CN117240755A - Log auditing method, device and storage medium for edge computing equipment - Google Patents
Log auditing method, device and storage medium for edge computing equipment Download PDFInfo
- Publication number
- CN117240755A CN117240755A CN202311493999.3A CN202311493999A CN117240755A CN 117240755 A CN117240755 A CN 117240755A CN 202311493999 A CN202311493999 A CN 202311493999A CN 117240755 A CN117240755 A CN 117240755A
- Authority
- CN
- China
- Prior art keywords
- resource utilization
- data
- traffic
- log
- edge computing
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
- 238000000034 method Methods 0.000 title claims abstract description 60
- 230000005856 abnormality Effects 0.000 claims abstract description 25
- 238000012544 monitoring process Methods 0.000 claims description 57
- 238000012550 audit Methods 0.000 claims description 47
- 239000013598 vector Substances 0.000 claims description 22
- 230000008569 process Effects 0.000 claims description 16
- 230000002159 abnormal effect Effects 0.000 claims description 7
- 238000010276 construction Methods 0.000 claims description 5
- 238000000605 extraction Methods 0.000 claims description 4
- 238000004590 computer program Methods 0.000 claims 1
- 230000000694 effects Effects 0.000 abstract description 3
- 238000012545 processing Methods 0.000 description 18
- 230000005540 biological transmission Effects 0.000 description 13
- 238000004458 analytical method Methods 0.000 description 11
- 238000010586 diagram Methods 0.000 description 9
- 238000004364 calculation method Methods 0.000 description 7
- 238000004891 communication Methods 0.000 description 5
- 239000000284 extract Substances 0.000 description 5
- 238000013075 data extraction Methods 0.000 description 4
- 238000005516 engineering process Methods 0.000 description 3
- 230000008878 coupling Effects 0.000 description 2
- 238000010168 coupling process Methods 0.000 description 2
- 238000005859 coupling reaction Methods 0.000 description 2
- 230000006870 function Effects 0.000 description 2
- 238000007689 inspection Methods 0.000 description 2
- 239000010410 layer Substances 0.000 description 2
- 230000003287 optical effect Effects 0.000 description 2
- 230000006978 adaptation Effects 0.000 description 1
- 238000013500 data storage Methods 0.000 description 1
- 238000013502 data validation Methods 0.000 description 1
- 238000011161 development Methods 0.000 description 1
- 239000004973 liquid crystal related substance Substances 0.000 description 1
- 238000007726 management method Methods 0.000 description 1
- 238000010295 mobile communication Methods 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 230000006855 networking Effects 0.000 description 1
- 239000011241 protective layer Substances 0.000 description 1
- 238000012552 review Methods 0.000 description 1
- 239000007787 solid Substances 0.000 description 1
Abstract
The application discloses a log auditing method, a log auditing device and a storage medium for edge computing equipment. The method comprises the following steps: receiving a traffic log and a resource utilization log from an edge computing device; constructing a resource utilization estimation model; extracting first traffic data from the traffic log and corresponding first resource utilization data from the resource utilization log, and determining parameters of a resource utilization estimation model according to the first traffic data and the first resource utilization data; extracting second traffic data of different network slices from the traffic log, and determining corresponding resource utilization estimation data of the edge computing equipment based on the second traffic data by utilizing a resource utilization estimation model; extracting second resource utilization data corresponding to the second traffic data from the traffic log; and determining whether an abnormality exists in the data traffic or the operation condition of the edge computing device according to the resource utilization estimation data and the second resource utilization data. Thereby achieving the technical effect of guaranteeing the safety of the network system.
Description
Technical Field
The present application relates to the field of network security technologies, and in particular, to a log auditing method, apparatus, and storage medium for an edge computing device.
Background
Log auditing is a process of recording and monitoring computer systems, applications, and network activity. These records are typically saved in log files for later analysis and inspection. Therefore, through log audit, abnormal phenomena existing in the network system can be timely found, early warning can be timely made, and serious loss caused by the abnormal phenomena of the network is avoided. There are a variety of types of logs, where weblogs record network traffic and connection information, which can be used to monitor intrusion and network activity. The resource utilization log records information related to equipment resources, such as CPU utilization rate, memory utilization, bandwidth utilization rate and storage utilization condition, and the log is helpful for knowing the equipment resource utilization condition and monitoring the equipment utilization abnormal condition.
Network slicing is a network virtualization technique that allows a physical network to be divided into multiple logical, independent network slices, each of which can be customized according to different needs and use cases. Network slicing may enable more flexible and efficient management of network resources, particularly in a multi-purpose network environment, such as a 5G network, where various applications and services need to share a network infrastructure. In reality, the processing of data of different network slices requires different computing resources, such as CPU utilization, memory occupation, bandwidth utilization, and use of storage space.
The combination of the current 5G network and the edge computing device provides more convenient distributed computing services for the public, and therefore, shows a rapid development trend. And the network slicing technology is widely applied to 5G networks. Based on this, if the traffic of the network slice and the calculation processing of the edge calculation device can be audited, the security of the network transmission and the edge calculation device can be ensured more effectively.
The publication number is CN116405287A, and the name is industrial control system network security assessment method, equipment and medium. The method comprises the following steps: performing security assessment modeling on the industrial control network system so as to establish a basic security assessment model comprising a protective layer; setting protection conditions corresponding to the protection layers based on the protection layers in the established basic security assessment model; acquiring an intrusion attack corresponding to an industrial control network system, thereby establishing an intrusion attack database; determining, based on the intrusion attack database, a protection outcome of the intrusion attack corresponding to the underlying security assessment model; and determining a probability value for successful protection of the industrial control network system based on the determined basic security assessment model, the protection conditions, and the protection outcomes.
Publication number CN115297098A, entitled edge service acquisition method and apparatus, edge computing system, medium, device. The method comprises the following steps: responding to service request information initiated by an application, and acquiring related information of an edge node; determining a target edge computing node based on the edge node related information, wherein the target edge computing node comprises second terminal equipment integrated with an edge computing unit; sending service request information to a source content distribution network and a target edge computing node to acquire service data; the data transmission between the first terminal device and the target edge computing node is based on the QUIC protocol.
Disclosure of Invention
The embodiment of the disclosure provides a log auditing method, a log auditing device and a log auditing storage medium for edge computing equipment, so that network slice traffic and computing processing of the edge computing equipment can be audited, and network transmission and edge computing equipment safety can be ensured more effectively.
According to one aspect of the disclosed embodiments, there is provided a log audit method for an edge computing device, comprising: receiving a flow log and a resource utilization log from the edge computing device, wherein the flow log is used for recording data flows of different network slices received by the edge computing device in real time, and the resource utilization log is used for recording the utilization condition of computing resources of the edge computing device in real time; constructing a resource utilization estimation model, wherein the resource utilization estimation model is used for estimating corresponding computing resources utilized by the edge computing equipment according to the data traffic of different network slices; extracting first traffic data from the traffic log and corresponding first resource utilization data from the resource utilization log, and determining parameters of a resource utilization estimation model according to the first traffic data and the first resource utilization data; extracting second traffic data of different network slices from the traffic log, and determining corresponding resource utilization estimation data of the edge computing equipment based on the second traffic data by utilizing a resource utilization estimation model; extracting second resource utilization data corresponding to the second traffic data from the traffic log; and determining whether an abnormality exists in the data traffic or the operation condition of the edge computing device according to the resource utilization estimation data and the second resource utilization data.
