CN114422325A - Content distribution network abnormity positioning method, device, equipment and storage medium - Google Patents
Content distribution network abnormity positioning method, device, equipment and storage medium Download PDFInfo
- Publication number
- CN114422325A CN114422325A CN202111664189.0A CN202111664189A CN114422325A CN 114422325 A CN114422325 A CN 114422325A CN 202111664189 A CN202111664189 A CN 202111664189A CN 114422325 A CN114422325 A CN 114422325A
- Authority
- CN
- China
- Prior art keywords
- abnormal
- alarm
- distribution network
- content distribution
- root cause
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/06—Management of faults, events, alarms or notifications
- H04L41/0677—Localisation of faults
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/06—Management of faults, events, alarms or notifications
- H04L41/0631—Management of faults, events, alarms or notifications using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L43/00—Arrangements for monitoring or testing data switching networks
- H04L43/02—Capturing of monitoring data
- H04L43/022—Capturing of monitoring data by sampling
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L43/00—Arrangements for monitoring or testing data switching networks
- H04L43/04—Processing captured monitoring data, e.g. for logfile generation
Abstract
The invention relates to the technical field of computer networks and discloses a method, a device, equipment and a storage medium for positioning content distribution network abnormity. The content distribution network abnormity positioning method comprises the following steps: sampling target monitoring data in a content distribution network for multiple times at intervals of a preset period; generating a time sequence data alarm according to target monitoring data obtained by multiple times of sampling; classifying the time sequence data alarms and generating an abnormal alarm knowledge graph; generating a software and hardware knowledge graph according to configuration management database information and DNS scheduling information of a content distribution network in the current period time; generating an abnormal root cause link map according to the abnormal alarm knowledge map and the software and hardware knowledge map; and based on the abnormal root cause link map, performing root cause positioning and outputting the abnormal root cause. The invention realizes the automatic monitoring and abnormal root cause positioning of the content distribution network, reduces the labor cost and obviously improves the efficiency and the accuracy of the monitoring of the content distribution network.
Description
Technical Field
The invention relates to the field of computer networks, in particular to a method, a device, equipment and a storage medium for positioning content distribution network abnormity.
Background
A Content Delivery Network (CDN) is an intelligent virtual Network built on the basis of the existing Network, and a user can obtain required Content nearby by using functional modules of load balancing, Content Delivery, scheduling and the like of a central platform by means of edge servers deployed in various places, so that Network congestion is reduced, and the access response speed and hit rate of the user are increased. The content distribution network has the characteristics of more composition machines, large user quantity, complex network, deep software architecture level and the like, so that the abnormity of the content distribution network is difficult to monitor and position.
In the prior art, anomaly detection is performed on a content distribution network in a layer-by-layer trial and error manner. The monitoring data is provided with a threshold value to judge whether the service is normal or not, when a certain domain name service is abnormal, professional operation and maintenance workers need to search and find machines scheduled by the domain name and find abnormal root causes one by one, and the method has the advantages of long time period for detecting the abnormal root causes, complexity, high possibility of errors and dependence on the experience of the operation and maintenance workers.
Disclosure of Invention
The invention mainly aims to provide a content distribution network abnormity positioning method, a device, equipment and a storage medium, and aims to solve the technical problems of high cost and low efficiency of the existing content distribution network abnormity positioning method.
The invention provides a method for positioning the abnormity of a content distribution network in a first aspect, which comprises the following steps:
sampling target monitoring data in a content distribution network for multiple times at intervals of a preset period;
generating time sequence data alarm of the content distribution network in the current period time according to target monitoring data obtained by multiple sampling;
classifying the time sequence data alarm, and generating an abnormal alarm knowledge graph of the content distribution network in the current period time according to the classification result;
generating a software and hardware knowledge graph of the content distribution network in the current period time according to configuration management database information and DNS scheduling information of the content distribution network in the current period time;
generating an abnormal root cause link map of the content distribution network in the current period time according to the abnormal alarm knowledge map and the software and hardware knowledge map;
and based on the abnormal root cause link map, performing root cause positioning on the abnormality of the content distribution network in the current cycle time, and outputting the abnormal root cause in the abnormal root cause link map.
Optionally, in a first implementation manner of the first aspect of the present invention, the generating a time series data alarm of the content delivery network in a current cycle time according to target monitoring data obtained through multiple sampling includes:
detecting the target monitoring data obtained by sampling for multiple times by adopting a preset data anomaly detection algorithm so as to judge whether the content distribution network is abnormal within the current period time;
and if the content distribution network is abnormal in the current cycle time, generating a time sequence data alarm of the content distribution network in the current cycle time based on the target monitoring data for detecting the abnormality.
Optionally, in a second implementation manner of the first aspect of the present invention, the classifying the time-series data alarm and generating an abnormal alarm knowledge graph of the content delivery network in a current cycle time according to a classification result includes:
classifying the time sequence data alarms based on a mapping relation between preset alarm characteristics and alarm classification to obtain a plurality of abnormal alarms of different classes, wherein the abnormal alarms comprise alarm sources and alarm descriptions, and the same alarm source corresponds to at least one alarm description;
and respectively establishing directed acyclic graphs corresponding to the abnormal alarms by taking the alarm source as a root node and the alarm description as a leaf node to obtain an abnormal alarm knowledge graph of the content distribution network in the current period time, wherein the abnormal alarm knowledge graph consists of the directed acyclic graphs corresponding to the abnormal alarms.
Optionally, in a third implementation manner of the first aspect of the present invention, the generating, according to the abnormal alarm knowledge graph and the software and hardware knowledge graph, an abnormal root cause link graph of the content distribution network in a current cycle time includes:
respectively acquiring root nodes of each directed acyclic graph in the abnormal alarm knowledge graph;
respectively taking the root node of each directed acyclic graph as a target node, traversing the software and hardware knowledge graph, and recording all node paths from the root node of the software and hardware knowledge graph to each target node;
and merging each node path and each directed acyclic graph based on the root node of each directed acyclic graph to obtain an abnormal root cause link graph of the content distribution network in the current cycle time.
Optionally, in a fourth implementation manner of the first aspect of the present invention, the performing root cause positioning on the abnormality occurring in the content delivery network within the current cycle time based on the abnormal root cause link map, and outputting the abnormal root cause in the abnormal root cause link map includes:
acquiring alarm weight corresponding to each abnormal alarm in the current period time;
respectively calculating probability values of different types of alarms in the abnormal root cause link diagram, which are described as abnormal root causes, based on the alarm weights;
and based on each probability value, performing root cause positioning on the abnormality of the content distribution network in the current cycle time, and outputting the abnormal root cause corresponding to the maximum probability value as the abnormal root cause in the abnormal root cause link diagram.
Optionally, in a fifth implementation manner of the first aspect of the present invention, the probability value is calculated as follows:
wherein, PiProbability value, W, representing the description of class i alarms as an abnormal rootiRepresenting the weight sum of abnormal alarms corresponding to the i-th class of alarm description, n representing the number of classes of alarm description, SijThe alarm weight k of the jth abnormal alarm in the abnormal alarms corresponding to the ith class of alarm description in the current cycle time is showniAnd indicating the number of abnormal alarms corresponding to the i-th class of alarm description.
Optionally, in a sixth implementation manner of the first aspect of the present invention, the generating a software and hardware knowledge graph of the content distribution network in a current cycle time according to configuration management database information and DNS scheduling information of the content distribution network in the current cycle time includes:
acquiring configuration management database information of the content distribution network in the current period time, wherein the configuration management database information comprises various software configuration information and hardware configuration information;
acquiring and analyzing DNS scheduling information of the content distribution network in the current cycle time;
and respectively taking the software configuration information and the hardware configuration information as nodes, and constructing a software and hardware knowledge graph of the content distribution network in the current period time based on the analyzed DNS scheduling information.
A second aspect of the present invention provides a device for locating an anomaly in a content delivery network, including:
the data sampling module is used for sampling target monitoring data in the content distribution network for multiple times at intervals of a preset period;
the first generation module is used for generating time sequence data alarm of the content distribution network in the current cycle time according to target monitoring data obtained by multiple times of sampling;
the second generation module is used for classifying the time sequence data alarm and generating an abnormal alarm knowledge graph of the content distribution network in the current period time according to the classification result;
a third generation module, configured to generate a software and hardware knowledge graph of the content distribution network in the current cycle time according to configuration management database information and DNS scheduling information of the content distribution network in the current cycle time;
a fourth generation module, configured to generate an abnormal root cause link map of the content distribution network in the current cycle time according to the abnormal alarm knowledge map and the software and hardware knowledge map;
and the abnormity positioning module is used for positioning the abnormity of the content distribution network in the current period time based on the abnormity root cause link diagram and outputting the abnormity root cause in the abnormity root cause link diagram.
Optionally, in a first implementation manner of the second aspect of the present invention, the first generating module is specifically configured to:
detecting the target monitoring data obtained by sampling for multiple times by adopting a preset data anomaly detection algorithm so as to judge whether the content distribution network is abnormal within the current period time;
and if the content distribution network is abnormal in the current cycle time, generating a time sequence data alarm of the content distribution network in the current cycle time based on the target monitoring data for detecting the abnormality.
Optionally, in a second implementation manner of the second aspect of the present invention, the second generating module is specifically configured to:
classifying the time sequence data alarms based on a mapping relation between preset alarm characteristics and alarm classification to obtain a plurality of abnormal alarms of different classes, wherein the abnormal alarms comprise alarm sources and alarm descriptions, and the same alarm source corresponds to at least one alarm description;
and respectively establishing directed acyclic graphs corresponding to the abnormal alarms by taking the alarm source as a root node and the alarm description as a leaf node to obtain an abnormal alarm knowledge graph of the content distribution network in the current period time, wherein the abnormal alarm knowledge graph consists of the directed acyclic graphs corresponding to the abnormal alarms.
Optionally, in a third implementation manner of the second aspect of the present invention, the fourth generating module is specifically configured to:
respectively acquiring root nodes of each directed acyclic graph in the abnormal alarm knowledge graph;
respectively taking the root node of each directed acyclic graph as a target node, traversing the software and hardware knowledge graph, and recording all node paths from the root node of the software and hardware knowledge graph to each target node;
and merging each node path and each directed acyclic graph based on the root node of each directed acyclic graph to obtain an abnormal root cause link graph of the content distribution network in the current cycle time.
Optionally, in a fourth implementation manner of the second aspect of the present invention, the anomaly locating module is specifically configured to:
acquiring alarm weight corresponding to each abnormal alarm in the current period time;
respectively calculating probability values of different types of alarms in the abnormal root cause link diagram, which are described as abnormal root causes, based on the alarm weights;
and based on each probability value, performing root cause positioning on the abnormality of the content distribution network in the current cycle time, and outputting the abnormal root cause corresponding to the maximum probability value as the abnormal root cause in the abnormal root cause link diagram.
Optionally, in a fifth implementation manner of the second aspect of the present invention, the step of
The probability value is calculated as follows:
wherein, PiProbability value, W, representing the description of class i alarms as an abnormal rootiRepresenting the weight sum of abnormal alarms corresponding to the i-th class of alarm description, n representing the number of classes of alarm description, SijThe alarm weight k of the jth abnormal alarm in the abnormal alarms corresponding to the ith class of alarm description in the current cycle time is showniAnd indicating the number of abnormal alarms corresponding to the i-th class of alarm description.
Optionally, in a sixth implementation manner of the second aspect of the present invention, the third generating module is specifically configured to:
acquiring configuration management database information of the content distribution network in the current period time, wherein the configuration management database information comprises various software configuration information and hardware configuration information;
acquiring and analyzing DNS scheduling information of the content distribution network in the current cycle time;
and respectively taking the software configuration information and the hardware configuration information as nodes, and constructing a software and hardware knowledge graph of the content distribution network in the current period time based on the analyzed DNS scheduling information.
A third aspect of the present invention provides an electronic device comprising: a memory and at least one processor, the memory having instructions stored therein; the at least one processor invokes the instructions in the memory to cause the electronic device to perform the content distribution network anomaly locating method described above.
A fourth aspect of the present invention provides a computer-readable storage medium having stored therein instructions, which, when run on a computer, cause the computer to execute the above-mentioned content distribution network anomaly locating method.
According to the technical scheme provided by the invention, target monitoring data in a content distribution network are sampled for multiple times at intervals of a preset period, time sequence data alarms are generated according to the target monitoring data obtained by the multiple sampling, the time sequence data alarms are classified, an abnormal alarm knowledge map is generated, a software and hardware knowledge map is generated according to configuration management database information and DNS scheduling information of the content distribution network in the current period, an abnormal root cause link map is generated according to the abnormal alarm knowledge map and the software and hardware knowledge map, root cause positioning is carried out on the basis of the abnormal root cause link map, and abnormal root causes are output. The invention realizes the automatic monitoring and abnormal root cause positioning of the content distribution network, reduces the manual participation degree, reduces the labor cost, can judge various abnormal data, meets the actual use requirement and obviously improves the efficiency and the accuracy of the content distribution network monitoring.
Drawings
Fig. 1 is a schematic diagram of a first embodiment of a method for locating an anomaly in a content distribution network according to an embodiment of the present invention;
FIG. 2 is a diagram of a second embodiment of a method for locating an anomaly in a content delivery network according to an embodiment of the present invention;
FIG. 3 is a diagram of a third embodiment of a method for locating an anomaly in a content distribution network according to an embodiment of the present invention;
FIG. 4 is a diagram of an embodiment of an abnormal alarm knowledge-graph in accordance with an embodiment of the present invention;
FIG. 5 is a schematic diagram of an embodiment of a software and hardware knowledge graph in an embodiment of the invention;
FIG. 6 is a diagram of an embodiment of an abnormal root cause link diagram in an embodiment of the present invention;
fig. 7 is a schematic diagram of an embodiment of a content distribution network anomaly locating device in the embodiment of the present invention;
fig. 8 is a schematic diagram of an embodiment of an electronic device in an embodiment of the invention.
Detailed Description
The embodiment of the invention provides a method, a device, equipment and a storage medium for positioning the abnormity of a content distribution network, which realize automatic monitoring and abnormity root cause positioning of the content distribution network, reduce the degree of manual participation, reduce the labor cost and obviously improve the efficiency and the accuracy of monitoring the content distribution network.
The terms "first," "second," "third," "fourth," and the like in the description and in the claims, as well as in the drawings, if any, are used for distinguishing between similar elements and not necessarily for describing a particular sequential or chronological order. It will be appreciated that the data so used may be interchanged under appropriate circumstances such that the embodiments described herein may be practiced otherwise than as specifically illustrated or described herein. Furthermore, the terms "comprises," "comprising," or "having," and any variations thereof, are intended to cover non-exclusive inclusions, such that a process, method, system, article, or apparatus that comprises a list of steps or elements is not necessarily limited to those steps or elements expressly listed, but may include other steps or elements not expressly listed or inherent to such process, method, article, or apparatus.
For convenience of understanding, a specific flow of the embodiment of the present invention is described below, and referring to fig. 1, a first embodiment of a method for locating an anomaly in a content distribution network according to the embodiment of the present invention includes:
101. sampling target monitoring data in a content distribution network for multiple times at intervals of a preset period;
it is to be understood that the execution subject of the present invention may be a content distribution network anomaly locating device, and may also be a terminal or a server, which is not limited herein. The embodiment of the present invention is described by taking a server as an execution subject.
In this embodiment, a Content Delivery Network (CDN) is an intelligent virtual Network established on the basis of an existing Network, and a user can obtain required Content nearby by using functional modules of load balancing, Content Delivery, scheduling, and the like of a central platform by means of edge servers deployed in various places, so that Network congestion is reduced, and the access response speed and hit rate of the user are increased. The key technology of the CDN is mainly content storage and distribution technology.
In this embodiment, the target monitoring data is data that needs to be monitored to determine whether the content delivery network is abnormal, and includes, but is not limited to, http request status code5xx data, error code data, CPU utilization of the server, disk utilization of the server, network packet loss rate, and the like.
Optionally, in an embodiment, the number and the type of the monitoring data may be adjusted according to requirements.
In this embodiment, in a period of time, the preselected target monitoring data is sampled for a plurality of times, and the sampling may be performed randomly in the period of time, or may be performed at preset time intervals in the period of time.
102. Generating time sequence data alarm of the content distribution network in the current period time according to target monitoring data obtained by multiple sampling;
in this embodiment, whether the sampled target monitoring data is abnormal is determined, and if the sampled target monitoring data is abnormal, a corresponding time sequence data alarm is generated.
In this embodiment, the time-series data alarm is a description of the abnormal data, and includes a data type of the abnormal data, a time when the abnormality occurs, and a data value of the abnormal data.
Optionally, in an embodiment, the step 102 includes:
detecting the target monitoring data obtained by sampling for multiple times by adopting a preset data anomaly detection algorithm so as to judge whether the content distribution network is abnormal within the current period time;
and if the content distribution network is abnormal in the current cycle time, generating a time sequence data alarm of the content distribution network in the current cycle time based on the target monitoring data for detecting the abnormality.
In this embodiment, the data anomaly detection algorithm is not limited, and optionally, in an embodiment, a 3-sigma algorithm is used to perform anomaly value detection, and whether the acquired target monitoring data is abnormal or not is determined.
103. Classifying the time sequence data alarm, and generating an abnormal alarm knowledge graph of the content distribution network in the current period time according to the classification result;
in this embodiment, the time series data alarm includes three types, which are an event (event), an external center (OC), and a host (host); the event is a unique identifier for monitoring the abnormality in the current cycle time, the external center is an edge node (edge machine room) of the content distribution network, and the host computer is a server in the edge node of the content distribution network.
In this embodiment, the abnormal alarm knowledge map is a knowledge map describing a time series data alarm.
Optionally, in an embodiment, the step 103 includes:
classifying the time sequence data alarms based on a mapping relation between preset alarm characteristics and alarm classification to obtain a plurality of abnormal alarms of different classes, wherein the abnormal alarms comprise alarm sources and alarm descriptions, and the same alarm source corresponds to at least one alarm description;
and respectively establishing directed acyclic graphs corresponding to the abnormal alarms by taking the alarm source as a root node and the alarm description as a leaf node to obtain an abnormal alarm knowledge graph of the content distribution network in the current period time, wherein the abnormal alarm knowledge graph consists of the directed acyclic graphs corresponding to the abnormal alarms.
In this embodiment, the alarm feature is a feature of the target monitoring data for detecting the abnormality, and is used to determine a data type of the target monitoring data for detecting the abnormality.
In this embodiment, the data types of the target monitoring data with different detection anomalies correspond to different alarm classifications, and the preset mapping relationship thereof can be changed through configuration.
In this embodiment, the alarm source is a main body that generates an abnormal alarm, and includes an event, an external center, and a host; the alarm description is a specific description of the abnormal alarm and describes specific alarm information of the abnormal alarm.
In this embodiment, a directed acyclic graph is established for a corresponding relationship between each alarm source and the alarm description, where the directed acyclic graph is a loop-free directed graph, the alarm source points to the corresponding alarm description, and each directed acyclic graph is combined to form an abnormal alarm knowledge graph.
104. Generating a software and hardware knowledge graph of the content distribution network in the current period time according to configuration management database information and DNS scheduling information of the content distribution network in the current period time;
in this embodiment, a Configuration Management Database (CMDB) is a logical Database, and includes information of the full life cycle of Configuration items and relationships (including physical relationships, real-time communication relationships, non-real-time communication relationships, and dependency relationships) between the Configuration items. The configuration management database tracks all IT components, the different versions and states of the components, and the relationships between the components. The configuration information of the network access of the content distribution network in the current cycle time can be obtained through the configuration management database.
In this embodiment, the DNS scheduling information is domain name scheduling resolution information of actual network access of the content distribution network in the current cycle time, and includes domain name information and domain name access addresses corresponding to the scheduling end and the scheduled end, respectively.
In this embodiment, dual guarantees are made using configuration management database information and DNS scheduling information.
In this embodiment, the software and hardware knowledge graph is a logical architecture formed by software and hardware of a content distribution network, where the software information includes a virtual server, a virtual cache, and load balancing software, and the hardware information includes multiple types of physical machines, switches, virtual servers, and routers.
105. Generating an abnormal root cause link map of the content distribution network in the current period time according to the abnormal alarm knowledge map and the software and hardware knowledge map;
in this embodiment, the abnormal root cause link map is a scheduling link map of the alarm source related to the abnormal alarm information.
In this embodiment, according to the software and hardware knowledge graph, the scheduling links of each alarm source in the abnormal alarm knowledge graph are obtained, and the scheduling links are combined to generate an abnormal root cause link graph.
106. And based on the abnormal root cause link map, performing root cause positioning on the abnormality of the content distribution network in the current cycle time, and outputting the abnormal root cause in the abnormal root cause link map.
In this embodiment, the root cause is a root cause of an abnormality in the content distribution network.
In this embodiment, based on the abnormal root cause link map, the probability that each alarm is described as an abnormal root cause is calculated, and the abnormal root cause is determined according to each probability value.
In the embodiment of the invention, target monitoring data in a content distribution network is sampled for multiple times at intervals of a preset cycle time, time sequence data alarms are generated according to the target monitoring data obtained by the multiple sampling, the time sequence data alarms are classified, an abnormal alarm knowledge map is generated, a software and hardware knowledge map is generated according to configuration management database information and DNS scheduling information of the content distribution network in the current cycle time, an abnormal root cause link map is generated according to the abnormal alarm knowledge map and the software and hardware knowledge map, root cause positioning is carried out based on the abnormal root cause link map, and abnormal root causes are output. The invention realizes the automatic monitoring and abnormal root cause positioning of the content distribution network, reduces the manual participation degree, reduces the labor cost, can judge various abnormal data, meets the actual use requirement and obviously improves the efficiency and the accuracy of the content distribution network monitoring.
Referring to fig. 2, a second embodiment of the method for locating an anomaly in a content distribution network according to the embodiment of the present invention includes:
201. sampling target monitoring data in a content distribution network for multiple times at intervals of a preset period;
202. generating time sequence data alarm of the content distribution network in the current period time according to target monitoring data obtained by multiple sampling;
203. classifying the time sequence data alarm, and generating an abnormal alarm knowledge graph of the content distribution network in the current period time according to the classification result;
204. generating a software and hardware knowledge graph of the content distribution network in the current period time according to configuration management database information and DNS scheduling information of the content distribution network in the current period time;
205. respectively acquiring root nodes of each directed acyclic graph in the abnormal alarm knowledge graph;
in this embodiment, the root node is the alert source.
206. Respectively taking the root node of each directed acyclic graph as a target node, traversing the software and hardware knowledge graph, and recording all node paths from the root node of the software and hardware knowledge graph to each target node;
in this embodiment, the method for graph traversal is not limited, and includes, but is not limited to, a depth-first search algorithm and a breadth-first search algorithm.
207. Merging each node path and each directed acyclic graph based on the root node of each directed acyclic graph to obtain an abnormal root cause link graph of the content distribution network in the current cycle time;
optionally, in an embodiment, the step 207 includes:
(1) newly building a directed acyclic graph;
(2) selecting a root node of the directed acyclic graph as a target node, traversing the software and hardware knowledge graph, finding all paths from the root node of the software and hardware knowledge graph to the node which is the same as the warning source indicated by the target node in the software and hardware knowledge graph, and adding the found paths into the newly-built directed acyclic graph;
(3) adding corresponding alarm description after the alarm source node;
(4) and repeating the step 2 and the step 3 until the root node of each directed acyclic graph finds the corresponding path.
208. Acquiring alarm weight corresponding to each abnormal alarm in the current period time;
in this embodiment, the alarm weight is a weight describing an abnormal degree in the abnormal root cause link map of each abnormal alarm.
Optionally, in an embodiment, the alarm weight is uniformly and initially assigned by an experienced operation and maintenance person, so that a judgment error caused by uneven levels of the operation and maintenance persons in a conventional detection manner is avoided.
Optionally, in an embodiment, an initial value of the alarm weight is automatically assigned, such as: all are distributed as 1, and the alarm weight is dynamically adjusted through the feedback of operation and maintenance personnel.
Optionally, in an embodiment, after the operation and maintenance person determines the abnormal root cause, if the automatically calculated abnormal root cause is different from the abnormal root cause determined by the operation and maintenance person, the weight of the abnormal alarm corresponding to the abnormal root cause determined by the operation and maintenance person is increased by one until the calculated abnormal root cause is the same as the abnormal root cause determined by the operation and maintenance person.
In this embodiment, the automatic weight updating algorithm is not limited, and optionally, a neural network BP algorithm is used for automatic updating.
209. Respectively calculating probability values of different types of alarms in the abnormal root cause link diagram, which are described as abnormal root causes, based on the alarm weights;
optionally, in an embodiment, the probability value is calculated as follows:
wherein, PiProbability value, W, representing the description of class i alarms as an abnormal rootiRepresenting the weight sum of abnormal alarms corresponding to the i-th class of alarm description, n representing the number of classes of alarm description, SijThe alarm weight k of the jth abnormal alarm in the abnormal alarms corresponding to the ith class of alarm description in the current cycle time is showniAnd indicating the number of abnormal alarms corresponding to the i-th class of alarm description.
In this embodiment, the sum of weights of the abnormal alarms corresponding to the i-th type of alarm description refers to the sum of weights of all the abnormal alarms including the i-th type of alarm description.
210. And based on each probability value, performing root cause positioning on the abnormality of the content distribution network in the current cycle time, and outputting the abnormal root cause corresponding to the maximum probability value as the abnormal root cause in the abnormal root cause link diagram.
In the embodiment of the invention, target monitoring data in a content distribution network is sampled for multiple times at intervals of a preset period, time sequence data alarms are generated according to the target monitoring data obtained by the multiple sampling, the time sequence data alarms are classified, an abnormal alarm knowledge map is generated, a software and hardware knowledge map is generated according to configuration management database information and DNS scheduling information of the content distribution network in the current period, an abnormal root cause link map is generated according to the abnormal alarm knowledge map and the software and hardware knowledge map, the probability value of describing different types of alarms as abnormal root causes is calculated based on the abnormal root cause link map, root cause positioning is carried out according to the calculated probability value, and the abnormal root causes are output. The method combines the software and hardware knowledge maps and the alarm knowledge map into the abnormal root cause link map, does not need manual participation, is suitable for various complex scenes, can dynamically adjust the abnormal root cause link map based on the abnormal root cause judgment of the weight, carries out self-learning under the condition of little manual intervention, and obviously improves the efficiency and the accuracy of content distribution network monitoring.
Referring to fig. 3, a third embodiment of the method for locating an anomaly in a content distribution network according to the embodiment of the present invention includes:
301. sampling target monitoring data in a content distribution network for multiple times at intervals of a preset period;
302. generating time sequence data alarm of the content distribution network in the current period time according to target monitoring data obtained by multiple sampling;
303. classifying the time sequence data alarm, and generating an abnormal alarm knowledge graph of the content distribution network in the current period time according to the classification result;
304. acquiring configuration management database information of the content distribution network in the current period time, wherein the configuration management database information comprises various software configuration information and hardware configuration information;
in this embodiment, the software configuration information includes a virtual server, a virtual cache, and load balancing software, and the hardware configuration information includes multiple types of a physical machine, a switch, a virtual server, and a router.
305. Acquiring and analyzing DNS scheduling information of the content distribution network in the current cycle time;
in this embodiment, the DNS scheduling information includes domain name information and domain name access addresses corresponding to the scheduling terminal and the scheduled terminal, respectively.
In this embodiment, the DNS scheduling information is analyzed to obtain an actual domain name scheduling path of the content distribution network in the current cycle time.
306. Respectively taking the software configuration information and the hardware configuration information as nodes, and constructing a software and hardware knowledge graph of the content distribution network in the current period time based on the analyzed DNS scheduling information;
in this embodiment, a connection relationship between nodes is constructed according to a domain name scheduling path in the DNS scheduling information, so as to generate a software and hardware knowledge graph.
307. Generating an abnormal root cause link map of the content distribution network in the current period time according to the abnormal alarm knowledge map and the software and hardware knowledge map;
308. and based on the abnormal root cause link map, performing root cause positioning on the abnormality of the content distribution network in the current cycle time, and outputting the abnormal root cause in the abnormal root cause link map.
In the embodiment of the invention, target monitoring data in a content distribution network is sampled for multiple times at intervals of a preset cycle time, time sequence data alarms are generated according to the target monitoring data obtained by the multiple sampling, the time sequence data alarms are classified, an abnormal alarm knowledge map is generated, a software and hardware knowledge map is generated according to configuration management database information and DNS scheduling information of the content distribution network in the current cycle time, an abnormal root cause link map is generated according to the abnormal alarm knowledge map and the software and hardware knowledge map, root cause positioning is carried out based on the abnormal root cause link map, and abnormal root causes are output. According to the method and the device, the software and hardware knowledge graph is dynamically generated according to the configuration management database information and the DNS scheduling information, the software and hardware knowledge graph in the corresponding period time can be generated without manual participation, the labor cost is reduced, the actual use requirement is met, and the efficiency and the accuracy of content distribution network monitoring are obviously improved.
FIG. 4 is an embodiment of an abnormal alert knowledge-graph in accordance with an embodiment of the present invention.
In this embodiment, there are four warning sources: event afc27280-e328-9124-4fbb-3ff3932f, host 60.15.139.10, host 218.60.55.136, host 183.201.22.67.
In the embodiment, the event afc27280-e328-9124-4fbb-3ff3932f corresponds to an alarm description http _ code _5xx, the htpcode 5xx is abnormal v29-ipv6.toutiaovod. com-htttpcode 5-1635, and the occurrence period is 1123-10:25-10: 30; host 60.15.139.10 corresponds to two alarm descriptions: http _ code, HttpCode504:1275 and error _ code, source http request failure 1275; host 218.60.55.136 corresponds to two alarm descriptions: http _ code, HttpCode504:313 and error _ code, source side http request failure 313; host 183.201.22.67 corresponds to an alarm description: error _ code, illegal accesskey: 22.
In this embodiment, the event afc27280-e328-9124-4fbb-3ff39 3932f means that 1635 times of abnormality at the beginning of the http response status code5 is generated in 10:25 to 10:30 of the domain name v29-ipv6.toutiaovod.com at 11, month and 23 days; 1275 http response status code504 errors occurred on host 60.15.139.10 and an error code of 1275 source side http request failures was generated; 313 http response status code504 errors occurred on host 218.60.55.136 and 313 error codes were generated for which the source side http request failed; host 183.201.22.67 generated error codes for 22 illegal accesskeys.
FIG. 5 is an embodiment of a software and hardware knowledge graph in an embodiment of the invention.
In the embodiment, the domain name v29-ipv6.toutiaovod.com is dispatched to the outer centers of telecom-Chongqing-YR-L-B, Unicom-Sublysei-SC-N-A, Mobile-Huainan-WX-N-A, Unicom-Shenyang-SY-N-A, Mobile-Tagen-YD-N-B and the like at 10:25 to 10:30 of 11, 23 days.
In this embodiment, Unicom-Sublication-SC-N-A is dispatched to hosts such as 60.15.139.10; Union-Shenyang-SY-N-A is dispatched to host machines such as 218.60.55.136; the mobile-taiyuan-YD-N-B is dispatched to 183.201.22.67 and other hosts; other external centrally scheduled host IP addresses are omitted from the figure and are not labeled.
FIG. 6 is an embodiment of an exception root cause link map in an embodiment of the present invention.
In this embodiment, the weight of the abnormal alarm generated 1275 times by the host 60.15.139.10 in the http response status code504 error is 1; the host 60.15.139.10 generates 1275 error codes with failed source http request with the weight of 2; the host 218.60.55.136 has a weight of 1 for generating 313 http response status code504 errors; the weight of the abnormal alarm generated by the host 218.60.55.136 for the error codes of 313 source side http request failures is 2; the host 183.201.22.67 generates an exception alarm with an error code of 22 illegal accesskeys with a weight of 2.
In this embodiment, the http response status code504 is calculated as follows for the probability value of the abnormal root:
in this embodiment, the probability value of the source http request failure as the abnormal root is calculated as follows:
in this embodiment, the probability value of the illegal accesskey being the abnormal root is calculated as follows:
in this embodiment, the abnormal root of the content distribution network is most likely to be a failure of the source http request.
In the above description of the method for locating an anomaly in a content distribution network according to an embodiment of the present invention, referring to fig. 7, an embodiment of the device for locating an anomaly in a content distribution network according to an embodiment of the present invention includes:
the data sampling module 701 is used for sampling target monitoring data in the content distribution network for multiple times at intervals of a preset period;
a first generating module 702, configured to generate a time series data alarm of the content distribution network in a current cycle time according to target monitoring data obtained through multiple sampling;
a second generating module 703, configured to classify the time series data alarm, and generate an abnormal alarm knowledge graph of the content delivery network in the current cycle time according to a classification result;
a third generating module 704, configured to generate a software and hardware knowledge graph of the content distribution network in the current cycle time according to configuration management database information and DNS scheduling information of the content distribution network in the current cycle time;
a fourth generating module 705, configured to generate an abnormal root cause link map of the content distribution network in the current cycle time according to the abnormal alarm knowledge map and the software and hardware knowledge map;
an exception positioning module 706, configured to perform root positioning on an exception occurring in the content distribution network within the current cycle time based on the exception root cause link map, and output an exception root cause in the exception root cause link map.
Optionally, the first generating module 702 is specifically configured to:
detecting the target monitoring data obtained by sampling for multiple times by adopting a preset data anomaly detection algorithm so as to judge whether the content distribution network is abnormal within the current period time; and if the content distribution network is abnormal in the current cycle time, generating a time sequence data alarm of the content distribution network in the current cycle time based on the target monitoring data for detecting the abnormality.
Optionally, the second generating module 703 is specifically configured to:
classifying the time sequence data alarms based on a mapping relation between preset alarm characteristics and alarm classification to obtain a plurality of abnormal alarms of different classes, wherein the abnormal alarms comprise alarm sources and alarm descriptions, and the same alarm source corresponds to at least one alarm description; and respectively establishing directed acyclic graphs corresponding to the abnormal alarms by taking the alarm source as a root node and the alarm description as a leaf node to obtain an abnormal alarm knowledge graph of the content distribution network in the current period time, wherein the abnormal alarm knowledge graph consists of the directed acyclic graphs corresponding to the abnormal alarms.
Optionally, the third generating module 704 is specifically configured to:
acquiring configuration management database information of the content distribution network in the current period time, wherein the configuration management database information comprises various software configuration information and hardware configuration information; acquiring and analyzing DNS scheduling information of the content distribution network in the current cycle time; and respectively taking the software configuration information and the hardware configuration information as nodes, and constructing a software and hardware knowledge graph of the content distribution network in the current period time based on the analyzed DNS scheduling information.
Optionally, the fourth generating module 705 is specifically configured to:
respectively acquiring root nodes of each directed acyclic graph in the abnormal alarm knowledge graph; respectively taking the root node of each directed acyclic graph as a target node, traversing the software and hardware knowledge graph, and recording all node paths from the root node of the software and hardware knowledge graph to each target node; and merging each node path and each directed acyclic graph based on the root node of each directed acyclic graph to obtain an abnormal root cause link graph of the content distribution network in the current cycle time.
Optionally, the anomaly locating module 706 is specifically configured to:
acquiring alarm weight corresponding to each abnormal alarm in the current period time; respectively calculating probability values of different types of alarms in the abnormal root cause link diagram, which are described as abnormal root causes, based on the alarm weights; and based on each probability value, performing root cause positioning on the abnormality of the content distribution network in the current cycle time, and outputting the abnormal root cause corresponding to the maximum probability value as the abnormal root cause in the abnormal root cause link diagram.
Optionally, the probability value is calculated as follows:
wherein, PiProbability value, W, representing the description of class i alarms as an abnormal rootiRepresenting the weight sum of abnormal alarms corresponding to the i-th class of alarm description, n representing the number of classes of alarm description, SijThe alarm weight k of the jth abnormal alarm in the abnormal alarms corresponding to the ith class of alarm description in the current cycle time is showniAnd indicating the number of abnormal alarms corresponding to the i-th class of alarm description.
In the embodiment of the invention, target monitoring data in a content distribution network is sampled for multiple times at intervals of a preset cycle time, time sequence data alarms are generated according to the target monitoring data obtained by the multiple sampling, the time sequence data alarms are classified, an abnormal alarm knowledge map is generated, a software and hardware knowledge map is generated according to configuration management database information and DNS scheduling information of the content distribution network in the current cycle time, an abnormal root cause link map is generated according to the abnormal alarm knowledge map and the software and hardware knowledge map, root cause positioning is carried out based on the abnormal root cause link map, and abnormal root causes are output. The invention realizes the automatic monitoring and abnormal root cause positioning of the content distribution network, reduces the manual participation degree, reduces the labor cost, can judge various abnormal data, meets the actual use requirement and obviously improves the efficiency and the accuracy of the content distribution network monitoring.
Fig. 7 describes the content distribution network anomaly locating apparatus in the embodiment of the present invention in detail from the perspective of the modular functional entity, and the electronic device in the embodiment of the present invention in detail from the perspective of hardware processing.
Fig. 8 is a schematic structural diagram of an electronic device 500 according to an embodiment of the present invention, where the electronic device 500 may have a relatively large difference due to different configurations or performances, and may include one or more processors (CPUs) 510 (e.g., one or more processors) and a memory 520, and one or more storage media 530 (e.g., one or more mass storage devices) for storing applications 533 or data 532. Memory 520 and storage media 530 may be, among other things, transient or persistent storage. The program stored on the storage medium 530 may include one or more modules (not shown), each of which may include a sequence of instructions for operating the electronic device 500. Further, the processor 510 may be configured to communicate with the storage medium 530 to execute a series of instruction operations in the storage medium 530 on the electronic device 500.
The electronic device 500 may also include one or more power supplies 540, one or more wired or wireless network interfaces 550, one or more input-output interfaces 560, and/or one or more operating systems 531, such as Windows Server, Mac OS X, Unix, Linux, FreeBSD, and so forth. Those skilled in the art will appreciate that the electronic device configuration shown in fig. 5 does not constitute a limitation of the electronic device and may include more or fewer components than those shown, or some components may be combined, or a different arrangement of components.
The present invention further provides an electronic device, which includes a memory and a processor, where the memory stores computer readable instructions, and when the computer readable instructions are executed by the processor, the processor executes the steps of the content distribution network anomaly positioning method in the foregoing embodiments.
The present invention also provides a computer-readable storage medium, which may be a non-volatile computer-readable storage medium, and which may also be a volatile computer-readable storage medium, having stored therein instructions, which, when run on a computer, cause the computer to perform the steps of the content distribution network anomaly locating method.
It is clear to those skilled in the art that, for convenience and brevity of description, the specific working processes of the above-described systems, apparatuses and units may refer to the corresponding processes in the foregoing method embodiments, and are not described herein again.
The integrated unit, if implemented in the form of a software functional unit and sold or used as a stand-alone product, may be stored in a computer readable storage medium. Based on such understanding, the technical solution of the present invention may be embodied in the form of a software product, which is stored in a storage medium and includes instructions for causing a computer device (which may be a personal computer, a server, or a network device) to execute all or part of the steps of the method according to the embodiments of the present invention. And the aforementioned storage medium includes: various media capable of storing program codes, such as a usb disk, a removable hard disk, a read-only memory (ROM), a Random Access Memory (RAM), a magnetic disk, or an optical disk.
The above-mentioned embodiments are only used for illustrating the technical solutions of the present invention, and not for limiting the same; although the present invention has been described in detail with reference to the foregoing embodiments, it will be understood by those of ordinary skill in the art that: the technical solutions described in the foregoing embodiments may still be modified, or some technical features may be equivalently replaced; and such modifications or substitutions do not depart from the spirit and scope of the corresponding technical solutions of the embodiments of the present invention.
Claims (10)
1. A method for locating an abnormality in a content delivery network is characterized by comprising the following steps:
sampling target monitoring data in a content distribution network for multiple times at intervals of a preset period;
generating time sequence data alarm of the content distribution network in the current period time according to target monitoring data obtained by multiple sampling;
classifying the time sequence data alarm, and generating an abnormal alarm knowledge graph of the content distribution network in the current period time according to the classification result;
generating a software and hardware knowledge graph of the content distribution network in the current period time according to configuration management database information and DNS scheduling information of the content distribution network in the current period time;
generating an abnormal root cause link map of the content distribution network in the current period time according to the abnormal alarm knowledge map and the software and hardware knowledge map;
and based on the abnormal root cause link map, performing root cause positioning on the abnormality of the content distribution network in the current cycle time, and outputting the abnormal root cause in the abnormal root cause link map.
2. The method for locating the abnormality in the content delivery network according to claim 1, wherein the generating a time series data alarm of the content delivery network in a current cycle time according to the target monitoring data obtained by the multiple sampling includes:
detecting the target monitoring data obtained by sampling for multiple times by adopting a preset data anomaly detection algorithm so as to judge whether the content distribution network is abnormal within the current period time;
and if the content distribution network is abnormal in the current cycle time, generating a time sequence data alarm of the content distribution network in the current cycle time based on the target monitoring data for detecting the abnormality.
3. The method according to claim 1, wherein the classifying the time-series data alarms and generating the abnormal alarm knowledge graph of the content delivery network in the current cycle time according to the classification result comprises:
classifying the time sequence data alarms based on a mapping relation between preset alarm characteristics and alarm classification to obtain a plurality of abnormal alarms of different classes, wherein the abnormal alarms comprise alarm sources and alarm descriptions, and the same alarm source corresponds to at least one alarm description;
and respectively establishing directed acyclic graphs corresponding to the abnormal alarms by taking the alarm source as a root node and the alarm description as a leaf node to obtain an abnormal alarm knowledge graph of the content distribution network in the current period time, wherein the abnormal alarm knowledge graph consists of the directed acyclic graphs corresponding to the abnormal alarms.
4. The method for locating the abnormality in the content delivery network according to claim 3, wherein the generating an abnormal root cause link map of the content delivery network in a current cycle time according to the abnormal alarm knowledge map and the software and hardware knowledge map comprises:
respectively acquiring root nodes of each directed acyclic graph in the abnormal alarm knowledge graph;
respectively taking the root node of each directed acyclic graph as a target node, traversing the software and hardware knowledge graph, and recording all node paths from the root node of the software and hardware knowledge graph to each target node;
and merging each node path and each directed acyclic graph based on the root node of each directed acyclic graph to obtain an abnormal root cause link graph of the content distribution network in the current cycle time.
5. The method according to claim 4, wherein the performing root localization on the abnormality occurring in the content delivery network within the current cycle time based on the abnormal root cause link map, and outputting the abnormal root cause in the abnormal root cause link map comprises:
acquiring alarm weight corresponding to each abnormal alarm in the current period time;
respectively calculating probability values of different types of alarms in the abnormal root cause link diagram, which are described as abnormal root causes, based on the alarm weights;
and based on each probability value, performing root cause positioning on the abnormality of the content distribution network in the current cycle time, and outputting the abnormal root cause corresponding to the maximum probability value as the abnormal root cause in the abnormal root cause link diagram.
6. The method of claim 5, wherein the probability value is calculated by the following formula:
wherein, PiProbability value, W, representing the description of class i alarms as an abnormal rootiA weight sum representing abnormal alarms corresponding to the i-th class of alarm description, and an n tableNumber of classes of alarm description, SijThe alarm weight k of the jth abnormal alarm in the abnormal alarms corresponding to the ith class of alarm description in the current cycle time is showniAnd indicating the number of abnormal alarms corresponding to the i-th class of alarm description.
7. The method for locating the abnormality in the content delivery network according to claim 1, wherein the generating a software and hardware knowledge graph of the content delivery network in the current cycle time according to the configuration management database information and the DNS scheduling information of the content delivery network in the current cycle time includes:
acquiring configuration management database information of the content distribution network in the current period time, wherein the configuration management database information comprises various software configuration information and hardware configuration information;
acquiring and analyzing DNS scheduling information of the content distribution network in the current cycle time;
and respectively taking the software configuration information and the hardware configuration information as nodes, and constructing a software and hardware knowledge graph of the content distribution network in the current period time based on the analyzed DNS scheduling information.
8. A device for locating an abnormality in a content distribution network, the device comprising:
the data sampling module is used for sampling target monitoring data in the content distribution network for multiple times at intervals of a preset period;
the first generation module is used for generating time sequence data alarm of the content distribution network in the current cycle time according to target monitoring data obtained by multiple times of sampling;
the second generation module is used for classifying the time sequence data alarm and generating an abnormal alarm knowledge graph of the content distribution network in the current period time according to the classification result;
a third generation module, configured to generate a software and hardware knowledge graph of the content distribution network in the current cycle time according to configuration management database information and DNS scheduling information of the content distribution network in the current cycle time;
a fourth generation module, configured to generate an abnormal root cause link map of the content distribution network in the current cycle time according to the abnormal alarm knowledge map and the software and hardware knowledge map;
and the abnormity positioning module is used for positioning the abnormity of the content distribution network in the current period time based on the abnormity root cause link diagram and outputting the abnormity root cause in the abnormity root cause link diagram.
9. An electronic device, characterized in that the electronic device comprises: a memory and at least one processor, the memory having instructions stored therein;
the at least one processor invokes the instructions in the memory to cause the electronic device to perform the content distribution network anomaly locating method of any one of claims 1-7.
10. A computer-readable storage medium having instructions stored thereon, wherein the instructions, when executed by a processor, implement the content distribution network anomaly locating method according to any one of claims 1-7.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202111664189.0A CN114422325A (en) | 2021-12-30 | 2021-12-30 | Content distribution network abnormity positioning method, device, equipment and storage medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202111664189.0A CN114422325A (en) | 2021-12-30 | 2021-12-30 | Content distribution network abnormity positioning method, device, equipment and storage medium |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN114422325A true CN114422325A (en) | 2022-04-29 |
Family
ID=81271556
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202111664189.0A Pending CN114422325A (en) | 2021-12-30 | 2021-12-30 | Content distribution network abnormity positioning method, device, equipment and storage medium |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN114422325A (en) |
Cited By (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN114844712A (en) * | 2022-05-23 | 2022-08-02 | 苏州思萃工业互联网技术研究所有限公司 | Safety detection system and method based on knowledge graph edge nodes |
| CN114944956A (en) * | 2022-05-27 | 2022-08-26 | 深信服科技股份有限公司 | Attack link detection method and device, electronic equipment and storage medium |
| CN115190001A (en) * | 2022-07-22 | 2022-10-14 | 天翼云科技有限公司 | Network abnormal state analysis method and device |
| CN116962673A (en) * | 2023-09-21 | 2023-10-27 | 四川君恒泰电子电器有限公司 | Abnormality detection method and system applied to intelligent television main board system |
Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN112019932A (en) * | 2020-08-27 | 2020-12-01 | 广州华多网络科技有限公司 | Network fault root cause positioning method and device, computer equipment and storage medium |
| CN112787841A (en) * | 2019-11-11 | 2021-05-11 | 华为技术有限公司 | Fault root cause positioning method and device and computer storage medium |
| CN112887119A (en) * | 2019-11-30 | 2021-06-01 | 华为技术有限公司 | Fault root cause determination method and device and computer storage medium |
| CN113032238A (en) * | 2021-05-25 | 2021-06-25 | 南昌惠联网络技术有限公司 | Real-time root cause analysis method based on application knowledge graph |
| CN113282461A (en) * | 2021-05-28 | 2021-08-20 | 中国联合网络通信集团有限公司 | Alarm identification method and device for transmission network |
| CN113590451A (en) * | 2021-09-29 | 2021-11-02 | 阿里云计算有限公司 | Root cause positioning method, operation and maintenance server and storage medium |
-
2021
- 2021-12-30 CN CN202111664189.0A patent/CN114422325A/en active Pending
Patent Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN112787841A (en) * | 2019-11-11 | 2021-05-11 | 华为技术有限公司 | Fault root cause positioning method and device and computer storage medium |
| CN112887119A (en) * | 2019-11-30 | 2021-06-01 | 华为技术有限公司 | Fault root cause determination method and device and computer storage medium |
| CN112019932A (en) * | 2020-08-27 | 2020-12-01 | 广州华多网络科技有限公司 | Network fault root cause positioning method and device, computer equipment and storage medium |
| CN113032238A (en) * | 2021-05-25 | 2021-06-25 | 南昌惠联网络技术有限公司 | Real-time root cause analysis method based on application knowledge graph |
| CN113282461A (en) * | 2021-05-28 | 2021-08-20 | 中国联合网络通信集团有限公司 | Alarm identification method and device for transmission network |
| CN113590451A (en) * | 2021-09-29 | 2021-11-02 | 阿里云计算有限公司 | Root cause positioning method, operation and maintenance server and storage medium |
Cited By (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN114844712A (en) * | 2022-05-23 | 2022-08-02 | 苏州思萃工业互联网技术研究所有限公司 | Safety detection system and method based on knowledge graph edge nodes |
| CN114944956A (en) * | 2022-05-27 | 2022-08-26 | 深信服科技股份有限公司 | Attack link detection method and device, electronic equipment and storage medium |
| CN115190001A (en) * | 2022-07-22 | 2022-10-14 | 天翼云科技有限公司 | Network abnormal state analysis method and device |
| CN115190001B (en) * | 2022-07-22 | 2024-03-08 | 天翼云科技有限公司 | Network abnormal state analysis method and device |
| CN116962673A (en) * | 2023-09-21 | 2023-10-27 | 四川君恒泰电子电器有限公司 | Abnormality detection method and system applied to intelligent television main board system |
| CN116962673B (en) * | 2023-09-21 | 2023-12-15 | 四川君恒泰电子电器有限公司 | Abnormality detection method and system applied to intelligent television main board system |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN114422325A (en) | Content distribution network abnormity positioning method, device, equipment and storage medium | |
| CN106130786B (en) | A kind of detection method and device of network failure | |
| CN103081407B (en) | Fail analysis device, trouble analysis system and failure analysis methods | |
| US7500142B1 (en) | Preliminary classification of events to facilitate cause-based analysis | |
| US11348023B2 (en) | Identifying locations and causes of network faults | |
| CN115668865A (en) | Network anomaly detection | |
| US20080016115A1 (en) | Managing Networks Using Dependency Analysis | |
| US20160179598A1 (en) | System and method of visualizing historical event correlations in a data center | |
| EP3329640B1 (en) | Network operation | |
| CN107683586A (en) | Method and apparatus for rare degree of the calculating in abnormality detection based on cell density | |
| JP2009048611A (en) | Method and apparatus for generating configuration rules for computing entities within computing environment using association rule mining | |
| US20090164618A1 (en) | Network system and method of administrating networks | |
| JP2021141582A (en) | Fault recovery method and apparatus, and storage medium | |
| CN108123849A (en) | Detect threshold value determination method, device, equipment and the storage medium of network traffics | |
| JP2009527839A (en) | Method and system for transaction monitoring in a communication network | |
| Rochim et al. | Design Log Management System of Computer Network Devices Infrastructures Based on ELK Stack | |
| CN112596975A (en) | Method, system, equipment and storage medium for monitoring network equipment | |
| CN113438110B (en) | Cluster performance evaluation method, device, equipment and storage medium | |
| CN113938407A (en) | Data center network fault detection method and device based on in-band network telemetry system | |
| CN112769605A (en) | Heterogeneous multi-cloud operation and maintenance management method and hybrid cloud platform | |
| JP5505930B2 (en) | Monitoring device, monitoring method and program | |
| CN104518896A (en) | Network vulnerability analysis method and device based on routing betweenness of interior gateway protocol | |
| Raja et al. | Rule generation for TCP SYN flood attack in SIEM environment | |
| CN115202958A (en) | Power abnormity monitoring method and device, electronic equipment and storage medium | |
| CN111865667A (en) | Network connectivity fault root cause positioning method and device |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |