CN115412443B - Network topology change detection method based on burst detection - Google Patents
Network topology change detection method based on burst detection Download PDFInfo
- Publication number
- CN115412443B CN115412443B CN202211030564.0A CN202211030564A CN115412443B CN 115412443 B CN115412443 B CN 115412443B CN 202211030564 A CN202211030564 A CN 202211030564A CN 115412443 B CN115412443 B CN 115412443B
- Authority
- CN
- China
- Prior art keywords
- node
- state
- burst
- network
- delay
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 230000008859 change Effects 0.000 title claims abstract description 69
- 238000001514 detection method Methods 0.000 title claims abstract description 46
- 238000000034 method Methods 0.000 claims abstract description 30
- 238000005457 optimization Methods 0.000 claims abstract description 8
- 230000007704 transition Effects 0.000 claims description 27
- 239000000523 sample Substances 0.000 claims description 26
- 230000005540 biological transmission Effects 0.000 claims description 22
- 230000006870 function Effects 0.000 claims description 17
- 230000001934 delay Effects 0.000 claims description 9
- 239000011159 matrix material Substances 0.000 claims description 7
- 238000004458 analytical method Methods 0.000 claims description 4
- 230000004044 response Effects 0.000 claims description 4
- 238000012546 transfer Methods 0.000 claims description 4
- 230000009466 transformation Effects 0.000 claims description 4
- 238000009825 accumulation Methods 0.000 claims description 3
- 238000004364 calculation method Methods 0.000 claims description 3
- 238000005259 measurement Methods 0.000 claims description 3
- 230000001105 regulatory effect Effects 0.000 claims description 3
- 238000012163 sequencing technique Methods 0.000 claims 1
- 238000012544 monitoring process Methods 0.000 abstract description 5
- 238000003325 tomography Methods 0.000 abstract description 2
- 230000006399 behavior Effects 0.000 description 5
- 238000013459 approach Methods 0.000 description 2
- 238000010586 diagram Methods 0.000 description 2
- 230000000694 effects Effects 0.000 description 2
- 238000013439 planning Methods 0.000 description 2
- 230000002159 abnormal effect Effects 0.000 description 1
- 230000009286 beneficial effect Effects 0.000 description 1
- 238000004891 communication Methods 0.000 description 1
- 238000011161 development Methods 0.000 description 1
- 238000005516 engineering process Methods 0.000 description 1
- 238000005206 flow analysis Methods 0.000 description 1
- 238000007689 inspection Methods 0.000 description 1
- 238000012423 maintenance Methods 0.000 description 1
- 238000007726 management method Methods 0.000 description 1
- 230000008569 process Effects 0.000 description 1
- 238000012545 processing Methods 0.000 description 1
- 238000012384 transportation and delivery Methods 0.000 description 1
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/12—Discovery or management of network topologies
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/06—Management of faults, events, alarms or notifications
- H04L41/0677—Localisation of faults
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L43/00—Arrangements for monitoring or testing data switching networks
- H04L43/08—Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
- H04L43/0852—Delays
Abstract
The invention discloses a network topology change detection method based on burst detection, which comprises the steps of firstly taking end-to-end delay information obtained by network tomography as input, then carrying out burst detection on each target node delay sequence, adding a target node with a burst into a burst node set, and finally positioning a change source node through the burst node set to finish the task of network topology change detection. Compared with the existing methods, the method provided by the invention has the advantages that under the actual network condition, the network topology change can be perceived and positioned more accurately and efficiently, the execution cost is lower than that of other methods, the method has positive practical significance for the study of topology monitoring in the actual network environment, the network topology structure can be known more accurately, and the network control and the network topology structure optimization can be enhanced.
Description
Technical Field
The invention belongs to the field of network topology, and particularly relates to a network topology change detection method based on burst detection.
Background
With the rapid development of internet technology, the network scale is rapidly expanded, the importance of the network is also significantly improved, and the internet is essential to influence various aspects of human life. The topology structure of the network reflects the structural relation of the entities in the network, has great influence on the performance of the network, the reliability of the system and the communication cost, and is very important and meaningful for the study of the network topology. In practical networks, however, the network is quite complex and remains dynamically changing. The network topology change detection is to analyze the abnormal condition of the network according to the information obtained by feedback, monitor the network, sense the change of the network topology and locate the source of the change. The maintenance of the stable operation of the network requires the efficient and accurate sensing and positioning of the network topology change and the positioning of the change source node, and is an important component of the network monitoring management.
The problem of detecting network topology changes has been long, but the existing solutions still have some problems. The problem needs to be solved by continuously sending detection data into the network and collecting network performance data such as flow, time delay, packet loss and the like in real time. The existing network topology change detection methods are mainly divided into two types. Firstly, a network topology change detection method based on rules is used for formulating different analysis rules aiming at different network behaviors; and secondly, analyzing whether network characteristics of newly detected data are similar to network characteristics of historical data or not or modeling network behaviors through the historical data based on a network topology change detection method of model prediction, and inputting the newly detected data into a model to predict so as to judge the current network topology state. The network topology is perceived to change by analyzing the network behavior, and the change source node needs to be positioned. Similar to network topology change identification, the change source node positioning can also be inferred or modeled for prediction according to analytical rules.
The method for detecting the network topology change based on the rules analyzes the rules of the current network topology result through the equipment information of the network equipment, and utilizes the analyzed rules to dynamically analyze the network topology of the newly detected data. The rule-based network topology change detection method requires detailed device information of network devices, but in an actual network, detailed information of many devices cannot be obtained, and as the scale of the network is enlarged, the workload of the work is very huge. In addition, the performance of the rule-based network topology change detection method is limited by the quality of the parsing rule in the scene which has already appeared, and it is difficult to cope with a new scene. The utility of such methods is becoming lower and lower.
The network topology change detection method based on model prediction models network behaviors by analyzing the prior data, and inputs newly detected data into the model to predict the network behaviors. The most widely used method in the network topology change detection method based on model prediction is the network topology change detection method based on flow analysis. For the network topology change detection method based on model prediction, parameters required by an algorithm in a given model, such as distance definition, cluster size and the like, are often required, and the set parameters directly influence the result of the network topology.
The quality of the rules resolved by the already-occurring scenes has great influence on the effect of the rule-based network topology change detection method, and the method has poor strain capacity on different scenes. The network topology change detection method based on model prediction consumes certain resources and time by an automatic increment learning mode, and is suitable for newly appearing scenes to continuously perfect the model. In addition, the complex and huge network environment is full of a large amount of noise, and great interference is generated for detecting the network topology change.
Disclosure of Invention
In order to solve the technical problems, the invention provides a network topology change detection method based on burst detection.
The technical scheme of the invention is as follows: a network topology change detection method based on burst detection comprises the following specific steps:
s1, network topology change identification is performed,
analyzing end-to-end delay variation of source and destination nodes to find destination node set affected by node faultLocating a set of failed nodes->
From the source node s to any destination node d, probe packets are sent at a fixed rate, and the path p can be obtained by analyzing the probe packet response d And time delay information of each node. Assuming that n data messages are collected, according to the arrival time of the messages, an end-to-end time delay sequence is adoptedThe expression is as follows:
wherein ,t0 ,t 1 ,…,t n-1 Respectively representing the end-to-end time delays of n data messages.
The probability density function f (t) of the probe packet end-to-end delay t is simulated by an exponential function:
f(t)＝αe -αt (α>0)
where α represents the transmission rate, and the delay of the probe packet is desirably 1/α.
Burst modeling of end-to-end delay can be generalized from an automaton in two states to an automaton in an infinite state. Definition State table Θ= { θ 0 ,θ 1 If there is a node failure on the path from the source node s to the destination node d, resulting in a lower probe packet transmission rate, d is in state θ 0 The method comprises the steps of carrying out a first treatment on the surface of the The path state from the source node s to the destination node d is stable, and d is in theta when the data packet transmission rate is high 1 Status of the device. One state in the state table Θ corresponds to one time delay, and the d state sequence of the destination nodeAnd delay sequence->Correspondingly (I)>The expression is as follows:
wherein ,q0 ,q 1 ,…q n-1 Respectively representing the states of the destination nodes corresponding to the time delays.
The network performance is changed due to the change of node state, and the known end-to-end delay sequence from s to d is thatSolving for the appropriate +.>Assuming that the two-state automaton transitions between states with a probability p, the objective function can be expressed as:
from bayesian estimation, one can get:
wherein ,to normalize constant, t i End-to-end delay, q for the i-1 data message i At t i Corresponding destination node states, assumed in the state sequence +.>In (2), the total number of state transitions between adjacent elements is m, then +.>Is>Expressed as:
assuming that the end-to-end delays of the probe packets sent from s to d in the network are independent of each other, the conditional probabilityCan be expressed as:
wherein ,f(ti |q i ) Represented at q i In the state expressed as t i Probability of time delay f qi (t i ) Is f (t) i |q i ) Is a shorthand for (2).
Then atIn the state of +.>Prior probability of delay->Can be expressed in the following form:
taking logarithms from the two sides of the upper part at the same time, the method can obtain:
the first two terms are constants, letThe objective function may be expressed as:
the equivalent transformation is to minimize a loss function as follows:
observing the above equation, the total number of transitions of the state sequence determines the size of the first term mln ((1-p)/p), and in order to minimize mln ((1-p)/p), the solution with the least number of transitions is found. The second term fits the detected delay data to the result of the actual network measurement as closely as possible to the solution of the constraint problem.
Expanding the state of automata from two to infinity, i.e. state table Θ = { θ 0 ,θ 1 ,…,θ ∞ ++, and ensures that the elements in Θ can represent a sequence of statesDescribe a set of low to high rates +.>The average rate is needed as a reference, and assuming that the average rate and the average time delay are reciprocal in the present invention, the average time delay can be expressed as:
wherein ,the transmission rate of the end-to-end probe packet corresponding to index i in (i) can be expressed as:
wherein sigma is a transmission rate adjustment parameter for adjusting burst result resolution, regulating and controllingA multiple of the elements in the formula.
Assuming an infinite state automaton, a cost is required to achieve transitions between states analogous to the minimization of the loss function in the two state automaton described above. For theta in theta i and θj (i>j) State theta i To theta j Cost of transfer c (θ i ,θ j ) Lnn =ε (i-j), where ε>And 0 represents a state transition cost size control parameter for extracting burst hierarchy richness. Network topology route re-planning or normal detection errors may result in such state transitions without the cost of c (θ j ,θ i )＝0。
The optimization objective of the infinite state automaton is:
wherein ,c(qi ，q i+1 ) Representing the corresponding state transition costs.
In a real network, the network transmission rate cannot become extremely large, and the real meaning represented by the overlarge state approaches 0. Recording deviceThe size calculation formula of the optimal state table is as follows:
after the size of the state table is determined, the optimal solution of the optimization target of the infinite state automaton is solved by using a dynamic programming method.
Sequentially solving a state sequence responded by each target node according to the end-to-end delay analysis of each detected target node, and carrying out emergency detection according to the state sequence to obtain a target node set influenced by the fault nodeJudging whether the destination node is connected, detecting the packet loss rate of the detection packet in a period of time, if the packet loss rate is excessive, judging that the node is not connected, and adding the node into the detection packet>
S2, obtaining an affected destination node set after node failure according to the step S1, detecting emergency, completing the positioning of the change source node,
and detecting an emergency according to the time delay information, and if the time delay sequence of any node on the path has obvious burst and the time delay sequence from end to end also shows obvious burst, comprehensively showing the time delay sequence burst state of all nodes on the path as the time delay sequence burst state from end to end.
If an obvious burst is detected by the end-to-end delay from s to d, then the burst is detected in the path p d There is a high probability that a node which is down-line due to a certain factor is failed, and the node is in the original logic topology G 1 From s toIs denoted as +.>Reducing the search space of the source node of the change to the path set +.>On the basis, establishing a burst relation between the nodes and the paths, and reversing the burst state of the nodes through the burst state of the paths to finish the target of the positioning of the source node.
Wherein the bursty state of the node is described by using a Boolean performance model, modeling is performed on a time delay sequence of any node v in a network by using the network topology change identification method, and the node v is set at t 1 The moment isState at t 2 Time of day transition toStatus of the device. The burst state of the time delay sequence passes through a binary random variable B v Is described as follows:
by using binary random variables Y of similar meaning d Representing end-to-end delay bursty state, i.e. path p from s to d d The bursty state of the time delay sequence of (a) is comprehensively represented. The path delay burst may be represented by a node delay burst:
wherein, V represents binary logical OR operation.
For path p d The end-to-end delay sequence burst state of (a) is equivalent to the accumulation of delay sequence burst states of all nodes on the path, and can be expressed as:
the association of the path with the bursty state between the nodes can be established by the above equation for all detected destination nodes.
Numbering all nodes except the probe source node in the network topology from 0 in sequence and increasing progressively, and collecting shortest pathsMiddle route from->Numbering is carried out in sequence, and a route matrix R is constructed. Each row of R represents information of a path in which a certain node is passed, the position value being 1, otherwise 0. The global burst status that needs to be monitored can be established as follows:
Y＝RB
wherein Y represents the state of a path in the network, is a column vector, R represents that each path in the network passes through a node matrix and can react to the shortest path, B represents the state of the node in the network, and each element in Y corresponds to a burst of one pathState of beingAnd (3) a dimension column vector, wherein each element in the B corresponds to a burst state of a node except a source node s, the column vector is a column vector with the dimension of |V| -1, and V represents a node set in a network. According to the shortest path criterion, the number of destination nodes is equal to the number of paths monitored and no probe packet is typically sent to all nodes in the network, there is +.>Assuming that a very small proportion of nodes result in a change in network topology, the source node location problem can be solved by an integer linear problem, namely:
by converting the positioning problem into an integer linear programming problem and solving the vector B, the time delay sequence burst state of all nodes except the detection source node s in the network can be obtained. If a certain node corresponds to the ith element B of B i In the monitoring, firstly, a fault occurs, a data message can not successfully reach a target node through the node, in theory, the delay of the node can be infinite, and the delay sequence of the node can be obviously burst. By ordering the burst strength of all nodes in the network topology except s, a source node or set of source nodes can be located efficiently.
The invention has the beneficial effects that: the method of the invention firstly takes the end-to-end time delay information obtained by network tomography as input, then carries out burst detection on each target node time delay sequence, adds the target node with burst into a burst node set, and finally locates the change source node through the burst node set to finish the task of detecting the network topology change. Compared with the existing methods, the method provided by the invention has the advantages that under the actual network condition, the network topology change can be perceived and positioned more accurately and efficiently, the execution cost is lower than that of other methods, the method has positive practical significance for the study of topology monitoring in the actual network environment, the network topology structure can be known more accurately, and the network control and the network topology structure optimization can be enhanced.
Drawings
Fig. 1 is a flowchart of a network topology change detection method based on burst detection according to the present invention.
Fig. 2 is a state transition diagram in an embodiment of the invention.
FIG. 3 is a diagram illustrating a nested structure extracted by the burst detection algorithm according to an embodiment of the present invention.
Detailed Description
The invention is further described below with reference to the accompanying drawings.
As shown in fig. 1, the method for detecting network topology change based on burst detection of the present invention comprises the following specific steps:
s1, network topology change identification is performed,
the time delay from the source node to the destination node from end to end changes, which is caused by the fact that some nodes fail or are attacked to cause the disconnection, and the data transmission paths of some nodes in the network change. Network topology change identification is to infer a set of destination nodes affected by node failure through end-to-end delay changeBecause of the huge scale of the internet, the cost of network logic topology reconstruction is high, and when only a small number of nodes in the network fail, the data packet passing through the node can only need to be rerouted and forwarded by other nodes. Therefore, whether the network topology is sent or not is inferred by searching whether the routing paths are changed or not, and even after the node fails, the search space of the target failure node can be reduced to help locate the failure node.
In view of the above problem, in this embodiment, considering the influence of the topology path change on the network performance, in the rerouting process, a part of the area of the network may cause an increase in the packet loss rate, network congestion occurs, and the delay characteristics of the remaining probe packets that are not lost may also change to some extent from end to end due to the rerouting.
Analyzing the end-to-end delay variation of the source and destination nodes to potentially find a set of destination nodes affected by the node failureLocating a set of failed nodes->A detailed flow of network topology change identification is shown in fig. 1.
From the source node s to any destination node d, probe packets are sent at a fixed rate, and the path p can be obtained by analyzing the probe packet response d And time delay information of each node. Assuming that n data messages are collected, according to the arrival time of the messages, an end-to-end time delay sequence is adoptedThe expression is as follows:
wherein ,t0 ,t 1 ,…,t n-1 Respectively representing the end-to-end time delays of n data messages.
The probability density function f (t) of the probe packet end-to-end delay t is simulated by an exponential function:
f(t)＝αe -αt (α>0)
where α represents the transmission rate, and the delay of the probe packet is desirably 1/α.
Burst modeling of end-to-end delay can be generalized from an automaton in two states to an automaton in an infinite state. Definition State table Θ= { θ 0 ,θ 1 If there is a node failure on the path from the source node s to the destination node d, resulting in a lower probe packet transmission rate, d is in state θ 0 The method comprises the steps of carrying out a first treatment on the surface of the The path state from the source node s to the destination node d is stable, and d is in theta when the data packet transmission rate is high 1 Status of the device.One state in the state table Θ corresponds to one time delay, and the d state sequence of the destination nodeAnd delay sequence->Correspondingly (I)>The expression is as follows:
wherein ,q0 ,q 1 ,…q n-1 Respectively representing the states of the destination nodes corresponding to the time delays.
The network performance is changed due to the change in node state, in this embodiment, the known end-to-end delay sequence from s to d isSolving for the appropriate +.>Assuming that the two-state automaton transitions between states with a probability p, the objective function can be expressed as:
from bayesian estimation, one can get:
wherein ,to get home toConstant of transformation, t i End-to-end delay, q for the i-1 data message i At t i Corresponding destination node states, assumed in the state sequence +.>In (2), the total number of state transitions between adjacent elements is m, then +.>Is>Can be expressed as:
assuming that the end-to-end delays of the probe packets sent from s to d in the network are independent of each other, the conditional probabilityCan be expressed as:
wherein ,f(ti |q i ) Represented at q i In the state expressed as t i The probability of the time delay is determined,is f (t) i |q i ) Is a shorthand for (2).
Then atIn the state of +.>Prior probability of delay->Can be expressed in the following form:
taking logarithms from the two sides of the upper part at the same time, the method can obtain:
the first two terms are constants, letThe objective function can then be expressed as:
the equivalent transformation is to minimize a loss function as follows:
looking at the above equation, the total number of transitions in the state sequence determines the size of the first term mln ((1-p)/p), in order to minimize mln ((1-p)/p), the solution with the least number of transitions is found in this embodiment, because node failures do not occur frequently, and network topology performance is smooth in most states. The second term fits the detected delay data to the result of the actual network measurement as closely as possible to the solution of the constraint problem.
In most cases, the two state change errors are relatively large and cannot describe the change in network performance. Expanding the states of automata from two to infinity, i.e., state table Θ= { θ 0 ,θ 1 ,…,θ ∞ -and ensures that the elements in Θ can represent a sequence of statesIn a practical network topology, the end-to-end transmission rate for each state is difficult to determine, describing a set of low-to-high rates +.>The average rate is required as a reference. Assuming that the average rate and the average delay are reciprocal in the present invention, the average delay can be expressed as:
wherein ,the transmission rate of the end-to-end probe packet corresponding to index i in (i) can be expressed as:
wherein sigma is a transmission rate adjustment parameter for adjusting burst result resolution, regulating and controllingA multiple of the elements in the formula.
Assuming an infinite state automaton, a cost is required to achieve transitions between states analogous to the minimization of the loss function in the two state automaton described above. For theta in theta i and θj (i>j) State theta i To theta j Cost of transfer c (θ i ,θ j ) Lnn, =ε (i-j), where ε>And 0 is a state transition cost size control parameter used for extracting burst hierarchy richness.
As can be seen from the above, a lower transmission rate generally manifests as a larger end-to-end delay, corresponding to a smaller subscripted state in the state table, state θ i To theta j Transfer also illustrates the net at this timeThe network may be negatively affected to some extent resulting in reduced performance. Conversely, when the network node fails, the network performance recovers after the packet is rerouted and converged, the packet transmission rate may rise to some extent, and the node transitions from a low transmission rate state to a high transmission rate state. In this embodiment, network topology route re-planning or normal detection errors may result in such state transitions without the cost, i.e., c (θ j ,θ i ) =0. In summary, the transition costs between states are shown in fig. 2.
The optimization objective of the infinite state automaton is:
wherein ,c(qi ，q i+1 ) Representing the corresponding state transition costs.
In a real network, the network transmission rate does not become extremely high, so the real meaning represented by the excessively large state approaches 0. Recording deviceThe size calculation formula of the optimal state table is as follows:
after the size of the state table is determined, the optimal solution of the optimization target of the infinite state automaton can be solved by using a dynamic programming method. Modeling for bursty state implies rich hierarchical information, the results of which are shown in FIG. 3. Wherein from t 1 Starting at time, in state 0 until t 2 The node starts to transition to a high state after the node transits to the state 1 at the moment; similarly, t 3 From state 3 to state 4, the time transitions to the highest state; from t 4 Starting at a moment, the node transitions from a high state to a low state.
Sequentially solving a state sequence of the node response according to the end-to-end delay analysis of each detected target node and according to the stateThe sequence carries out emergency detection to obtain a target node set influenced by the fault nodeIn this case, the node cannot detect the emergency by detecting the delay sequence of the packet mobile phone, and cannot use the burst inspection algorithm. In this embodiment, the criterion for determining whether the destination node is connected is to detect the packet loss rate of the probe packet in a period of time. If the packet loss is excessive, judging that the node is not connected, adding the node into the node +.>
S2, obtaining an affected destination node set after node failure according to the step S1, detecting emergency, completing the positioning of the change source node,
according to the result of the network topology change identification method of the burst detection in the step S1, a target node set affected after the node failure can be obtainedIn the path node sequence from s to d, the sending delay, the propagation delay, the processing delay and the queuing delay of the detection packet are not considered separately, and the end-to-end delay is the sum of all the node delays, so that the delay of any node is changed to have a certain effect on the end-to-end delay.
And detecting an emergency according to the time delay information, wherein if the time delay sequence of any node on the path has obvious burst, the obvious burst is also shown in the end-to-end time delay sequence, and the comprehensive of the time delay sequence burst states of all nodes on the path is shown as the end-to-end time delay sequence burst state.
If an obvious burst is detected by the end-to-end delay from s to d, then the burst is detected in the path p d There is a high probability that there will be nodes that are down-line due to some factor that are root causes of affecting the transmission of data messages between s and d and causing changes in the network topology. In the original stateLogic topology G 1 From s toIs denoted as +.>Reducing the search space of the source node of the change to the path set +.>On the basis, the embodiment establishes the burst relation between the nodes and the paths, and the burst state of the nodes is reversely pushed through the burst state of the paths to complete the positioning target of the change source node.
The bursty state of the node is described by using a Boolean performance model, the time delay sequence of any node v in the network is modeled by using the network topology change identification method, and the node v is set at t 1 The moment isState at t 2 Time of day transition toStatus of the device. The burst state of the time delay sequence passes through a binary random variable B v Is described as follows:
by using binary random variables Y of similar meaning d Representing end-to-end delay bursty state, i.e. path p from s to d d The bursty state of the time delay sequence of (a) is comprehensively represented. The path delay burst may be represented by a node delay burst:
wherein, V represents binary logical OR operation.
The boolean performance model can detect whether there are bursts in the path, but all path bursts are considered as bursts with intensity "1", treated equally, and may have a relatively large impact on the burst state estimation of the node.
In the actual case of a situation in which,some weak bursts may still be detected by the end-to-end delay of a small portion of the paths that do not pass through the source node, because the source node may propagate the impact of network performance in a small range, including some paths that do not pass through the source node, and the message that did pass through the anomaly node may need to take a new route for successful delivery.
In this embodiment, a method for locating a source node of a change based on burst strength is further provided to solve the problem in the boolean performance model, where different burst states are represented by different burst strengths. Obviously, the burst strength is used for representing the burst state, so that the path or node delay sequence emergency can be described more accurately. For the destination node d, the states of the delay sequence before and after the network topology change are respectively q 1 and q2 Then q is used for its corresponding burst status 1 -q 2 To represent.
For path p d The end-to-end delay sequence burst state of (a) is equivalent to the accumulation of delay sequence burst states of all nodes on the path, and can be expressed as:
the association of the path with the bursty state between the nodes can be established by the above equation for all detected destination nodes.
Numbering all nodes except the probe source node in the network topology from 0 in sequence and increasing progressively, and collecting the shortest pathMiddle route from->Numbering is carried out in sequence, and a route matrix R is constructed. Each row of R represents information of a path in which a certain node is passed, the position value being 1, otherwise 0. The global burst status that needs to be monitored can be established as follows:
Y＝RB
wherein Y represents the state of a path in the network, is a column vector, R represents that each path in the network passes through a node matrix and can react to the shortest path, B represents the state of the node in the network, and each element in Y corresponds to the burst state of one path and isAnd (5) maintaining the column vector. Column vector of |V| -1 dimension, V represents the set of nodes in the network. The number of destination nodes is equal to the number of paths monitored according to the shortest path criterion and typically no probe packets are sent to all nodes in the network, there areA linear system of equations with y=rb will often have multiple sets of solutions with underqualification problems. In this embodiment, the network topology is in a relatively stable state in most of the time, the node faults in the network are small probability events, and the faults of a single node generally affect only the local network performance, and basically no large-scale node faults occur, so in this embodiment, it is assumed that a few proportion of nodes cause the change of the network topology, and the problem of positioning the change source node can be solved by an integer linear problem, namely:
by converting the positioning problem into an integer linear programming problem and solving the vector B, the method can obtain the division in the networkThe time delay sequence burst state of all nodes except the source node s is detected. If a certain node corresponds to the ith element B of B i In the monitoring, firstly, a fault occurs, the data message can not successfully reach the destination node through the node, in theory, the delay of the node can be infinite, and the delay sequence of the node can be obviously burst. By ordering the burst strength of all nodes in the network topology except s, a source node or set of source nodes can be located efficiently.
Claims (1)
1. A network topology change detection method based on burst detection comprises the following specific steps:
s1, network topology change identification is performed,
analyzing end-to-end delay variation of source and destination nodes to find destination node set affected by node faultLocating a set of failed nodes->
Transmitting probe packets from a source node s to an arbitrary destination node d at a fixed rate, and obtaining a path p by analyzing probe packet responses d Delay information of each node is provided that n data messages are collected, and an end-to-end delay sequence is carried out according to the arrival time of the messagesThe expression is as follows:
wherein ,t0 ,t 1 ,…,t n-1 Respectively representing the end-to-end time delay of n data messages;
simulating and detecting a probability density function f (t) of the packet end-to-end time delay t by using an exponential function:
f(t)＝αe -αt (α>0)
where α represents a transmission rate, and the delay of the probe packet is expected to be 1/α;
definition State table Θ= { θ 0 ,θ 1 D-state sequence of destination nodeAnd delay sequence->Correspondingly (I)>The expression is as follows:
wherein ,q0 ,q 1 ,…q n-1 Respectively representing the states of the destination nodes corresponding to the time delays;
the end-to-end time delay sequence from s to d is known asSolving for the appropriate +.>Assuming a two-state automaton transitions between states with a probability p, the objective function is expressed as:
from bayesian estimation, we get:
wherein ,to normalize constant, t i End-to-end delay, q for the i-1 data message i At t i Corresponding destination node states, assumed in the state sequence +.>In (2), the total number of state transitions between adjacent elements is m times,/v>Is>Expressed as:
assuming that the end-to-end delays of the probe packets sent from s to d in the network are independent of each other, conditional probabilityExpressed as:
wherein ,f(ti |q i ) Represented at q i In the state expressed as t i The probability of the time delay is determined,is f (t) i |q i ) Is abbreviated as (1);
then atIn the state of +.>Prior probability of delay->Expressed in the following form:
taking logarithms from the two sides of the upper part at the same time, the method can obtain:
the first two terms are constants, letThe objective function is expressed as:
the equivalent transformation is to minimize a loss function as follows:
observing the above formula, finding a solution with the minimum transfer times for minimizing mln ((1-p)/p), fitting the second term to the detected time delay data, and enabling the solution of the constraint problem to be as consistent as possible with the actual network measurement result;
expanding the state of automata from two to infinity, i.e. state table Θ = { θ 0 ,θ 1 ,…,θ ∞ Guarantee that elements in Θ can represent a sequence of statesAssuming that the average rate and the average delay are reciprocal in the present invention, the average delay is expressed as:
wherein ,the transmission rate of the end-to-end probe packet corresponding to index i is expressed as:
wherein sigma is a transmission rate adjustment parameter for adjusting burst result resolution, regulating and controllingA multiple relationship of the elements;
the optimization targets of the infinite state automaton are as follows:
wherein ,c(qi ，q i+1 ) Representing a corresponding state transition cost;
the size calculation formula of the optimal state table is as follows:
after the size of the state table is determined, solving an optimal solution of an infinite state automaton optimization target by using a dynamic programming method;
sequentially solving a state sequence responded by each target node according to the end-to-end delay analysis of each detected target node, and carrying out emergency detection according to the state sequence to obtain a target node set influenced by the fault nodeJudging whether the destination node is connected or not, detecting the packet loss rate of the detection packet in a period of time, if the packet loss rate is excessive, judging that the node is not connected, and adding the node into the network
S2, obtaining an affected destination node set after node failure according to the step S1, detecting emergency, completing the positioning of the change source node,
in the original logic topology G 1 From s toIs denoted as +.>Reducing the search space of the source node of the change to the path set +.>Establishing a burst relation between the nodes and the paths, and reversely pushing the burst state of the nodes through the burst state of the paths to finish the target of the positioning of the change source nodes;
wherein the bursty state of the node is described by using a Boolean performance model, modeling is performed on a time delay sequence of any node v in a network by using the network topology change identification method, and the node v is set at t 1 The moment isState at t 2 Time shift to +.>A state; the burst state of the time delay sequence passes through a binary random variable B v Is described as follows:
binary random variable Y using similar meanings d Representing end-to-end delay bursty state, i.e. path p from s to d d Comprehensive representation of burst state of delay sequence of (a) by node delay burstThe state represents a path delay burst state:
wherein "" represents binary logical OR "operation;
for path p d The end-to-end delay sequence burst state of (a) is equivalent to the accumulation of delay sequence burst states of all nodes on the path, expressed as:
establishing a connection of a path and a burst state between nodes through the above method for all detected destination nodes;
numbering all nodes except the probe source node in the network topology from 0 in sequence and increasing progressively, and collecting shortest pathsMiddle route from->Numbering in sequence, constructing information of each row of the routing matrix R, wherein each row of the routing matrix R represents a path, a certain node passes through the path, the position value of the node is 1, otherwise, the position value of the node is 0, and the following equation is established for the global burst state to be monitored:
