CN117527520A - Method and system for detecting abnormal operation of access equipment of dispatching switching network - Google Patents
Method and system for detecting abnormal operation of access equipment of dispatching switching network Download PDFInfo
- Publication number
- CN117527520A CN117527520A CN202311494303.9A CN202311494303A CN117527520A CN 117527520 A CN117527520 A CN 117527520A CN 202311494303 A CN202311494303 A CN 202311494303A CN 117527520 A CN117527520 A CN 117527520A
- Authority
- CN
- China
- Prior art keywords
- data
- switching network
- abnormal operation
- statistic
- increment
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
- 230000002159 abnormal effect Effects 0.000 title claims abstract description 71
- 238000000034 method Methods 0.000 title claims abstract description 49
- 230000004927 fusion Effects 0.000 claims abstract description 25
- 238000004364 calculation method Methods 0.000 claims abstract description 22
- 238000001514 detection method Methods 0.000 claims description 21
- 238000004590 computer program Methods 0.000 claims description 14
- 230000008569 process Effects 0.000 claims description 13
- 238000012545 processing Methods 0.000 claims description 13
- 238000010606 normalization Methods 0.000 claims description 6
- 238000000605 extraction Methods 0.000 claims description 4
- 238000012098 association analyses Methods 0.000 claims description 3
- 238000004891 communication Methods 0.000 abstract description 5
- 238000010586 diagram Methods 0.000 description 11
- 230000006870 function Effects 0.000 description 11
- 238000004422 calculation algorithm Methods 0.000 description 6
- 238000007418 data mining Methods 0.000 description 5
- 230000000007 visual effect Effects 0.000 description 5
- 230000005856 abnormality Effects 0.000 description 3
- 238000004519 manufacturing process Methods 0.000 description 3
- 238000005065 mining Methods 0.000 description 2
- 238000012986 modification Methods 0.000 description 2
- 230000004048 modification Effects 0.000 description 2
- 230000003287 optical effect Effects 0.000 description 2
- 238000012360 testing method Methods 0.000 description 2
- 230000004931 aggregating effect Effects 0.000 description 1
- 238000004458 analytical method Methods 0.000 description 1
- 230000009286 beneficial effect Effects 0.000 description 1
- 230000000694 effects Effects 0.000 description 1
- 230000006872 improvement Effects 0.000 description 1
- 230000003993 interaction Effects 0.000 description 1
- 238000005259 measurement Methods 0.000 description 1
- 238000013138 pruning Methods 0.000 description 1
- 238000012216 screening Methods 0.000 description 1
- 238000011179 visual inspection Methods 0.000 description 1
- 238000012800 visualization Methods 0.000 description 1
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/06—Management of faults, events, alarms or notifications
- H04L41/0631—Management of faults, events, alarms or notifications using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/22—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks comprising specially adapted graphical user interfaces [GUI]
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Human Computer Interaction (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
The invention relates to the field of power communication and provides a method and a system for detecting abnormal operation of access equipment of a dispatching switching network. The method comprises the steps of obtaining inbound traffic data and outbound traffic data of the access equipment; fusing inbound traffic data and outbound traffic data to obtain fused data; based on the fusion data, calculating an increment sample value of the fusion data by adopting an increment calculation method, calculating statistic of an increment sample according to the increment sample value, and obtaining a current sample statistic value as characteristic information according to the statistic of a historical sample and the statistic of the increment sample; based on the characteristic information, judging whether the access equipment is abnormal or not, and displaying an abnormal result in a recursion chart.
Description
Technical Field
The invention relates to the field of power communication, in particular to a method and a system for detecting abnormal operation of access equipment of a dispatching switching network.
Background
The statements in this section merely provide background information related to the present disclosure and may not necessarily constitute prior art.
The power dispatching switching network is a special network commanded by a power dispatching telephone. The network is an important communication means for ensuring the safe production operation of the power grid, and needs to have high reliability and quick connection capability. In general, the power dispatching switching network is divided into three stages, wherein the first stage faces to each province, each local dispatching center, each large power plant and each large hub substation; the secondary is oriented to a small transformer substation and a secondary power station; three stages are mainly oriented to regional bureau networks. In recent years, with the increasing number of access devices, hijacked access devices are easy to appear, so that illegal attacks are initiated on the exchange network, and serious network security risks are caused.