According to another aspect of the embodiments of the present disclosure, there is also provided a storage medium including a stored program, wherein the method described above is performed by a processor when the program is run.
According to another aspect of the embodiments of the present disclosure, there is also provided a log audit apparatus for an edge computing device, including: the system comprises a log receiving module, a log processing module and a resource utilization module, wherein the log receiving module is used for receiving a flow log and a resource utilization log from the edge computing equipment, the flow log is used for recording data flows of different network slices received by the edge computing equipment in real time, and the resource utilization log is used for recording the utilization condition of computing resources of the edge computing equipment in real time; the model construction module is used for constructing a resource utilization estimation model, wherein the resource utilization estimation model is used for estimating corresponding computing resources utilized by the edge computing equipment according to the data traffic of different network slices; the model parameter determining module is used for extracting first flow data from the flow log, extracting corresponding first resource utilization data from the resource utilization log and determining parameters of a resource utilization estimation model according to the first flow data and the first resource utilization data; the resource utilization estimation module is used for extracting second flow data of different network slices from the flow log and determining corresponding resource utilization estimation data of the edge computing equipment based on the second flow data by utilizing the resource utilization estimation model; the resource utilization data extraction module is used for extracting second resource utilization data corresponding to second flow data from the flow log; and an anomaly determination module for determining whether anomalies exist in the data traffic or the operation condition of the edge computing device according to the resource utilization estimation data and the second resource utilization data.
According to another aspect of the embodiments of the present disclosure, there is also provided a log audit apparatus for an edge computing device, including: a processor; and a memory, coupled to the processor, for providing instructions to the processor for processing the steps of: receiving a flow log and a resource utilization log from the edge computing device, wherein the flow log is used for recording data flows of different network slices received by the edge computing device in real time, and the resource utilization log is used for recording the utilization condition of computing resources of the edge computing device in real time; constructing a resource utilization estimation model, wherein the resource utilization estimation model is used for estimating corresponding computing resources utilized by the edge computing equipment according to the data traffic of different network slices; extracting first traffic data from the traffic log and corresponding first resource utilization data from the resource utilization log, and determining parameters of a resource utilization estimation model according to the first traffic data and the first resource utilization data; extracting second traffic data of different network slices from the traffic log, and determining corresponding resource utilization estimation data of the edge computing equipment based on the second traffic data by utilizing a resource utilization estimation model; extracting second resource utilization data corresponding to the second traffic data from the traffic log; and determining whether an abnormality exists in the data traffic or the operation condition of the edge computing device according to the resource utilization estimation data and the second resource utilization data.
Therefore, according to the embodiment, the log audit data platform can determine whether the edge computing device has the abnormality in terms of data traffic or operation conditions or not based on the traffic analysis corresponding to the network slice traffic data of the edge computing device and the resource analysis of the computing resources through the traffic log and the resource utilization log, so that the security of the network system is further ensured.
Drawings
The accompanying drawings, which are included to provide a further understanding of the disclosure, illustrate and explain the present disclosure, and together with the description serve to explain the present disclosure. In the drawings:
FIG. 1 is a block diagram of a hardware architecture of a computing device for implementing a method according to embodiment 1 of the present disclosure;
FIG. 2A is a schematic diagram of a log audit system for an edge computing device according to embodiment 1 of the present disclosure;
FIG. 2B is a transmission schematic diagram of a log audit system for an edge computing device according to embodiment 1 of the present disclosure;
FIG. 3 is a flow diagram of a log audit method for an edge computing device according to a first aspect of embodiment 1 of the present disclosure;
FIG. 4 is a schematic diagram of a log audit apparatus for an edge computing device according to embodiment 2 of the present disclosure; and
Fig. 5 is a schematic diagram of a log audit apparatus for an edge computing device according to embodiment 3 of the present disclosure.
Detailed Description
In order to better understand the technical solutions of the present disclosure, the following description will clearly and completely describe the technical solutions of the embodiments of the present disclosure with reference to the drawings in the embodiments of the present disclosure. It will be apparent that the described embodiments are merely embodiments of a portion, but not all, of the present disclosure. All other embodiments, which can be made by one of ordinary skill in the art without inventive effort, based on the embodiments in this disclosure, shall fall within the scope of the present disclosure.
It should be noted that the terms "first," "second," and the like in the description and claims of the present disclosure and in the foregoing figures are used for distinguishing between similar objects and not necessarily for describing a particular sequential or chronological order. It is to be understood that the data so used may be interchanged where appropriate such that the embodiments of the disclosure described herein may be capable of operation in sequences other than those illustrated or described herein. Furthermore, the terms "comprises," "comprising," and "having," and any variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, system, article, or apparatus that comprises a list of steps or elements is not necessarily limited to those steps or elements expressly listed but may include other steps or elements not expressly listed or inherent to such process, method, article, or apparatus.
Example 1
According to the present embodiment, there is provided a method embodiment of a log audit method for an edge computing device, it being noted that the steps illustrated in the flowchart of the figures may be performed in a computer system, such as a set of computer executable instructions, and that although a logical order is illustrated in the flowchart, in some cases the steps illustrated or described may be performed in an order other than that illustrated herein.
The method embodiments provided by the present embodiments may be performed in a server or similar computing device. FIG. 1 illustrates a block diagram of a hardware architecture of a computing device for implementing a log audit method for an edge computing device. As shown in fig. 1, the computing device may include one or more processors (which may include, but are not limited to, a microprocessor MCU, a processing device such as a programmable logic device FPGA), memory for storing data, transmission means for communication functions, and input/output interfaces. Wherein the memory, the transmission device and the input/output interface are connected with the processor through a bus. In addition, the method may further include: a display connected to the input/output interface, a keyboard, and a cursor control device. It will be appreciated by those of ordinary skill in the art that the configuration shown in fig. 1 is merely illustrative and is not intended to limit the configuration of the electronic device described above. For example, the computing device may also include more or fewer components than shown in FIG. 1, or have a different configuration than shown in FIG. 1.
It should be noted that the one or more processors and/or other data processing circuits described above may be referred to herein generally as "data processing circuits. The data processing circuit may be embodied in whole or in part in software, hardware, firmware, or any other combination. Furthermore, the data processing circuitry may be a single stand-alone processing module, or incorporated in whole or in part into any of the other elements in the computing device. As referred to in the embodiments of the present disclosure, the data processing circuit acts as a processor control (e.g., selection of the variable resistance termination path to interface with).
The memory may be used to store software programs and modules of application software, such as a program instruction/data storage device corresponding to a log audit method for an edge computing device in an embodiment of the disclosure, and the processor executes the software programs and modules stored in the memory, thereby executing various functional applications and data processing, that is, implementing the log audit method for an edge computing device of the application program. The memory may include high speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid state memory. In some examples, the memory may further include memory remotely located with respect to the processor, which may be connected to the computing device via a network. Examples of such networks include, but are not limited to, the internet, intranets, local area networks, mobile communication networks, and combinations thereof.
The transmission means is used for receiving or transmitting data via a network. Specific examples of the network described above may include a wireless network provided by a communications provider of the computing device. In one example, the transmission means comprises a network adapter (Network Interface Controller, NIC) connectable to other network devices via the base station to communicate with the internet. In one example, the transmission device may be a Radio Frequency (RF) module, which is used to communicate with the internet wirelessly.
The display may be, for example, a touch screen type Liquid Crystal Display (LCD) that may enable a user to interact with a user interface of the computing device.
It should be noted herein that in some alternative embodiments, the computing device shown in FIG. 1 described above may include hardware elements (including circuitry), software elements (including computer code stored on a computer-readable medium), or a combination of both hardware and software elements. It should be noted that fig. 1 is only one example of a particular specific example and is intended to illustrate the types of components that may be present in the computing devices described above.
The terminal device 100 may include, for example, a terminal device such as a mobile phone terminal or a car networking terminal, and communicates through 5G or the like. Fig. 2A is a schematic diagram of a log audit system for an edge computing device according to the present embodiment. Referring to fig. 2A, the system includes: a user terminal device 100; edge computing device 200; log audit data platform 300. Wherein the 5G communication network is in communication connection with the edge computing device 200. So that the edge computing device 200 can provide the edge computing service to the terminal device 100.
Fig. 2B is a transmission schematic diagram of a log audit system for an edge computing device according to an embodiment of the present disclosure. Referring further to fig. 2B, the terminal device 100 may send data with different demands on network transmission and computing resources to the edge computing device 200 through a plurality of network slices 1 to n. The edge calculation process is performed by the edge calculation device 200. The plurality of network slices may be, for example, 3 network slices, for example, a ul lc slice, an eMBB slice, and an emtc slice. Of course, more network slices can be set according to practical application, so that different network slices can meet different requirements of network transmission and computing resources.
The edge computing device 200 receives slice data transmitted by the terminal device 100 through the network slices 1 to n, and performs edge computing service on the slice data. The edge computing device 200 may collect network transmission data and resource utilization data of the computing device in real time, and generate corresponding log information and send the log information to the log audit data platform 300. Specifically, for example, the edge computing device 200 transmits a traffic log for monitoring traffic data and a resource utilization log for monitoring resource utilization of the edge computing device 200 to the log audit data platform 300. Thus, the log audit data platform 300 may perform audit processing on the received log information, thereby monitoring and pre-warning the traffic and device operation conditions of the edge computing device 200.
It should be noted that, the log audit data platform 300 in the system may be applicable to the above-described hardware structure.
In the above-described operating environment, according to a first aspect of the present embodiment, a log audit method for an edge computing device is provided, the method implemented by log audit data platform 300 in fig. 2A and 2B. Fig. 3 shows a schematic flow chart of the method, and referring to fig. 3, the method includes:
s302: receiving a flow log and a resource utilization log from the edge computing device, wherein the flow log is used for recording data flows of different network slices received by the edge computing device in real time, and the resource utilization log is used for recording the utilization condition of computing resources of the edge computing device in real time;
s304: constructing a resource utilization estimation model, wherein the resource utilization estimation model is used for estimating corresponding computing resources utilized by the edge computing equipment according to the data traffic of different network slices;
s306: extracting first traffic data from the traffic log and corresponding first resource utilization data from the resource utilization log, and determining parameters of a resource utilization estimation model according to the first traffic data and the first resource utilization data;
S308: extracting second traffic data of different network slices from the traffic log, and determining corresponding resource utilization estimation data of the edge computing equipment based on the second traffic data by utilizing a resource utilization estimation model;
s310: extracting second resource utilization data corresponding to the second traffic data from the traffic log; and
s312: and determining whether the data flow or the operation condition of the edge computing equipment is abnormal according to the resource utilization estimation data and the second resource utilization data.
Specifically, referring to fig. 2B, the edge computing device 200 receives data traffic from the terminal device 100 through different network slices 1 to n, so that the edge computing device 200 records data traffic information related to the received data traffic in real time and generates a corresponding traffic log. The traffic log may include, for example, information of each received packet:
wherein "timestamp" is used to indicate the time at which the data packet was received by the edge computing device 200; "network slice information" is used to indicate through which network slice the packet is transmitted; "header information" is used to indicate information related to the header of the data packet, wherein the edge computing device 200 can obtain information related to the data amount of the data packet from the header information; and "message information" for indicating information related to the message of the data packet.
Thus, the edge computing device 200 aggregates the above information of each data packet received, and transmits the aggregated traffic log to the log audit data platform 300 every predetermined period.
In addition, the edge computing device 200 also monitors in real time resource utilization information related to the utilization of computing resources, including, for example, m different-dimensional resource utilization meta-information D 1 ~D m Wherein for example D 1 May be the CPU utilization of the edge computing device 200; d (D) 2 May be the bandwidth occupancy of the edge computing device 200; d (D) 3 May be the memory occupancy of the edge computing device 200; and so on; d (D) m May be the memory footprint of the edge computing device 200. The resource utilization information may record m different-dimensional resource utilization meta-information D related to the computing resource utilization of the edge computing device 200 1 ~D m . Thus, the format of each piece of resource utilization information is as follows:
wherein "timestamp" is used to indicate the monitoring time at which the edge computing device 200 is monitoring; d (D) 1 ~D m For indicating resource utilization meta-information for different dimensions of the edge computing device 200 at the monitoring time.
Thus, the edge computing device 200 aggregates the monitored information, and transmits the aggregated resource utilization log to the log audit data platform 300 every predetermined period.
The log audit data platform 300 may thus receive traffic logs as well as resource utilization logs from the edge computing device 200 (S302).
Then, the log audit data platform 300 builds a resource utilization estimation model for estimating the corresponding computing resources utilized by the edge computing device from the data traffic of the different network slices (S304).
Specifically, log audit data platform 300 may construct, for example, a resource utilization estimation model as shown in the following equation:
wherein [ d ] 1,0 d 2,0 d 3,0 ... d m,0 ] T Are constant entries corresponding to the 1 st to m-th resource utilization meta information, respectively. [ d ] 1,1 d 2,1 d 3,1 ... d m,1 ] T Representing the computational resources utilized by the edge computing device 200 to process a unit data volume of a 1 st network slice, where d 1,1 ~d m,1 Corresponding to the 1 st to m-th resource utilization meta information, respectively. [ d ] 1,2 d 2,2 d 3,2 ... d m,2 ] T Representing the computational resources utilized by the edge computing device 200 to process a unit data volume of a 2 nd network slice, where d 1,2 ~d m,2 Corresponding to the 1 st to m-th resource utilization meta information, respectively. And so on, [ d ] 1,n d 2,n d 3,n ... d m,n ] T Representing the computational resources utilized by the edge computing device 200 to process a unit data volume of an nth network slice, where d 1,n ~d m,n Corresponding to the 1 st to m-th resource utilization meta information, respectively.
The unit data amount may be, for example, bytes, KB (kilobits), or KB (kilobytes), and may be determined according to a specific application. k (k) 1 ~k n Representing the amount of data received by the edge computing device 200 through the 1 st through nth network slices, respectively.The estimated values of the 1 st to m th resource utilization meta-information in the resource utilization information of the edge computing device 200 are respectively represented.
Wherein, formula (1) can be simplified expressed as:
wherein d 0 =[d 1,0 d 2,0 d 3,0 ... d m,0 ] T ；d 1 =[d 1,1 d 2,1 d 3,1 ... d m,1 ] T ；d 2 =[d 1,2 d 2,2 d 3,2 ... d m,2 ] T ；......；d n =[d 1,n d 2,n d 3,n ... d m,n ] T 。。
Wherein the parameter vector d 0 ~d n Can be determined by calculation in the steps described later, i.e. the parameter d i,j I=1 to m, j= 0~n can be determined by calculation in the steps described later. Variable k 1 ~k n The traffic data validation may be based on different network slices in the traffic log. So that the estimated value of the resource utilization information of the edge computing device 200 at the time of processing the corresponding data can be estimated from the flow data described in the flow log by the above-described formula (1) or formula (2)。
In actual practice, the inventors have noted that the computing resources utilized by the edge computing device 200 are determined by the total amount of traffic data transmitted by each network slice 1-n in the corresponding time slot. For example, the utilization D of the CPU utilized by the edge computing device 200 1 Is determined by the total amount of traffic data received at the respective times through each network slice 1-n. Edge of the sheet Bandwidth occupancy D of computing device 200 2 Also by the total amount of traffic data received at the respective time by each network slice 1-n. Similarly, other types of resource utilization meta-information are also determined by the total amount of traffic data received at the corresponding time by each network slice 1-n. However, the data transmitted through different network slices also varies in the utilization requirements of the computing resources of the edge computing device 200. Taking the 1 st slice network and the 2 nd slice network as examples, the CPU utilization rate d required for processing the unit flow data of the 1 st slice network 1,1 CPU utilization d required for processing unit traffic data of slice 2 network 1,2 Is different. Based on the above, therefore, the inventors constructed the resource utilization estimation models expressed by the formulas (1) and (2), and can accurately estimate the resource utilization of the edge computing device 200 from the traffic data received through the respective network slices.
Then, after constructing the resource utilization estimation model, the log audit data platform 300 extracts first traffic data from the obtained traffic log and corresponding first resource utilization data from the resource utilization log, and determines a parameter d of the resource utilization model from the first traffic data and the first resource utilization data 0 ~d n （S304）。
Specifically, for example, the log audit data platform 300 may extract the first traffic data and the first resource utilization data from the traffic log to construct a resource utilization estimation model for estimating the resource utilization of the edge computing device 200.
Specifically, for example, the log audit data platform 300 may extract traffic information for a plurality of time slots of a predetermined length (e.g., 1 minute) in a traffic log during a period in which the edge computing device 200 has been verified as operating properly, to make statistics, thereby obtaining first traffic data as described above, wherein the first traffic data may be represented by the following table 1:
TABLE 1
Then, the log audit data platform 300 extracts the first resource utilization data within the time slot corresponding to table 1 in the resource utilization log:
TABLE 2
Thus, log audit data platform 300 may determine the parameters in equation (1) using the data of tables 1 and 2.
Specifically, the formula (1) may be further modified into the following formula:
thus, the data in table 1 can be combined with the data corresponding to the 1 st-dimensional resource utilization meta information in table 2 to obtain a sample set as shown in table 3-1:
TABLE 3-1
The model of equation (1-1) may thus be trained (e.g., using gradient descent, not described further herein) using the sample set described in Table 3-1 to determine d 1,0 ~d 1,n Is a numerical value of (2).
Likewise, the data in Table 1 can thus be combined with the data corresponding to the 2 nd-dimensional resource utilization meta-information in Table 2 to obtain a sample set as shown in Table 3-2:
TABLE 3-2
The model of equation (1-2) may thus be trained (e.g., using gradient descent, not described further herein) using the sample set described in Table 3-2 to determine d 2,0 ~d 2,n Is a numerical value of (2).
And so on until the data in table 1 is combined with the data corresponding to the m-th dimension resource utilization meta information in table 2, a sample set as shown in table 3-m is obtained:
TABLE 3-m
Thus, the model of equation (1-m) can be trained (e.g., using gradient descent, not described further herein) using the sample set described in Table 3-m to determine d m,0 ~d m,n Is a numerical value of (2).
Thus, in the manner described above, the various parameters of the resource utilization estimation model may be determined from the first traffic data and the first resource utilization data collected during the period that the edge computing device 200 has been verified as normal.
Further, the log audit data platform 300 may then monitor the traffic and operational status of the edge computing device 200 based on the traffic log and the resource utilization log of the edge computing device 200 using the trained resource utilization assessment model.
Specifically, the log audit data platform 300 extracts second traffic data of a monitoring slot of a predetermined length (for example, 1 minute) corresponding to a monitoring time point within a monitoring period from the traffic log and the resource utilization log transmitted by the edge computing device 200 (S308). Specifically, the second flow data is shown in table 4 below:
TABLE 4 Table 4
Thus, the data in Table 4 can be used to monitor the flow data vector kw 1 ~kw L The way of (a) represents:
kw 1 =[kw 1,1 kw 2,1 ... kw n,1 ] T ；
kw 2 =[kw 1,2 kw 2,2 ... kw n,2 ] T ；
...
kw L =[kw 1,L kw 2,L ... kw n,L ] T
wherein, the time slot serial numbers 1-L in the table 4 are monitoring time slots corresponding to L monitoring time points in the monitoring period.
The log audit data platform 300 then determines corresponding resource utilization estimation data based on the second traffic data shown in table 4 using the resource utilization estimation model, as shown in table 5:
TABLE 5
Wherein the data in Table 5 may be used as a resource utilization estimate vector De 1 ~De L The way of (a) represents:
De 1 =[De 1,1 De 1,2 De 1,3 ... De 1,m ] T ；
De 2 =[De 2,1 De 2,2 De 2,3 ... De 2,m ] T ；
...
De L =[De L,1 De L,2 De L,3 ... De L,m ] T 。
and wherein the resource utilization estimation vector De 1 Is to monitor the flow data vector kw 1 Inputting the estimated value obtained by calculation of the resource utilization estimation model; resource utilization estimation vector De 2 Is to monitor the flow data vector kw 2 Inputting the estimated value obtained by calculation of the resource utilization estimation model; and so on; resource utilization estimation vector De L Is to monitor the flow data vector kw L And inputting the estimated value obtained by calculation of the resource utilization estimation model.
The log audit data platform 300 then extracts second resource utilization data corresponding to the monitoring time slots in table 4 in the resource utilization log (S310), wherein the second resource utilization data may be represented by table 6 below:
TABLE 6
Wherein the second resource utilization data shown in Table 6 may be in the resource utilization monitor vector Dw 1 ~Dw L The way of (a) represents:
Dw 1 =[Dw 1,1 Dw 1,2 Dw 1,3 ... Dw 1,m ] T ；
Dw 2 =[Dw 2,1 Dw 2,2 Dw 2,3 ... Dw 2,m ] T ；
...
Dw L =[Dw L,1 Dw L,2 Dw L,3 ... Dw L,m ] T 。
then, the log audit data platform 300 estimates a vector De according to the resource utilization 1 ~De L And a resource utilization monitor vector Dw 1 ~Dw L It is determined whether there is an abnormality in the data traffic or the operation condition of the edge computing device 200 (S312).
Specifically, for each monitoring time slot 1-l, the log audit data platform 300 may estimate the vector De according to the corresponding resource utilization k And resource utilization monitor vector Dw k (k=1 to l). The method comprises the following steps:
first, for each monitoring time slot 1-L, the log audit data platform 300 calculates a corresponding resource utilization estimation vector De according to the following formula k And resource utilization monitor vector Dw k Distance between:
then, the log audit data platform 300 uses the following formulas (4) and (5) according to the calculated distance L k Determining the probability P that an abnormality exists in the data traffic or the operation condition of the edge computing device 200 at the monitoring time slot k k ：
Thus, the anomaly determination probability P that the anomaly exists in the data flow or the operation condition of the edge computing device 200 can be determined by the formulas (4) and (5) k 。
Thus when P k If the data traffic or the operation condition of the edge computing device 200 is greater than the preset threshold (for example, 50%), determining that an abnormality exists in the data traffic or the operation condition of the edge computing device 200 in the monitoring time slot k; otherwise, it is determined that there is no abnormality in the data traffic or the operation condition of the edge computing device 200 in the monitoring slot k. Of course, the threshold may be set lower (e.g., 40%) for safety.
Furthermore, the log audit data platform 300 can determine the anomaly determination probability sequence P for the monitoring time slots 1-L 1 ~P L . As shown in table 7 below:
TABLE 7
Therefore, the log censoring data platform 300 can determine which monitoring time slots have anomalies in terms of data traffic or operation conditions in a series of monitoring time slots 1-l of the monitoring period, so as to facilitate statistics of anomalies of the edge computing device 200. In particular, log review data platform 300 may issue pre-warning information for further inspection of the edge computing device 200 when an anomaly occurs in a consecutive plurality of monitoring slots greater than a predetermined threshold.
Thus, in this way, the log audit data platform can determine whether the edge computing device has an anomaly in data traffic or operational condition based on traffic analysis corresponding to network slice traffic data of the edge computing device and computing resource analysis through the traffic log and the resource utilization log.
Further, referring to fig. 1, according to a second aspect of the present embodiment, there is provided a storage medium. The storage medium includes a stored program, wherein the method of any of the above is performed by a processor when the program is run.
Therefore, according to the embodiment, the log audit data platform can determine whether the edge computing device has abnormality in terms of data traffic or operation conditions or not based on traffic analysis and computing resource analysis corresponding to the network slice traffic data of the edge computing device through the traffic log and the resource utilization log, so that the security of the network system is further ensured.
It should be noted that, for simplicity of description, the foregoing method embodiments are all described as a series of acts, but it should be understood by those skilled in the art that the present invention is not limited by the order of acts described, as some steps may be performed in other orders or concurrently in accordance with the present invention. Further, those skilled in the art will also appreciate that the embodiments described in the specification are all preferred embodiments, and that the acts and modules referred to are not necessarily required for the present invention.
From the description of the above embodiments, it will be clear to a person skilled in the art that the method according to the above embodiments may be implemented by means of software plus the necessary general hardware platform, but of course also by means of hardware, but in many cases the former is a preferred embodiment. Based on such understanding, the technical solution of the present invention may be embodied essentially or in a part contributing to the prior art in the form of a software product stored in a storage medium (e.g. ROM/RAM, magnetic disk, optical disk) comprising instructions for causing a terminal device (which may be a mobile phone, a computer, a server, or a network device, etc.) to perform the method according to the embodiments of the present invention.
Example 2
Fig. 4 shows a log auditing apparatus 400 for an edge computing device according to this embodiment, the apparatus 400 corresponding to the method according to the first aspect of embodiment 1. Referring to fig. 4, the apparatus 400 includes: a log receiving module 410, configured to receive, from an edge computing device, a traffic log and a resource utilization log, where the traffic log is used to record, in real time, data traffic of different network slices received by the edge computing device, and the resource utilization log is used to record, in real time, a utilization condition of computing resources of the edge computing device; a model construction module 420, configured to construct a resource utilization estimation model, where the resource utilization estimation model is configured to estimate corresponding computing resources utilized by the edge computing device according to data traffic of different network slices; a model parameter determination module 430 for extracting first traffic data from the traffic log and corresponding first resource utilization data from the resource utilization log, and determining parameters of the resource utilization estimation model from the first traffic data and the first resource utilization data; a resource utilization estimation module 440, configured to extract second traffic data of different network slices from the traffic log, and determine resource utilization estimation data corresponding to the edge computing device based on the second traffic data by using a resource utilization estimation model; a resource utilization extraction module 450, configured to extract second resource utilization data corresponding to the second traffic data from the traffic log; and an anomaly determination module 460 for determining whether an anomaly exists in the data traffic or the operation condition of the edge computing device according to the resource utilization estimation data and the second resource utilization data.
Optionally, the model construction module 420 includes a model construction unit for constructing a resource utilization estimation model shown in the following formula (1):
wherein [ d ] 1,0 d 2,0 d 3,0 ... d m,0 ] T Constant items corresponding to the 1 st to m th resource utilization meta information, respectively; [ d ] 1,1 d 2,1 d 3,1 ... d m,1 ] T Representing the computational resources utilized by the edge computing device to process a unit data volume of a 1 st network slice, where d 1,1 ~d m,1 Respectively corresponding to the 1 st to m th resource utilization meta information; [ d ] 1,2 d 2,2 d 3,2 ... d m,2 ] T Representing the computational resources utilized by the edge computing device to process a unit data volume of a 2 nd network slice, where d 1,2 ~d m,2 Respectively corresponding to the 1 st to m th resource utilization meta information; and so on, [ d ] 1,n d 2,n d 3,n ... d m,n ] T Representing a computing resource utilized by the edge computing device to process a unit data amount of an nth network slice, where d 1,n ~d m,n Respectively corresponding to the 1 st to m th resource utilization meta information; k (k) 1 ~k n Respectively representing the data quantity received by the edge computing device through the 1 st network slice to the n-th network slice; andand respectively representing 1 st to m th resource utilization meta information in the resource utilization information of the edge computing equipment.
Optionally, the model parameter determination module 430 includes: a first traffic extraction unit, configured to extract traffic information related to a network slice in a first time slot of a plurality of predetermined lengths from a traffic log in a period in which the edge computing device has been verified as operating normally, and perform statistics, so as to determine first traffic data; and a first resource utilization data extraction unit configured to extract, in the resource utilization log, first resource utilization data corresponding to the first slot, wherein the first resource utilization data respectively includes resource utilization data corresponding to the 1 st to m-th resource utilization meta information.
Optionally, the model parameter determination module 430 includes: a parameter determination unit for substituting the first flow data and the first resource utilization data into the resource utilization estimation model shown in the formula (1) to determine a parameter d i,j Wherein i=1 to m, j= 0~n.
Optionally, the resource utilization estimation module 440 includes: and the second flow data extraction unit is used for extracting second flow data of the monitoring time slots corresponding to a plurality of monitoring time points in the monitoring period from the flow logs and the resource utilization logs sent by the edge computing equipment. And resource utilization estimation module 440, further comprising: and a resource utilization estimation unit configured to determine, for each monitoring slot, a resource utilization estimation vector corresponding to each monitoring slot based on the second traffic data using a resource utilization estimation model.
Optionally, the resource utilization extraction module 450 includes: and the second resource utilization data extraction unit is used for extracting the resource utilization monitoring vector corresponding to each monitoring time slot from the traffic log as second resource utilization data for each monitoring time slot.
Optionally, the anomaly determination module 460 includes: a distance determining unit, configured to calculate, for each monitoring slot, a distance between a corresponding resource utilization estimation vector and a corresponding resource utilization monitoring vector; the probability determining unit is used for determining the abnormality judgment probability of abnormality of the data flow or the operation condition of the edge computing equipment in each monitoring time slot according to the distance; and an abnormality determination unit configured to determine whether or not there is an abnormality in the data flow or the operation condition of the edge computing device based on the abnormality determination probability.
Therefore, according to the embodiment, the log audit data platform can determine whether the edge computing device has abnormality in terms of data traffic or operation conditions or not based on traffic analysis and computing resource analysis corresponding to the network slice traffic data of the edge computing device through the traffic log and the resource utilization log, so that the security of the network system is further ensured.
Example 3
Fig. 5 shows a log auditing apparatus 500 for an edge computing device according to the present embodiment, the apparatus 500 corresponding to the method according to the first aspect of embodiment 1. Referring to fig. 5, the apparatus 500 includes: a processor 510; and a memory 520 coupled to the processor 510 for storing one or more programs that, when executed by the processor 510, cause the processor 510 to perform the steps of: receiving a flow log and a resource utilization log from the edge computing device, wherein the flow log is used for recording data flows of different network slices received by the edge computing device in real time, and the resource utilization log is used for recording the utilization condition of computing resources of the edge computing device in real time; constructing a resource utilization estimation model, wherein the resource utilization estimation model is used for estimating corresponding computing resources utilized by the edge computing equipment according to the data traffic of different network slices; extracting first traffic data from the traffic log and corresponding first resource utilization data from the resource utilization log, and determining parameters of a resource utilization estimation model according to the first traffic data and the first resource utilization data; extracting second traffic data of different network slices from the traffic log, and determining corresponding resource utilization estimation data of the edge computing equipment based on the second traffic data by utilizing a resource utilization estimation model; extracting second resource utilization data corresponding to the second traffic data from the traffic log; and determining whether an abnormality exists in the data traffic or the operation condition of the edge computing device according to the resource utilization estimation data and the second resource utilization data.
Optionally, the operation of constructing the resource utilization estimation model includes constructing the resource utilization estimation model shown in the following formula (1):
wherein [ d ] 1,0 d 2,0 d 3,0 ... d m,0 ] T Constant items corresponding to the 1 st to m th resource utilization meta information, respectively; [ d ] 1,1 d 2,1 d 3,1 ... d m,1 ] T Representing the computational resources utilized by the edge computing device to process a unit data volume of a 1 st network slice, where d 1,1 ~d m,1 Respectively corresponding to the 1 st to m th resource utilization meta information; [ d ] 1,2 d 2,2 d 3,2 ... d m,2 ] T Representing the computational resources utilized by the edge computing device to process a unit data volume of a 2 nd network slice, where d 1,2 ~d m,2 Respectively corresponding to the 1 st to m th resource utilization meta information; and so on, [ d ] 1,n d 2,n d 3,n ... d m,n ] T Representing a computing resource utilized by the edge computing device to process a unit data amount of an nth network slice, where d 1,n ~d m,n Respectively corresponding to the 1 st to m th resource utilization meta information; k (k) 1 ~k n Respectively representing the data quantity received by the edge computing device through the 1 st network slice to the n-th network slice; andand respectively representing 1 st to m th resource utilization meta information in the resource utilization information of the edge computing equipment.
Optionally, the operation of extracting the first traffic data from the traffic log and extracting the corresponding first resource utilization data from the resource utilization log includes: extracting flow information related to the network slice in a first time slot of a plurality of preset time lengths from a flow log in a period of time when the edge computing equipment is verified to work normally, and counting, so as to determine first flow data; and extracting first resource utilization data corresponding to the first time slot from the resource utilization log, wherein the first resource utilization data respectively comprises resource utilization data corresponding to the 1 st to m th resource utilization meta information.
Optionally, determining parameters of the resource utilization estimation model from the first traffic data and the first resource utilization data comprises: substituting the first flow data and the first resource utilization data into a resource utilization estimation model shown in formula (1) to determine a parameter d i,j Wherein i=1 to m, j= 0~n.
Optionally, the operation of extracting second traffic data of different network slices from the traffic log includes: the operations of extracting second traffic data of monitoring time slots corresponding to a plurality of monitoring time points in a monitoring period from traffic logs and resource utilization logs sent by the edge computing device, and determining corresponding resource utilization estimation data of the edge computing device based on the second traffic data by utilizing a resource utilization estimation model include: for each monitoring slot, a resource utilization estimation vector corresponding to each monitoring slot is determined based on the second traffic data using a resource utilization estimation model.
Optionally, the operation of extracting second resource utilization data corresponding to the second traffic data from the traffic log includes: and extracting the resource utilization monitoring vector corresponding to each monitoring time slot from the flow log as second resource utilization data aiming at each monitoring time slot.
Optionally, determining whether there is an abnormality in the data traffic or the operation condition of the edge computing device according to the resource utilization estimation data and the second resource utilization data includes: for each monitoring time slot, calculating the distance between the corresponding resource utilization estimation vector and the corresponding resource utilization monitoring vector; determining the abnormality judgment probability of abnormality of the data flow or the running condition of the edge computing equipment in each monitoring time slot according to the distance; and determining whether an anomaly exists in the data traffic or the operation condition of the edge computing device based on the anomaly determination probability.
Therefore, according to the embodiment, the log audit data platform can determine whether the edge computing device has abnormality in terms of data traffic or operation conditions or not based on traffic analysis and computing resource analysis corresponding to the network slice traffic data of the edge computing device through the traffic log and the resource utilization log, so that the security of the network system is further ensured.
The foregoing embodiment numbers of the present invention are merely for the purpose of description, and do not represent the advantages or disadvantages of the embodiments.
In the foregoing embodiments of the present invention, the descriptions of the embodiments are emphasized, and for a portion of this disclosure that is not described in detail in this embodiment, reference is made to the related descriptions of other embodiments.
In the several embodiments provided in the present application, it should be understood that the disclosed technology may be implemented in other manners. The above-described embodiments of the apparatus are merely exemplary, and the division of the units, such as the division of the units, is merely a logical function division, and may be implemented in another manner, for example, multiple units or components may be combined or may be integrated into another system, or some features may be omitted, or not performed. Alternatively, the coupling or direct coupling or communication connection shown or discussed with each other may be through some interfaces, units or modules, or may be in electrical or other forms.
The units described as separate units may or may not be physically separate, and units shown as units may or may not be physical units, may be located in one place, or may be distributed on a plurality of network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.
In addition, each functional unit in the embodiments of the present application may be integrated in one processing unit, or each unit may exist alone physically, or two or more units may be integrated in one unit. The integrated units may be implemented in hardware or in software functional units.
The integrated units, if implemented in the form of software functional units and sold or used as stand-alone products, may be stored in a computer readable storage medium. Based on such understanding, the technical solution of the present invention may be embodied essentially or in part or all of the technical solution or in part in the form of a software product stored in a storage medium, including instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method according to the embodiments of the present invention. And the aforementioned storage medium includes: a U-disk, a Read-Only Memory (ROM), a random access Memory (RAM, random Access Memory), a removable hard disk, a magnetic disk, or an optical disk, or other various media capable of storing program codes.
The foregoing is merely a preferred embodiment of the present invention and it should be noted that modifications and adaptations to those skilled in the art may be made without departing from the principles of the present invention, which are intended to be comprehended within the scope of the present invention.
Claims (10)
1. A log audit method for an edge computing device, comprising:
receiving a traffic log and a resource utilization log from an edge computing device, wherein the traffic log is used for recording data traffic of different network slices received by the edge computing device in real time, and the resource utilization log is used for recording the utilization condition of computing resources of the edge computing device in real time;
constructing a resource utilization estimation model, wherein the resource utilization estimation model is used for estimating corresponding computing resources utilized by the edge computing equipment according to the data traffic of the different network slices;
extracting first traffic data from the traffic log and corresponding first resource utilization data from the resource utilization log, and determining parameters of the resource utilization estimation model according to the first traffic data and the first resource utilization data;
extracting second traffic data of the different network slices from the traffic log, and determining corresponding resource utilization estimation data of the edge computing device based on the second traffic data by utilizing the resource utilization estimation model;
extracting second resource utilization data corresponding to the second flow data from the flow log; and
And determining whether the data flow or the operation condition of the edge computing equipment is abnormal according to the resource utilization estimation data and the second resource utilization data.
2. The method of claim 1, wherein the operation of constructing a resource utilization estimation model comprises constructing a resource utilization estimation model represented by the following formula (1):
（1）
wherein [ d ] 1,0 d 2,0 d 3,0 ... d m,0 ] T Constant items corresponding to the 1 st to m th resource utilization meta information, respectively;
[d 1,1 d 2,1 d 3,1 ... d m,1 ] T representing the computational resources utilized by the edge computing device to process a unit data volume of a 1 st network slice, where d 1,1 ~d m,1 Respectively with the 1 st to m th resource utilization elementsThe information corresponds;
[d 1,2 d 2,2 d 3,2 ... d m,2 ] T representing the computational resources utilized by the edge computing device to process a unit data amount of a 2 nd network slice, where d 1,2 ~d m,2 Respectively corresponding to the 1 st to m th resource utilization meta information;
and so on, [ d ] 1,n d 2,n d 3,n ... d m,n ] T Representing a computing resource utilized by the edge computing device to process a unit data amount of an nth network slice, wherein d 1,n ~d m,n Respectively corresponding to the 1 st to m th resource utilization meta information;
k 1 ~k n respectively representing the data quantity received by the edge computing device through the 1 st network slice to the n-th network slice; and
and respectively representing 1 st to m th resource utilization meta information in the resource utilization information of the edge computing equipment.
3. The method of claim 2, wherein extracting first traffic data from the traffic log and extracting corresponding first resource utilization data from a resource utilization log comprises:
extracting traffic information related to the network slice in a first time slot of a plurality of preset time lengths from traffic logs in a period of time when the edge computing equipment is verified to work normally, and counting, so as to determine first traffic data; and
and extracting first resource utilization data corresponding to the first time slot from the resource utilization log, wherein the first resource utilization data respectively comprises resource utilization data corresponding to 1 st to m th resource utilization meta information.
4. A method according to claim 3, wherein determining parameters of the resource utilization estimation model from the first traffic data and the first resource utilization data comprises:
substituting the first flow data and the first resource utilization data into a resource utilization estimation model shown in the formula (1) to determine a parameter d i,j Wherein i=1 to m, j= 0~n.
5. The method of claim 4, wherein extracting second traffic data for the different network slice from the traffic log comprises: extracting second traffic data of monitoring time slots corresponding to a plurality of monitoring time points in a monitoring period from traffic logs and resource utilization logs transmitted by the edge computing device, and
An operation of determining, using the resource utilization estimation model, corresponding resource utilization estimation data for the edge computing device based on the second traffic data, comprising: and determining a resource utilization estimation vector corresponding to each monitoring time slot based on the second flow data by utilizing the resource utilization estimation model for each monitoring time slot.
6. The method of claim 5, wherein extracting second resource utilization data corresponding to the second traffic data from the traffic log comprises: and extracting resource utilization monitoring vectors corresponding to the monitoring time slots from the flow logs as the second resource utilization data aiming at the monitoring time slots.
7. The method of claim 6, wherein determining whether an anomaly exists in data traffic or operation of the edge computing device based on the resource utilization estimation data and the second resource utilization data comprises:
for each monitoring time slot, calculating the distance between the corresponding resource utilization estimation vector and the corresponding resource utilization monitoring vector;
determining an abnormality determination probability of abnormality of data flow or operation condition of the edge computing device in each monitoring time slot according to the distance; and
And determining whether an abnormality exists in the data flow or the operation condition of the edge computing equipment based on the abnormality judgment probability.
8. A storage medium storing a computer program, wherein the program when executed by a processor implements the method of any one of claims 1 to 7.
9. A log auditing apparatus for an edge computing device, comprising:
the system comprises a log receiving module, a log sending module and a log receiving module, wherein the log receiving module is used for receiving a flow log and a resource utilization log from an edge computing device, the flow log is used for recording data flows of different network slices received by the edge computing device in real time, and the resource utilization log is used for recording the utilization condition of computing resources of the edge computing device in real time;
a model construction module for constructing a resource utilization estimation model, wherein the resource utilization estimation model is used for estimating corresponding computing resources utilized by the edge computing device according to the data traffic of the different network slices;
a model parameter determining module, configured to extract first traffic data from the traffic log and corresponding first resource utilization data from the resource utilization log, and determine parameters of the resource utilization estimation model according to the first traffic data and the first resource utilization data;
A resource utilization estimation module, configured to extract second traffic data of the different network slices from the traffic log, and determine, based on the second traffic data, resource utilization estimation data corresponding to the edge computing device using the resource utilization estimation model;
a resource utilization extraction module, configured to extract second resource utilization data corresponding to the second traffic data from the traffic log; and
and the abnormality determination module is used for determining whether the data flow or the running condition of the edge computing equipment is abnormal according to the resource utilization estimation data and the second resource utilization data.
10. A log auditing apparatus for an edge computing device, comprising:
a processor; and
and a memory, coupled to the processor, for storing one or more programs that, when executed by the processor, cause the processor to perform the steps of:
receiving a traffic log and a resource utilization log from an edge computing device, wherein the traffic log is used for recording data traffic of different network slices received by the edge computing device in real time, and the resource utilization log is used for recording the utilization condition of computing resources of the edge computing device in real time;
Constructing a resource utilization estimation model, wherein the resource utilization estimation model is used for estimating corresponding computing resources utilized by the edge computing equipment according to the data traffic of the different network slices;
extracting first traffic data from the traffic log and corresponding first resource utilization data from the resource utilization log, and determining parameters of the resource utilization estimation model according to the first traffic data and the first resource utilization data;
extracting second traffic data of the different network slices from the traffic log, and determining corresponding resource utilization estimation data of the edge computing device based on the second traffic data by utilizing the resource utilization estimation model;
extracting second resource utilization data corresponding to the second flow data from the flow log; and
and determining whether the data flow or the operation condition of the edge computing equipment is abnormal according to the resource utilization estimation data and the second resource utilization data.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202311493999.3A CN117240755B (en) | 2023-11-10 | 2023-11-10 | Log auditing method, device and storage medium for edge computing equipment |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202311493999.3A CN117240755B (en) | 2023-11-10 | 2023-11-10 | Log auditing method, device and storage medium for edge computing equipment |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN117240755A true CN117240755A (en) | 2023-12-15 |
| CN117240755B CN117240755B (en) | 2024-02-06 |
Family
ID=89098582
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202311493999.3A Active CN117240755B (en) | 2023-11-10 | 2023-11-10 | Log auditing method, device and storage medium for edge computing equipment |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN117240755B (en) |
Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111866953A (en) * | 2019-04-26 | 2020-10-30 | 中国移动通信有限公司研究院 | Network resource allocation method, device and storage medium |
| CN114679378A (en) * | 2022-04-21 | 2022-06-28 | 青岛海尔科技有限公司 | Log monitoring and analyzing method and system, storage medium and electronic device |
| CN115297098A (en) * | 2022-08-04 | 2022-11-04 | 北京沃东天骏信息技术有限公司 | Edge service acquisition method and device, edge computing system, medium and equipment |
| WO2023283102A1 (en) * | 2021-07-08 | 2023-01-12 | Intel Corporation | Radio resource planning and slice-aware scheduling for intelligent radio access network slicing |
| WO2023104085A1 (en) * | 2021-12-10 | 2023-06-15 | 中兴通讯股份有限公司 | Resource adjustment method, communication node, communication apparatus, communication system and server |
| CN116502162A (en) * | 2023-04-11 | 2023-07-28 | 河北工程大学 | Abnormal computing power federal detection method, system and medium in edge computing power network |
-
2023
- 2023-11-10 CN CN202311493999.3A patent/CN117240755B/en active Active
Patent Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111866953A (en) * | 2019-04-26 | 2020-10-30 | 中国移动通信有限公司研究院 | Network resource allocation method, device and storage medium |
| WO2023283102A1 (en) * | 2021-07-08 | 2023-01-12 | Intel Corporation | Radio resource planning and slice-aware scheduling for intelligent radio access network slicing |
| WO2023104085A1 (en) * | 2021-12-10 | 2023-06-15 | 中兴通讯股份有限公司 | Resource adjustment method, communication node, communication apparatus, communication system and server |
| CN114679378A (en) * | 2022-04-21 | 2022-06-28 | 青岛海尔科技有限公司 | Log monitoring and analyzing method and system, storage medium and electronic device |
| CN115297098A (en) * | 2022-08-04 | 2022-11-04 | 北京沃东天骏信息技术有限公司 | Edge service acquisition method and device, edge computing system, medium and equipment |
| CN116502162A (en) * | 2023-04-11 | 2023-07-28 | 河北工程大学 | Abnormal computing power federal detection method, system and medium in edge computing power network |
Also Published As
| Publication number | Publication date |
|---|---|
| CN117240755B (en) | 2024-02-06 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US6973415B1 (en) | System and method for monitoring and modeling system performance | |
| EP3537658A1 (en) | Network detection method and apparatus | |
| JP6355683B2 (en) | Risk early warning method, apparatus, storage medium, and computer program | |
| WO2003081556A1 (en) | Methods and apparatus for handling information regarding an alarm for a communication network | |
| CN103309790A (en) | Method and device for monitoring mobile terminal | |
| CN109672582A (en) | Complete trails monitoring method, equipment, storage medium and device | |
| CN105072139B (en) | Recommend method and apparatus | |
| US8599684B1 (en) | Congestion estimation | |
| CN111162950A (en) | Fault event processing method, device and system | |
| CN111585837B (en) | Internet of things data link monitoring method and device, computer equipment and storage medium | |
| CN105187554A (en) | Method and system for monitoring server performance | |
| CN108306749A (en) | A kind of monitoring system alarming method, monitoring system and monitoring device | |
| WO2017023266A1 (en) | Application centric network experience monitoring | |
| CN105490835B (en) | Information monitoring method and device | |
| CN117240755B (en) | Log auditing method, device and storage medium for edge computing equipment | |
| CN112565062A (en) | Processing method, related device, equipment and medium of instant messaging order | |
| CN110460487B (en) | Service node monitoring method and system and service node | |
| CN107395450B (en) | Using the monitoring method and device, storage medium, electronic device for logging in situation | |
| CN110069382A (en) | Software supervision method, server, terminal device, computer equipment and medium | |
| CN110275815A (en) | A kind of system exception alert processing method and device | |
| CN116016150A (en) | Early warning method and device for physical network, electronic equipment and storage medium | |
| CN108345650A (en) | Electronic invoice business monitors method for early warning and system in real time | |
| CN114416420A (en) | Equipment problem feedback method and system | |
| CN106664217A (en) | Identification of candidate problem network entities | |
| CN113676347B (en) | Load prediction method and device of server, storage medium and electronic device |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |