TWI423619B - Intelligent network monitoring system - Google Patents

Description

Smart network monitoring system

The invention relates to a smart network monitoring system, in particular to a smart network monitoring system based on a network traffic knowledge ontology.

At present, it is the age of communication. There is no need for internet in all walks of life. The importance of the Internet is inexplicable. The market sales of related network devices are rapidly increasing, and the demand for network monitoring systems is increasing.

At present, the existing network traffic monitoring system can only display "traffic" or "line occupancy rate", but in different network environments, the same network traffic value has different representative meanings, so the current network In the case of traffic monitoring, the network administrator must still be able to know the meaning of the network traffic represented by these values.

In addition, there are millions of network monitoring systems on the market that can be afforded by non-sMEs and schools. In terms of school units, according to the statistics of the Ministry of Education in the 97th school year, Taiwan currently has 171 colleges and universities. Among them, in addition to several schools with five-year 50 billion and teaching excellence programs, other schools are very concerned about the issue of network traffic monitoring, but have no money to build millions of network monitoring. system. Therefore, it is necessary to seek a solution.

Accordingly, it is an object of the present invention to provide a smart network monitoring system.

Thus, the intelligent network monitoring system of the present invention is used to monitor the network traffic of most network devices of a particular building. The system comprises a network traffic data retrieval unit, a knowledge ontology repository and a fuzzy inference engine. The network traffic data capture unit is configured to retrieve network traffic data from the network devices. The knowledge ontology repository is used to store at least one knowledge of the network monitoring field provided by an expert in the field of network monitoring for the specific building. The fuzzy inference engine is configured to convert the network traffic data transmitted by the network traffic data extraction unit into network traffic semantics based on the knowledge of the network monitoring domain in the knowledge ontology repository.

The effect of the invention is that when the network traffic is abnormal, the alarm semantics in accordance with the human thinking mode can be provided immediately, so that the network administrator can immediately take appropriate measures. In addition, the construction cost of the present invention is affordable for general SMEs and schools, so that general SMEs and schools can save a large amount of customized network environment traffic monitoring costs.

The above and other technical contents, features and advantages of the present invention will be apparent from the following detailed description of the preferred embodiments.

Before the present invention is described in detail, it is noted that in the following description, similar elements are denoted by the same reference numerals.

Referring to Figure 1, a preferred embodiment of the intelligent network monitoring system 1 of the present invention is used to monitor the network traffic of a majority of network devices 9 of a particular building. In the preferred embodiment, a building in a school is used as the specific building. However, the specific building in the present invention is not limited to a building in a school, and may be utilized by the wisdom of the present invention. The network monitoring system 1 monitors any particular building of the network traffic of the network device 9. The intelligent network monitoring system 1 includes a network traffic data capturing unit 11, a fuzzy inference controller 13 including a knowledge body repository 131 and a fuzzy inference engine 132, an alarm unit 14, and a network monitoring interface. 15.

The network traffic data capturing unit 11 is configured to retrieve network traffic data from the network devices 9. These network traffic data needs to be defined in advance by network administrators. For example, in the preferred embodiment, the important information defined by the school's network administrators is: building, campus, floor, IP address, alias, category, time, port, fuzzy variable, traffic entry, Flow outflow, maximum outflow of equipment, and maximum inflow of equipment. These network traffic data will vary according to different network environments, such as the building, campus and floor of the physical location, or the fuzzy variables of the network device 9, the maximum outflow of the device, and the maximum amount of equipment entering, so The most important key in the process of building the network traffic data capture unit 11 is the network administrators in the network environment.

The above network administrator refers to the network monitoring domain expert 8 who is familiar with the network environment, and based on the knowledge of the specific network environment, establishes the knowledge ontology of the network environment and stores it to the knowledge. The ontology repository 131.

Referring to FIG. 1 to FIG. 4, the knowledge ontology repository 131 is configured to store at least one network monitoring domain expert 8 knowledge of the network monitoring domain provided by the specific network environment, which is mainly used to describe the specific network environment. Domain knowledge, including Domain Layer, Category Layer, Concept, Attribute, Operation, and Instance Layer. As shown in FIG. 2, it is the knowledge ontology stored in the knowledge ontology repository 12 in the preferred embodiment, wherein the domain layer is the knowledge ontology, and the category layer has a campus area 1 and a campus area 2. And campus n, the concept represents the name of each network device 9, the attribute is the attribute of the concept, its main usage is to describe the attribute values contained in the concept, and these attributes are also representative of the key items for the concept. Therefore, in the process of the system 1 of the present invention, the domain attribute expert 8 is first used to define the key attributes of the network device 9, and then the knowledge ontology of the network device 9 is built. As for the operation, it is the concept of operation for the concept. In addition, the instance layer represents an instance in the actual network environment. As shown in FIG. 3 and FIG. 4, FIG. 3 is a conceptual example of the network device 9 in the preferred embodiment, and FIG. 4 is an example thereof. Therefore, the knowledge ontology repository 131 stores the knowledge ontology defined by the network traffic data domain expert 8 for immediate fuzzy inference or future network data analysis.

Referring to FIG. 1 and FIG. 5, the fuzzy inference engine 132 is configured to convert the network traffic data transmitted by the network traffic data extraction unit 11 into a network based on the knowledge of the network monitoring domain in the knowledge ontology repository 131. Traffic semantics. That is, the fuzzy inference engine 132 captures the value transmitted by the network traffic data extraction unit 11 and according to the fuzzy inference knowledge base defined by the network monitoring domain expert 8 in the knowledge ontology repository 131. 1311, the key value of a certain network device 9 can be obtained. In the preferred embodiment, it is mainly to determine the amount of network uploads and downloads between buildings in the campus. As shown in Figure 5, each network line (or port) has its network traffic input fuzzy variable, for example, its semantic terms can be very low (V_Low), low (Low), medium (Medium). , High and Very High (V_High), so each network line is an input fuzzy variable. For example, when the network traffic of a certain network device 9 is 66 Mbps, since it only corresponds to the ladder curve of the semantic term, the input fuzzy variable corresponding to the network traffic of 66 Mbps is However, when the network traffic of a certain network device 9 is 72 Mbps, since it corresponds to a ladder curve of a high-level and a very high-order, the embodiment of the present invention. The higher the possibility (the ordinate) of the lieutenant, that is, the meaning of the word is the ladder curve of the 〝高〝, so the input fuzzy variable corresponding to the network traffic of 72 Mbps is 〝高〞. Therefore, by synthesizing all the network lines as shown in Figures 6, 7, and 8 (described later in detail), it is possible to determine the network traffic between the building and the building to obtain a certain The flow of the building is semantic.

In the process of the fuzzy inference engine 132 converting the network traffic data into the semantics of the network traffic, it is first necessary to define the input fuzzy variables of the upload and download of the individual network line traffic, and the overall output upload and download traffic is analyzed by using the comprehensive analysis. Line upload and download traffic. Among them, the upload (download) amount of an individual line is an input fuzzy variable, and the overall network upload (download) traffic is an output fuzzy variable. In this embodiment, the membership function between the traffic of the network line and the input fuzzy variable is an expert method, and the domain expert 8 defines according to the individual network environment, so the obtained membership function is incomplete for different network environments. In the same way, the value of the input network traffic can be converted into the semantics of the domain knowledge of experts in the field of network monitoring.

Referring to Figures 1, 6, 7, and 8, in the preferred embodiment, the knowledge ontology repository 131 is constructed using a Fuzzy Markup Language (FML) and includes a fuzzy inference knowledge base (Knowledge). Base) 1311 and a fuzzy inference rule base (Rule Base) 1312. The FML language is proposed by scholars such as Acampora and Loia, and is a language defined on the basis of XML and combined with fuzzy logic. FML is basically divided into three layers of architecture, namely XML, Document Type Definition (DTD) and Extensible Stylesheet Language Transformations (XSLT). Among them, XML is to establish fuzzy logic control into a new markup language. DTD is to define the tag component that can be legally used in FML. The function of XSLT is to convert the fuzzy control description into a specific programming language.

As shown in FIG. 6, it is a FML architecture diagram of a smart network monitoring system based on the network traffic knowledge ontology (taking the uploading network traffic of the student dormitory Huaiyuanzhai in the case of the applicant's campus in Tainan University as an example). In the preferred embodiment, the root node of the system 1 is a fuzzy inference controller (Controller) 13, which can be represented by a <FUZZYCONTROL> tag in the FML programming language. The <FUZZYCONTROL> tag uses three subtags, type, defuzzifymethod, and ip, where: (1) type represents the type of the fuzzy controller, such as MAMDANI; (2) defuzzifymethod defines the method of defuzzification; (3) ip represents The network address of this fuzzy controller on the network.

In addition, the left subtree shown in FIG. 6 is the fuzzy inference knowledge base 1311. If the code is written in the FML language, it will be represented by the <KNOWLEDGEBASE> tag. <KNOWLEDGEBASE> uses the <FUZZYVARIABLE> and <FUZZYTERM> subtags to describe the concept of blurring (for example, one of the campus network lines) and its semantics (for example, very high traffic). The tags of <FUZZYVARIABLE> are name, scale, domainLeft, domainRight, type, and ip, where: (1) name is the name of the fuzzy concept; (2) scale is the unit of measurement of the fuzzy concept; (3) domainLeft and domainRight are fuzzy concepts (4) type is the role of the fuzzy concept in the rule; (5) ip represents the network address of the fuzzy knowledge base 131 on the network. <FUZZYTERM> has only one label named, which is used to define the semantics of the fuzzy concept.

In the example illustrated in Figures 6, 7, and 8, the left subtree in Figure 6 and its corresponding code Figure 7 illustrate the applicant from the Tainan University in the case of Gezhilou (its building code is A) to Huaiyuan Five fuzzy sets of Huaiyuanzhai download traffic (four in total, four fuzzy variables) for each line of Zhai (its building code is E). In this example, the input fuzzy variable for each line can be set to five fuzzy sets, with semantic terms being Very Low (Lery_Low), Low (Low), Medium (High), High (High), and Very High (Very_High). The output fuzzy variable is the degree of building traffic. It is also defined as five fuzzy sets. The semantic terms are also very low (Very_Low), low (Low), medium (Medium), high (High) and very high ( Very_High).

Furthermore, the right subtree shown in FIG. 6 is the fuzzy inference rule base 1312. If the code is written in the FML language, it will be represented by the <RULEBASE> tag. <RULEBASE> has two subtags, inferenceengine and ip. The inferenceengine defines the inference method, such as MINMAXMINMAMDANI; ip represents the network address of the fuzzy controller on the network. Each single rule is represented by the label <RULE>, and the sub-labels used by <RULE> are id, connector, weight, and ip, respectively: (1) id is the code of the rule; (2) the operator is the operation element of the logical operation (3) weight is the weight value of the rule; (4) ip represents the network address of the fuzzy rule base on the network. The fuzzy rules of IF-PART and THEN-PART are represented by the tags <ANTECEDENT> and <CONSEQUENT>, respectively, <CLAUSEA> and <CLAUSEC> define the fuzzy clauses of IF-PART and THEN-PART, respectively, and (1)<VARIABLE > Label describes the fuzzy concept; (2) <TERM> label describes the fuzzy concept semantics; (3) <TSKPARAM> describes the TSK fuzzy control type THEN-PART parameters. Therefore, in the preferred embodiment, since FML is a general-purpose tag language for fuzzy inference, it has versatility and can express the rule base 1311 and the knowledge base 1312 in detail, and can be quickly constructed and applied to different networks by using FML in the future. Smart network monitoring system for road environment 1. As shown in FIG. 7 and FIG. 8 , the codes of the fuzzy inference knowledge base 1311 and the fuzzy inference rule base 1312 written in the FML language in the present embodiment are respectively used as the student dormitory Huai Yuanzhai on the campus of the applicant of Tainan University. The upload network traffic part of the code is an example).

In the example illustrated in Figures 6, 7, and 8, the right subtree in Figure 6 and its corresponding code Figure 8 illustrate the desire to obtain from Gezhilou (its building code is A) to Huaiyuanzhai (its building The fuzzy rule base used for the download traffic semantics of the entire building of Huaiyuanzhai with the code name E). In a system with four ports as shown in FIG. 6, since its representative has four input fuzzy variables, and each input fuzzy variable has five fuzzy sets, there are a total of 5 ⁴ = 625 fuzzy rules. As shown in the right subtree of Figure 6. Some of the sample code is shown in Figure 8.

The primary function of the alert unit 14 is to receive the output of the fuzzy inference engine 132 (the overall network traffic semantics). If the output is abnormal, such as High or Very High, the alarm unit 14 will notify the network administrator by means of email and/or mobile phone newsletter, and display a warning message on the network monitoring interface 15, first The time informs the network administrator and solves the problem, wherein the network monitoring interface 15 can be implemented, for example, by Network Weathermap technology. In the case of other normal traffic (Very low, Low, and Medium), the overall network traffic semantics is only displayed on the network monitoring interface 15 normally, without being sent via the alert unit 14 by email and/or Tell the network administrator how to use the mobile phone newsletter.

Therefore, the present invention can provide network real-time traffic semantics of a building in a network environment by cooperative operation of components such as the knowledge ontology repository 131, the fuzzy inference engine 13, the alarm unit 14, and the network monitoring interface 15. The final warning semantics that can be produced by the system 1 of the present invention. The main purpose of this warning is that the network administrator can use this warning to understand which network traffic is normal or urgent, and can understand the network status of the entire environment in the first time, instead of Passively waiting for notifications to understand the problem with the network. The system 1 of the present invention not only allows the network administrator to actively understand the network traffic status, but also further analyzes the network usage of the entire network environment through the data of the knowledge ontology repository 131.

The actual performance of the present invention is tested by implementing the technology of the system 1 of the present invention in a virtual experimental environment set up by the Knowledge Ontology Application and Software Engineering Laboratory of the National Taiwan University of Tainan.

Experiment 1 (normal state):

Referring to FIG. 5, the relationship between the network traffic and the corresponding possibility in this embodiment, the FML architecture diagram of FIG. 6, FIG. 9, and the following Tables 1, 2, the inventor of the present invention uses a certain point in time (December 24, 2008) At 22:22:55, the student dormitory (Huaiyuanzhai) immediately downloads traffic data and analyzes the instantaneous network traffic at this point in time. There are four main network traffic lines (or Ports) in this residence hall, which means that the building has four input fuzzy variables, so the input values of these four fuzzy variables can be retrieved. These four input values represent the instantaneous download traffic of the four networks in this student residence (as shown in Table 1 and Table 2). After the fuzzy inference of the four instant download traffic, the semantic meaning of the real-time network download traffic of the student dormitory is “very low”, and the experimental result is shown in the network monitoring interface 15 of FIG. 10, and it is known. The experimental results are consistent with the judgments of the network administrators.

Experiment 2 (abnormal state caused by loops):

Referring to Tables 3, 4 and 10 below, the inventors then simulate a situation in which one of the network routes causes a loop of the line flow, for example, someone accidentally connects the same network route to the network hole of the line source. At this point, the traffic of the entire network device 9 will be blocked by this loop, thus causing the maximum network traffic that the device network 9 can provide on this loop, which may further cause network congestion. Tables 3 and 4 show the network traffic data obtained in this case, which is processed by the system 1 of the present invention to generate a warning page as shown in FIG. As shown in FIG. 11, it shows that the overall building network traffic line is abnormal, and the alarm unit 14 in the present invention can further actively remind the manager of an abnormal phenomenon by means of an email or a mobile phone newsletter, so as to let the network The road management personnel quickly found out that the problem was the 埠5/1 of Huaiyuanzhai to achieve the alarm function of the system 1.

Experiment 3 (Using P2P software caused by abnormal state):

Refer to Tables 5, 6 and Figure 11 below. In addition, the inventor of the present invention also simulated another abnormality of network traffic based on historical data. In this state, the use of P2P software to download videos in the middle of the night caused the students to abnormally increase the traffic of the dormitory. As shown in the five sets of records in Table 5 from 00:00:00 on May 19, 2009 to 00:20:00 on May 19, 2009, when using the system 1 of the present invention to monitor network traffic, it can be found A student dormitory (Yiyouzhai) experienced a surge in network traffic during this time period and was caused by students using P2P software. Since P2P software is currently used to download illegal audio and video and software, many schools have begun to ban use, so the monitoring system 1 of the present invention can be used to detect whether such an abnormality occurs in the campus. As shown in FIG. 11, it is the warning page generated by the first group of records in Tables 5 and 6 (00:00:00 on May 19, 2009) after being processed by the system 1 of the present invention. As shown in FIG. 11, it shows the case where the download of the Yiyouzhai caused by the P2P software is abnormal.

In summary, when the network traffic is abnormal, the intelligent network monitoring system of the present invention can immediately provide a warning semantics in accordance with the human thinking mode, so as to inform the network administrator to take appropriate measures immediately. In addition, the construction cost of the present invention is affordable for general SMEs and schools, so that general SMEs and schools can save a large amount of custom network environment traffic monitoring costs, so the object of the present invention can be achieved.

The above is only the preferred embodiment of the present invention, and the scope of the invention is not limited thereto, that is, the simple equivalent changes and modifications made by the scope of the invention and the description of the invention are All remain within the scope of the invention patent.

1. . . Smart network monitoring system

11. . . Network traffic data retrieval unit

13. . . Fuzzy inference controller

131. . . Knowledge ontology repository

1311. . . Fuzzy inference knowledge base

1312. . . Fuzzy inference rule base

132. . . Fuzzy inference engine

14. . . Alarm unit

15. . . Network monitoring interface

8. . . Expert in network monitoring

9. . . Network device

1 is a system block diagram showing a preferred embodiment of the intelligent network monitoring system of the present invention;

2 is a tree diagram illustrating the knowledge ontology stored in the knowledge ontology repository in the preferred embodiment;

3 is a schematic diagram showing an example of the concept of a network device in the preferred embodiment;

4 is a schematic diagram showing an example of an example of a network device in the preferred embodiment;

Figure 5 is a graph illustrating an example of a membership function between a flow of a network line (or referred to as a Port) and an input fuzzy variable in the preferred embodiment;

6 is an architectural diagram illustrating the FML architecture diagram in the preferred embodiment (taking the uploading network traffic of the student dormitory Huaiyuanzhai on the campus of the applicant's Tainan University as an example);

Figure 7 is a block diagram showing an example of the FML code of the knowledge base in the preferred embodiment;

Figure 8 is a block diagram showing an example of the FML code of the rule base in the preferred embodiment;

9 is a computer operation screen illustrating the network monitoring interface of Experiment 1 in the preferred embodiment;

10 is a computer operation screen illustrating the network monitoring interface of Experiment 2 in the preferred embodiment; and

Figure 11 is a computer operation screen illustrating the network monitoring interface of Experiment 3 in the preferred embodiment.

1. . . Smart network monitoring system

11. . . Network traffic data retrieval unit

13. . . Fuzzy inference controller

131. . . Knowledge ontology repository

1311. . . Fuzzy inference knowledge base

1312. . . Fuzzy inference rule base

132. . . Fuzzy inference engine

14. . . Alarm unit

15. . . Network monitoring interface

8. . . Expert in network monitoring

9. . . Network device

Claims (5)

A smart network monitoring system for monitoring network traffic of a majority of network devices in a particular building, the system comprising: a network traffic data retrieval unit for extracting networks from the network devices Traffic data; a knowledge ontology repository for storing at least one knowledge of the network monitoring field provided by an expert in the field of network monitoring for the specific building, which is used to describe the domain knowledge of the specific building, including the domain layer , a category layer, a concept, an attribute, an operation, and an instance layer, wherein the knowledge ontology repository is constructed in such a way that the network devices are considered concepts and the key functions of the network devices are treated as concepts. The knowledge ontology repository includes a fuzzy inference knowledge base and a fuzzy inference rule base. The fuzzy inference knowledge base and the fuzzy inference rule base are constructed by using a fuzzy markup language, and the fuzzy inference knowledge base is used to store the network. The input fuzzy variable of all the lines of the network devices defined by the monitoring domain expert and the membership function of the majority semantics, and the fuzzy inference rule base is used Storing a plurality of fuzzy inference rules defined by experts in the network monitoring field; and a fuzzy inference engine for transmitting the network traffic data extraction unit based on the knowledge of the network monitoring domain in the knowledge ontology repository The network traffic data is converted into a network traffic semantics, wherein the fuzzy inference engine transmits the network traffic data extraction unit according to the membership function in the fuzzy inference knowledge base and the fuzzy inference rules. The network traffic data is converted into the output fuzzy variable of the particular building as the semantics of the network traffic for that particular building. According to the smart network monitoring system described in claim 1, the alarm network further includes an alarm unit for instantly transmitting the network through a predetermined method when the network traffic data of the network device is abnormal. The traffic is an abnormal alarm semantic. The smart network monitoring system according to claim 2, wherein the predetermined method is an email. According to the smart network monitoring system described in claim 2, wherein the predetermined method is a mobile phone newsletter. According to the intelligent network monitoring system described in claim 1, the network monitoring interface further includes a network monitoring interface for presenting the semantics of the network traffic.