The existing common access equipment abnormal operation detection method mainly relies on a two-stage clustering method to identify abnormal operation states, but is poor in treatment effect on a large amount of data, and cannot meet the daily production requirements in terms of accuracy and efficiency.
Disclosure of Invention
In order to solve the technical problems in the background art, the invention provides a method and a system for detecting abnormal operation of access equipment of a dispatching switching network, which acquire flow data of the access equipment by using a network tool Scapy and normalize and fuse the acquired data; extracting data characteristic information through a time sliding window and an increment calculation mode; and taking a clustering algorithm and related rules in data mining as cores to obtain an accurate abnormal detection result. Finally, based on a recursive graph structure, the detection result is visualized, and the detection accuracy and efficiency are improved.
In order to achieve the above purpose, the present invention adopts the following technical scheme:
the first aspect of the invention provides a method for detecting abnormal operation of access equipment of a dispatching switching network.
A method for detecting abnormal operation of a dispatch switching network access device includes:
acquiring inbound traffic data and outbound traffic data of an access device;
fusing inbound traffic data and outbound traffic data to obtain fused data;
based on the fusion data, calculating an increment sample value of the fusion data by adopting an increment calculation method, calculating statistic of an increment sample according to the increment sample value, and obtaining a current sample statistic value as characteristic information according to the statistic of a historical sample and the statistic of the increment sample;
based on the characteristic information, judging whether the access equipment is abnormal or not, and displaying an abnormal result in a recursion chart.
Further, before the fusing, the method further comprises: and carrying out normalization processing on the inbound flow data and the outbound flow data, calculating cosine similarity between different data structures based on normalization processing results, and selecting data with the cosine similarity larger than a set first threshold value for fusion to obtain fusion data.
Further, before the process of adopting the incremental calculation method, the method further comprises: based on the fusion data, a sliding window with fixed time is defined, and flow data is captured in real time, so that the real-time running state of the access equipment of the dispatching switching network is obtained.
Further, the process of judging whether the access device is abnormal based on the feature information includes: and regarding each feature information as a cluster, calculating Euclidean distance between the current feature information and the random feature information, selecting a plurality of feature information with Euclidean distance larger than a set second threshold value for clustering, calculating the distance between adjacent clusters, and combining the adjacent clusters when certain conditions are met to obtain the clustered feature information.
Still further, the process of determining whether the access device is abnormal based on the feature information further includes: and carrying out association analysis on the clustered characteristic information, calculating the similarity between the clustered characteristic information and data in the mode rule base according to the mode rule base corresponding to the normal operation state, and obtaining that the access equipment is in the abnormal operation state when the similarity is larger than a set third threshold value.
Further, the process of displaying the abnormal result in the recursive graph includes: and (3) based on the time sequence of the detection output result of the abnormal operation state of the equipment, establishing an n-dimensional phase space, and connecting all the output abnormal detection time sequences to form a recursive graph structure for display.
Further, in the display process of the recursive graph structure, the minimum delay time is calculated, the abnormal output time interval is determined according to the average value of the calculation result of the minimum delay time, and the output time of the detection output interface is controlled.
A second aspect of the present invention provides a system for detecting abnormal operation of an access device of a dispatch switching network.
A system for detecting abnormal operation of a dispatch switching network access device, comprising:
a data acquisition module configured to: acquiring inbound traffic data and outbound traffic data of an access device;
a fusion module configured to: fusing inbound traffic data and outbound traffic data to obtain fused data;
a feature extraction module configured to: based on the fusion data, calculating an increment sample value of the fusion data by adopting an increment calculation method, calculating statistic of an increment sample according to the increment sample value, and obtaining a current sample statistic value as characteristic information according to the statistic of a historical sample and the statistic of the increment sample;
an output module configured to: based on the characteristic information, judging whether the access equipment is abnormal or not, and displaying an abnormal result in a recursion chart.
A third aspect of the present invention provides a computer-readable storage medium.
A computer-readable storage medium having stored thereon a computer program which, when executed by a processor, implements the steps in the method for detecting abnormal operation of a dispatch switching network access device as described in the first aspect above.
A fourth aspect of the invention provides a computer device.
A computer device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, the processor implementing the steps in the method for detecting abnormal operation of a dispatch switching network access device as described in the first aspect above when the program is executed by the processor.
Compared with the prior art, the invention has the beneficial effects that:
the invention collects the flow data of the access equipment by using a network tool Scapy, and normalizes and fuses the collected data; extracting data characteristic information through a time sliding window and an increment calculation mode; and taking a clustering algorithm and related rules in data mining as cores to obtain an accurate abnormal detection result. Finally, based on a recursive graph structure, the detection result is visualized, and the detection accuracy and efficiency are improved.
Based on the traditional detection method for abnormal operation of the access equipment in the dispatching switching network, the invention takes the clustering algorithm and the related rules in the data mining as cores, and based on the recursive graph structure, the detection result is visualized, thereby effectively improving the accuracy and the detection efficiency of abnormal state identification.
The method and the device realize quick and accurate identification of the abnormal state of the access equipment of the high-power dispatching switching network and visual display.
Drawings
The accompanying drawings, which are included to provide a further understanding of the invention and are incorporated in and constitute a part of this specification, illustrate embodiments of the invention and together with the description serve to explain the invention.
Fig. 1 is a flowchart of a method for detecting abnormal operation of an access device of a dispatch switching network according to the present invention.
Detailed Description
The invention will be further described with reference to the drawings and examples.
It should be noted that the following detailed description is illustrative and is intended to provide further explanation of the invention. Unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs.
It is noted that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of exemplary embodiments according to the present invention. As used herein, the singular is also intended to include the plural unless the context clearly indicates otherwise, and furthermore, it is to be understood that the terms "comprises" and/or "comprising" when used in this specification are taken to specify the presence of stated features, steps, operations, devices, components, and/or combinations thereof.
It is noted that the flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of methods and systems according to various embodiments of the present disclosure. It should be noted that each block in the flowchart or block diagrams may represent a module, segment, or portion of code, which comprises one or more executable instructions for implementing the logical functions specified in the various embodiments. It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the flowchart illustrations and/or block diagrams, and combinations of blocks in the flowchart illustrations and/or block diagrams, can be implemented by special purpose hardware-based systems which perform the specified functions or operations, or combinations of special purpose hardware and computer instructions.
Example 1
The embodiment provides a method for detecting abnormal operation of access equipment of a dispatching switching network, which is applied to a server for illustration, and it can be understood that the method can also be applied to a terminal, can also be applied to a system and a terminal, and can be realized through interaction of the terminal and the server. The server can be an independent physical server, a server cluster or a distributed system formed by a plurality of physical servers, and can also be a cloud server for providing cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network servers, cloud communication, middleware services, domain name services, security services CDNs, basic cloud computing services such as big data and artificial intelligent platforms and the like. The terminal may be, but is not limited to, a smart phone, a tablet computer, a notebook computer, a desktop computer, a smart speaker, a smart watch, etc. The terminal and the server may be directly or indirectly connected through wired or wireless communication, which is not limited herein. In this embodiment, the method includes the steps of:
acquiring inbound traffic data and outbound traffic data of an access device;
fusing inbound traffic data and outbound traffic data to obtain fused data;
based on the fusion data, calculating an increment sample value of the fusion data by adopting an increment calculation method, calculating statistic of an increment sample according to the increment sample value, and obtaining a current sample statistic value as characteristic information according to the statistic of a historical sample and the statistic of the increment sample;
based on the characteristic information, judging whether the access equipment is abnormal or not, and displaying an abnormal result in a recursion chart.
The technical scheme of the present embodiment is described in detail below with reference to the accompanying drawings, as shown in fig. 1:
step (1): and capturing and processing traffic data of the dispatching network access equipment.
Inbound and outbound traffic data for the access device is captured from an interface of the dispatch switching network with the aid of a network tool Scapy. And then, aggregating the traffic data of the access equipment by means of the edge network, and importing the traffic data into a router and the Internet to serve as a basis for detecting and scheduling abnormal operation of the access equipment of the switching network.
The normalization processing calculation formula of the captured data is as follows:
wherein: a represents the original data of the image and,the normalized data is represented by a representation of the normalized data, s representing node, beta s Weight vector representing node->And representing the weighting vector normalization processing result.
In the process of flow data fusion of access equipment, the invention proposes to fuse data with different dimensions by calculating cosine similarity between different data structures:
wherein:and (3) expressing cosine similarity, measuring operation data of the dispatching switching network access equipment according to the calculation result of the formula, screening data with high similarity, reserving part of effective data, and outputting the fused equipment flow data processing result as a basis for detecting abnormal operation of subsequent equipment.
Step (2): and extracting characteristic information of the flow data.
Aiming at the fused equipment flow data, the invention adopts a sliding time window and an increment calculation method to extract the characteristic information of the fused data. First, a fixed time sliding window is defined to capture traffic data in real time, and since the traffic data collected by the sliding time window is time-varying traffic data, all the collected traffic data can be summarized to describe the real-time operating state of the dispatch switching network access device.
The invention adopts an increment calculation mode to calculate the mean value and the variance of the acquired data samples as the statistic value of the historical samples, and then calculates the increment samples to obtain the mean value and the variance of the increment samples, namely the statistic value. And the current sample statistical value calculated by combining the historical statistical value and the increment statistical value is used as characteristic information. Where current sample = history sample + delta sample.
The mean and variance calculation formula of the current statistical value is as follows:
wherein the method comprises the steps ofIs the current sample mean, delta 2 Is the current sample variance, +.>Is the average value of historical samples,/->Is the historic sample variance, +.>Is the incremental sample mean, ++>Is the delta sample variance, M is the number of history samples, and N is the number of delta samples.
Step (3): an anomaly identification method based on data mining is designed.
The invention applies a clustering algorithm and related rules in a data mining algorithm to identify abnormal operation states of access equipment in a dispatching switching network. And aiming at the extracted flow data characteristic information, a clustering hierarchical clustering algorithm is applied to perform clustering analysis. In the actual operation, the features need to be treated as a cluster and Euclidean distance between the features and the nearby random feature information is calculated. When the euclidean distance measurement result is higher than the threshold value, it may be determined that the two feature information belong to the same cluster. According to the calculation method, all the characteristic information is combined into a plurality of clusters, and then the distance between adjacent clusters is calculated. And combining the clusters with the closer distance into a new cluster to finish the clustering processing of the data characteristic information.
And then, carrying out association analysis on the clustered characteristic information. And generating a mode rule base corresponding to the normal running state by associating the data of the normal running state of the rule information mining equipment, and taking the mode rule base as a basis for judging the abnormality of the dispatching switching network. In the process of mining association rules, it is necessary to describe cluster feature information into items and item sets, transactions and transaction databases, and calculate the support degree of each item set:
wherein X represents a set of terms, ψ represents a support function, θ represents a count function, L represents a transaction, and D represents a transaction database.
Searching association rules for a term set meeting the minimum support requirement to obtain the following association rule form:
where X, Y denotes two transactions, T denotes an association rule between two transactions, and according to the above formula, if one of the two transactions having the association rule exists, the probability that the other transaction exists is certain.
Then, the support degree and the credibility of the extracted association rule are calculated:
wherein,representing the support of the association rule, +.>Representing the credibility of the association rule when the support is +>Greater than or equal to a specified minimum support threshold minsup, credibility +.>And when the confidence coefficient minimum threshold value minconf is larger than or equal to the confidence coefficient minimum threshold value minconf, determining that the association rule is a valid rule. Wherein the rule set is obtained by concatenation and pruning.
After the operation flow of the access equipment is collected and processed, the similarity of the current equipment operation data feature vector is analyzed according to the normal operation state rule set, and then an abnormality judgment threshold is defined. And when the similarity calculation result is larger than the threshold value, a conclusion that the equipment is in an abnormal operation state at the moment can be drawn.
Step (4): and generating a visual abnormal operation detection result.
In order to enhance the intuitiveness of the abnormal operation test result of the equipment, a recursive graph structure is adopted to output the test result in a visual form. And (3) based on the time sequence of the abnormal operation state detection output result, establishing an n-dimensional phase space. And connecting all the output abnormality detection time sequences to form a recursive graph structure.
δ ij ＝H(μ-||U i -U j ||)
Where δ represents a recursive graph, (i, j) represents a coordinate position, U represents a device coordinate point in a phase space, H represents a Heaviside function, and μ represents a visualization radius.
Through the above calculation, a visual inspection result can be obtained. In order to avoid the problem of delay of the visual output result based on the recursion diagram, in the visual display of the abnormal operation detection result, the minimum delay time is first calculated. And determining an abnormal output time interval according to the average value of the minimum delay time calculation result, thereby controlling the output time of the detection output interface.
Example two
The embodiment provides a system for detecting abnormal operation of access equipment of a dispatching switching network.
