WO2020227985A1 - Détection de défaut en temps réel sur des dispositifs et des circuits de réseau sur la base de statistiques de volume de trafic - Google Patents

Détection de défaut en temps réel sur des dispositifs et des circuits de réseau sur la base de statistiques de volume de trafic Download PDF

Info

Publication number
WO2020227985A1
WO2020227985A1 PCT/CN2019/087086 CN2019087086W WO2020227985A1 WO 2020227985 A1 WO2020227985 A1 WO 2020227985A1 CN 2019087086 W CN2019087086 W CN 2019087086W WO 2020227985 A1 WO2020227985 A1 WO 2020227985A1
Authority
WO
WIPO (PCT)
Prior art keywords
traffic
datum
net
baseline dataset
interval
Prior art date
Application number
PCT/CN2019/087086
Other languages
English (en)
Inventor
Shi ZHAO
Yuehua LIN
Hui Xu
Duncheng SHE
Miao Wang
Hui Liu
Original Assignee
Alibaba Group Holding Limited
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Alibaba Group Holding Limited filed Critical Alibaba Group Holding Limited
Priority to CN201980092647.2A priority Critical patent/CN113454950A/zh
Priority to PCT/CN2019/087086 priority patent/WO2020227985A1/fr
Publication of WO2020227985A1 publication Critical patent/WO2020227985A1/fr

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/14—Network analysis or design
    • H04L41/142—Network analysis or design using statistical or mathematical methods
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/14—Network analysis or design
    • H04L41/145—Network analysis or design involving simulating, designing, planning or modelling of a network
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/08—Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
    • H04L43/0876—Network utilisation, e.g. volume of load or congestion level
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/06—Management of faults, events, alarms or notifications
    • H04L41/0681—Configuration of triggering conditions
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/12—Network monitoring probes

Definitions

  • Embodiments of the present disclosure relate generally to the field of communication networks, and more specifically, to the field of network fault detection mechanisms.
  • a communication network is composed of links and nodes arranged in a certain topology for transporting Internet traffic.
  • the nodes include network devices interconnected through links, such as servers, switches and routers.
  • Today’s fault detection in commercial networks usually relies on user-defined alarm and rule violations based on measured indexes, which requires detailed knowledge of the characteristics and performance of the hardware and software constituents in a network infrastructure. For a single device or a simple network, fault detection is typically well understood and easy to accomplish.
  • Embodiments of the present disclosure are directed to systems and methods of real-time network fault detection in which traffic volume abnormity of network components are discovered by using dynamic statistics of traffic volume data and yet without the necessity of recognizing the detailed characteristics and operations of the monitored components.
  • embodiments of the present disclosure provide a mechanism of detecting abnormity in individual switch devices by periodically evaluating net traffic volume of a device against dynamically-updated statistics Net traffic volume corresponds to the difference between ingress and egress traffic volume of a device.
  • a statistic empirical model of net traffic volume may be constructed according to a machine learning process.
  • the model is initially established by using net traffic volume data collected on the device in a plurality of intervals, e.g., consecutive intervals.
  • each datum in baseline dataset of the model corresponds to the net traffic volume accumulated in each interval.
  • the model includes a function of a mean value and a standard deviation value of net traffic volume per interval.
  • the new datum is evaluated against the updated model to determine whether it is an outlier.
  • an alarm is generated, which may rigger further automatic or manual diagnostic, troubleshooting and repair actions.
  • a circuit includes a group of parallel links sharing the traffic load between two sides of the circuit, each side including one or more devices.
  • the links are functionally equal and the total traffic volume between the two sides can be distributed across the links in stable proportions absent faults. If one link faults, the other links can automatically take over the traffic load that cannot be accomplished by the fault link, and therefore the traffic distribution among the links (or “link traffic distribution” herein) changes.
  • embodiments provide a mechanism of detecting circuit abnormity by periodically comparing the real-time link traffic distribution in the circuit with a dynamically-updated statistic empirical model.
  • the model includes an expected link traffic distribution.
  • An expected link traffic distribution can be obtained by averaging a baseline dataset of link traffic distribution data that are collected in a plurality of intervals, e.g., consecutive intervals. For example, each datum in the dataset corresponds to a set of proportions of traffic that the links assume respectively in one interval.
  • a new datum of link traffic distribution is qualified and selected to update the baseline dataset. If yes, the new datum replaces the earliest datum in the baseline dataset to update the expected link traffic distributions. Regardless of whether it is used to update the model, the new datum is evaluated against the expected distributions to determine whether it is an outlier. In responsive to detection of a prescribed number of consecutive outliers, an alarm is generated, which may rigger further automatic or manual diagnostic, troubleshooting and repair actions.
  • network abnormity in a device or a circuit can be advantageously captured in fast responses regardless of complexity of the network infrastructures. Since the monitored statistics can be derived simply from traffic volume data, fault detection can be advantageously achieved by using readily-available data in a device or a circuit and an empirical model without requiring comprehensive knowledge of its detailed characteristics and operations.
  • a statistic model can reflect the most recent data probability distributions which can advantageously enhance effectiveness and accuracy of fault detection.
  • the model is tailored to the characteristics and operations of the device or circuit. This further contributes to fault detection accuracy.
  • Fig. 1 illustrates an exemplary communication network with fault detection equipment capable of detecting device faults and circuit faults in real-time based on statistics of traffic volume data in accordance with an embodiment of the present disclosure.
  • Fig. 2 is a flow chart depicting an exemplary computer implemented process of real-time device fault detection based on traffic volume statistics in accordance with an embodiment of the present disclosure.
  • Fig. 3 is a flow chart depicting an exemplary computer implemented process of statistic model construction and corresponding fault detection for a device in accordance with an embodiment of the present disclosure.
  • Fig. 4 illustrates changes in link traffic distribution of an exemplary circuit following a link fault.
  • Fig. 5 is a flow chart depicting an exemplary computer implemented process of real-time circuit fault detection based on traffic volume statistics in accordance with an embodiment of the present disclosure.
  • Fig. 6 is a flow chart depicting an exemplary computer implemented process of statistic model construction and corresponding fault detection for a circuit in accordance with an embodiment of the present disclosure.
  • Fig. 7 is a block diagram illustrating an exemplary computing system capable of real-time device fault detection and link detection based on traffic volume statistics in accordance with an embodiment of the present disclosure.
  • Embodiments of the present disclosure provide mechanisms of detecting network device or circuit faults based on real-time traffic volume data as well as the data statistics.
  • an empirical statistic model can be constructed by using a baseline dataset collected in a plurality of intervals, where the model is representative of a probability distribution of net traffic volume of the device per interval.
  • the model may include a set of statistic metrics or a function thereof, for example the metrics being a mean value and a standard deviation.
  • a new datum of net traffic volume of each interval is evaluated against the model to determine whether the datum of the interval is an outlier. Consecutive occurrences of outliers may trigger an alarm of fault. If qualified, the new datum can be randomly selected to update the baseline model. In this manner, the model is updated with the most recent normal data and therefore can accurately reflect the current characteristics and operations of the device.
  • an empirical statistic model is constructed by using a baseline dataset collected in a plurality of intervals, where the model is representative of the probability distribution of link traffic distribution per interval in the circuit.
  • the model may correspond to an expected link traffic distribution.
  • a new datum including a set of link traffic volumes or a link traffic distribution is evaluated against the model to determine whether the datum of the interval is an outlier. Consecutive occurrences of outliers may trigger an alarm of fault. If qualified, the new datum can be randomly selected to update the baseline model. In this manner, the model is updated with the most recent normal data and therefore can accurately reflect the current characteristics and operations of the device.
  • Fig. 1 illustrates an exemplary communication network 100 with fault detection equipment 121 and 122 capable of detecting device faults and circuit faults in real-time based on statistics of traffic volume data in accordance with an embodiment of the present disclosure.
  • the network 100 includes a plurality of network switches (e.g., routers) interconnected and arranged in multiple layers and each switch is configured to forward network traffic.
  • the switches belong to a network infrastructure controlled by the Internet Service Provider 110.
  • Terminals e.g., 131 are coupled to the switches and may be server devices or client devices. It will be appreciated that the present disclosure is not limited to any specific types of network topology or switch devices.
  • Each switch may be configured to collect traffic volume data of various forms, for example in compliance with the Simple Network Management Protocol (SNMP) .
  • SNMP Simple Network Management Protocol
  • the real-time traffic volume data can be used to construct a dynamically-updated statistic model for fault detection on devices and circuits in real-time.
  • the model construction and fault detection functions may be implemented in a separate monitoring device (e.g., device 141 or 142) that is coupled to the monitored (e.g., switch 121 or 122) .
  • the fault detection functions may be integrated in the switches.
  • the switch 122 collects its ingress and egress traffic volume periodically for supply to the monitoring device 142. It is assumed that a substantial variation in net traffic volume in a short time may be indicative of abnormity or fault in switch, where the net traffic volume corresponds to a difference between the total ingress traffic volume and the total egress traffic volume.
  • the monitoring device 142 constructs a statistic empirical model of the net traffic volume based on a baseline dataset supplied from the switch 122.
  • the model indicates a probability distribution of per-interval net traffic volume, according to which a normal zone and outlier zones are defined.
  • the model include as simple as a mean value and a standard deviation of the baseline dataset.
  • the present disclosure is not limited to any specific statistic metrics, functions, algorithms or formula related to net traffic volume used in the statistic model. For each interval, the new datum of net traffic volume is evaluated against the model to determine if it falls in an outlier zone. In addition, a qualified new datum may be selected to update model. If consecutive outliers are detected, an alarm may be generated to trigger following manual or automatic fault diagnosis actions.
  • the switches 121 and 123 and the several links 151 in between are configured as a circuit.
  • the traffic between the switches 121 and 123 is proportioned across the links 151 in a set of certain ratios.
  • the switch 123 collects its total ingress or egress traffic volume of each link periodically for supply to the monitoring device 141.
  • the monitoring device 141 constructs a statistic empirical model based on a baseline dataset supplied from the switch 123.
  • the model may indicate an expected link traffic distribution of the circuit.
  • a normal zone and outlier zones are defined based on the model.
  • a new datum includes a set of link traffic volumes or a current link traffic distribution, which is evaluated against the expected distribution to determine if the new datum falls in an outlier zone.
  • a qualified new datum may be selected to update model. If consecutive outliers are detected, an alarm may be generated to trigger following manual or automatic fault diagnosis actions.
  • network abnormity in a device or a circuit can be advantageously captured in fast responses despite complexity of the network infrastructures. Since the monitored statistic metrics can be derived from traffic volumes, fault detection can be advantageously achieved by using readily-available data in a device or a circuit and an empirical model without requiring comprehensive knowledge of its detailed characteristics, performance and operations.
  • the models reflect the most recent data probability distributions which can advantageously enhance effectiveness and accuracy of fault detection. Furthermore, as a model is constructed and updated by using the empirical data collected from the particular device or circuit, the model is still tailored to the monitored device or circuit. This further contributes to fault detection accuracy.
  • Fig. 2 is a flow chart depicting an exemplary computer implemented process 200 of real-time device fault detection based on traffic volume statistics in accordance with an embodiment of the present disclosure.
  • Process 200 may be performed by a monitoring device that is communicatively coupled to a monitored switch device, or by a monitoring module integrated in a monitored switch device.
  • a statistic empirical model of net traffic volume per interval is generated based on an initial baseline dataset.
  • the dataset includes net traffic volume data of N consecutive intervals, e.g., each interval being 1 minute and N being 2000.
  • the particular numbers herein are merely exemplary and the present disclosure is not limited thereto.
  • the interval duration and the sample size can be selected by considering factors like data collection noise caused by various engineering limitations, statistic properties of traffic distribution, and adequate representation of the probability distribution.
  • Each datum in the dataset is a per-interval net traffic volume which corresponds to a difference between the total ingress traffic volume and the total egress traffic volume accumulated in one interval.
  • the ingress and egress total traffic volumes may be sums of traffic across all the ingress ports and egress ports of the device, respectively.
  • the ingress and egress traffic volume data may be collected in real-time at the monitored device and supplied to the monitoring device or the monitoring module for fault detection purposes.
  • a normal zone and one or more outlier zones are defined.
  • the real-life net traffic volume data may follow a normal probability distribution; however, the present disclosure is not limited thereto.
  • the statistic model involves a mean value and a standard deviation of the baseline dataset, and the outlier zones and the normal zone can be defined by a function of the mean value and the standard deviation, as described in greater detail with reference to Fig. 3 below.
  • net traffic volume data of the device is generated periodically, e.g., per minute, in the same manner of generating the baseline dataset at 201.
  • the statistic model is updated in real-time with new net traffic volume data while maintaining the data count in the baseline dataset.
  • each new net traffic volume datum is evaluated against the updated statistic model to determine whether it is in an outlier zone thereof.
  • an alarm is generated which may trigger various further operations such as fault verification, diagnostic operations, and etc. For example, M is predefined as 3.
  • Fig. 3 is a flow chart depicting an exemplary computer implemented process 300 of statistic model construction and corresponding fault detection for a device in accordance with an embodiment of the present disclosure.
  • the interval index “i” is set to 1.
  • a net traffic volume datum Di of the interval Ti is determined based on detected real-time ingress and egress traffic volumes accumulated in the interval.
  • a datum is qualified on the conditions that (1) both the total ingress volume and the total egress volume in the interval are greater than a particular number, e.g., 1 Mbit per sec (BPS) ; and (2) the previous datum (i-1) is a normal one, as described below.
  • BPS 1 Mbit per sec
  • i-1 the previous datum
  • various other qualification conditions can be used without departing from the scope of the present disclosure. If it is not a qualified datum, the index i is incremented at 311 to evaluate the next datum.
  • the baseline dataset of the statistic model For a qualified datum, it is determined whether to add it to the baseline dataset of the statistic model. Particularly, at 304, it is determined whether the current baseline dataset has less than 2000 counts. If yes, at 305, the new datum Di is added to the baseline dataset for initial construction of the statistic model, e.g., obtaining the mean value and the standard deviation of the dataset. In some embodiments, the mean value (m) is calculated as
  • sd sd (log (D1) , ...log (Di) , ..., log (DN) ) .
  • Di is directly, it is further determined whether Di is an outlier at 306. For example, it is defined that Di is an outlier if (Di-mean) /sd >3. If Di is not an outlier, Di is incorporated to the baseline dataset and replaces the earliest datum in the dataset at 307; and the mean and standard deviation of net traffic volume are updated accordingly at 305. Once the model is updated with Di at 305, the index i is incremented at 311 to evaluate the next datum.
  • Di is the 3 rd outlier detected in a row. If yes, it means that there have been 3 consecutive outliers and a fault alarm is generated at 310. At 310, the index i is incremented. The foregoing process 302 ⁇ 312 is repeated per interval.
  • Di may be randomly selected to according to a prescribed chance, e.g., 50%. If Di is selected, the earliest datum in the dataset is replaced with Di and thereby the statistic model is updated. For example, Di is incorporated in recalculating the mean value and the standard deviation. If the current baseline dataset has reached 2000, Di is added to the baseline dataset without replacing any datum and used to recalculate the mean value and the standard deviation.
  • a prescribed chance e.g. 50%.
  • a circuit is composed of a first side A and a second side B as well as several parallel links that are functionally equivalent and can share the traffic load between A and B.
  • Each side has ingress and egress traffic.
  • Any of the traffic volumes A_in, A_out, B_in and B_out can be used to characterize the circuit for fault detection purposes according to embodiments of the present disclosure.
  • the examples described in detail herein may refer to the traffic volume of any combination of side and direction.
  • FIG. 4 illustrates changes in link traffic distribution of an exemplary circuit following a link fault.
  • the 4 links 401-404 respectively assume 20%, 30%, 40%and 10%of the total traffic volume, e.g., the traffic flowing into ⁇ side A.
  • link 401 faults its proportion drops to 0%, while the rest become 40%, 40%and 20%.
  • Fig. 5 is a flow chart depicting an exemplary computer implemented process 500 of real-time circuit fault detection based on traffic volume statistics in accordance with an embodiment of the present disclosure.
  • Process 500 may be performed by a monitoring device that is communicatively coupled to the switches in a monitored circuit, or by a monitoring module in a monitored circuit.
  • a statistic empirical model representative of link traffic distribution is generated based on an initial baseline dataset.
  • the dataset includes link traffic distribution data of N intervals, e.g., each interval being 1 minute and N being 100.
  • the particular numbers are merely exemplary and the present disclosure is not limited thereto.
  • the interval duration and the sample size can be selected by considering factors like data collection noise caused by various engineering limitations, statistic properties of traffic distribution, and adequate representation of the probability distribution.
  • Each datum in the dataset corresponds to the respective traffic proportions assumed by all the links in a certain direction (either ingress or egress) on one side of the circuit.
  • the traffic volume data of each link may be collected in each interval and supplied to the monitoring device or the monitoring module for fault detection purposes.
  • the model may correspond to an expected link traffic distribution, which includes a set of expected link traffic proportions.
  • an expected proportion of a link may be obtained by averaging the traffic proportions of the link over the baseline dataset.
  • a normal zone and one or more outlier zones can be defined as a function of the expected link traffic distribution.
  • the traffic volume data of the links are collected and the link traffic distribution data are generated periodically, e.g., per minute, in the same manner of generating the baseline dataset at 501.
  • the statistic model is updated in real-time with new link traffic distribution data while maintaining the data count in the baseline dataset.
  • each new link traffic distribution datum is evaluated against the updated statistic model to determine whether it is in an outlier zone thereof.
  • an alarm is generated which may trigger various further operations such as fault verification, diagnostic operations, and etc.
  • M is predefined as 3.
  • Fig. 6 is a flow chart depicting an exemplary computer implemented process 600 of statistic model construction and corresponding fault detection for a circuit in accordance with an embodiment of the present disclosure.
  • the interval index “i” is set to 1.
  • Ai may include the ingress link traffic proportions derived from the link traffic volumes or any other suitable variant of link traffic volumes representative of link traffic distribution.
  • Ai is a qualified datum, e.g., whether the number of functional links that can provide effective traffic volume data has changed in the last 3 consecutive intervals. If yes, a fault alarm is generated at 604.
  • the baseline dataset of the statistic model For a qualified datum, it is then determined whether to add it to the baseline dataset of the statistic model. Particularly, at 605, it is determined whether the current baseline dataset has less than 100 counts. If yes, the new datum Ai is added to the baseline dataset for initial construction of the statistic model, e.g., obtaining the expected link traffic distribution based on the dataset. At 614, the index i is incremented.
  • the expected distribution corresponds to the average distribution over the baseline dataset. It will be appreciated that the various other forms of average or other statistic metrics can be used without departing from the scope of the present disclosure.
  • the distance between the current link traffic distribution and the expected link traffic distribution is evaluated at 607, and the result is then used to judge whether Ai is an outlier at 608. For example, it is defined that Ai is an outlier if
  • V j_i fis the ingress traffic volume of link j in interval i;
  • V all is the total ingress traffic volume across all the links; is the expected proportion of traffic volume of link j in each interval according to the model;
  • X is a prescribed threshold value.
  • Ai is an outlier, it is recorded so at 610.
  • the index i is incremented. If Ai is not an outlier, the earliest datum in the dataset is replaced with Ai and thereby the statistic model is updated at 606. For example, Ai is incorporated in recalculating the expected link traffic distribution.
  • the index i is then incremented. The foregoing process 602 ⁇ 614 is repeated per interval.
  • Ai is randomly selected according to a prescribed chance at 606, e.g., 10%. If Ai is selected, the earliest datum in the dataset is replaced with Ai and thereby the statistic is updated.
  • Fig. 7 is a block diagram illustrating an exemplary computing system 700 capable of real-time device fault detection and link detection based on traffic volume statistics in accordance with an embodiment of the present disclosure.
  • the computing system comprises a main processor (CPU) 701, a system memory 702, a graphics processing unit (GPU) 703, I/O interfaces 704 and network circuits 705, an operating system 706 and application software 710 including real-time fault detection modules 720 and 730 stored in the memory 702.
  • the system 700 is communicatively coupled to a switch device through the network interfaces.
  • the device fault detection module 720 can detect device faults in real-time based on the traffic volume statistics as described in greater detail with reference to Figs. 1-3.
  • the device fault detection module 720 includes a net traffic data generation module 721, a baseline dataset module 722, a statistic model module 722 and a device fault processing module 724.
  • the net traffic data generation module 721 is configured to calculate the difference of ingress and egress traffic volumes of the switch device 750 per interval.
  • the baseline dataset module 722 that maintains a fixed count of baseline dataset by selectively admitting qualified new data while removing the earliest ones.
  • the statistic model module 723 can calculate the mean and standard deviation of the baseline dataset, and update these statistic metrics each time the baseline dataset is updated with a new datum.
  • the device fault processing module 724 can determine whether a new datum is an outlier based on the model, generate alarms in responsive to detection consecutive outliers, and perform various other operations of fault detection, verification and diagnosis.
  • the link fault detection module 720 can detect link faults in real-time based on the traffic volume statistics as described in greater detail with reference to Figs. 4-6.
  • the link fault detection module 730 includes a link traffic distribution generation module 731, a baseline dataset module 732, a statistic model module 733 and a link fault processing module 724.
  • the link traffic distribution generation module 731 is configured to calculate the link traffic proportions in the circuit per interval.
  • the baseline dataset module 732 that maintains a fixed count of baseline dataset by selectively admitting qualified new data while removing the earliest ones.
  • the statistic model module 733 can calculate the expected link traffic distribution, and update the expected distribution when the baseline dataset is updated with a new datum.
  • the link fault processing module 734 can determine whether a new datum is an outlier based on the model, generate alarms in responsive to detection consecutive outliers, and various other operations of fault detection, verification and diagnosis.
  • the fault detection modules 720 and 730 can be implemented in any one or more suitable programming languages that are known to those skilled in the art. In some embodiments, a system includes only one of the fault detection modules 720 and 730.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Environmental & Geological Engineering (AREA)
  • Physics & Mathematics (AREA)
  • Algebra (AREA)
  • General Physics & Mathematics (AREA)
  • Mathematical Analysis (AREA)
  • Mathematical Optimization (AREA)
  • Mathematical Physics (AREA)
  • Probability & Statistics with Applications (AREA)
  • Pure & Applied Mathematics (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

La présente invention concerne des systèmes et des procédés de détection d'anomalie dans des dispositifs de commutation de réseau ou dans des circuits de réseau en temps réel sur la base de statistiques de volume de trafic. Dans la détection de défaillance de dispositif, un modèle empirique statistique de volume de trafic net est construit selon un ensemble de données de ligne de base, chaque donnée correspondant au volume de trafic net accumulé dans chaque intervalle. Dans la détection de défaillance de circuit, un modèle empirique statistique de distribution de trafic de liaison est construit selon un ensemble de données de ligne de base, chaque donnée correspondant à la distribution de trafic de liaison dans chaque intervalle. Dans les deux cas, après la construction initiale, le modèle est mis à jour dynamiquement à l'aide de nouvelles données qualifiées et sélectionnées. Chaque nouvelle donnée est évaluée par rapport au modèle mis à jour pour déterminer s'il s'agit d'une valeur aberrante. Des valeurs aberrantes consécutives peuvent déclencher une alarme de défaillance.
PCT/CN2019/087086 2019-05-15 2019-05-15 Détection de défaut en temps réel sur des dispositifs et des circuits de réseau sur la base de statistiques de volume de trafic WO2020227985A1 (fr)

Priority Applications (2)

Application Number Priority Date Filing Date Title
CN201980092647.2A CN113454950A (zh) 2019-05-15 2019-05-15 基于流量统计的网络设备及链路实时故障检测方法和系统
PCT/CN2019/087086 WO2020227985A1 (fr) 2019-05-15 2019-05-15 Détection de défaut en temps réel sur des dispositifs et des circuits de réseau sur la base de statistiques de volume de trafic

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2019/087086 WO2020227985A1 (fr) 2019-05-15 2019-05-15 Détection de défaut en temps réel sur des dispositifs et des circuits de réseau sur la base de statistiques de volume de trafic

Publications (1)

Publication Number Publication Date
WO2020227985A1 true WO2020227985A1 (fr) 2020-11-19

Family

ID=73289095

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/087086 WO2020227985A1 (fr) 2019-05-15 2019-05-15 Détection de défaut en temps réel sur des dispositifs et des circuits de réseau sur la base de statistiques de volume de trafic

Country Status (2)

Country Link
CN (1) CN113454950A (fr)
WO (1) WO2020227985A1 (fr)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112887123A (zh) * 2021-01-06 2021-06-01 新浪网技术(中国)有限公司 一种基于调用链的业务报警方法、系统及装置
CN116938684A (zh) * 2023-09-19 2023-10-24 北京锐服信科技有限公司 一种网络故障诊断方法与系统

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1368667A (zh) * 2001-02-02 2002-09-11 刘峰 容错阵列服务器
US20110093740A1 (en) * 2002-04-05 2011-04-21 Tsao Sheng Tai Ted Distributed Intelligent Virtual Server
CN104954192A (zh) * 2014-03-27 2015-09-30 东华软件股份公司 一种网络流量监测方法和设备
CN105718715A (zh) * 2015-12-23 2016-06-29 华为技术有限公司 异常检测方法和设备

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103081407B (zh) * 2011-03-03 2015-11-25 株式会社日立制作所 故障分析装置、故障分析系统及故障分析方法
MY172616A (en) * 2013-03-13 2019-12-06 Telekom Malaysia Berhad A system for analysing network traffic and a method thereof
CN104717106B (zh) * 2015-03-04 2015-12-09 贵州电网公司信息通信分公司 一种基于多变量序贯分析的分布式网络流量异常检测方法
CN107888441B (zh) * 2016-09-30 2022-03-18 全球能源互联网研究院 一种网络流量基线自学习自适应方法
CN107276808A (zh) * 2017-06-21 2017-10-20 北京华创网安科技股份有限公司 一种流量异常监测的优化方法
CN107733921A (zh) * 2017-11-14 2018-02-23 深圳中兴网信科技有限公司 网络流量异常检测方法、装置、计算机设备和存储介质

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1368667A (zh) * 2001-02-02 2002-09-11 刘峰 容错阵列服务器
US20110093740A1 (en) * 2002-04-05 2011-04-21 Tsao Sheng Tai Ted Distributed Intelligent Virtual Server
CN104954192A (zh) * 2014-03-27 2015-09-30 东华软件股份公司 一种网络流量监测方法和设备
CN105718715A (zh) * 2015-12-23 2016-06-29 华为技术有限公司 异常检测方法和设备

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112887123A (zh) * 2021-01-06 2021-06-01 新浪网技术(中国)有限公司 一种基于调用链的业务报警方法、系统及装置
CN116938684A (zh) * 2023-09-19 2023-10-24 北京锐服信科技有限公司 一种网络故障诊断方法与系统
CN116938684B (zh) * 2023-09-19 2023-12-26 北京锐服信科技有限公司 一种网络故障诊断方法与系统

Also Published As

Publication number Publication date
CN113454950A (zh) 2021-09-28

Similar Documents

Publication Publication Date Title
US9672085B2 (en) Adaptive fault diagnosis
US20220210176A1 (en) Systems and methods to detect abnormal behavior in networks
US8635498B2 (en) Performance analysis of applications
US11765437B2 (en) Automatic diagnostics alerts
US7437611B2 (en) System and method for problem determination using dependency graphs and run-time behavior models
US8140454B2 (en) Systems and/or methods for prediction and/or root cause analysis of events based on business activity monitoring related data
WO2018103453A1 (fr) Procédé et appareil de détection de réseau
US20160378583A1 (en) Management computer and method for evaluating performance threshold value
CN112398680B (zh) 一种故障定界方法及设备
US20060215575A1 (en) System and method for monitoring and reacting to peer-to-peer network metrics
US8355341B2 (en) Delay time measurement apparatus, storage medium storing delay time measurement program and network system
JP6097889B2 (ja) 監視システム、監視装置、および検査装置
US20150103642A1 (en) Diagnosing connectivity in a network
US9524223B2 (en) Performance metrics of a computer system
EP3222004B1 (fr) Test de diagnostic dans des réseaux
CN112615888B (zh) 一种网络攻击行为的威胁评估方法及装置
CN111010291A (zh) 业务流程异常告警方法、装置、电子设备及存储介质
US10291493B1 (en) System and method for determining relevant computer performance events
WO2020227985A1 (fr) Détection de défaut en temps réel sur des dispositifs et des circuits de réseau sur la base de statistiques de volume de trafic
CN111611146B (zh) 一种微服务故障预测方法和装置
CN113259168A (zh) 一种故障根因分析方法及装置
CN112988446B (zh) 一种故障根因检测方法及装置
CN113986595A (zh) 一种异常定位方法及装置
CN107911762A (zh) 一种基于决策树的onu故障诊断方法
KR102234054B1 (ko) 리스크 평가 장치, 리스크 평가 시스템, 리스크 평가 방법, 리스크 평가 프로그램 및 데이터 구조

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19928447

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 19928447

Country of ref document: EP

Kind code of ref document: A1