Y＝RB
wherein Y represents the state of a path in the network, is a column vector, R represents that each path in the network passes through a node matrix and reacts shortest, B represents the state of the node in the network, and each element in Y corresponds to the burst state of one path and isThe column vector is in the dimension of |V| -1, each element in B corresponds to the burst state of the nodes except the source node s, and B is the column vector in the dimension of |V| -1 i Corresponding to the ith element of B, V represents the node set in the network, falseSetting few proportion of nodes to cause the change of network topology, solving the change source node positioning problem through an integer linear problem, namely:
and converting the positioning problem into an integer linear programming problem, solving the vector B, obtaining the time delay sequence burst state of all nodes except the detection source node s in the network, and effectively positioning the change source node or the source node set by sequencing the burst strength of all nodes except the s in the network topology.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202211030564.0A CN115412443B (en) | 2022-08-26 | 2022-08-26 | Network topology change detection method based on burst detection |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202211030564.0A CN115412443B (en) | 2022-08-26 | 2022-08-26 | Network topology change detection method based on burst detection |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN115412443A CN115412443A (en) | 2022-11-29 |
| CN115412443B true CN115412443B (en) | 2023-10-17 |
Family
ID=84161001
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202211030564.0A Active CN115412443B (en) | 2022-08-26 | 2022-08-26 | Network topology change detection method based on burst detection |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN115412443B (en) |
Citations (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN105306291A (en) * | 2015-09-16 | 2016-02-03 | 电子科技大学 | Network topology estimation method based on packet loss rate and time delay combination |
Family Cites Families (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| EP2644000A2 (en) * | 2010-11-24 | 2013-10-02 | Elta Systems Ltd. | Various traffic management methods for dynamic multi-hop backhauling cellular network and systems useful in conjunction therewith |
| ES2827245T3 (en) * | 2014-10-07 | 2021-05-20 | Sedonasys Systems Ltd | Systems and methods for managing multilayer communication networks |
-
2022
- 2022-08-26 CN CN202211030564.0A patent/CN115412443B/en active Active
Patent Citations (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN105306291A (en) * | 2015-09-16 | 2016-02-03 | 电子科技大学 | Network topology estimation method based on packet loss rate and time delay combination |
Non-Patent Citations (3)
| Title |
|---|
| Network Topology Inference Based on Subset Structure Fusion;Jian Ye;《 IEEE Access》;全文 * |
| 基于网络断层扫描技术的网络拓扑推测方法研究;李贵山;蔡皖东;;计算机应用研究(第12期);全文 * |
| 网络拓扑结构的优化测量和识别方法研究;叶剑;《硕士电子期刊》;全文 * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN115412443A (en) | 2022-11-29 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| Dusia et al. | Recent advances in fault localization in computer networks | |
| Huo et al. | A SDN‐based fine‐grained measurement and modeling approach to vehicular communication network traffic | |
| CN107370732B (en) | Abnormal behavior discovery system of industrial control system based on neural network and optimal recommendation | |
| US11348023B2 (en) | Identifying locations and causes of network faults | |
| CN113032238B (en) | Real-time root cause analysis method based on application knowledge graph | |
| CN115412947A (en) | Fault simulation method and system based on digital twin and AI algorithm | |
| CN102684902B (en) | Based on the network failure locating method of probe prediction | |
| CN114579407B (en) | Causal relationship inspection and micro-service index prediction alarm method | |
| CN116684253A (en) | Network anomaly management and control method based on intelligent operation and maintenance | |
| CN109587000A (en) | High latency method for detecting abnormality and system based on collective intelligence network measurement data | |
| Solmaz et al. | ALACA: A platform for dynamic alarm collection and alert notification in network management systems | |
| CN116166505A (en) | Monitoring platform, method, storage medium and equipment for dual-state IT architecture in financial industry | |
| CN115412443B (en) | Network topology change detection method based on burst detection | |
| CN113484693A (en) | Transformer substation secondary circuit fault positioning method and system based on graph neural network | |
| Alghuried et al. | Anomaly detection in large-scale networks: A state-space decision process | |
| Sartzetakis et al. | Machine learning network tomography with partial topology knowledge and dynamic routing | |
| Guo et al. | FullSight: A feasible intelligent and collaborative framework for service function chains failure detection | |
| US20230133541A1 (en) | Alert correlating using sequence model with topology reinforcement systems and methods | |
| Zhang et al. | A novel virtual network fault diagnosis method based on long short-term memory neural networks | |
| Huo et al. | A software‐defined networks‐based measurement method of network traffic for 6G technologies | |
| Kilinçer et al. | Automatic fault detection with Bayes method in university campus network | |
| Muthukumar et al. | Denoising internet delay measurements using weak supervision | |
| Fu et al. | A learning-based service function chain early fault diagnosis mechanism based on in-band network telemetry | |
| Cai et al. | Modelcoder: A fault model based automatic root cause localization framework for microservice systems | |
| WO2023231192A1 (en) | Srv6-based intelligent network and device fault prediction method and system |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |