Nothing Special   »   [go: up one dir, main page]

CN114531374A - Network monitoring method, device, equipment and storage medium - Google Patents

Network monitoring method, device, equipment and storage medium Download PDF

Info

Publication number
CN114531374A
CN114531374A CN202210180843.9A CN202210180843A CN114531374A CN 114531374 A CN114531374 A CN 114531374A CN 202210180843 A CN202210180843 A CN 202210180843A CN 114531374 A CN114531374 A CN 114531374A
Authority
CN
China
Prior art keywords
early warning
time period
total number
messages
devices
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Granted
Application number
CN202210180843.9A
Other languages
Chinese (zh)
Other versions
CN114531374B (en
Inventor
黄佳鹏
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Shenzhen Ping An Smart Healthcare Technology Co ltd
Original Assignee
Ping An International Smart City Technology Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Ping An International Smart City Technology Co Ltd filed Critical Ping An International Smart City Technology Co Ltd
Priority to CN202210180843.9A priority Critical patent/CN114531374B/en
Publication of CN114531374A publication Critical patent/CN114531374A/en
Application granted granted Critical
Publication of CN114531374B publication Critical patent/CN114531374B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00Arrangements for monitoring or testing data switching networks
    • H04L43/08Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/06Management of faults, events, alarms or notifications
    • H04L41/0681Configuration of triggering conditions
    • YGENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
    • Y02TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
    • Y02PCLIMATE CHANGE MITIGATION TECHNOLOGIES IN THE PRODUCTION OR PROCESSING OF GOODS
    • Y02P90/00Enabling technologies with a potential contribution to greenhouse gas [GHG] emissions mitigation
    • Y02P90/02Total factory control, e.g. smart factories, flexible manufacturing systems [FMS] or integrated manufacturing systems [IMS]

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Environmental & Geological Engineering (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

The invention relates to the technical field of data processing, and discloses a network monitoring method, which comprises the following steps: acquiring the number of historical messages of a plurality of devices in a historical time period; determining the device labels of all devices in a plurality of preset time periods according to the historical time periods and the historical message number; acquiring the current message quantity of all equipment in the current time period in real time; determining a target preset time period to which the current time period belongs, acquiring a total number of target expected messages corresponding to the target preset time period, comparing the total number of the target expected messages with the current message number, and judging whether to generate early warning information or not based on a comparison result; and when the early warning information is generated, sending the early warning information to a management user corresponding to an early warning platform. When the expected message total number is designed, the environmental factors of the equipment are considered, and the data reasonable interval of the expected message total number of the equipment enables the generation of the early warning information to be more accurate.

Description

Network monitoring method, device, equipment and storage medium
Technical Field
The present application relates to the field of data processing technologies, and in particular, to a network monitoring method, apparatus, device, and storage medium.
Background
With the development of network technology, more and more scenes relate to a multi-network docking scene. Such as: e-commerce websites need to be in network connection with logistics companies to inquire goods logistics information in real time; the financial system needs to be connected with a credit investigation system and calls client credit investigation information to support financial services; the internet of things equipment terminal needs to be connected to a service end cloud network through an internet of things network in an interfacing mode.
In the prior art, although the operation condition of a system basic network can be monitored, the conditions of cluster hardware and network resources can be easily monitored, but the condition that the service of cluster equipment fails cannot be monitored.
Disclosure of Invention
In view of the above, the present invention provides a network monitoring method, device, equipment and storage medium, and aims to solve the technical problem that the failure of the service of the cluster equipment cannot be monitored in the prior art.
In order to achieve the above object, the present invention provides a network monitoring method, including:
acquiring the number of historical messages of a plurality of devices in a historical time period;
determining device labels of all devices in a plurality of preset time periods according to the historical time periods and the historical message quantity, wherein the device labels comprise the total expected message quantity of all devices in the preset time periods;
acquiring the current message quantity of all equipment in the current time period in real time;
determining a target preset time period to which the current time period belongs, acquiring a total number of target expected messages corresponding to the target preset time period, comparing the total number of the target expected messages with the current message number, and judging whether to generate early warning information based on a comparison result, wherein the early warning information comprises early warning levels;
and when the early warning information is generated, sending the early warning information to a management user corresponding to an early warning platform.
Preferably, the determining, according to the historical time period and the historical message number, device tags of all devices in a plurality of preset time periods, where the device tags include a total number of expected messages of all devices in a preset time period, includes:
acquiring the total number of the devices of the plurality of devices, and calculating the total number of expected messages according to the historical message number and the total number of the devices;
determining a device tag based on the expected total number of messages.
Preferably, the determining, according to the historical time period and the historical message number, device tags of all devices in a plurality of preset time periods, where the device tags include a total number of expected messages of all devices in the preset time periods, further includes:
acquiring a preset fault-tolerant coefficient and a preset temporary coefficient;
and determining a data reasonable interval of the total number of expected messages corresponding to the equipment label according to the preset fault-tolerant coefficient and the preset temporary coefficient.
Preferably, the calculation formula of the data reasonable interval is as follows:
and the data reasonable interval is the total number of the expected messages [ 1-fault-tolerant coefficient, 1+ fault-tolerant coefficient ] [ temporary coefficient min value, temporary coefficient Max value ].
Preferably, the obtaining, in real time, the current message number of all the devices in the current time period includes:
and monitoring the equipment through a CAT distributed monitoring system, and acquiring the number of the sent messages in real time.
Preferably, the determining the target preset time period to which the current time period belongs, obtaining a total number of target expected messages corresponding to the target preset time period, comparing the total number of target expected messages with the current number of messages, and determining whether to generate the warning information based on a comparison result includes:
if the error value between the first time period and the current message quantity is larger than a first preset value, early warning is carried out;
and if the error value between the second time period and the current message quantity is greater than a second preset value, early warning is carried out.
Preferably, when the early warning information is generated, sending the early warning information to a management user corresponding to an early warning platform includes:
sending the early warning information to a management user corresponding to the early warning platform for confirmation;
and receiving the false alarm information fed back by the management user, and correcting the fault tolerance coefficient value.
In order to achieve the above object, the present invention further provides a network monitoring apparatus, including:
the device comprises a first acquisition module, a second acquisition module and a third acquisition module, wherein the first acquisition module is used for acquiring the number of historical messages of a plurality of devices in a historical time period;
a determining module, configured to determine device tags of all devices in a plurality of preset time periods according to the historical time periods and the historical message number, where the device tags include total expected messages of all devices in the preset time periods;
the second acquisition module is used for acquiring the current message quantity of all the devices in the current time period in real time;
the early warning module is used for determining a target preset time period to which the current time period belongs, acquiring a total number of target expected messages corresponding to the target preset time period, comparing the total number of the target expected messages with the current number of the messages, and judging whether to generate early warning information or not based on a comparison result, wherein the early warning information comprises an early warning level;
and the sending module is used for sending the early warning information to a management user corresponding to the early warning platform when the early warning information is generated.
In order to achieve the above object, the present invention also provides an electronic device, including:
at least one processor; and the number of the first and second groups,
a memory communicatively coupled to the at least one processor; wherein,
the memory stores a program executable by the at least one processor, the program being executable by the at least one processor to enable the at least one processor to perform the network monitoring method.
In order to achieve the above object, the present invention further provides a computer-readable storage medium storing a network monitoring program, where the network monitoring program, when executed by a processor, implements the steps of the network monitoring method.
According to the invention, the historical information of a plurality of devices in a preset time period is collected through the device server, the device labels are determined according to the historical information, the plurality of devices are monitored according to the device labels, and the early warning information is generated according to the monitoring result, so that the devices can be effectively and dynamically monitored; and the total number of the expected messages is designed, and the environmental factors of the equipment and the reasonable data interval of the total number of the expected messages of the equipment are considered when the total number of the expected messages is designed, so that the generation of the early warning information is more accurate.
Drawings
In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed to be used in the embodiments or the prior art descriptions will be briefly described below, and it is obvious that the drawings in the following description are only some embodiments of the present application, and it is obvious for those skilled in the art to obtain other drawings based on these drawings without creative efforts.
FIG. 1 is a diagram of an electronic device according to a preferred embodiment of the present invention;
FIG. 2 is a block diagram of a preferred embodiment of the network monitoring device of FIG. 1;
FIG. 3 is a flow chart of a preferred embodiment of a network monitoring method according to the present invention;
the implementation, functional features and advantages of the objects of the present invention will be further explained with reference to the accompanying drawings.
Detailed Description
In order to make the objects, technical solutions and advantages of the present invention more apparent, the present invention is described in further detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present invention.
Fig. 1 is a schematic diagram of an electronic device 1 according to a preferred embodiment of the invention.
The electronic device 1 includes but is not limited to: memory 11, processor 12, display 13, and network interface 14. The electronic device 1 is connected to a network through a network interface 14 to obtain raw data. The network may be a wireless or wired network such as an Intranet (Internet), the Internet (Internet), a Global System for mobile communications (GSM), Wideband Code Division Multiple Access (WCDMA), a 4G network, a 5G network, Bluetooth (Bluetooth), or a Wi-Fi communication network.
The memory 11 includes at least one type of readable storage medium including a flash memory, a hard disk, a multimedia card, a card type memory (e.g., SD or DX memory, etc.), a Random Access Memory (RAM), a Static Random Access Memory (SRAM), a Read Only Memory (ROM), an Electrically Erasable Programmable Read Only Memory (EEPROM), a Programmable Read Only Memory (PROM), a magnetic memory, a magnetic disk, an optical disk, etc. In some embodiments, the storage 11 may be an internal storage unit of the electronic device 1, such as a hard disk or a memory of the electronic device 1. In other embodiments, the memory 11 may also be an external storage device of the electronic device 1, such as a plug-in hard disk, a Smart Media Card (SMC), a Secure Digital (SD) Card, a Flash memory Card (Flash Card), and the like equipped with the electronic device 1. Of course, the memory 11 may also comprise both an internal memory unit and an external memory device of the electronic device 1. In this embodiment, the memory 11 is generally used for storing an operating system installed in the electronic device 1 and various application software, such as a program code of the network monitoring program 10. Further, the memory 11 may also be used to temporarily store various types of data that have been output or are to be output.
Processor 12 may be a Central Processing Unit (CPU), controller, microcontroller, microprocessor, or other data Processing chip in some embodiments. The processor 12 is typically used for controlling the overall operation of the electronic device 1, such as performing data interaction or communication related control and processing. In this embodiment, the processor 12 is configured to run the program code stored in the memory 11 or process data, for example, run the program code of the network monitoring program 10.
The display 13 may be referred to as a display screen or display unit. In some embodiments, the display 13 may be an LED display, a liquid crystal display, a touch-sensitive liquid crystal display, an Organic Light-emitting diode (OLED) touch screen, or the like. The display 13 is used for displaying information processed in the electronic device 1 and for displaying a visual work interface, e.g. displaying the results of data statistics.
The network interface 14 may optionally comprise a standard wired interface, a wireless interface (e.g. WI-FI interface), the network interface 14 typically being used for establishing a communication connection between the electronic device 1 and other electronic devices.
Fig. 1 shows only the electronic device 1 with components 11-14 and the network monitoring program 10, but it is to be understood that not all of the shown components are required to be implemented, and that more or fewer components may be implemented instead.
Optionally, the electronic device 1 may further comprise a target user interface, the target user interface may comprise a Display (Display), an input unit such as a Keyboard (Keyboard), and the optional target user interface may further comprise a standard wired interface and a wireless interface. Alternatively, in some embodiments, the display may be an LED display, a liquid crystal display, a touch-sensitive liquid crystal display, an Organic Light-Emitting Diode (OLED) touch screen, or the like. The display, which may also be referred to as a display screen or display unit, is suitable for displaying information processed in the electronic device 1 and for displaying a visualized target user interface, among other things.
The electronic device 1 may further include a Radio Frequency (RF) circuit, a sensor, an audio circuit, and the like, which are not described in detail herein.
In the above embodiment, the processor 12, when executing the network monitoring program 10 stored in the memory 11, may implement the following steps:
acquiring the number of historical messages of a plurality of devices in a historical time period;
determining device labels of all devices in a plurality of preset time periods according to the historical time periods and the historical message quantity, wherein the device labels comprise the total expected message quantity of all devices in the preset time periods;
acquiring the current message quantity of all equipment in the current time period in real time;
determining a target preset time period to which the current time period belongs, acquiring a total number of target expected messages corresponding to the target preset time period, comparing the total number of the target expected messages with the current message number, and judging whether to generate early warning information or not based on a comparison result, wherein the early warning information comprises an early warning level;
and when the early warning information is generated, sending the early warning information to a management user corresponding to an early warning platform.
For detailed description of the above steps, please refer to the following description of fig. 2 regarding a functional block diagram of an embodiment of the network monitoring apparatus 100 and fig. 3 regarding a flowchart of an embodiment of the network monitoring method.
Referring to fig. 2, a functional block diagram of the network monitoring apparatus 100 according to the present invention is shown.
The network monitoring apparatus 100 of the present invention may be installed in an electronic device. According to the implemented functions, the network monitoring apparatus 100 may include: the system comprises a first acquisition module 110, a determination module 120, a second acquisition module 130, an early warning module 140 and a sending module 150. The module of the present invention, which may also be referred to as a unit, refers to a series of computer program segments that can be executed by a processor of an electronic device and that can perform a fixed function, and that are stored in a memory of the electronic device.
In the present embodiment, the functions regarding the respective modules/units are as follows:
the first obtaining module 110 is configured to obtain a historical message number of the plurality of devices in a historical time period.
Specifically, the access module is connected with the devices to obtain the historical messages of each device in the historical time period, and the historical messages are counted to obtain the number of the historical messages, which is the number of the historical messages of all the devices and can be understood as the flow. The historical time period may be a day, a week, a month, a year, etc. of the historical time, and is not limited herein.
Further, the historical message quantity of the multiple devices in a preset time period can be directly obtained through the server, or the historical message quantity is transmitted to the back-end server by the devices for subsequent early warning judgment operation. The message transmitted by each device may be preset, for example, if the device is a logistics service and corresponds to a logistics vehicle, a data collector may be installed on the device, and the data collector may send messages such as a travel, a repair condition, and a service time of the logistics vehicle in real time. And the back-end server performs calculation according to the received historical information, and monitors the equipment according to the calculation result. The cross-network monitoring can be realized by calculating through the back-end server under the conditions that the network of the equipment is not invaded and the extra expense is not generated by the network of the equipment.
A determining module 120, configured to determine device tags of all devices in multiple preset time periods according to the historical time periods and the historical message numbers, where the device tags include total expected messages of all devices in the preset time periods.
Specifically, the device tags are set in advance according to the service requirements, and include the average daily message number D and the average hourly message numbers H0, H1 to H23, which are used to represent the number of messages that each device can accommodate within a preset time period. The preset time period comprises a first preset time period and a second preset time period, wherein the first preset time period is each small time period, and the second preset time period is one day. And the expected message total number of each device is calculated through the device tag, so that the message amount of each device can be monitored based on the expected message total number. Counting the historical message numbers of the plurality of devices according to time, counting the total number of messages in preset time periods such as every hour, every day and the like, acquiring the total number of the devices corresponding to the plurality of devices, calculating a message average value number according to the total number of the devices and the total number of the messages, and associating the message average value number with the device label, namely the device label.
Further, the determining, according to the historical time period and the historical message number, device tags of all devices in a plurality of preset time periods, where the device tags include a total number of expected messages of all devices in a preset time period includes:
acquiring the total number of the devices of the plurality of devices, and calculating the total number of expected messages according to the historical message number and the total number of the devices;
determining a device tag based on the expected total number of messages.
Further, the determining, according to the historical time period and the historical message number, device tags of all devices in a plurality of preset time periods, where the device tags include a total number of expected messages of all devices in the preset time periods, and further including:
acquiring a preset fault-tolerant coefficient and a preset temporary coefficient;
and determining a data reasonable interval of the total number of expected messages corresponding to the equipment label according to the preset fault-tolerant coefficient and the preset temporary coefficient.
Specifically, due to the influence of environmental factors such as device performance or network performance, the calculated total amount of expected data may have a deviation, a fault-tolerant coefficient and a temporary coefficient may be set according to an actual situation, and the temporary coefficient includes a maximum value of the temporary coefficient and a minimum value of the temporary coefficient, so as to calculate a data reasonable interval of the total number of expected messages, thereby performing traffic monitoring more accurately.
Further, the calculation formula of the data reasonable interval is as follows:
and the data reasonable interval is the total number of the expected messages [ 1-fault-tolerant coefficient, 1+ fault-tolerant coefficient ] [ temporary coefficient min value, temporary coefficient Max value ].
Specifically, taking the reasonable hour data interval as an example, the calculation formula is as follows:
the reasonable interval of the hour data is the total number of expected messages per hour [ 1-hour fault-tolerant coefficient, 1+ hour fault-tolerant coefficient ] [ temporary coefficient min value, temporary coefficient Max value ];
wherein, the data reasonable interval DataRange is expressed by DR; the total number of expected messages, ExpertData, expressed in ED; the fault tolerance coefficient Error-tolerant Rate is represented by EtR; the temporary coefficient Template Rate is denoted by TR.
Thus, the above formula can be expressed as: DR ═ ED ═ 1-EtR,1+ EtR ═ TRmin, TRmax.
Such as: when the total expected hourly message ED is 3000, the fault tolerance coefficient EtR is 10%, the temporary coefficient TRmin is 1, and the temporary coefficient TRmax is 100, the reasonable hourly data interval is: DR ═ 3000 × 1 to 10%, 1+ 10% ] × 1,100 ═ 2700, 330000.
A second obtaining module 130, configured to obtain, in real time, the current message number of all the devices in the current time period.
Specifically, the current message number of each device is monitored in real time, which can be understood as the current data traffic. And acquiring all the messages sent by the equipment in real time, and counting to obtain the current message quantity.
Further, the obtaining, in real time, the current message number of all devices in the current time period includes:
and monitoring the equipment through a CAT distributed monitoring system, and acquiring the number of the sent messages in real time.
The quantity monitoring of equipment and the quantity of the messages obtained and sent can be carried out through monitoring systems such as a CAT distributed monitoring system, the distributed monitoring system can store the monitored message quantity in a local server and can also upload the monitored message quantity to cloud equipment for storage, and data storage is carried out by taking time as a storage tag during storage so that the message quantity can be subjected to real-time statistics and obtaining in time.
The early warning module 140 is configured to determine a target preset time period to which the current time period belongs, obtain a total number of target expected messages corresponding to the target preset time period, compare the total number of target expected messages with the current number of messages, and determine whether to generate early warning information based on a comparison result, where the early warning information includes an early warning level.
Specifically, the current time period may be a first preset time period or a second preset time period, and the target time period is any one of a plurality of preset time periods. And when the target time period corresponding to the current time period is determined, acquiring the total number of the target expected messages corresponding to the target preset time period.
Further, the current message quantity can be compared according to a first preset time period and a second time period, and if the error value between the first time period and the current message quantity is greater than a first preset value, early warning is carried out; if the error value between the second time period and the current message quantity is larger than a second preset value, early warning is carried out; to more accurately determine whether to perform the warning. And comparing the current message number with the data reasonable interval of the total number of the target expected messages and the total number of the target expected messages, and generating early warning information according to a comparison result, wherein the early warning information comprises multi-stage early warning information. And comparing whether the current message number falls in the reasonable data interval, if so, not generating early warning information for warning, and finishing monitoring at the current time interval. And if the hour data is not reasonable, generating early warning information, wherein the early warning information comprises the equipment name and the early warning level of the current equipment, and the early warning level is set according to the difference value of the reasonable data interval between the number of the current information and the total number of the expected information.
Furthermore, an early warning template of the early warning information is preset according to the early warning information sending channel, when the early warning information is judged to be generated, an early warning level is determined according to a data reasonable interval of the total number of the expected messages and the current message number, and then the early warning information sending channel is based on the early warning level, namely an early warning mode. And substituting the early warning level and the equipment identification of the early warning equipment needing early warning into the corresponding early warning template to generate corresponding early warning information.
And a sending module 150, configured to send the early warning information to a management user corresponding to the early warning platform when the early warning information is generated.
Specifically, the early warning information is sent to the user according to the early warning information sending channel, the user can be a manager of the device, the user manages the device according to the early warning level, and complex service failure conditions of network delay, data accumulation, partial dead business, business paralysis and the like of the device can be found in time.
Further, when the early warning information is generated, sending the early warning information to a management user corresponding to an early warning platform includes:
sending the early warning information to a management user corresponding to the early warning platform for confirmation;
and receiving the false alarm information fed back by the management user, and correcting the fault tolerance coefficient value.
Specifically, after the early warning occurs, the accuracy of the early warning can be confirmed with the corresponding user side, if the early warning belongs to false alarm, the fault-tolerant coefficient value can be dynamically corrected, and after correction for a certain number of times, the early warning accuracy is greatly improved. Special events are as follows: if the equipment is updated in batches to generate the expected flow interruption condition and no alarm is needed, the temporary coefficient value can be modified to achieve the aim of not generating the alarm. Temporary coefficient validity period: in order to improve efficiency and further reduce operations, a validity period may be set for the temporary coefficient, and when the validity period is exceeded, the temporary coefficient may automatically be invalidated. To improve the accuracy, the expected data interval of the hour granularity can be further calculated into smaller granularity of quarter clock, minute and the like, and the overall calculation logic is unchanged.
According to the method and the device, the historical information of the multiple devices in the preset time period is collected through the device server, the device labels are determined according to the historical information, the multiple devices are monitored according to the device labels, and the early warning information is generated according to the monitoring result, so that the devices can be effectively and dynamically monitored; and the total number of the expected messages is designed, and the environmental factors of the equipment and the reasonable data interval of the total number of the expected messages of the equipment are considered when the total number of the expected messages is designed, so that the generation of the early warning information is more accurate.
In addition, the invention also provides a network monitoring method. Fig. 3 is a schematic method flow diagram of an embodiment of the network monitoring method according to the present invention. The processor 12 of the electronic device 1, when executing the network monitoring program 10 stored in the memory 11, implements a network monitoring method, including steps S101-S105.
S101, acquiring the number of history messages of a plurality of devices in a history time period.
Specifically, the access module is connected with the devices to obtain the historical messages of each device in the historical time period, and the historical messages are counted to obtain the number of the historical messages, which is the number of the historical messages of all the devices and can be understood as the flow. The historical time period may be a day, a week, a month, a year, etc. of the historical time, and is not limited herein.
Further, the historical message quantity of the multiple devices in a preset time period can be directly obtained through the server, or the historical message quantity is transmitted to the back-end server by the devices for subsequent early warning judgment operation. The message transmitted by each device may be preset, for example, if the device is a logistics service and corresponds to a logistics vehicle, a data collector may be installed on the device, and the data collector may send messages such as a travel, a repair condition, and a service time of the logistics vehicle in real time. And the back-end server performs calculation according to the received historical information, and monitors the equipment according to the calculation result. The cross-network monitoring can be realized by calculating through the back-end server under the conditions that the network of the equipment is not invaded and the extra expense is not generated by the network of the equipment.
S102, determining the device labels of all the devices in a plurality of preset time periods according to the historical time periods and the historical message number, wherein the device labels comprise the total number of the expected messages of all the devices in the preset time periods.
Specifically, the device tags are set in advance according to the service requirements, and include the average daily message number D and the average hourly message numbers H0, H1 to H23, which are used to represent the number of messages that each device can accommodate within a preset time period. The preset time period comprises a first preset time period and a second preset time period, wherein the first preset time period is each small time period, and the second preset time period is one day. And the expected message total number of each device is calculated through the device tag, so that the message amount of each device can be monitored based on the expected message total number. Counting the historical message numbers of the plurality of devices according to time, counting the total number of messages in preset time periods such as every hour, every day and the like, acquiring the total number of the devices corresponding to the plurality of devices, calculating a message average value number according to the total number of the devices and the total number of the messages, and associating the message average value number with the device label, namely the device label.
Further, the determining, according to the historical time period and the historical message number, device tags of all devices in a plurality of preset time periods, where the device tags include a total number of expected messages of all devices in a preset time period includes:
acquiring the total number of the devices of the plurality of devices, and calculating the total number of expected messages according to the historical message number and the total number of the devices;
determining a device tag based on the expected total number of messages.
Wherein the expected message total number comprises an hour expected message total number and a day expected message total number, and the calculation formula of the hour message number and the day average message number (the day expected message total number) is as follows:
total expected messages per hour — total number of devices by average number of messages per hour;
total expected messages per day is total number of devices per day;
the total number of the devices is set according to service requirements, for example, order type services of a treasure panning platform are processed, and the total number of the devices can be set to be greater than 1000; the order type business of the bank platform is processed, and the total number of the devices can be set to be less than 1000.
Further, the total expected messages for hours and the total expected messages for days calculated according to the actual historical message number are shown in the following table:
Figure BDA0003520768320000091
table 1: expected data calculation table
Further, the determining, according to the historical time period and the historical message number, device tags of all devices in a plurality of preset time periods, where the device tags include a total number of expected messages of all devices in the preset time periods, and further including:
acquiring a preset fault-tolerant coefficient and a preset temporary coefficient;
and determining a data reasonable interval of the total number of expected messages corresponding to the equipment label according to the preset fault-tolerant coefficient and the preset temporary coefficient.
Specifically, due to the influence of environmental factors such as device performance or network performance, the calculated total amount of expected data may have a deviation, a fault-tolerant coefficient and a temporary coefficient may be set according to an actual situation, and the temporary coefficient includes a maximum value of the temporary coefficient and a minimum value of the temporary coefficient, so as to calculate a data reasonable interval of the total number of expected messages, thereby performing traffic monitoring more accurately.
Further, the calculation formula of the data reasonable interval is as follows:
and the data reasonable interval is the total number of the expected messages [ 1-fault-tolerant coefficient, 1+ fault-tolerant coefficient ] [ temporary coefficient min value, temporary coefficient Max value ].
Specifically, taking the reasonable hour data interval as an example, the calculation formula is as follows:
the reasonable interval of the hour data is the total number of expected messages per hour [ 1-hour fault-tolerant coefficient, 1+ hour fault-tolerant coefficient ] [ temporary coefficient min value, temporary coefficient Max value ];
wherein, the data reasonable interval DataRange is expressed by DR; the total number of expected messages, ExpertData, expressed in ED; the fault tolerance coefficient Error-tolerant Rate is represented by EtR; the temporary coefficient Template Rate is denoted by TR.
Thus, the above formula can be expressed as: DR ═ ED ═ 1-EtR,1+ EtR ═ TRmin, TRmax.
Such as: when the total number ED of the expected messages per hour is 3000, the fault tolerance coefficient EtR is 10%, the temporary coefficient TRmin is 1, and the temporary coefficient TRmax is 100, the reasonable interval of the hour data is: DR ═ 3000 × 1 to 10%, 1+ 10% ] × 1,100 ═ 2700, 330000.
S103, acquiring the current message quantity of all the devices in the current time period in real time.
Specifically, the current message number of each device is monitored in real time, which can be understood as the current data traffic. And acquiring all the messages sent by the equipment in real time, and counting to obtain the current message quantity.
Further, the obtaining, in real time, the current message number of all devices in the current time period includes:
and monitoring the equipment through a CAT distributed monitoring system, and acquiring the number of the sent messages in real time.
The quantity monitoring of equipment and the quantity of the messages obtained and sent can be carried out through monitoring systems such as a CAT distributed monitoring system, the distributed monitoring system can store the monitored message quantity in a local server and can also upload the monitored message quantity to cloud equipment for storage, and data storage is carried out by taking time as a storage tag during storage so that the message quantity can be subjected to real-time statistics and obtaining in time.
S104, determining a target preset time period to which the current time period belongs, acquiring a total number of target expected messages corresponding to the target preset time period, comparing the total number of the target expected messages with the current number of the messages, and judging whether to generate early warning information or not based on a comparison result, wherein the early warning information comprises early warning levels.
Specifically, the current time period may be a first preset time period or a second preset time period, and the target time period is any one of a plurality of preset time periods. And when the target time period corresponding to the current time period is determined, acquiring the total number of the target expected messages corresponding to the target preset time period.
Further, the current message quantity can be compared according to a first preset time period and a second time period, and if the error value between the first time period and the current message quantity is greater than a first preset value, early warning is carried out; if the error value between the second time period and the current message quantity is larger than a second preset value, early warning is carried out; to more accurately determine whether to perform the warning. And comparing the current message number with the data reasonable interval of the total number of the target expected messages and the total number of the target expected messages, and generating early warning information according to a comparison result, wherein the early warning information comprises multi-stage early warning information. And comparing whether the current message number falls in the reasonable data interval, if so, not generating early warning information for warning, and finishing monitoring at the current time interval. And if the hour data is not reasonable, generating early warning information, wherein the early warning information comprises the equipment name and the early warning level of the current equipment, and the early warning level is set according to the difference value of the reasonable data interval between the number of the current information and the total number of the expected information. The early warning level is preset, and is shown in the following table:
Figure BDA0003520768320000111
table 2: early warning information generation table
Furthermore, an early warning template of the early warning information is preset according to the early warning information sending channel, when the early warning information is judged to be generated, an early warning level is determined according to a data reasonable interval of the total number of the expected messages and the current message number, and then the early warning information sending channel is based on the early warning level, namely an early warning mode. And substituting the early warning level and the equipment identification of the early warning equipment needing early warning into the corresponding early warning template to generate corresponding early warning information.
And S105, when the early warning information is generated, sending the early warning information to a management user corresponding to an early warning platform.
Specifically, the early warning information is sent to the user according to the early warning information sending channel, the user can be a manager of the device, the user manages the device according to the early warning level, and complex service failure conditions of network delay, data accumulation, partial dead business, business paralysis and the like of the device can be found in time.
Further, when the early warning information is generated, sending the early warning information to a management user corresponding to an early warning platform includes:
sending the early warning information to a management user corresponding to the early warning platform for confirmation;
and receiving the false alarm information fed back by the management user, and correcting the fault tolerance coefficient value.
Specifically, after the early warning occurs, the accuracy of the early warning can be confirmed with the corresponding user side, if the early warning belongs to false alarm, the fault-tolerant coefficient value can be dynamically corrected, and after correction for a certain number of times, the early warning accuracy is greatly improved. Special events are as follows: if the equipment is updated in batches to generate the expected flow interruption condition and no alarm is needed, the temporary coefficient value can be modified to achieve the aim of not generating the alarm. Temporary coefficient validity period: in order to improve efficiency and further reduce operations, a validity period may be set for the temporary coefficient, and when the validity period is exceeded, the temporary coefficient may automatically be invalidated. To improve the accuracy, the expected data interval of the hour granularity can be further calculated into smaller granularity of quarter clock, minute and the like, and the overall calculation logic is unchanged.
According to the method and the device, the historical information of the multiple devices in the preset time period is collected through the device server, the device labels are determined according to the historical information, the multiple devices are monitored according to the device labels, and the early warning information is generated according to the monitoring result, so that the devices can be effectively and dynamically monitored; and the total number of the expected messages is designed, and the environmental factors of the equipment and the reasonable data interval of the total number of the expected messages of the equipment are considered when the total number of the expected messages is designed, so that the generation of the early warning information is more accurate.
Furthermore, the embodiment of the present invention also provides a computer-readable storage medium, which may be any one or any combination of a hard disk, a multimedia card, an SD card, a flash memory card, an SMC, a Read Only Memory (ROM), an Erasable Programmable Read Only Memory (EPROM), a portable compact disc read only memory (CD-ROM), a USB memory, and the like. The computer readable storage medium includes a storage data area and a storage program area, the storage data area stores data created according to the use of the blockchain node, the storage program area stores the network monitoring program 10, and when the network monitoring program 10 is executed by a processor, the network monitoring method operation is realized.
In another embodiment, in order to further ensure the privacy and security of all the data, all the data may be stored in a node of a block chain.
It should be noted that the blockchain in the present invention is a novel application mode of computer technologies such as distributed data storage, point-to-point transmission, consensus mechanism, and encryption algorithm. A block chain (Blockchain), which is essentially a decentralized database, is a series of data blocks associated by using a cryptographic method, and each data block contains information of a batch of network transactions, so as to verify the validity (anti-counterfeiting) of the information and generate a next block. The blockchain may include a blockchain underlying platform, a platform product service layer, an application service layer, and the like.
The embodiment of the computer readable storage medium of the present invention is substantially the same as the embodiment of the network monitoring method, and will not be described herein again.
It should be noted that, the above numbers of the embodiments of the present invention are only for description, and do not represent the advantages and disadvantages of the embodiments. And the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, apparatus, article, or method that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, apparatus, article, or method. Without further limitation, an element defined by the phrase "comprising an … …" does not exclude the presence of other like elements in a process, apparatus, article, or method that includes the element.
It should be noted that, the above embodiments of the present invention may acquire and process related data based on an artificial intelligence technique. Among them, Artificial Intelligence (AI) is a theory, method, technique and application system that simulates, extends and expands human Intelligence using a digital computer or a machine controlled by a digital computer, senses the environment, acquires knowledge and uses the knowledge to obtain the best result.
The artificial intelligence infrastructure generally includes technologies such as sensors, dedicated artificial intelligence chips, cloud computing, distributed storage, big data processing technologies, operation/interaction systems, mechatronics, and the like. The artificial intelligence software technology mainly comprises a computer vision technology, a robot technology, a biological recognition technology, a voice processing technology, a natural language processing technology, machine learning/deep learning and the like.
Through the above description of the embodiments, those skilled in the art will clearly understand that the method of the above embodiments can be implemented by software plus a necessary general hardware platform, and certainly can also be implemented by hardware, but in many cases, the former is a better implementation manner. Based on such understanding, the technical solutions of the present invention may be embodied in the form of a software product, which is stored in a storage medium (such as ROM/RAM, magnetic disk, optical disk) as described above, and includes instructions for enabling an electronic device (such as a mobile phone, a computer, an electronic apparatus, or a network device) to execute the method according to the embodiments of the present invention.
The above description is only a preferred embodiment of the present invention, and is not intended to limit the scope of the present invention, and all equivalent structures or equivalent processes performed by the present invention or directly or indirectly applied to other related technical fields are also included in the scope of the present invention.

Claims (10)

1. A method for network monitoring, the method comprising:
acquiring the number of historical messages of a plurality of devices in a historical time period;
determining device labels of all devices in a plurality of preset time periods according to the historical time periods and the historical message quantity, wherein the device labels comprise the total expected message quantity of all devices in the preset time periods;
acquiring the current message quantity of all equipment in the current time period in real time;
determining a target preset time period to which the current time period belongs, acquiring a total number of target expected messages corresponding to the target preset time period, comparing the total number of the target expected messages with the current message number, and judging whether to generate early warning information or not based on a comparison result, wherein the early warning information comprises an early warning level;
and when the early warning information is generated, sending the early warning information to a management user corresponding to an early warning platform.
2. The network monitoring method of claim 1, wherein the determining device tags of all devices in a plurality of preset time periods according to the historical time periods and the historical message numbers, the device tags including the total number of expected messages of all devices in a preset time period comprises:
acquiring the total number of the devices of the plurality of devices, and calculating the total number of expected messages according to the historical message number and the total number of the devices;
determining a device tag based on the expected total number of messages.
3. The network monitoring method according to claim 1, wherein the determining device tags of all devices in a plurality of preset time periods according to the historical time periods and the historical message numbers, the device tags including the total number of messages expected by all devices in a preset time period, further comprises:
acquiring a preset fault-tolerant coefficient and a preset temporary coefficient;
and determining a data reasonable interval of the total number of expected messages corresponding to the equipment label according to the preset fault-tolerant coefficient and the preset temporary coefficient.
4. The network monitoring method according to claim 3, wherein the calculation formula of the data reasonable interval is:
and the data reasonable interval is the total number of the expected messages [ 1-fault-tolerant coefficient, 1+ fault-tolerant coefficient ] [ temporary coefficient min value, temporary coefficient Max value ].
5. The network monitoring method of claim 1, wherein the obtaining the current message number of all devices in the current time period in real time comprises:
and monitoring the equipment through a CAT distributed monitoring system, and acquiring the number of the sent messages in real time.
6. The network monitoring method according to claim 1, wherein the determining a target preset time period to which the current time period belongs, obtaining a total number of target expected messages corresponding to the target preset time period, comparing the total number of target expected messages with the current number of messages, and determining whether to generate warning information based on a comparison result includes:
if the error value between the first time period and the current message quantity is larger than a first preset value, early warning is carried out;
and if the error value between the second time period and the current message quantity is greater than a second preset value, early warning is carried out.
7. The network monitoring method according to claim 1, wherein the sending the early warning information to a management user corresponding to an early warning platform when the early warning information is generated comprises:
sending the early warning information to a management user corresponding to the early warning platform for confirmation;
and receiving the false alarm information fed back by the management user, and correcting the fault tolerance coefficient value.
8. A network monitoring apparatus, the apparatus comprising:
the device comprises a first acquisition module, a second acquisition module and a third acquisition module, wherein the first acquisition module is used for acquiring the number of historical messages of a plurality of devices in a historical time period;
a determining module, configured to determine device tags of all devices in a plurality of preset time periods according to the historical time periods and the historical message number, where the device tags include total expected messages of all devices in the preset time periods;
the second acquisition module is used for acquiring the current message quantity of all the devices in the current time period in real time;
the early warning module is used for determining a target preset time period to which the current time period belongs, acquiring a total number of target expected messages corresponding to the target preset time period, comparing the total number of the target expected messages with the current number of the messages, and judging whether to generate early warning information or not based on a comparison result, wherein the early warning information comprises an early warning level;
and the sending module is used for sending the early warning information to a management user corresponding to the early warning platform when the early warning information is generated.
9. An electronic device, characterized in that the electronic device comprises:
at least one processor; and the number of the first and second groups,
a memory communicatively coupled to the at least one processor; wherein,
the memory stores a program executable by the at least one processor to enable the at least one processor to perform the network monitoring method according to any one of claims 1 to 7.
10. A computer-readable storage medium, characterized in that the computer-readable storage medium stores a network monitoring program, which when executed by a processor, implements the steps of the network monitoring method according to any one of claims 1 to 7.
CN202210180843.9A 2022-02-25 2022-02-25 Network monitoring method, device, equipment and storage medium Active CN114531374B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202210180843.9A CN114531374B (en) 2022-02-25 2022-02-25 Network monitoring method, device, equipment and storage medium

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202210180843.9A CN114531374B (en) 2022-02-25 2022-02-25 Network monitoring method, device, equipment and storage medium

Publications (2)

Publication Number Publication Date
CN114531374A true CN114531374A (en) 2022-05-24
CN114531374B CN114531374B (en) 2023-08-25

Family

ID=81623905

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202210180843.9A Active CN114531374B (en) 2022-02-25 2022-02-25 Network monitoring method, device, equipment and storage medium

Country Status (1)

Country Link
CN (1) CN114531374B (en)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117148798A (en) * 2023-09-01 2023-12-01 山东溯源安全科技有限公司 Equipment monitoring method and device, storage medium and electronic equipment

Citations (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107809331A (en) * 2017-10-25 2018-03-16 北京京东尚科信息技术有限公司 The method and apparatus for identifying abnormal flow
CN108965826A (en) * 2018-08-21 2018-12-07 北京旷视科技有限公司 Monitoring method, device, processing equipment and storage medium
CN109194661A (en) * 2018-09-13 2019-01-11 网易(杭州)网络有限公司 Network attack alarm threshold configuration method, medium, device and calculating equipment
CN110086649A (en) * 2019-03-19 2019-08-02 深圳壹账通智能科技有限公司 Detection method, device, computer equipment and the storage medium of abnormal flow
CN110166418A (en) * 2019-03-04 2019-08-23 腾讯科技(深圳)有限公司 Attack detection method, device, computer equipment and storage medium
CN110784458A (en) * 2019-10-21 2020-02-11 新华三信息安全技术有限公司 Flow abnormity detection method and device and network equipment
CN112087350A (en) * 2020-09-17 2020-12-15 中国工商银行股份有限公司 Method, device, system and medium for monitoring network access line flow
CN112579148A (en) * 2020-12-17 2021-03-30 广州虎牙科技有限公司 Service message processing method and device based on service agent and electronic equipment
WO2021057808A1 (en) * 2019-09-27 2021-04-01 华为技术有限公司 Method and apparatus for traffic control

Patent Citations (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107809331A (en) * 2017-10-25 2018-03-16 北京京东尚科信息技术有限公司 The method and apparatus for identifying abnormal flow
CN108965826A (en) * 2018-08-21 2018-12-07 北京旷视科技有限公司 Monitoring method, device, processing equipment and storage medium
CN109194661A (en) * 2018-09-13 2019-01-11 网易(杭州)网络有限公司 Network attack alarm threshold configuration method, medium, device and calculating equipment
CN110166418A (en) * 2019-03-04 2019-08-23 腾讯科技(深圳)有限公司 Attack detection method, device, computer equipment and storage medium
CN110086649A (en) * 2019-03-19 2019-08-02 深圳壹账通智能科技有限公司 Detection method, device, computer equipment and the storage medium of abnormal flow
WO2021057808A1 (en) * 2019-09-27 2021-04-01 华为技术有限公司 Method and apparatus for traffic control
CN110784458A (en) * 2019-10-21 2020-02-11 新华三信息安全技术有限公司 Flow abnormity detection method and device and network equipment
CN112087350A (en) * 2020-09-17 2020-12-15 中国工商银行股份有限公司 Method, device, system and medium for monitoring network access line flow
CN112579148A (en) * 2020-12-17 2021-03-30 广州虎牙科技有限公司 Service message processing method and device based on service agent and electronic equipment

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117148798A (en) * 2023-09-01 2023-12-01 山东溯源安全科技有限公司 Equipment monitoring method and device, storage medium and electronic equipment

Also Published As

Publication number Publication date
CN114531374B (en) 2023-08-25

Similar Documents

Publication Publication Date Title
CN112052111B (en) Processing method, device and equipment for server abnormity early warning and storage medium
CN107909486B (en) Commission management method, application server and computer readable storage medium
CN111698303A (en) Data processing method and device, electronic equipment and storage medium
CN110930107A (en) Attendance information processing method and device, computer equipment and storage medium
CN112181967B (en) Method, device, computer equipment and medium for monitoring quality of source data
CN114564294A (en) Intelligent service arranging method and device, computer equipment and storage medium
CN112860662A (en) Data blood relationship establishing method and device, computer equipment and storage medium
CN110807050B (en) Performance analysis method, device, computer equipment and storage medium
CN114531374B (en) Network monitoring method, device, equipment and storage medium
CN106708869B (en) Group data processing method and device
CN116843395A (en) Alarm classification method, device, equipment and storage medium of service system
CN111144634A (en) Method and device for predicting power price
CN113313352B (en) Hydrogenation station safety monitoring method, electronic equipment and storage medium
CN115221171A (en) Abnormal data intelligent monitoring method and device, electronic equipment and storage medium
CN117829897A (en) Data prediction method, device, computer equipment and storage medium
CN113781237B (en) Product purchase order consumption method based on distributed artificial intelligence system
CN115577867B (en) Method and system for creating spot check task, computer equipment and storage medium
CN113627996B (en) Transaction resource amount prediction method and device, computer equipment and storage medium
CN117993879B (en) Machine learning model-based attendance anomaly prediction and processing method
CN117395309A (en) Data reporting method, device, computer equipment and storage medium
CN101894119A (en) Mass data storage system for monitoring
CN114239517A (en) Data processing method and device, electronic equipment and storage medium
CN116010952A (en) Dynamic baseline determination method, transaction data detection method, device and electronic equipment
CN115630825A (en) Scheduling method and device based on artificial intelligence, computer equipment and storage medium
CN113936313A (en) Method, device, equipment and storage medium for detecting account number lending of website employees

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
TA01 Transfer of patent application right

Effective date of registration: 20220928

Address after: Room 2601 (Unit 07), Qianhai Free Trade Building, No. 3048, Xinghai Avenue, Nanshan Street, Qianhai Shenzhen-Hong Kong Cooperation Zone, Shenzhen, Guangdong 518000

Applicant after: Shenzhen Ping An Smart Healthcare Technology Co.,Ltd.

Address before: 1-34 / F, Qianhai free trade building, 3048 Xinghai Avenue, Mawan, Qianhai Shenzhen Hong Kong cooperation zone, Shenzhen, Guangdong 518000

Applicant before: Ping An International Smart City Technology Co.,Ltd.

TA01 Transfer of patent application right
GR01 Patent grant
GR01 Patent grant