CN117811896A - Multistage intranet asset mapping method - Google Patents

Abstract

The invention discloses a multistage intranet asset mapping method, which relates to the technical field of network asset mapping, and specifically comprises the steps of S100, collecting real-time network asset data and historical network asset data, and extracting distinguishing characteristics of the real-time network asset data and the historical network asset data; step 200, integrating and analyzing distinguishing features of real-time network asset data and historical network asset data to generate analysis marks, wherein the analysis marks comprise signal influence marks and abnormal influence marks; step S300, carrying out integrated analysis on the signal influence identifiers and the abnormal influence identifiers to generate influence degree tags; step S400, performing model analysis on the generated influence degree label, outputting a future influence result and displaying the future influence result on a display terminal; the invention can judge the future influence degree of the abnormal condition according to the output encoding value of the abnormal condition of the network asset, and further analyze whether the influence reason of the abnormal condition needs to be processed in time.

Description

Multistage intranet asset mapping method

Technical Field

The invention relates to the technical field of network asset mapping, in particular to a multistage intranet asset mapping method.

Background

Network asset mapping refers to detailed investigation and recording of all assets on a network by an organization or individual to better understand and manage the assets, and intranet asset mapping is based on network asset mapping modes set internally by departments.

If there is a network abnormality or an unexpected situation in the existing intranet asset mapping, the intranet asset data has a loss situation, although the intranet asset data can be timely retrieved according to the historical data, the influence of losing the network asset data cannot be judged according to the loss situation of the data retrieved by backup, if the influence result is smaller, more manpower resources are consumed for analyzing the influence result, if the influence result is larger, the influence reason analysis is not timely performed, and the subsequent data loss phenomenon possibly exists, so that a larger influence result is brought.

In order to solve the above mentioned problems, a multi-stage intranet asset mapping method is proposed.

Disclosure of Invention

The invention aims to provide a multistage intranet asset mapping method which aims to solve the defects in the background technology.

In order to achieve the above object, the present invention provides the following technical solutions:

the multistage intranet asset mapping method comprises the following steps of:

step S100, acquiring real-time network asset data and historical network asset data, and extracting distinguishing features of the real-time network asset data and the historical network asset data;

step 200, integrating and analyzing distinguishing features of real-time network asset data and historical network asset data to generate analysis marks, wherein the analysis marks comprise signal influence marks and abnormal influence marks;

step S300, carrying out integrated analysis on the signal influence identifiers and the abnormal influence identifiers to generate influence degree tags;

and step 400, performing model analysis on the generated influence degree label, outputting a future influence result and displaying the future influence result on a display terminal.

In a preferred embodiment, the distinguishing features include a packet loss rate, asset category data and asset number data, where the packet loss rate is a key indicator for measuring network connection quality, and a change situation of the packet loss rate may indicate a network performance problem; the asset category data may categorize network assets by category, with the asset count data reflecting the number of network assets for a single category.

In a preferred embodiment, feature extraction is performed according to the distinguishing feature, statistics of average packet loss rate, maximum packet loss rate, minimum packet loss rate and standard deviation of packet loss rate are performed on the packet loss rate, statistics of single thermal code, average value, maximum value and minimum value of server class number in the asset category data are performed, and statistics of average asset number, maximum asset number, minimum asset number and standard deviation of asset number are performed on the asset number data.

In a preferred embodiment, the step of generating the signal impact identifier is:

and counting packet loss rate standard deviation Du, setting packet loss standard deviation threshold Du1 and Du2, wherein the packet loss standard deviation threshold Du1 is smaller than the packet loss standard deviation threshold Du2, substituting the packet loss rate standard deviation Du into the packet loss standard deviation threshold Du1 and Du2 for comparison, generating a low-degree packet loss influence identifier if the packet loss rate standard deviation Du is larger than 0 and smaller than the packet loss standard deviation threshold Du1, generating a medium-degree packet loss influence identifier if the packet loss rate standard deviation Du is larger than the packet loss standard deviation threshold Du1 and smaller than the packet loss standard deviation threshold Du2, and generating a high-degree packet loss influence identifier if the packet loss rate standard deviation Du is larger than the packet loss standard deviation threshold Du 2.

In a preferred embodiment, the average number of servers Gz and the standard deviation Zm of the asset data are counted, an anomaly impact factor Δj is obtained by integrating the average number of servers Gz and the standard deviation Zm of the asset data, an anomaly impact threshold Δj and Δk are set, the anomaly impact threshold Δj is greater than the anomaly impact threshold Δk, the anomaly impact factor Δis substituted into the anomaly impact thresholds Δj and Δk, a low-data loss identifier is generated if the anomaly impact factor Δis smaller than the anomaly impact threshold Δk, a medium-data loss identifier is generated if the anomaly impact factor Δis greater than the anomaly impact threshold Δk and smaller than the anomaly impact threshold Δj, and a high-data loss identifier is generated if the anomaly impact factor Δis greater than the anomaly impact threshold Δj.

In a preferred embodiment, the influence level tags include a high influence tag, a medium influence tag and a low influence tag, and the analysis logic for the signal influence identification and the anomaly influence identification is:

and if the data loss identification and the high packet loss influence identification, the medium data loss identification and the high packet loss influence identification or the high data loss identification and the medium packet loss influence identification are provided at the same time, generating a high influence label, and if the data loss identification and the medium packet loss influence identification, the medium data loss identification and the low packet loss influence identification, the low data loss identification and the medium packet loss influence identification, the low data loss identification and the high data loss influence identification or the high data loss identification and the low packet loss influence identification are provided at the same time, generating a medium influence label, and if the data loss identification and the low packet loss influence identification are provided at the same time, generating a low influence label.

In a preferred embodiment, the influence degree label is subjected to model analysis, wherein an abnormal influence prediction model is adopted, and the abnormal influence prediction model is created by the following steps:

loading a data set by using a tool or a programming language, checking the integrity and the format of the data, ensuring that each sample comprises network asset data, packet loss rate data and corresponding influence labels, and dividing the data set into a training set and a testing set;

extracting characteristics of network asset data and packet loss rate data, performing preprocessing such as data standardization and normalization, selecting a machine learning model, including but not limited to random forests, training the selected model by using a training set, and adjusting super parameters of the model by using a cross verification technology;

and evaluating the performance of the model by using a test set, coding the label, mapping the high-influence label, the medium-influence label and the low-influence label into numerical values, explaining the prediction result of the model on the future influence degree, and analyzing the interpretability of the prediction result by indexes such as accuracy, precision, recall rate, F1 score and the like.

In a preferred embodiment, the application steps of the abnormal influence prediction model are as follows:

and carrying out input analysis on the influence degree label, and outputting a coded numerical value after coding the label based on the influence degree label, wherein the coded numerical value is distributed according to the alphabetical order of the category, and the coded numerical value does not directly reflect the grade of the label.

In the technical scheme, the invention has the technical effects and advantages that:

the invention can judge the future influence degree of the abnormal condition according to the output encoding value of the abnormal condition of the network asset, further analyze whether the influence reason of the abnormal condition needs to be processed in time, thereby adopting the normal diagnosis measures of the inner network asset verification and the inner network abnormal reason, and reducing the unnecessary of the asset inspection due to the network influence and the timeliness of the asset inspection of the abnormal influence.

Drawings

For a clearer description of embodiments of the present application or of the solutions of the prior art, the drawings that are needed in the embodiments will be briefly described below, it being obvious that the drawings in the following description are only some embodiments described in the present invention, and that other drawings may be obtained according to these drawings for a person skilled in the art.

Fig. 1 is a flow chart of a multi-level intranet asset mapping method of the present invention.

Detailed Description

For the purpose of making the objects, technical solutions and advantages of the embodiments of the present invention more apparent, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention, and it is apparent that the described embodiments are some embodiments of the present invention, but not all embodiments of the present invention. All other embodiments, which can be made by those skilled in the art based on the embodiments of the invention without making any inventive effort, are intended to be within the scope of the invention.

Referring to fig. 1, the method for mapping multi-stage intranet assets according to the present embodiment includes the following steps:

step S100, acquiring real-time network asset data and historical network asset data, and extracting distinguishing features of the real-time network asset data and the historical network asset data;

step 200, integrating and analyzing distinguishing features of real-time network asset data and historical network asset data to generate analysis marks, wherein the analysis marks comprise signal influence marks and abnormal influence marks;

step S300, carrying out integrated analysis on the signal influence identifiers and the abnormal influence identifiers to generate influence degree tags;

and step 400, performing model analysis on the generated influence degree label, outputting a future influence result and displaying the future influence result on a display terminal.

The distinguishing features comprise packet loss rate, asset category data and asset number data, wherein the packet loss rate is a key index for measuring network connection quality, and the change condition of the packet loss rate can indicate network performance problems; the asset category data may categorize network assets by category, with the asset count data reflecting the number of network assets for a single category.

It should be noted that: the high packet loss rate may indicate that the network has problems, may cause communication delay and service quality to be reduced, and can timely identify abnormal conditions of network connection by monitoring the packet loss rate, thereby triggering the update of the asset list;

analysis of asset class data is helpful for better understanding and managing data conditions of assets in a network, different classes of devices may have different functions, security requirements and configuration rules, and by extracting asset class information, finer granularity management and monitoring of network assets can be facilitated, and the asset class data can be used for automatically classifying new devices and identifying changes of different classes from historical data;

the change in the number of assets may represent an expansion or contraction in the network size, and monitoring the asset count data may help identify the change in the network size, thereby triggering an update of the asset inventory, which may ensure timeliness and accuracy of the asset inventory for larger-scale network assets.

The distinguishing characteristic extraction steps are as follows:

performing feature extraction according to the distinguishing features, performing statistics on average packet loss rate, maximum packet loss rate, minimum packet loss rate and standard deviation of packet loss rate on the packet loss rate, performing statistics on average value, maximum value and minimum value of independent heat codes and server class quantity in the asset class data, and performing statistics on average asset number, maximum asset number, minimum asset number and standard deviation of asset number on the asset number data;

the specific extraction method comprises the following steps:

providing a data set comprising real-time network asset data and historical network asset data, wherein the data set comprises packet loss rate of equipment, asset category data (equipment type) and asset number data;

extracting packet loss rate characteristics, wherein;

average packet loss rate:

(0.02+0.05+0.10+0.03+0.06+0.12)/6＝0.08；

maximum packet loss rate: 0.12;

minimum packet loss rate: 0.02;

standard deviation: calculating standard deviation of all packet loss rates;

extracting the data characteristics of the asset category, wherein;

single heat coding: for three categories of servers, routers, switches, a three-bit binary representation may be used, and the servers may be encoded as (1, 0).

Category number: average, maximum, minimum of number of servers:

average asset number: (5+2+10+6+3+11)/6=6.17;

maximum number of assets: 11;

minimum number of assets: 2;

standard deviation: calculating standard deviation of all asset numbers;

the signal influence mark generation step is as follows:

counting packet loss rate standard deviation Du, setting packet loss standard deviation threshold Du1 and Du2, wherein the packet loss standard deviation threshold Du1 is smaller than the packet loss standard deviation threshold Du2, substituting the packet loss rate standard deviation Du into the packet loss standard deviation threshold Du1 and Du2 for comparison, generating a low-level packet loss influence mark if the packet loss rate standard deviation Du is larger than 0 and smaller than the packet loss standard deviation threshold Du1, generating a medium-level packet loss influence mark if the packet loss rate standard deviation Du is larger than the packet loss standard deviation threshold Du1 and smaller than the packet loss standard deviation threshold Du2, generating a high-level packet loss influence mark if the packet loss rate standard deviation Du is larger than the packet loss standard deviation threshold Du2, and generating a network fluctuation degree of the high-level packet loss influence mark is larger than the medium-level influence mark;

it should be noted that:

the size of the standard deviation of the packet loss rate reflects the dispersion degree of the packet loss rate data, and the larger the standard deviation is, the wider the variation range of the packet loss rate data is, and the larger the dispersion degree of the data points relative to the average value is, specifically;

the large standard deviation of the packet loss rate indicates that the distribution of the packet loss rate data is relatively dispersed, and large fluctuation exists, which possibly means that the quality of network connection is good and bad, and the packet loss rate is changed severely frequently.

The small standard deviation of the packet loss rate indicates that the distribution of the packet loss rate data is relatively stable, and the distribution is close to an average value, which may mean that the network connection quality is relatively consistent and the packet loss rate is not changed greatly.

In network management and monitoring, an increase in the standard deviation of the packet loss rate may indicate a large fluctuation in network quality or instability of the network, which may lead to uncertainty in network performance, which may require attention for some applications requiring high network stability, and an administrator may evaluate the stability of the network connection by monitoring the change in the standard deviation of the packet loss rate, and discover and solve potential problems in time.

The abnormal influence identification comprises a high data loss identification, a medium data loss identification and a low data loss identification, and the generation steps of the abnormal influence identification are as follows:

counting the average number of servers Gz and the standard deviation Zm of the asset data, and carrying out integrated calculation on the average number of servers Gz and the standard deviation Zm of the asset data to obtain an abnormal influence factor delta, wherein a specific calculation formula of the abnormal influence factor delta is as follows:

and if the abnormal influence factor delta is larger than the abnormal influence threshold delta K and smaller than the abnormal influence threshold delta J, generating a medium-data loss identifier, and if the abnormal influence factor delta is larger than the abnormal influence threshold delta J, generating a high-data loss identifier, wherein the data loss influence condition of the high-data loss identifier is larger than the data loss influence condition of the medium-data loss identifier.

It should be noted that: the larger the standard deviation of the asset data, the more dispersed the asset data is, and the more dispersed the data points are relative to the average. Specifically:

a large standard deviation of the asset data indicates a large fluctuation in the value of the asset data relative to the average value, which may indicate a large difference between different time points or different asset classes, i.e., a high degree of dispersion of the data points, uneven distribution of the asset, and the presence of some outliers or special cases.

Asset data small standard deviation: indicating that the value of the asset data is relatively stable, close to the average, which may mean that the asset data is relatively less variable, relatively consistent, the number or value of assets is relatively stable, the variation is not great, the number or value of assets of different categories is relatively consistent, the distribution of assets is relatively even, and abnormal values are less likely to occur.

In asset management and monitoring, variations in standard deviation of asset data may be used to evaluate trends and volatility of assets.

The influence degree labels comprise a high influence label, a medium influence label and a low influence label, and the analysis logic for the signal influence identification and the abnormal influence identification is as follows:

and if the data loss identification and the high packet loss influence identification, the medium data loss identification and the high packet loss influence identification or the high data loss identification and the medium packet loss influence identification are provided at the same time, generating a high influence label, and if the data loss identification and the medium packet loss influence identification, the medium data loss identification and the low packet loss influence identification, the low data loss identification and the medium packet loss influence identification, the low data loss identification and the high data loss influence identification or the high data loss identification and the low packet loss influence identification are provided at the same time, generating a medium influence label, and if the data loss identification and the low packet loss influence identification are provided at the same time, generating a low influence label.

Performing model analysis on the influence degree label, wherein an abnormal influence pre-estimation model is adopted, and the abnormal influence pre-estimation model is created by the following steps:

loading the data set by using a tool or a programming language, checking the integrity and the format of the data, ensuring that each sample comprises network asset data, packet loss rate data and corresponding influence tags (high influence tags, medium influence tags and low influence tags), and dividing the data set into a training set and a test set;

extracting characteristics of network asset data and packet loss rate data, performing preprocessing such as data standardization and normalization, selecting a machine learning model, including but not limited to random forests, training the selected model by using a training set, and adjusting super parameters of the model by using a cross verification technology;

and evaluating the performance of the model by using a test set, coding the label, mapping the high-influence label, the medium-influence label and the low-influence label into numerical values, and specifically, coding the label and mapping the high-influence label, the medium-influence label and the low-influence label into the numerical values. For example, a label encoder may be used to interpret the prediction result of the degree of influence of the model on the future, and the interpretation of the analysis prediction result may be performed by an index such as accuracy, precision, recall, and F1 score.

The application steps of the abnormal influence prediction model are as follows:

and carrying out input analysis on the influence degree label, and outputting a coded numerical value after coding the label based on the influence degree label, wherein the coded numerical value is distributed according to the alphabetical order of the category, and the coded numerical value does not directly reflect the grade of the label.

It should be noted that: if it is desired that the encoded values correspond to the label's level, mapping may be performed manually or in some other way to ensure that the encoded values are in the order expected by your.

The output code value is displayed on a display terminal, and an administrator judges the future influence degree according to the output code value;

the invention can judge the future influence degree of the abnormal condition according to the output encoding value of the abnormal condition of the network asset, further analyze whether the influence reason of the abnormal condition needs to be processed in time, thereby adopting the normal diagnosis measures of the inner network asset verification and the inner network abnormal reason, and reducing the unnecessary of the asset inspection due to the network influence and the timeliness of the asset inspection of the abnormal influence.

The above formulas are all formulas with dimensions removed and numerical values calculated, the formulas are formulas with a large amount of data collected for software simulation to obtain the latest real situation, and preset parameters in the formulas are set by those skilled in the art according to the actual situation.

It should be understood that the term "and/or" is merely an association relationship describing the associated object, and means that three relationships may exist, for example, a and/or B may mean: there are three cases, a alone, a and B together, and B alone, wherein a, B may be singular or plural. In addition, the character "/" herein generally indicates that the associated object is an "or" relationship, but may also indicate an "and/or" relationship, and may be understood by referring to the context.

In the present application, "at least one" means one or more, and "a plurality" means two or more. "at least one of" or the like means any combination of these items, including any combination of single item(s) or plural items(s). For example, at least one (one) of a, b, or c may represent: a, b, c, a-b, a-c, b-c, or a-b-c, wherein a, b, c may be single or plural.

It should be understood that, in various embodiments of the present application, the sequence numbers of the foregoing processes do not mean the order of execution, and the order of execution of the processes should be determined by the functions and internal logic thereof, and should not constitute any limitation on the implementation process of the embodiments of the present application.

It will be clear to those skilled in the art that, for convenience and brevity of description, specific working procedures of the above-described systems, apparatuses and units may refer to corresponding procedures in the foregoing method embodiments, and are not repeated herein.

The units described as separate units may or may not be physically separate, and units shown as units may or may not be physical units, may be located in one place, or may be distributed over a plurality of network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

In addition, each functional unit in each embodiment of the present application may be integrated in one processing unit, or each unit may exist alone physically, or two or more units may be integrated in one unit.

The foregoing is merely specific embodiments of the present application, but the scope of the present application is not limited thereto, and any person skilled in the art can easily think about changes or substitutions within the technical scope of the present application, and the changes and substitutions are intended to be covered by the scope of the present application. Therefore, the protection scope of the present application shall be subject to the protection scope of the claims.

Claims (8)

1. A method of multi-level intranet asset mapping, the method comprising the steps of:

step S100, acquiring real-time network asset data and historical network asset data, and extracting distinguishing features of the real-time network asset data and the historical network asset data;

step 200, integrating and analyzing distinguishing features of real-time network asset data and historical network asset data to generate analysis marks, wherein the analysis marks comprise signal influence marks and abnormal influence marks;

step S300, carrying out integrated analysis on the signal influence identifiers and the abnormal influence identifiers to generate influence degree tags;

and step 400, performing model analysis on the generated influence degree label, outputting a future influence result and displaying the future influence result on a display terminal.

2. The multi-level intranet asset mapping method according to claim 1, wherein the distinguishing features comprise a packet loss rate, asset category data and asset number data, the packet loss rate is a key index for measuring network connection quality, and the change condition of the packet loss rate can indicate a network performance problem; the asset category data may categorize network assets by category, with the asset count data reflecting the number of network assets for a single category.

3. The multi-level intranet asset mapping method according to claim 2, wherein feature extraction is performed according to the distinguishing features, average packet loss rate, maximum packet loss rate, minimum packet loss rate and standard deviation statistics of packet loss rate are performed on the packet loss rate, single thermal coding in the asset category data, average value, maximum value and minimum value of server category number are counted, and average asset number, maximum asset number, minimum asset number and standard deviation statistics of asset number are performed on the asset number data.

4. A multi-level intranet asset mapping method as claimed in claim 3, wherein the step of generating the signal impact identifier is:

and counting packet loss rate standard deviation Du, setting packet loss standard deviation threshold Du1 and Du2, wherein the packet loss standard deviation threshold Du1 is smaller than the packet loss standard deviation threshold Du2, substituting the packet loss rate standard deviation Du into the packet loss standard deviation threshold Du1 and Du2 for comparison, generating a low-degree packet loss influence identifier if the packet loss rate standard deviation Du is larger than 0 and smaller than the packet loss standard deviation threshold Du1, generating a medium-degree packet loss influence identifier if the packet loss rate standard deviation Du is larger than the packet loss standard deviation threshold Du1 and smaller than the packet loss standard deviation threshold Du2, and generating a high-degree packet loss influence identifier if the packet loss rate standard deviation Du is larger than the packet loss standard deviation threshold Du 2.

5. The multi-level intranet asset mapping method of claim 4, wherein the statistics of the average number of servers Gz and the standard deviation Zm of asset data are performed, an anomaly impact factor delta is obtained by integrating the average number of servers Gz and the standard deviation Zm of asset data, anomaly impact thresholds delta J and delta K are set, the anomaly impact threshold delta J is greater than the anomaly impact threshold delta K, the anomaly impact factor delta is substituted into the anomaly impact thresholds delta J and delta K, a low-data loss identifier is generated if the anomaly impact factor delta is less than the anomaly impact threshold delta K, a medium-data loss identifier is generated if the anomaly impact factor delta is greater than the anomaly impact threshold delta J and less than the anomaly impact threshold delta J, and a high-data loss identifier is generated if the anomaly impact factor delta is greater than the anomaly impact threshold delta J.

6. The multi-level intranet asset mapping method of claim 5, wherein the influence level tags include a high influence tag, a medium influence tag, and a low influence tag, and the analysis logic for the signal influence identifier and the anomaly influence identifier is:

and if the data loss identification and the high packet loss influence identification, the medium data loss identification and the high packet loss influence identification or the high data loss identification and the medium packet loss influence identification are provided at the same time, generating a high influence label, and if the data loss identification and the medium packet loss influence identification, the medium data loss identification and the low packet loss influence identification, the low data loss identification and the medium packet loss influence identification, the low data loss identification and the high data loss influence identification or the high data loss identification and the low packet loss influence identification are provided at the same time, generating a medium influence label, and if the data loss identification and the low packet loss influence identification are provided at the same time, generating a low influence label.

7. The method for mapping multi-level intranet assets according to claim 6, wherein the influence degree labels are subjected to model analysis, wherein an abnormal influence prediction model is adopted, and the abnormal influence prediction model is created by the steps of:

loading a data set by using a tool or a programming language, checking the integrity and the format of the data, ensuring that each sample comprises network asset data, packet loss rate data and corresponding influence labels, and dividing the data set into a training set and a testing set;

extracting characteristics of network asset data and packet loss rate data, performing preprocessing such as data standardization and normalization, selecting a machine learning model, including but not limited to random forests, training the selected model by using a training set, and adjusting super parameters of the model by using a cross verification technology;

and evaluating the performance of the model by using a test set, coding the label, mapping the high-influence label, the medium-influence label and the low-influence label into numerical values, explaining the prediction result of the model on the future influence degree, and analyzing the interpretability of the prediction result by indexes such as accuracy, precision, recall rate, F1 score and the like.

8. The method for mapping multi-level intranet assets according to claim 7, wherein the step of applying the abnormal influence prediction model is:

and carrying out input analysis on the influence degree label, and outputting a coded numerical value after coding the label based on the influence degree label, wherein the coded numerical value is distributed according to the alphabetical order of the category, and the coded numerical value does not directly reflect the grade of the label.