A system for detecting abnormal operation of a dispatch switching network access device, comprising:
a data acquisition module configured to: acquiring inbound traffic data and outbound traffic data of an access device;
a fusion module configured to: fusing inbound traffic data and outbound traffic data to obtain fused data;
a feature extraction module configured to: based on the fusion data, calculating an increment sample value of the fusion data by adopting an increment calculation method, calculating statistic of an increment sample according to the increment sample value, and obtaining a current sample statistic value as characteristic information according to the statistic of a historical sample and the statistic of the increment sample;
an output module configured to: based on the characteristic information, judging whether the access equipment is abnormal or not, and displaying an abnormal result in a recursion chart.
It should be noted that, the data acquisition module, the fusion module, the feature extraction module, and the output module are the same as the examples and application scenarios implemented by the steps in the first embodiment, but are not limited to the disclosure in the first embodiment. It should be noted that the modules described above may be implemented as part of a system in a computer system, such as a set of computer-executable instructions.
Example III
The present embodiment provides a computer-readable storage medium having stored thereon a computer program which, when executed by a processor, implements the steps in the method for detecting abnormal operation of an access device of a dispatch switching network as described in the above embodiment.
Example IV
The embodiment provides a computer device, which comprises a memory, a processor and a computer program stored in the memory and capable of running on the processor, wherein the processor executes the program to realize the steps in the method for detecting abnormal operation of the access device of the dispatch switching network according to the embodiment.
It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as a method, system, or computer program product. Accordingly, the present invention may take the form of a hardware embodiment, a software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, magnetic disk storage, optical storage, and the like) having computer-usable program code embodied therein.
The present invention is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the invention. It will be understood that each flow and/or block of the flowchart illustrations and/or block diagrams, and combinations of flows and/or blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
Those skilled in the art will appreciate that implementing all or part of the above-described methods in accordance with the embodiments may be accomplished by way of a computer program stored on a computer readable storage medium, which when executed may comprise the steps of the embodiments of the methods described above. The storage medium may be a magnetic disk, an optical disk, a Read-Only Memory (ROM), a Random access Memory (Random AccessMemory, RAM), or the like.
The above description is only of the preferred embodiments of the present invention and is not intended to limit the present invention, but various modifications and variations can be made to the present invention by those skilled in the art. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention should be included in the protection scope of the present invention.
Claims (10)
1. The method for detecting the abnormal operation of the access equipment of the dispatching switching network is characterized by comprising the following steps:
acquiring inbound traffic data and outbound traffic data of an access device;
fusing inbound traffic data and outbound traffic data to obtain fused data;
based on the fusion data, calculating an increment sample value of the fusion data by adopting an increment calculation method, calculating statistic of an increment sample according to the increment sample value, and obtaining a current sample statistic value as characteristic information according to the statistic of a historical sample and the statistic of the increment sample;
based on the characteristic information, judging whether the access equipment is abnormal or not, and displaying an abnormal result in a recursion chart.
2. The method for detecting abnormal operation of a dispatch switching network access device of claim 1, further comprising, prior to the fusing: and carrying out normalization processing on the inbound flow data and the outbound flow data, calculating cosine similarity between different data structures based on normalization processing results, and selecting data with the cosine similarity larger than a set first threshold value for fusion to obtain fusion data.
3. The method for detecting abnormal operation of a dispatch switching network access device of claim 1, further comprising, prior to the process of employing the incremental calculation method: based on the fusion data, a sliding window with fixed time is defined, and flow data is captured in real time, so that the real-time running state of the access equipment of the dispatching switching network is obtained.
4. The method for detecting abnormal operation of an access device of a dispatch switching network according to claim 1, wherein the process of determining whether the access device is abnormal based on the characteristic information comprises: and regarding each feature information as a cluster, calculating Euclidean distance between the current feature information and the random feature information, selecting a plurality of feature information with Euclidean distance larger than a set second threshold value for clustering, calculating the distance between adjacent clusters, and combining the adjacent clusters when certain conditions are met to obtain the clustered feature information.
5. The method for detecting abnormal operation of an access device of a dispatch switching network of claim 4, wherein the process of determining whether the access device is abnormal based on the characteristic information further comprises: and carrying out association analysis on the clustered characteristic information, calculating the similarity between the clustered characteristic information and data in the mode rule base according to the mode rule base corresponding to the normal operation state, and obtaining that the access equipment is in the abnormal operation state when the similarity is larger than a set third threshold value.
6. The method for detecting abnormal operation of a dispatch switching network access device according to claim 1, wherein the process of displaying the abnormal result in a recursive graph comprises: and (3) based on the time sequence of the detection output result of the abnormal operation state of the equipment, establishing an n-dimensional phase space, and connecting all the output abnormal detection time sequences to form a recursive graph structure for display.
7. The method for detecting abnormal operation of access equipment of a dispatch switching network according to claim 6, wherein the minimum delay time is calculated in the process of displaying the recursive graph structure, and the abnormal output time interval is determined according to the average value of the calculation results of the minimum delay time to control the output time of the detection output interface.
8. A system for detecting abnormal operation of an access device of a dispatch switching network, comprising:
a data acquisition module configured to: acquiring inbound traffic data and outbound traffic data of an access device;
a fusion module configured to: fusing inbound traffic data and outbound traffic data to obtain fused data;
a feature extraction module configured to: based on the fusion data, calculating an increment sample value of the fusion data by adopting an increment calculation method, calculating statistic of an increment sample according to the increment sample value, and obtaining a current sample statistic value as characteristic information according to the statistic of a historical sample and the statistic of the increment sample;
an output module configured to: based on the characteristic information, judging whether the access equipment is abnormal or not, and displaying an abnormal result in a recursion chart.
9. A computer readable storage medium having stored thereon a computer program, which when executed by a processor performs the steps in the method for detecting abnormal operation of a dispatch switching network access device according to any one of claims 1-7.
10. A computer device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, wherein the processor, when executing the program, implements the steps of the method for detecting abnormal operation of a dispatch switch network access device as claimed in any one of claims 1 to 7.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202311494303.9A CN117527520A (en) | 2023-11-09 | 2023-11-09 | Method and system for detecting abnormal operation of access equipment of dispatching switching network |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202311494303.9A CN117527520A (en) | 2023-11-09 | 2023-11-09 | Method and system for detecting abnormal operation of access equipment of dispatching switching network |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN117527520A true CN117527520A (en) | 2024-02-06 |
Family
ID=89741367
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202311494303.9A Pending CN117527520A (en) | 2023-11-09 | 2023-11-09 | Method and system for detecting abnormal operation of access equipment of dispatching switching network |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN117527520A (en) |
-
2023
- 2023-11-09 CN CN202311494303.9A patent/CN117527520A/en active Pending
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN107391598B (en) | Automatic threat information generation method and system | |
| CN108319649B (en) | System and method for improving quality of water regime and water-diversion data | |
| CN108206813B (en) | Security audit method and device based on k-means clustering algorithm and server | |
| CN111800430A (en) | Attack group identification method, device, equipment and medium | |
| CN112468339B (en) | Alarm processing method, system, device and storage medium | |
| CN114386537A (en) | Lithium battery fault diagnosis method and device based on Catboost and electronic equipment | |
| CN110941978A (en) | Face clustering method and device for unidentified personnel and storage medium | |
| CN113570200A (en) | Power grid operation state monitoring method and system based on multidimensional information | |
| CN114915478A (en) | Multi-Agent-based network attack scene identification method for intelligent park industrial control system based on distributed correlation analysis | |
| CN104951553A (en) | Content collecting and data mining platform accurate in data processing and implementation method thereof | |
| CN111191720A (en) | Service scene identification method and device and electronic equipment | |
| CN115049410A (en) | Electricity stealing behavior identification method and device, electronic equipment and computer readable storage medium | |
| CN114978877A (en) | Exception handling method and device, electronic equipment and computer readable medium | |
| CN108763926B (en) | Industrial control system intrusion detection method with safety immunity capability | |
| CN117095247B (en) | Numerical control machining-based machining gesture operation optimization method, system and medium | |
| CN116074215B (en) | Network quality detection method, device, equipment and storage medium | |
| CN112434049A (en) | Table data storage method and device, storage medium and electronic device | |
| CN117527520A (en) | Method and system for detecting abnormal operation of access equipment of dispatching switching network | |
| CN110582091B (en) | Method and apparatus for locating wireless quality problems | |
| CN115037632A (en) | Network security situation perception analysis system | |
| CN110245617A (en) | Artificial intelligence analysis's method based on transient state recording waveform | |
| CN110781309A (en) | Entity parallel relation similarity calculation method based on pattern matching | |
| CN113612727B (en) | Attack IP identification method, device, equipment and computer readable storage medium | |
| CN116186549B (en) | Model training method, device, equipment and medium | |
| KR102251467B1 (en) | Anomaly detection apparatus based on outlier score in EDR |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |