CN113971093A

CN113971093A - Message processing method, device, equipment and computer storage medium

Info

Publication number: CN113971093A
Application number: CN202010714270.4A
Authority: CN
Inventors: 李国辉; 王燕; 张飞; 顾建宏; 王瑞宇
Original assignee: China Mobile Communications Group Co Ltd; China Mobile Suzhou Software Technology Co Ltd
Current assignee: China Mobile Communications Group Co Ltd; China Mobile Suzhou Software Technology Co Ltd
Priority date: 2020-07-22
Filing date: 2020-07-22
Publication date: 2022-01-25

Abstract

The invention provides a message processing method, which comprises the following steps: obtaining historical message data of each type of interface and carrying out model training on the historical message data to obtain a calling quantity time sequence model of each type of interface; acquiring the calling quantity of a first real-time interface at a plurality of moments of an interface to be monitored; determining a target abnormal interface from the interfaces to be monitored based on the interface call volume time series model, the first real-time interface call volume and the performance index of the interface; obtaining a retention message of the target abnormal interface and a real-time message of the target abnormal interface; and performing flow control processing on the target abnormal interface based on the retention message and the real-time message. The invention also provides a message processing device, equipment and a computer storage medium, which realize the discovery and processing of the message storm of the authentication message and the resource change message, thereby ensuring the timeliness of message processing and the normal operation of the MANO system.

Description

Message processing method, device, equipment and computer storage medium

Technical Field

The present invention relates to message processing technologies in the field of communications, and in particular, to a message processing method, device, and apparatus, and a computer storage medium.

Background

The Network characteristics of the Network architecture of Network Function Virtualization (NFV) enable resource information changes such as virtual Network elements and virtual machines to be more flexible, so as to implement flexible construction of networks and dynamic allocation of resources. The specification of the Management and organization network Management system (MANO) of NFV introduces a resource change message to be pushed to the upper layer network Management in real time through a restful interface, and the upper layer network Management can start the relevant resource data acquisition work in real time after receiving the resource change message. The network resource data acquisition mode enables the data acquisition platform to send a large amount of authentication messages and resource change messages to all application modules, and at the moment, if network faults or abnormal conditions occur, a large amount of authentication messages and resource change messages can be caused to burst, and message storms are generated.

However, in the related art, the message storm is mainly discovered and processed for the warning message, and the message storm of the authentication message and the resource change message cannot be discovered and processed, so that the resource consumption of the data acquisition platform or each application platform is caused, the performance of the MANO system is reduced, and the normal operation of the MANO system is even influenced.

Disclosure of Invention

In view of this, the present invention is expected to provide a message processing method, apparatus, device and computer storage medium, which implement discovery and processing of message storm of authentication message and resource change message, ensure timeliness of message processing of NFV network, avoid resource consumption and ensure normal operation of network and MANO system.

In order to achieve the purpose, the technical scheme of the invention is realized as follows:

in a first aspect, a method for processing a message is provided, where the method includes:

obtaining historical message data of each type of interface and carrying out model training on the historical message data to obtain a calling quantity time sequence model of each type of interface;

acquiring the calling quantity of a first real-time interface at a plurality of moments of an interface to be monitored;

determining a target abnormal interface from the interfaces to be monitored based on the interface call volume time series model, the first real-time interface call volume and the performance index of the interface;

obtaining a retention message of the target abnormal interface and a real-time message of the target abnormal interface;

and performing flow control processing on the target abnormal interface based on the retention message and the real-time message.

Optionally, the obtaining historical message data of each type of interface and performing model training on the historical message data to obtain a time series model of call volume of each type of interface includes:

acquiring historical message data of an interface, and classifying the historical message data of the interface to obtain the historical message data of each type of interface, wherein the historical message data comprises authentication message data and/or resource change message data;

preprocessing the historical message data of each type of interface to obtain an interface call volume data sequence of each type of interface;

and performing time series modeling based on the interface call volume data sequence to obtain each type of interface call volume time series model.

Optionally, the determining a target abnormal interface from the interfaces to be monitored based on the interface call volume time series model, the first real-time interface call volume, and the performance index of the interface includes:

determining a reference abnormal interface from the interfaces to be monitored based on the first real-time interface call quantity and an interface call quantity time sequence model corresponding to the type of the interfaces to be monitored;

acquiring a reference performance index of the reference abnormal interface from the performance indexes, wherein the performance index indicates the message retention degree of the interface;

and determining the target abnormal interface from the reference abnormal interfaces based on the second real-time interface calling amount of the reference abnormal interface and the reference performance index.

Optionally, the determining a reference abnormal interface from the interfaces to be monitored based on the first real-time interface call quantity and an interface call quantity time series model corresponding to the type of the interface to be monitored includes:

analyzing an interface call quantity time sequence model corresponding to the type of the interface to be monitored to obtain a reference interface call quantity;

and determining the reference abnormal interface from the interfaces to be monitored based on the reference interface calling amount and the first real-time interface calling amount.

Optionally, the determining the reference abnormal interface from the interfaces to be monitored based on the reference interface call amount and the first real-time interface call amount includes:

calculating the difference value of the calling amount of each first real-time interface and the calling amount of the reference interface;

standardizing the difference to obtain a standardized residual error of the interface to be monitored;

and if the standardized residual error is larger than a preset reference value, determining the interface to be monitored as the reference abnormal interface.

Optionally, the determining the target abnormal interface from the reference abnormal interface based on the second real-time interface call amount of the reference abnormal interface and the reference performance index includes:

calculating a first moving average value of the second real-time interface calling amount and a second moving average value of the reference performance index by adopting a moving average algorithm;

determining the target exception interface from the reference exception interfaces based on the first moving average and the second moving average.

Optionally, the determining the target abnormal interface from the reference abnormal interfaces based on the first moving average and the second moving average includes:

based on the first moving average value and the first preset threshold value, carrying out normalization processing on the first moving average value to obtain a first normalization value of the second real-time interface calling amount;

normalizing the second moving average value of each reference performance index based on the second moving average value of each reference performance index and a first preset threshold value to obtain a second normalized value of each reference performance index;

calculating a message storm index of the reference abnormal interface based on the first normalization value, the first preset weight of the second real-time interface calling quantity, the second normalization value of each reference performance index and the second preset weight of each reference performance index;

and if the message storm index is larger than a second preset threshold value, determining the reference abnormal interface as the target abnormal interface.

Optionally, the performing flow control processing on the target abnormal interface based on the retention message and the real-time message includes:

establishing a message buffer queue, wherein the message buffer queue is used for storing the detained messages;

and if the retention message contains the message matched with the real-time message, deleting the retention message matched with the real-time message, and storing the real-time message into the message cache queue.

Optionally, the establishing a message buffer queue includes:

determining the capacity of the message cache queue based on a first message storm index of the target abnormal interface;

and establishing the message buffer queue based on the capacity of the message buffer queue.

Optionally, if there is a message matching with the real-time message in the retention message, deleting the retention message matching with the real-time message, and storing the real-time message in the message buffer queue, including:

calculating a hash value of the real-time message; detecting whether the hash value of the real-time message is the same as the hash value of the detained message, wherein the hash value of the detained message is stored in the message cache queue;

if the information is the same, detecting whether the resources corresponding to the retention information are the same as the resources corresponding to the real-time information or not based on a preset resource matching library;

and if the real-time messages are the same, deleting the retention messages with the same resources corresponding to the real-time messages, and storing the real-time messages and the hash values of the real-time messages into the message cache queue.

Optionally, the method further includes:

calculating a second message storm index of the target abnormal interface;

and if the second message storm index is less than or equal to a third preset threshold value, deleting the message buffer queue.

Optionally, the method further includes:

and carrying out resource relevance analysis on the resource information related to the target abnormal interface, and determining the reason of the network fault and/or the fault point of the network.

Optionally, the performing resource relevance analysis on the resource information associated with the target abnormal interface to determine a cause and/or a network fault point of the network fault includes:

if the resource information related to the target abnormal interface is from resource information related to a network element layer, a virtual layer and a physical layer in an NFV framework, determining the reason of the network fault as the related relation among the network element layer, the virtual layer and the physical layer; and/or

If the resource information associated with the target abnormal interface is derived from the resource information of a network element group with a plurality of network elements in a network element layer in the NFV architecture, determining a fault point of the network as the network element group; and/or

And if the resource information associated with the target abnormal interface is derived from the resource information of a network element node group with a plurality of network element nodes in the network element of the NFV architecture, determining the fault point of the network as the network element node group.

Optionally, the method further includes:

comparing the number of the detained messages in the message cache queue with the capacity of the message cache queue to obtain a comparison result;

and adjusting the relation between the first message storm index and the capacity of the message buffer queue based on the comparison result.

Optionally, the method further includes:

monitoring first system resource information and second system resource information, and comparing the first system resource information with the second system resource information, wherein the first system resource information is the system resource information before the message cache queue is established; the second system resource information is the system resource information after the message buffer queue is established.

In a second aspect, a message processing apparatus is provided, the apparatus comprising: the device comprises a generating unit, a first acquiring unit, a first determining unit, a second acquiring unit and a processing unit, wherein:

the generation unit is used for acquiring historical message data of each type of interface and performing model training on the historical message data to obtain a calling quantity time sequence model of each type of interface;

the first acquisition unit is used for acquiring the first real-time interface calling amount of the interface to be monitored at a plurality of moments;

the first determining unit is used for determining a target abnormal interface from the interfaces to be monitored based on the interface call volume time series model, the first real-time interface call volume and the performance index of the interface;

the second acquisition unit is used for acquiring the retention message of the target abnormal interface and the real-time message of the target abnormal interface;

and the processing unit is used for carrying out flow control processing on the target abnormal interface based on the retention message and the real-time message.

In a third aspect, a message processing apparatus is provided, the apparatus comprising: a processor, a memory, and a communication bus;

the communication bus is used for realizing communication connection between the processor and the memory;

the processor is configured to execute a message handler in memory to implement the steps of:

In a fourth aspect, a computer storage medium is provided, which is characterized by storing one or more programs, wherein the one or more programs are executable by one or more processors to implement the steps of the message processing method described above.

The message processing method, the device, the equipment and the computer storage medium provided by the invention are used for acquiring the historical message data of each type of interface and performing model training on the historical message data to obtain the interface call volume time series model of each type; acquiring the calling quantity of a first real-time interface at a plurality of moments of an interface to be monitored; determining a target abnormal interface from the interfaces to be monitored based on the interface call volume time series model, the first real-time interface call volume and the performance index of the interface; obtaining a retention message of the target abnormal interface and a real-time message of the target abnormal interface; and performing flow control processing on the real-time message based on the retention message and the real-time message, thus, by adopting an interface call volume time sequence model generated based on authentication message data and resource change message data, a target abnormal interface generating a message storm can be determined, and the flow control processing is performed on the message of the target abnormal interface, thereby realizing the discovery and processing of the message storm of the authentication message and the resource change message, ensuring the timeliness of the message processing of the NFV network, avoiding the consumption of resources and ensuring the normal operation of the network and the MANO system.

Drawings

Fig. 1 is a schematic flowchart of a message processing method according to an embodiment of the present invention;

fig. 2 is a schematic flowchart of another message processing method according to an embodiment of the present invention;

fig. 3 is a schematic flowchart of another message processing method according to an embodiment of the present invention;

fig. 4 is a schematic structural diagram of a message processing system according to an embodiment of the present invention;

fig. 5 is a schematic structural diagram of another message processing apparatus according to an embodiment of the present invention;

fig. 6 is a schematic structural diagram of another message processing apparatus according to an embodiment of the present invention.

Detailed Description

The technical solution of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention.

It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.

The invention provides a message processing method, which can be applied to message processing equipment and is shown in figure 1, and the method comprises the following steps:

step 101, obtaining historical message data of each type of interface and performing model training on the historical message data to obtain a calling quantity time sequence model of each type of interface.

In the embodiment of the invention, in the NFV network architecture, for the interfaces receiving the authentication message and the resource change message, the interfaces can be classified according to the type of the message content. The types of the interfaces can comprise interfaces of a network element layer, interfaces of a virtual layer, interfaces of a physical layer, interfaces of a core network, a transmission network and a wireless network which are associated with the three layers, and the like, and the interfaces can be further classified in a fine-grained way according to a more refined type of the message content. Wherein the method of discovery and handling of the message storm is the same for each type of interface.

Step 102, obtaining the first real-time interface calling amount of the interface to be monitored at a plurality of moments.

In the embodiment of the present invention, the first real-time interface call volume may be interface call times of the interface to be monitored at multiple times. In a possible implementation manner, the first real-time interface call amount may be stored in the form of a data sequence, and the data sequence is arranged along with the sequence of the plurality of moments.

And 103, determining a target abnormal interface from the interfaces to be monitored based on the interface call volume time sequence model, the first real-time interface call volume and the performance indexes of the interfaces.

In one possible implementation, the target exception interface is the interface that generated the message storm. The performance index of each type of interface can be one or more indexes, each index comprises data of the index at a plurality of moments, each index can be stored in the form of a data sequence, and the data sequence is arranged along the sequence of the moments.

And 104, acquiring a retention message of the target abnormal interface and a real-time message of the target abnormal interface.

In the embodiment of the invention, when a large amount of messages burst at the interface, the messages can not be processed in time, so that the message blocking of the interface can be caused, the interface generates a message storm and becomes a target abnormal interface, and the message which causes the interface to generate the message storm is a retention message of the target abnormal interface. And the message of the target abnormal interface at the current moment after the moment of the message storm is the real-time message of the target abnormal interface.

And 105, performing flow control processing on the target abnormal interface based on the retention message and the real-time message.

In the embodiment of the invention, after the storm occurs, the timeliness of real-time message processing is ensured by the flow control processing of the target abnormal interface, so that the consumption of the message storm on system resources is reduced, and the system pressure is further relieved.

The message processing method provided by the invention obtains the historical message data of each type of interface and carries out model training on the historical message data to obtain the interface call quantity time sequence model of each type; acquiring the calling quantity of a first real-time interface at a plurality of moments of an interface to be monitored; determining a target abnormal interface from the interfaces to be monitored based on the interface call volume time series model, the first real-time interface call volume and the performance indexes of the interfaces; obtaining a retention message of a target abnormal interface and a real-time message of the target abnormal interface; and performing flow control processing on the real-time message based on the retention message and the real-time message, thus, by adopting an interface call volume time sequence model generated based on the authentication message data and the resource change message data, a target abnormal interface generating a message storm can be determined, and the message of the target abnormal interface is subjected to flow control processing, thereby realizing the discovery and processing of the message storm of the authentication message and the resource change message, ensuring the timeliness of message processing of the NFV network system, avoiding the consumption of resources and ensuring the normal operation of the network and the MANO system.

Based on the foregoing embodiments, the present invention provides a message processing method, which may be applied to a message processing device, and as shown in fig. 2, the method may include the following steps:

step 201, obtaining historical message data of the interfaces, and classifying the historical message data of the interfaces to obtain historical message data of each type of interface.

Wherein the historical message data comprises authentication message data and/or resource change message data.

In one possible implementation, the classifying the historical message data may include classifying the historical message data by a type of interface.

It should be noted that the historical message data may be authentication message data and/or resource change message data in a certain historical time; in one possible implementation, historical message data may be obtained for each type of interface 10 days prior to the current time.

Step 202, preprocessing the historical message data of each type of interface to obtain an interface call volume data sequence of each type of interface.

In one possible implementation, the preprocessing may include a cleaning process, a deduplication process, a statistical process, and an interpolation process. The cleansing process may include removing unwanted fields, unifying data formats of the same fields, removing illegal values, and the like. The deduplication process may include retaining only one piece of data at each time, and removing redundant data at each time. The statistical processing may include performing statistics on historical message data of each type of interface subjected to the cleaning processing and the deduplication processing to obtain interface tuning frequency data of each time corresponding to each type of interface. The interpolation processing may include calculating a data missing ratio of the interface call frequency data, and then interpolating the historical message data having a missing ratio smaller than a preset ratio value in a linear interpolation manner or the like. The preset proportion value can be 10%, and can also be set and adjusted according to the actual application condition. And obtaining an interface call volume data sequence corresponding to each type of interface after interpolation processing.

And 203, performing time sequence modeling based on the interface call volume data sequence to obtain each type of interface call volume time sequence model.

In the embodiment of the invention, the time series modeling is carried out on the interface call volume in the interface call volume data sequence, so as to generate the time series model. In the related art, any method capable of implementing time series modeling according to the embodiment of the present invention may be applied to the embodiment of the present invention.

And 204, acquiring the calling quantity of the first real-time interface at multiple moments of the interface to be monitored.

Step 205, determining a reference abnormal interface from the interfaces to be monitored based on the first real-time interface call quantity and the interface call quantity time series model corresponding to the type of the interfaces to be monitored.

In the embodiment of the invention, some reference abnormal interfaces can be determined preliminarily, and the range of the interfaces with the abnormal interfaces is narrowed. These reference exception interfaces may include interfaces where message storms occur and "noisy" interfaces, where a "noisy" interface may be an interface where a message storm temporarily occurs for a short period of time.

Wherein step 205 may be implemented by steps 205a-205 b:

step 205a, analyzing the interface call quantity time series model corresponding to the type of the interface to be monitored to obtain the reference interface call quantity.

In a feasible implementation manner, the interface call volume in the interface call volume time series model can conform to normal distribution; in a normal distribution curve, taking the interface calling amount corresponding to the peak value as a reference interface calling amount; wherein, each type of interface to be monitored corresponds to a reference interface calling amount.

And step 205b, determining a reference abnormal interface from the interfaces to be monitored based on the reference interface calling amount and the first real-time interface calling amount.

In the embodiment of the invention, the reference interface calling amount is compared with the first real-time interface calling amount, then the comparison result is compared with a preset reference value to obtain a comparison result, and a reference abnormal interface is determined from the interfaces to be monitored based on the comparison result.

And step 206, acquiring a reference performance index of the reference abnormal interface from the performance indexes.

Wherein the performance indicator indicates a message retention level of the interface.

In one possible implementation, the performance indicators may include: one or more of the network flow of the interface, the Central Processing Unit (CPU) utilization rate of the interface, the memory occupancy rate of the interface, and the like. And the performance index of the reference abnormal interface is a reference performance index.

And step 207, determining a target abnormal interface from the reference abnormal interfaces based on the second real-time interface calling amount and the reference performance index of the reference abnormal interface.

In a feasible implementation manner, when the performance index may be a plurality of indexes, the reference performance index may also be a plurality of indexes, and the target abnormal interface is determined by using the plurality of reference performance indexes, so that the accuracy of determining the target abnormal interface can be further improved, that is, the accuracy of determining the occurrence of the message storm is improved.

Wherein step 207 may be implemented by steps 207a-207 b:

and step 207a, calculating a first moving average value of the second real-time interface call quantity and a second moving average value of the reference performance index by adopting a moving average algorithm.

In one possible implementation, the first moving average and the second moving average may be calculated using an exponential moving average algorithm. The calculation method of the first moving average value and the second moving average value is the same; a represents a smoothing parameter, and a is more than or equal to 0 and less than or equal to 1; n represents the size of the time sliding window, n is a natural number, y_T-iA reference performance index representing i moments before the T moment;

a second moving average representing the reference performance indicator at time T or time T + 1. When the reference performance index is a plurality of indices, the index is dividedAnd respectively calculating a second moving average value of each index. The formula for calculating the second moving average of the reference performance indicator may be as shown in formula (1):

in the case of calculating the first moving average value using the formula (1), y is represented by the formula (1)_T-iRepresenting the calling amount of a second real-time interface at i moments before the T moment;

a first moving average of the reference abnormal interface call volume at time T or time T +1, with other parameters unchanged.

It should be noted that if

May be a first moving average of the second real-time interface call volume at time T +1 and a second moving average of the reference performance indicator,

predicting a first moving average and a second moving average for the predicted first moving average and the predicted second moving average; at the moment, according to the predicted moving average value, predicting a target abnormal interface from a reference abnormal interface; the predicted target exception interface refers to an interface where an exception may occur.

And step 207b, determining a target abnormal interface from the reference abnormal interfaces based on the first moving average and the second moving average.

In the embodiment of the invention, the moving average value can reduce the influence degree of other factors on the calling quantity of the second real-time interface and the reference performance index, so that the determined target abnormal interface is more accurate.

And step 208, obtaining the retention message of the target abnormal interface and the real-time message of the target abnormal interface.

And step 209, performing flow control processing on the target abnormal interface based on the retention message and the real-time message.

In the embodiment of the invention, the flow control processing can be carried out on the real-time message by comparing the relation between the retention message and the real-time message.

It should be noted that, for the descriptions of the same steps and the same contents in this embodiment as those in other embodiments, reference may be made to the descriptions in other embodiments, which are not described herein again.

The message processing method provided by the invention adopts the interface call volume time sequence model generated based on the authentication message data and the resource change message data, can determine the target abnormal interface generating the message storm, and performs flow control processing on the message of the target abnormal interface, thereby realizing the discovery and processing of the message storm of the authentication message and the resource change message, ensuring the timeliness of the message processing of the NFV network system, avoiding the consumption of resources and ensuring the normal operation of the network and the MANO system.

Based on the foregoing embodiments, the present invention provides a message processing method, which may be applied to a message processing device, and as shown in fig. 3, the method may include the following steps:

step 301, obtaining historical message data of the interfaces, and classifying the historical message data of the interfaces to obtain historical message data of each type of interface.

Step 302, preprocessing the historical message data of each type of interface to obtain an interface call volume data sequence of each type of interface.

And 303, performing time series modeling based on the interface call volume data sequence to obtain each type of interface call volume time series model.

And 304, acquiring the calling quantity of the first real-time interface at multiple moments of the interface to be monitored.

305, analyzing an interface call quantity time sequence model corresponding to the type of the interface to be monitored to obtain a reference interface call quantity;

and step 306, calculating the difference value between each first real-time interface calling amount and the reference interface calling amount.

In a feasible implementation manner, the first real-time interface call quantity can be used as a decrement, the reference interface call quantity is used as a decrement, and a difference value is obtained through calculation; where res represents a difference, i.e. a residual; c_trueRepresenting a first real-time interface call amount; c_preRepresenting a reference interface call amount; at this time, the calculation formula of the difference between the first real-time interface call amount and the reference interface call amount may be as shown in formula (2):

res＝C_true-C_pre (2)

and 307, standardizing the difference value to obtain a standardized residual error of the interface to be monitored.

In one possible implementation, nres represents the normalized residual; mean (res) represents the mean of the residuals; sd (res) represents the standard deviation of the residual. The normalized residuals follow a standard normal distribution N (0, 1) with a mean of 0 and a variance of 1; at this time, the calculation formula for normalizing the difference value may be as shown in formula (3):

and 308, if the standardized residual error is larger than a preset reference value, determining the interface to be monitored as a reference abnormal interface.

Wherein, the preset reference value can be the upper alpha quantile u of the standard normal distribution_αThe normalized residual is compared to the upper alpha quantile u_αFor comparison, if nres > u_αThe first real-time interface call amount corresponding to the standardized residual error may be considered to be abnormal, and the interface to be monitored corresponding to the first real-time interface call amount is a reference abnormal interface. It should be noted that the value of α can be set and adjusted according to the actual application; when α is 0.92, nres > u occurs_0.92The probability of (2) is 0.08; if nres > u_0.92Then, it may be considered that the first real-time interface call volume corresponding to the normalized residual error is abnormal.

Step 309, obtaining a reference performance index of the reference abnormal interface from the performance indexes.

And 310, calculating a first moving average value of the second real-time interface call quantity and a second moving average value of the reference performance index by adopting a moving average algorithm.

Step 311, based on the first moving average and a first preset threshold, performing normalization processing on the first moving average to obtain a first normalized value of the call amount of the second real-time interface.

In one possible implementation, the first moving average values are respectively compared with a first preset threshold value, where the first preset threshold value is (Q)_d，Q_u) The first moving average is greater than Q_uThen, 1 is assigned to the first moving average, which is less than Q_dAnd then, assigning 0 to the first moving average value to obtain a first normalized value.

And step 312, performing normalization processing on the second moving average value of each reference performance index based on the second moving average value of each reference performance index and the first preset threshold value to obtain a second normalized value of each reference performance index.

In one possible implementation, the normalization processing method for the first moving average and the second moving average is the same. If the reference performance index comprises a plurality of indexes, respectively comparing the second moving average value of each reference performance index with a first preset threshold value, wherein the first preset threshold value is (Q)_d，Q_u) The second moving average is greater than Q_uThen, a value of 1 is assigned to the second moving average, which is less than Q_dAnd then, assigning 0 to the second moving average value to obtain a second normalized value of each reference performance index. Wherein the moving average is greater than Q_uBased on the abnormal interface call amount or the abnormal performance index corresponding to the moving average value, the moving average value is smaller than Q_dThe reference abnormal interface call amount or the reference performance index corresponding to the moving average value may be considered to be normal. It should be noted that the first preset threshold may be set and adjusted according to practical applications.

Step 313, calculating a message storm index of the reference abnormal interface based on the first normalization value, the first preset weight of the second real-time interface call quantity, the second normalization value of each reference performance index and the second preset weight of each reference performance index.

In the embodiment of the invention, if the reference performance index is a plurality of indexes, respectively aiming at each reference performance index, multiplying a second normalization value of the reference performance index by a corresponding second preset weight to obtain a product, meanwhile, multiplying a first normalization value by a first preset weight to obtain a product, and finally adding all the obtained products to obtain the message storm index; in a possible implementation, if the second real-time interface call amount is used as one of the reference performance indicators, the message storm index may be calculated by using formula (4):

wherein Storm represents a message Storm index; k represents the number of the reference performance indexes, and is a positive integer; j represents a label corresponding to the reference performance index, and j is a natural number; v. of_jThe normalized value of the reference performance indicator denoted j; w is a_jRepresenting a preset weight of the reference performance indicator denoted j.

It should be noted that the preset weight of the reference performance index may be set and adjusted according to the actual application situation.

And step 314, if the message storm index is larger than a second preset threshold, determining the reference abnormal interface as a target abnormal interface.

It should be noted that the second preset threshold may be set and adjusted according to the actual application.

And step 315, obtaining the retention message of the target abnormal interface and the real-time message of the target abnormal interface.

Step 316, establish a message buffer queue.

Wherein the message buffer queue is used for storing the detained messages.

In the embodiment of the invention, when the message storm is indicated to occur after the target abnormal interface is determined, a message buffer queue is established.

In a feasible implementation manner, when the message buffer queue is established, the capacity of the message buffer queue needs to be determined first, where the capacity may be a capacity preset according to actual application, or may be a capacity determined according to a first message storm index of a target abnormal interface calculated.

Wherein step 316 may be implemented by steps 316a-316 b:

step 316a, determining the capacity of the message buffer queue based on the first message storm index of the target abnormal interface.

Step 316b, establishing a message buffer queue based on the capacity of the message buffer queue.

In the embodiment of the present invention, in the message storm indexes, the message storm index greater than the second preset threshold is the first message storm index, that is, the first message storm index of the target abnormal interface.

In one possible implementation, the size of the message buffer queue may be determined by a functional relationship size ═ f (Storm') between the first message Storm index and the size of the message buffer queue, and then the message buffer queue may be established based on the size.

Wherein size represents the capacity of the message buffer queue; storm' denotes a first message Storm index; the functional relationship may comprise a linear functional relationship, i.e. the higher the first message storm index, the larger the capacity.

And 317, if the message matched with the real-time message exists in the detained message, deleting the detained message matched with the real-time message, and storing the real-time message into a message cache queue.

According to the embodiment of the invention, the retention message is filtered through whether the real-time message is the same as the retention message or not, so that the overdue retention message is prevented from being repeatedly processed while the real-time message is prevented from being lost, the timeliness of the retention message processing is ensured, and the timeliness of the message processing is further ensured.

In a possible implementation manner, since multiple retained messages identical to the real-time message may be stored in the buffer queue, whether the retained messages are identical to the real-time message or not may be detected one by one.

In one possible implementation, if the same message as the real-time message does not exist in the retained message, the real-time message is stored in the message buffer queue.

Wherein step 317 can be implemented by steps 317a-317 c:

step 317a, calculating a hash value of the real-time message; detecting whether the hash value of the real-time message is the same as the hash value of the retention message; wherein the hash value of the retained message is stored in the message buffer queue.

In the embodiment of the invention, the hash value of the retention message can be calculated after the retention message is obtained, and the cache queue stores the retention message and the hash value thereof together.

In one possible implementation, the hash value of the retention message is calculated by using a combination of the type of the resource corresponding to the retention message and the unique identifier of the resource as a key, and the algorithm for calculating the hash value includes, but is not limited to, a modulo algorithm. The method for calculating the hash value of the retention message is the same as the method for calculating the hash value of the real-time message.

And 317b, if the information is the same, detecting whether the resources corresponding to the retention information are the same as the resources corresponding to the real-time information based on the preset resource matching library.

In a feasible implementation manner, the preset resource matching library stores information such as the type of the interface, the resource type corresponding to the message, the field of the resource, the detection method of the same resource, and the like. Further, the type of the target abnormal interface, the resources corresponding to the retention message and the resources corresponding to the real-time message are matched with the information in the preset resource matching library, and after matching, whether the resources corresponding to the retention message and the resources corresponding to the real-time message are the same is detected according to a detection method of the same resources.

In one possible implementation, if the hash value of the real-time message is different from the hash value of the retained message, the hash values of the real-time message and the real-time message are stored in a message cache queue.

And 317c, if the real-time messages are the same, deleting the detained messages with the same resources corresponding to the real-time messages, and storing the real-time messages and the hash values of the real-time messages into a message cache queue.

If necessary, the

steps

311 and 312 are executed without any sequence.

Based on the foregoing embodiment, in other embodiments of the present invention, after the step 316, the steps 401 and 402 can be further executed:

step 401, calculating a second message storm index of the target abnormal interface.

In this embodiment of the present invention, the second message storm index is the same as the message storm index calculation method in step 312, except that the second message storm index is calculated after the flow control processing is performed on the target abnormal interface.

And step 402, deleting the message buffer queue if the second message storm index is less than or equal to a third preset threshold value.

In the embodiment of the present invention, if the second message storm index is less than or equal to the third preset threshold, the target abnormal interface is converted into the normal interface, that is, the message storm of the target abnormal interface is eliminated, and at this time, the real-time message of the normal interface is normally processed. After all processing of the stranded messages in the message buffer queue is completed, the message buffer queue may be deleted.

Based on the foregoing embodiments, in other embodiments of the present invention, the method may further include the steps of:

step 501, comparing the number of the detained messages in the message buffer queue with the capacity of the message buffer queue to obtain a comparison result.

And 502, adjusting the relation between the first message storm index and the capacity of the message buffer queue based on the comparison result.

In a possible implementation, if the capacity of the message buffer queue is calculated based on a functional relationship between the first message storm index and the capacity of the message buffer queue, the functional relationship may be adjusted according to the comparison result.

In a feasible implementation manner, when the number of the retained messages in the message buffer queue is greater than or equal to the capacity of the message buffer queue, the buffer overflow may be caused, and at this time, the functional relationship between the first message storm index and the capacity of the message buffer queue may be adjusted and optimized, so that when a subsequent message buffer queue is established, the capacity of the message buffer queue is adjusted, and the buffer overflow is avoided. When the ratio of the maximum value of the number of the detained messages in the message buffer queue to the capacity of the message buffer queue is smaller than a fourth preset threshold value, the functional relation between the first message storm index and the capacity of the message buffer queue can be adjusted and optimized, so that the capacity of the message buffer queue is adjusted when a subsequent message buffer queue is built, and the situation that the space is occupied due to the overlarge capacity is avoided.

step 601, monitoring the first system resource information and the second system resource information, and comparing the first system resource information and the second system resource information.

The first system resource information is system resource information before a message cache queue is established; the second system resource information is the system resource information after the message buffer queue is established.

In the embodiment of the invention, the first system resource information and the second system resource information are the system resource information of the MANO system, and the running state of the MANO system and the performance state of the system before and after the establishment of the message cache queue can be compared by monitoring the first system resource information and the second system resource information.

step 701, performing resource relevance analysis on the resource information related to the target abnormal interface, and determining a fault point of the network.

In the embodiment of the invention, the fault point of the network can be positioned according to the resource information associated with the target abnormal interface, so that the root cause of the message storm of the target abnormal interface is determined, the fault of the fault point can be eliminated in time, and the normal operation of the network is ensured.

It should be noted that the step 701 may be performed before or after the

steps

104, 208, and 315, or may be performed after the

steps

105, 209, and 317.

Wherein, step 701 can be implemented by steps 701a, 701b and/or 701 c:

step 701a, if the resource information associated with the target abnormal interface is derived from the resource information associated with the network element layer, the virtual layer and the physical layer in the NFV architecture, determining that the cause of the network fault is the association between the network element layer, the virtual layer and the physical layer.

In the embodiment of the invention, if the retention message of the target abnormal interface and the resource information corresponding to the real-time message are from the first resource information in the network element layer, the virtual layer and/or the physical layer, and the first resource information is related to the second resource information in the three layers, further, if the second resource information is related to the third resource information in the three layers, a network fault is generated due to the association relationship among the network element layer, the virtual layer and the physical layer, and further, a message storm occurs to the interface. The first resource information, the second resource information, and the third resource information may include one or more resource information, respectively.

In a feasible implementation manner, if the professional network management equipment of the network element layer continuously and frequently acquires identity authentication token (token) information from the upper layer comprehensive network management, it is considered that the virtual network card information of the virtual layer frequently changes, and the reason why the frequent change occurs may be that the connection of a certain switch of the physical layer is unstable, so that it is considered that the network fault is caused by the association relationship among the network element layer, the physical layer, and the virtual layer.

Step 701b, if the resource information associated with the target abnormal interface is derived from the resource information of a network element group with a plurality of network elements in the network element layer in the NFV architecture, determining that the fault point of the network is the network element group.

In the embodiment of the present invention, a plurality of network elements forming a network element group have an association relationship, and if resource information associated with a target abnormal interface is derived from a network element group of a network element layer in an NFV architecture, it can be determined that the network element group formed by the plurality of network elements is a fault point of a network.

In a feasible implementation manner, the failure of the network element group may include a failure of a signaling link of the network element group, a failure that a network route of the network element group is unreachable, or a failure that a network element in the network element group is overloaded at the same time.

Step 701c, if the resource information associated with the target abnormal interface is derived from the resource information of a network element node group having a plurality of network element nodes in the network element of the NFV architecture, determining that the fault point of the network is the network element node group.

In a feasible implementation manner, after determining the cause of the network fault and the fault point of the network, network element information generating the network fault may be obtained, and fault diagnosis may be performed according to the network element information, where the fault diagnosis may include performing fault diagnosis by using each professional fault management system, and/or performing fault troubleshooting on an on-site machine room or a base station according to the network element information.

In a possible implementation manner, the message processing method according to the embodiment of the present invention may be applied to the system shown in fig. 4; the system may include: the system comprises an original data module, an application and system index module, a data analysis preprocessing module, a model training and message storm confirmation module, a flow control processing module, a preset resource matching library, a training model library and an application module. The original data module includes original data, and the original data may include an interface authentication message and a resource change message. Specifically, the method comprises the following steps:

firstly, carrying out data classification and preprocessing on an interface authentication message and a resource change message through a data analysis preprocessing module; the preprocessing comprises data processing through a data cleaning submodule, a data duplication removing submodule, a data statistics submodule and a data interpolation submodule; in one possible implementation, the interface authentication message and the resource change message may refer to historical interface authentication messages and resource change messages; of course, the interface authentication message and the resource change message may also include an interface authentication message and a resource change message generated by the interface in real time.

Secondly, obtaining an interface call volume data sequence of each type of interface after preprocessing, carrying out model training on the interface call volume data sequence in a model training and message storm confirmation module based on an algorithm in a model training library to obtain an interface call volume time sequence model, and storing the interface call volume time sequence in a training model library.

Then, the model training and message storm confirming module can determine a reference abnormal interface in the interface to be monitored based on the interface calling quantity time sequence model and the real-time interface calling quantity.

Thirdly, a data analysis submodule of the flow control processing module determines a target abnormal interface from the reference abnormal interface according to each index in the application and system index module, namely an interface for determining the occurrence of the message storm, and then calls a flow strategy configuration execution submodule which performs flow control processing on the retention message and the real-time message of the target abnormal interface through a message cache queue based on a preset resource matching library; meanwhile, the strategy execution management submodule monitors the buffer overflow condition of the message buffer queue and contrasts and analyzes the system resource information before and after the flow control processing. When the message storm of the target abnormal interface is eliminated, the strategy execution management submodule indicates the flow strategy configuration execution submodule to remove flow control processing, and the normal interface message processing flow is recovered.

And finally, a network hidden danger troubleshooting submodule in the application module is used for troubleshooting the network fault hidden danger according to the resource information associated with the target abnormal interface, and a capability output submodule can output information such as the message type and the interface details of the target abnormal interface generating the message storm.

The message processing method provided by the invention can determine the target abnormal interface generating the message storm based on the interface call volume time sequence model generated by the authentication message data and the resource change message data, and then, flow control processing is carried out on the message of the target abnormal interface so as to realize the discovery and processing of the message storm of the authentication message and the resource change message, thereby ensuring the timeliness of message processing of an NFV network system, avoiding the consumption of resources and ensuring the normal operation of the network and the MANO system.

The present invention provides a message processing apparatus, which can be applied to a message processing method corresponding to fig. 1 to 3, and as shown in fig. 5, the apparatus may include: a generating unit 81, a first obtaining unit 82, a first determining unit 83, a second obtaining unit 84, and a processing unit 85, wherein:

the generating unit 81 is configured to obtain historical message data of each type of interface and perform model training on the historical message data to obtain an interface call volume time series model of each type;

a first obtaining unit 82, configured to obtain first real-time interface call quantities of an interface to be monitored at multiple times;

the first determining unit 83 is configured to determine a target abnormal interface from the interfaces to be monitored based on the interface call volume time series model, the first real-time interface call volume, and the performance index of the interface;

a second obtaining unit 84, configured to obtain a retention message of the target abnormal interface and a real-time message of the target abnormal interface;

and the processing unit 85 is configured to perform flow control processing on the target exception interface based on the retention message and the real-time message.

In other embodiments of the present invention, the generating unit 81 may include: the device comprises an acquisition module, a processing module and a generation module.

The acquisition module is used for acquiring historical message data of the interfaces and classifying the historical message data of the interfaces to obtain the historical message data of each type of interface, wherein the historical message data comprises authentication message data and/or resource change message data;

the processing module is used for preprocessing the historical message data of each type of interface to obtain an interface call volume data sequence of each type of interface;

and the generating module is used for carrying out time sequence modeling based on the interface call quantity data sequence to obtain each type of interface call quantity time sequence model.

In other embodiments of the present invention, the first determining unit 83 may include: the device comprises a first determining module, an obtaining module and a second determining module.

The first determining module is used for determining a reference abnormal interface from the interfaces to be monitored based on the first real-time interface call quantity and an interface call quantity time sequence model corresponding to the type of the interfaces to be monitored;

the acquisition module is used for acquiring a reference performance index of a reference abnormal interface from the performance indexes, wherein the performance index indicates the message retention degree of the interface;

and the second determining module is used for determining the target abnormal interface from the reference abnormal interface based on the second real-time interface calling amount and the reference performance index of the reference abnormal interface.

The first determining module is specifically configured to implement the following steps:

and determining a reference abnormal interface from the interfaces to be monitored based on the reference interface calling amount and the first real-time interface calling amount.

The first determining module is further specifically configured to implement the following steps:

carrying out standardization processing on the difference value to obtain a standardized residual error of the interface to be monitored;

and if the standardized residual error is larger than the preset reference value, determining the interface to be monitored as a reference abnormal interface.

The second determining module is specifically configured to implement the following steps:

calculating a first moving average value of the calling amount of the second real-time interface and a second moving average value of the reference performance index by adopting a moving average algorithm;

and determining a target abnormal interface from the reference abnormal interfaces based on the first moving average and the second moving average.

The second determining module is further specifically configured to implement the following steps:

based on the first moving average value and a first preset threshold value, carrying out normalization processing on the first moving average value to obtain a first normalization value of the calling amount of the second real-time interface;

calculating a message storm index of a reference abnormal interface based on the first normalization value, the first preset weight of the second real-time interface calling quantity, the second normalization value of each reference performance index and the second preset weight of each reference performance index;

and if the message storm index is larger than a second preset threshold value, determining the reference abnormal interface as a target abnormal interface.

In other embodiments of the present invention, the processing unit 85 may include: a creating module and a filtering module.

The device comprises a creating module, a sending module and a receiving module, wherein the creating module is used for creating a message buffer queue, and the message buffer queue is used for storing retention messages;

and the filtering module is used for deleting the retention message matched with the real-time message and storing the real-time message into the message cache queue if the retention message contains the message matched with the real-time message.

The creating module is specifically configured to implement the following steps:

determining the capacity of a message cache queue based on a first message storm index of a target abnormal interface;

Wherein, the filtration module is specifically used for realizing the following steps:

calculating a hash value of the real-time message; detecting whether the hash value of the real-time message is the same as the hash value of the retention message, wherein the hash value of the retention message is stored in a message cache queue;

and if the real-time messages are the same, deleting the retention messages with the same resources corresponding to the real-time messages, and storing the real-time messages and the hash values of the real-time messages into a message cache queue.

In other embodiments of the present invention, the message processing apparatus further includes: a calculation unit and a detection unit.

The calculating unit is used for calculating a second message storm index of the target abnormal interface;

and the detection unit is used for deleting the message buffer queue if the second message storm index is less than or equal to a third preset threshold value.

In other embodiments of the present invention, the message processing apparatus further includes: a second determination unit.

And the second determining unit is used for carrying out resource relevance analysis on the resource information related to the target abnormal interface and determining the reason of the network fault and/or the fault point of the network.

The second determining unit is specifically configured to implement the following steps:

if the resource information related to the target abnormal interface is from the resource information related to the network element layer, the virtual layer and the physical layer in the NFV architecture, determining the reason of the network fault as the related relation among the network element layer, the virtual layer and the physical layer; and/or

In other embodiments of the present invention, the message processing apparatus further includes: a comparison unit and an adjustment unit.

The comparison unit is used for comparing the number of the detained messages in the message cache queue with the capacity of the message cache queue to obtain a comparison result;

and the adjusting unit is used for adjusting the relation between the first message storm index and the capacity of the message buffer queue based on the comparison result.

In other embodiments of the present invention, the message processing apparatus further includes: and a monitoring unit.

The monitoring unit is used for monitoring the first system resource information and the second system resource information and comparing the first system resource information with the second system resource information, wherein the first system resource information is the system resource information before the message cache queue is established; the second system resource information is the system resource information after the message buffer queue is established.

The message processing device provided by the invention can determine the target abnormal interface generating the message storm based on the interface call volume time sequence model generated by the authentication message data and the resource change message data, and then, performs flow control processing on the message of the target abnormal interface to realize the discovery and processing of the message storm of the authentication message and the resource change message, thereby ensuring the timeliness of message processing of an NFV network system, avoiding the consumption of resources and ensuring the normal operation of the network and the MANO system.

Based on the foregoing embodiments, the present invention provides a message processing apparatus 9, where the message processing apparatus 9 may be applied to a message processing method corresponding to fig. 1 to 3, and as shown in fig. 6, the message processing apparatus may include: a processor 91, a memory 92, and a communication bus 93, wherein:

the communication bus 93 is used for realizing communication connection between the processor 91 and the memory 92;

the processor 91 is configured to execute the message processing program stored in the memory 92 to implement the following steps:

determining a target abnormal interface from the interfaces to be monitored based on the interface call volume time series model, the first real-time interface call volume and the performance indexes of the interfaces;

obtaining a retention message of a target abnormal interface and a real-time message of the target abnormal interface;

In other embodiments of the present invention, the processor 91 is further configured to execute a message processing program stored in the memory 92 to obtain historical message data of each type of interface and perform model training on the historical message data to obtain a time series model of call volume of each type of interface, so as to implement the following steps:

acquiring historical message data of the interfaces, classifying the historical message data of the interfaces to obtain the historical message data of each type of interface, wherein the historical message data comprises authentication message data and/or resource change message data;

preprocessing the historical message data of each type of interface to obtain an interface calling amount data sequence of each type of interface;

In other embodiments of the present invention, the processor 91 is further configured to execute an interface call volume-based time series model of the message handler stored in the memory 92, the first real-time interface call volume, and a performance index of the interface, and determine a target abnormal interface from the interfaces to be monitored, so as to implement the following steps:

acquiring a reference performance index of a reference abnormal interface from the performance indexes, wherein the performance index indicates the message retention degree of the interface;

and determining a target abnormal interface from the reference abnormal interfaces based on the second real-time interface calling amount of the reference abnormal interface and the reference performance index.

In other embodiments of the present invention, the processor 91 is further configured to execute a time-series model of the message handler stored in the memory 92, based on the first real-time interface call amount and an interface call amount corresponding to the type of the interface to be monitored, to determine a reference abnormal interface from the interfaces to be monitored, so as to implement the following steps:

In other embodiments of the present invention, the processor 91 is further configured to execute the message handler stored in the memory 92, and determine a reference abnormal interface from the interfaces to be monitored based on the reference interface call amount and the first real-time interface call amount, so as to implement the following steps:

In other embodiments of the present invention, the processor 91 is further configured to execute the second real-time interface call amount and the reference performance index of the message handler stored in the memory 92 based on the reference exception interface, and determine the target exception interface from the reference exception interface, so as to implement the following steps:

In other embodiments of the present invention, the processor 91 is further configured to execute a message handler stored in the memory 92 to determine a target exception interface from the reference exception interfaces based on the first moving average and the second moving average to implement the following steps:

In other embodiments of the present invention, the processor 91 is further configured to execute a message processing program stored in the memory 92, and perform flow control processing on the target exception interface based on the retention message and the real-time message, so as to implement the following steps:

establishing a message buffer queue, wherein the message buffer queue is used for storing detained messages;

and if the message matched with the real-time message exists in the retention message, deleting the retention message matched with the real-time message, and storing the real-time message into a message cache queue.

In other embodiments of the present invention, the processor 91 is further configured to execute the message processing program stored in the memory 92 to establish a message buffer queue, so as to implement the following steps:

In another embodiment of the present invention, the processor 91 is further configured to execute the message processing program stored in the memory 92, if there is a message matching the real-time message in the retained message, delete the retained message matching the real-time message, and store the real-time message in the message buffer queue, so as to implement the following steps:

In other embodiments of the present invention, the processor 91 is further configured to execute the message processing program stored in the memory 92 to implement the steps of:

calculating a second message storm index of the target abnormal interface;

In other embodiments of the present invention, the processor 91 is further configured to execute a resource relevance analysis of the resource information associated with the target abnormal interface of the message handler stored in the memory 92, and determine a cause of the network fault and/or a fault point of the network, so as to implement the following steps:

monitoring first system resource information and second system resource information, and comparing the first system resource information with the second system resource information, wherein the first system resource information is the system resource information before a message cache queue is established; the second system resource information is the system resource information after the message buffer queue is established.

The message processing equipment provided by the invention can determine the target abnormal interface generating the message storm based on the interface call volume time sequence model generated by the authentication message data and the resource change message data, and then, performs flow control processing on the message of the target abnormal interface to realize the discovery and processing of the message storm of the authentication message and the resource change message, thereby ensuring the timeliness of message processing of an NFV network system, avoiding the consumption of resources and ensuring the normal operation of the network and the MANO system.

Based on the foregoing embodiments, the present invention provides a computer storage medium storing one or more programs that can be executed by one or more processors to perform a message processing method to implement the steps of:

In other embodiments of the present invention, the one or more programs may be executed by the one or more processors to obtain historical message data of each type of interface and perform model training on the historical message data, so as to implement the following steps when obtaining the time series model of call volume of each type of interface:

In other embodiments of the present invention, the one or more programs are executable by the one or more processors to determine a target abnormal interface from the interfaces to be monitored based on the interface call volume time series model, the first real-time interface call volume, and the performance index of the interface, so as to implement the following steps:

In other embodiments of the present invention, the one or more programs are executable by the one or more processors to determine a reference abnormal interface from the interfaces to be monitored based on the first real-time interface call amount and an interface call amount time series model corresponding to the type of the interfaces to be monitored, so as to implement the following steps:

In other embodiments of the present invention, the one or more programs are executable by the one or more processors to determine a reference abnormal interface from the interfaces to be monitored based on the reference interface call amount and the first real-time interface call amount to perform the steps of:

In other embodiments of the present invention, the one or more programs are executable by the one or more processors to determine a target exception interface from the reference exception interfaces based on the second real-time interface call amount of the reference exception interface and the reference performance indicator to implement the steps of:

In other embodiments of the present invention, the one or more programs are executable by the one or more processors in determining a target exception interface from the reference exception interfaces based on the first moving average and the second moving average to perform the steps of:

In other embodiments of the present invention, the one or more programs, when executed by the one or more processors to perform flow control processing on the target exception interface based on the retention message and the real-time message, implement the following steps:

In other embodiments of the invention, the one or more programs, when executed by the one or more processors in establishing the message buffer queue, are operable to perform the steps of:

In other embodiments of the present invention, the one or more programs are executable by the one or more processors to perform the following steps when a lingering message identical to the real-time message is deleted and the real-time message is stored in the message buffer queue if the lingering message comprises the same message as the real-time message:

In other embodiments of the invention, the one or more programs, when executed by the one or more processors, perform the method of message processing to:

calculating a second message storm index of the target abnormal interface;

In other embodiments of the present invention, the one or more programs may be executed by the one or more processors to perform resource association analysis on the resource information associated with the target abnormal interface, and when determining the cause of the network failure and/or the network failure point, implement the following steps:

It should be noted that, a specific implementation process of the steps executed by the processor in the present invention may refer to an implementation process of the message processing method provided in the embodiments corresponding to fig. 1 to 3, and details are not described here.

It should be noted that, in this document, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising an … …" does not exclude the presence of other like elements in a process, method, article, or apparatus that comprises the element.

The above-mentioned serial numbers of the embodiments of the present invention are merely for description and do not represent the merits of the embodiments.

Through the above description of the embodiments, those skilled in the art will clearly understand that the method of the above embodiments can be implemented by software plus a necessary general hardware platform, and certainly can also be implemented by hardware, but in many cases, the former is a better implementation manner. Based on such understanding, the technical solutions of the present invention may be embodied in the form of a software product, which is stored in a storage medium (such as ROM/RAM, magnetic disk, optical disk) and includes instructions for enabling a terminal (such as a mobile phone, a computer, a server, an air conditioner, or a network device) to execute the method according to the embodiments of the present invention.

The present invention is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the invention. It will be understood that each flow and/or block of the flow diagrams and/or block diagrams, and combinations of flows and/or blocks in the flow diagrams and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.

While the present invention has been described with reference to the embodiments shown in the drawings, the present invention is not limited to the embodiments, which are illustrative and not restrictive, and it will be apparent to those skilled in the art that various changes and modifications can be made therein without departing from the spirit and scope of the invention as defined in the appended claims.

Claims

1. A method of message processing, the method comprising:

2. The method of claim 1, wherein the obtaining historical message data of each type of interface and performing model training on the historical message data to obtain a time series model of call volume of each type of interface comprises:

3. The method according to claim 1 or 2, wherein the determining a target abnormal interface from the interfaces to be monitored based on the interface call volume time series model, the first real-time interface call volume and the performance index of the interface comprises:

4. The method according to claim 3, wherein the determining a reference abnormal interface from the interfaces to be monitored based on the first real-time interface call amount and an interface call amount time series model corresponding to the type of the interfaces to be monitored comprises:

5. The method of claim 4, wherein the determining the reference abnormal interface from the interfaces to be monitored based on the reference interface call amount and the first real-time interface call amount comprises:

6. The method of claim 3, wherein the determining the target exceptional interface from the reference exceptional interfaces based on the second real-time interface call amount of the reference exceptional interface and the reference performance indicator comprises:

7. The method of claim 6, wherein determining the target anomaly interface from the reference anomaly interfaces based on the first moving average and the second moving average comprises:

8. The method of claim 7, wherein the performing flow control processing on the target exception interface based on the retention message and the real-time message comprises:

9. The method of claim 8, wherein the establishing a message buffer queue comprises:

10. The method according to claim 8 or 9, wherein if there is a message matching the real-time message in the retention message, deleting the retention message matching the real-time message, and storing the real-time message in the message buffer queue, comprises:

11. The method of claim 8, further comprising:

calculating a second message storm index of the target abnormal interface;

12. The method of claim 1, further comprising:

13. The method according to claim 12, wherein the performing resource relevance analysis on the resource information associated with the target abnormal interface to determine a cause of a network fault and/or a network fault point comprises:

14. The method of claim 9, further comprising:

15. The method of claim 8, further comprising:

16. A message processing apparatus, characterized in that the apparatus comprises: the device comprises a generating unit, a first acquiring unit, a first determining unit, a second acquiring unit and a processing unit, wherein:

17. A message processing device, characterized in that the device comprises: a processor, a memory, and a communication bus;

18. A computer storage medium, characterized in that the computer storage medium stores one or more programs executable by one or more processors to implement the message processing method according to any one of claims 1 to 15.