time RSSI value corresponding to the node to be detected REt is subtracted from a real-time RSSI value corresponding to the ith network node REi to obtain a real-time RSSI difference value therebetween, so as to cancel an influence of the reduction of the real-time RSSI value caused by the air channel attenuation, and the real-time RSSI difference value represents only a difference value between the transmission power TxPower and the reception gain RxGain between the two nodes and is irrelevant to the air channel attenuation AirLoss.

As an improvement of the above scheme, when the node to be detected serves as a sending node and the M network nodes serve as receiving nodes, the method further includes:

It should be noted that, the main concern of the embodiments of the present invention is to detect an abnormality of a radio frequency device of a network node, for example, a PA (Power Amplifier) or an LNA (Low Noise Amplifier) of the network node is damaged, when the PA is damaged, Tx performance is degraded, even a packet cannot be sent out due to complete damage, and when the LNA is damaged, Rx performance is degraded, even a packet cannot be received due to complete damage, so that after determining that an abnormality occurs in a node to be detected, it may be further determined whether the PA or the LNA in the network node is damaged.

Specifically, with reference to the above embodiment, taking a node to be detected as a sending node and M network nodes as receiving nodes as an example, a corresponding real-time RSSI difference value between the node to be detected and each network node in the M network nodes is already obtained, after it is determined that the node to be detected is abnormal, a change difference value between each real-time RSSI difference value and a corresponding initial RSSI difference value is respectively calculated, M change difference values are correspondingly obtained, and if each real-time RSSI difference value is smaller than the corresponding initial RSSI difference value and the M change difference values are greater than a preset threshold, it is determined that PA of the node to be detected is abnormal; and if each real-time RSSI difference value is not smaller than the corresponding initial RSSI difference value, and the M change difference values are larger than a preset threshold value, judging that the LNA of the node to be detected is abnormal.

It should be noted that, when the node to be detected is used as a receiving node and the M network nodes are used as sending nodes, the corresponding specific determination process is the same as the above-mentioned determination process when the node to be detected is used as a sending node and the M network nodes are used as receiving nodes, and details are not repeated here.

For example, as shown in fig. 2 and table 1, assuming that RE11 is used as the node to be detected and as the transmitting node, M network nodes are RE1, RE2 and RE3 in table 1, respectively, and are used as the receiving nodes, and the corresponding real-time RSSI difference between RE11 and RE1 is obtained as Δ RSSI_RE11-RE1＝RSSI_RE11-RE1-RSSI_RE1-RE11The corresponding real-time RSSI difference between RE11 and RE2 is Δ RSSI_RE11-RE2＝RSSI_RE11-RE2-RSSI_RE2-RE11The corresponding real-time RSSI difference between RE11 and RE3 is Δ RSSI_RE11-RE3＝RSSI_RE11-RE3-RSSI_RE3-RE11In combination with the above embodiments, the present invention can be achieved

From this formula, it can be seen that if the PA of RE11 is damaged, TxPower is assumed that RE1, RE2 and RE3 are all normal_RE11Becomes smaller, correspondingly, Δ RSSI_RE11-RE1、ΔRSSI_RE11-RE2And Δ RSSI_RE11-RE3Are all reduced; RxGain if LNA of RE11 is broken_RE11Becomes smaller, correspondingly, Δ RSSI_RE11-RE1、ΔRSSI_RE11-RE2And Δ RSSI_RE11-RE3Both become larger.

Considering that the PA and LNA of RE11 are damaged to different degrees, for example, RE11 performance is slightly reduced, transmission power is reduced by 1-2 dB or receiving gain is reduced by 1-2 dB, or, RE11 performance is severely degraded, transmit power drops by more than 6dB or receive gain drops by more than 6dB, alternatively, the Tx function of RE11 is completely unable to send out packets or the Rx function is completely unable to amplify signals, and for PA or LNA performance to be slightly degraded, on the one hand, the impact on the overall throughput of the network is small, on the other hand, since the radio channel affects the accuracy of the power measurement somewhat, therefore, the embodiment of the invention is mainly used for checking the condition that PA or LNA of RE11 is seriously damaged or even fails to work, a decision threshold value can be added, for example, 5dB, the real-time RSSI difference value obtained during anomaly detection is compared with the corresponding initial RSSI difference value, and if the variation difference value between the two exceeds 5dB, RE11 is considered to be abnormal; if the difference between the two changes does not exceed 5dB, the RE11 performance is considered to be slightly reduced, but RE11 is considered to be normal, and no abnormality occurs.

In yet another preferred embodiment, the method further comprises:

Specifically, with reference to the above embodiment, after it is determined that the node to be detected is abnormal, the SSID of the node to be detected needs to be modified correspondingly to mark the node to be detected as an abnormal node, for example, a model name, two bytes after MAC, and an ERROR suffix may be added to the current SSID of the node to be detected; the SSID needs to be modified because all network nodes in the network usually use the same SSID to facilitate wireless roaming, and after the SSID of the abnormal node is modified, the abnormal node and the normal node can be visually distinguished; the model name is added because different model networks are possibly used in the network, and the abnormal node and the normal node can be further conveniently distinguished by adding the model name; two bytes after the MAC is added, the abnormal nodes can be conveniently positioned, and the SSIDs of the rest normal nodes are kept unchanged.

In addition, after the node to be detected is judged to be abnormal, corresponding abnormal alarm needs to be performed, for example, alarm can be performed by continuously flashing a control system lamp.

For example, the wireless Mesh network uses the same SSID "TP-LNK _ Mesh", when an abnormal node is checked, the abnormal node SSID is changed to "TP-LNK _ Mesh _ TL-WDR8690_8D-4A _ ERROR", and the system lamp continuously blinks to perform abnormal node marking and alarm.

An embodiment of the present invention further provides a network node anomaly detection apparatus, which is shown in fig. 3 and is a block diagram of a preferred embodiment of the network node anomaly detection apparatus provided in the present invention, where the apparatus includes:

the real-time RSSI value acquisition module 11 is configured to acquire real-time RSSI values of a node to be detected and real-time RSSI values of M network nodes when the node to be detected communicates with the M network nodes in the initial signal strength table;

a real-time RSSI difference obtaining module 12, configured to respectively calculate and obtain real-time RSSI differences between the node to be detected and each of the network nodes according to the real-time RSSI values of the node to be detected and the real-time RSSI values of the M network nodes;

an RSSI difference comparison module 13, configured to compare real-time RSSI differences between the node to be detected and the M network nodes with initial RSSI differences between the node to be detected and the M network nodes in the initial signal strength table;

a node abnormality judgment module 14, configured to judge whether the node to be detected is abnormal according to the comparison result;

Preferably, the apparatus further comprises a signal strength table establishing module for establishing the initial signal strength table in advance by:

Preferably, the apparatus further comprises a signal strength table updating module configured to:

Preferably, the real-time RSSI value obtaining module 11 specifically includes:

a first real-time RSSI value obtaining unit, configured to obtain, in a BPSK modulation manner, real-time RSSI values when the node to be detected is used as a receiving node when the node to be detected communicates with the M network nodes, and real-time RSSI values when the M network nodes are used as receiving nodes; or the like, or, alternatively,

the second real-time RSSI value acquisition unit is used for respectively acquiring T RSSI values when the node to be detected is communicated with each network node and T RSSI values when each network node is used as a receiving node according to the preset test times T; wherein T is more than or equal to 2;

the first mean value calculation unit is used for carrying out averaging processing on the T RSSI values of the node to be detected and correspondingly obtaining real-time RSSI values when the node to be detected is used as a receiving node;

and the second mean value calculating unit is used for respectively carrying out averaging processing on the T RSSI values of each network node and correspondingly obtaining the real-time RSSI value when each network node is used as a receiving node.

Preferably, the node abnormality determining module 14 specifically includes:

and the node abnormity judging unit is used for judging that the node to be detected is abnormal when the real-time RSSI difference value between the node to be detected and the M network nodes is different from the initial RSSI difference value between the node to be detected and the M network nodes, and the change difference value between the real-time RSSI value and the initial RSSI value is larger than a preset threshold value.

Preferably, the real-time RSSI difference acquisition module 12 specifically includes:

a first real-time RSSI difference value obtaining unit, configured to obtain the Δ RSSI according to a formula when the node to be detected is used as a sending node and the M network nodes are used as receiving nodes_REti-REi＝RSSI_REti-REi-RSSI_REi-REtiCalculating to obtain a real-time RSSI difference value delta RSSI between the node to be detected and the ith network node_REti-REi；

A second real-time RSSI difference acquisition unit, for taking the node to be detected as a receiving node,when the M network nodes are used as transmitting nodes, according to a formula delta RSSI_REi-REti＝RSSI_REi-REti-RSSI_REti-REiCalculating to obtain a real-time RSSI difference value delta RSSI between the node to be detected and the ith network node_REi-REti；

Wherein the content of the first and second substances,

Preferably, when the node to be detected is used as a sending node and the M network nodes are used as receiving nodes, the apparatus further includes a node abnormality cause obtaining module, configured to:

Preferably, the apparatus further comprises a node exception handling module, configured to:

It should be noted that the network node abnormality detection apparatus provided in the embodiment of the present invention can implement all the processes of the network node abnormality detection method described in any one of the above embodiments, and the functions and implemented technical effects of each module and unit in the apparatus are respectively the same as those of the network node abnormality detection method described in the above embodiment and implemented technical effects, and are not described herein again.

An embodiment of the present invention further provides a network device, which is shown in fig. 4 and is a block diagram of a preferred embodiment of the network device provided in the present invention, where the network device includes a processor 10, a memory 20, and a computer program stored in the memory 20 and configured to be executed by the processor 10, and the processor 10, when executing the computer program, implements the network node abnormality detection method according to any of the embodiments described above.

Preferably, the computer program may be divided into one or more modules/units (e.g., computer program 1, computer program 2, … …) that are stored in the memory 20 and executed by the processor 10 to implement the present invention. The one or more modules/units may be a series of computer program instruction segments capable of performing specific functions, which are used to describe the execution of the computer program in the network device.

The Processor 10 may be a Central Processing Unit (CPU), other general purpose Processor, a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field Programmable Gate Array (FPGA) or other Programmable logic device, a discrete Gate or transistor logic device, a discrete hardware component, etc., the general purpose Processor may be a microprocessor, or the Processor 10 may be any conventional Processor, the Processor 10 is a control center of the network device, and various interfaces and lines are used to connect various parts of the network device.

The memory 20 mainly includes a program storage area that may store an operating system, an application program required for at least one function, and the like, and a data storage area that may store related data and the like. In addition, the memory 20 may be a high speed random access memory, may also be a non-volatile memory, such as a plug-in hard disk, a Smart Media Card (SMC), a Secure Digital (SD) Card, a Flash Card (Flash Card), and the like, or the memory 20 may also be other volatile solid state memory devices.

It should be noted that the network device may include, but is not limited to, a processor and a memory, and those skilled in the art will understand that the structural block diagram of fig. 4 is only an example of the network device and does not constitute a limitation of the network device, and may include more or less components than those shown, or combine some components, or different components.

To sum up, the method, the device and the network device for detecting the network node abnormality provided by the embodiment of the invention have the following beneficial effects:

(1) whether the node to be detected in the network is abnormal or not can be quickly judged according to the comparison result corresponding to the RSSI difference value, and the abnormal node in the network can be quickly positioned;

(2) the abnormal judgment result is not influenced by the position change of the network node, and the accuracy of the judgment result is higher;

(3) the method can be used for carrying out abnormity detection on whether the radio frequency device PA or LNA of the network node is damaged, and diagnosing the reason of the node abnormity more accurately.

The above description is only a preferred embodiment of the present invention, and it should be noted that, for those skilled in the art, several modifications and variations can be made without departing from the technical principle of the present invention, and these modifications and variations should also be regarded as the protection scope of the present invention.

Claims

1. A method for detecting network node abnormity is characterized by comprising the following steps:

2. The method of network node anomaly detection according to claim 1, characterized in that said method pre-establishes said initial signal strength table by:

3. The network node anomaly detection method according to claim 2, characterized in that said method further comprises:

4. The method according to claim 1, wherein the acquiring the real-time RSSI values of the node to be detected and the real-time RSSI values of the M network nodes when the node to be detected communicates with the M network nodes in the initial signal strength table specifically includes:

5. The method according to any one of claims 1 to 4, wherein the determining whether the node to be detected is abnormal according to the comparison result specifically includes:

6. The method according to claim 5, wherein the calculating, according to the real-time RSSI value of the node to be detected and the real-time RSSI values of the M network nodes, respectively obtains a real-time RSSI difference between the node to be detected and each network node, and specifically includes:

Wherein the content of the first and second substances,

RSSI_REti-REi、TxPower_REtiand RxGain_REiRespectively being the ith network node REi as a receiving node and the node to be detectedREt, when in communication, the real-time RSSI value of the ith network node REi, the transmission power of the node REt to be detected and the receiving gain of the ith network node REi; RSSI_REi-REti、TxPower_REiAnd RxGain_REtiWhen the node REt to be detected is used as a receiving node to communicate with the ith network node REi, the real-time RSSI value of the node REt to be detected, the transmission power of the ith network node REi and the receiving gain of the node REt to be detected are respectively set; AntGain_REiFor the antenna gain, AntGain, of the ith network node REi_REtFor the antenna gain of the node REt to be detected, AirLoss is the air channel attenuation, i is 1, 2, …, M.

7. The method for detecting network node abnormality according to claim 6, wherein when the node to be detected serves as a sending node and the M network nodes serve as receiving nodes, the method further comprises:

8. The network node anomaly detection method according to claim 5, characterized in that said method further comprises:

9. A network node abnormality detection apparatus, comprising:

10. A network device comprising a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, the processor implementing the network node anomaly detection method according to any one of claims 1 to 8 when executing the computer program.