CN115333928B

CN115333928B - Network early warning method and device, electronic equipment and storage medium

Info

Publication number: CN115333928B
Application number: CN202210814995.XA
Authority: CN
Inventors: 槐正; 郑万静; 李雅楠; 徐冬冬; 付迎鑫; 崔明; 马荻; 刘桥; 徐锐; 王健; 徐蕾
Original assignee: China Telecom Corp Ltd
Current assignee: China Telecom Corp Ltd
Priority date: 2022-07-12
Filing date: 2022-07-12
Publication date: 2024-07-02
Anticipated expiration: 2042-07-12
Also published as: CN115333928A

Abstract

The embodiment of the invention provides a network early warning method, a device, electronic equipment and a storage medium in a data transmission process, wherein the method comprises the following steps: acquiring node information of a target Pod node, inputting the node information into a correlation probability prediction model to perform node correlation probability prediction, acquiring a correlation probability value between the target Pod node and other Pod nodes in a k8s cluster, and taking the Pod nodes with the correlation probability values meeting preset conditions in the other Pod nodes as correlation Pod nodes corresponding to the target Pod nodes; and determining an associated Node corresponding to the associated Pod Node, acquiring first equipment information corresponding to a first physical equipment to which the associated Pod Node belongs and second equipment information corresponding to a second physical equipment to which the target Node belongs, and respectively processing the first equipment information and the second equipment information through a network anomaly early warning model issued by a Master Node to acquire a first anomaly probability for the first physical equipment and a second anomaly probability for the second physical equipment.

Description

Network early warning method and device, electronic equipment and storage medium

Technical Field

The present invention relates to the technical field of IT and software development, and in particular, to a network early warning method in a data transmission process, a network early warning device in a data transmission process, an electronic device, and a computer readable storage medium.

Background

With the rapid development of computer technology, information networks have become an important guarantee of social development. In the traditional hardware resource virtualization and the centralized management operation and maintenance system of virtual resources, service resources and user resources, the virtualization platform is a server virtualization solution leading in the industry, and the solution of the cloud operating system is that virtualized software is deployed on a server, so that one physical server can bear the work of a plurality of servers. However, in the related art, it is common to collect related performance parameters in a cluster and compare the related performance parameters with a preset detection threshold value, so as to monitor the state of the cluster, where a performance failure of the cluster is easily found, resulting in unstable cluster operation.

Disclosure of Invention

The embodiment of the invention provides a network early warning method, a device, electronic equipment and a computer readable storage medium in a data transmission process, which are used for solving or partially solving the problem that the cluster performance faults cannot be early warned in time in the related technology.

The embodiment of the invention discloses a network early warning method in a data transmission process, which relates to a k8s cluster, wherein the k8s cluster comprises a Master Node, a plurality of Node nodes connected with the Master Node and at least one Pod Node connected with each Node; the distributed virtualization platform is deployed in the k8s cluster, and the Pod node is deployed on corresponding physical equipment based on the distributed virtualization platform; the method is applied to a target Node, and the target Node is deployed with an associated probability prediction model, and comprises the following steps:

acquiring node information of a target Pod node, wherein the node information comprises information generated when data interaction occurs between the target Pod node and other Pod nodes;

Inputting the node information into the association probability prediction model to perform node association probability prediction, obtaining association probability values between the target Pod node and other Pod nodes in the k8s cluster, and taking the Pod nodes with the association probability values meeting preset conditions in the other Pod nodes as association Pod nodes corresponding to the target Pod nodes;

Determining an associated Node corresponding to the associated Pod Node, and acquiring first equipment information corresponding to first physical equipment to which the associated Pod Node belongs and second equipment information corresponding to second physical equipment to which the target Node belongs;

the first equipment information is input into a network abnormality early warning model issued by the Master node to conduct abnormality probability prediction on the first physical equipment to obtain first abnormality probability aiming at the first physical equipment, and the second equipment information is input into a preset network abnormality early warning model to conduct abnormality probability prediction on the second physical equipment to obtain second abnormality probability aiming at the second physical equipment.

Optionally, the first anomaly probability is a probability representing that the first physical device is anomalous when data transmission is performed between the first physical device and the second physical device; the second anomaly probability is a probability representing that the second physical device is anomalous when data transmission is performed between the first physical device and the second physical device.

Optionally, the inputting the first device information into the network anomaly early-warning model issued by the Master node performs anomaly probability prediction on the first physical device to obtain a first anomaly probability for the first physical device, and inputting the second device information into a preset network anomaly early-warning model performs anomaly probability prediction on the second physical device to obtain a second anomaly probability for the second physical device, which includes:

Responding to a model instruction issued by the Master node, if the network abnormality early-warning model is detected to be not deployed locally according to the model instruction, requesting the network abnormality early-warning model from the Master node, and deploying the network abnormality early-warning model issued by the Master node locally;

inputting the first equipment information into the network abnormality early warning model to predict the abnormality probability of the first physical equipment, and obtaining a first abnormality probability for the first physical equipment;

and inputting the second equipment information into a preset network abnormality early warning model to predict the abnormality probability of the second physical equipment, and obtaining a second abnormality probability for the second physical equipment.

Optionally, the first device information includes at least a first device parameter, a first network port parameter, and a second device parameter of a third physical device that is in a VLAN pool with the first physical device, and the inputting the first device information into a preset network anomaly early-warning model predicts an anomaly probability of the first physical device, to obtain a first anomaly probability for the first physical device, including:

inputting the first equipment parameters into a preset network abnormality early warning model to predict equipment abnormality probability of the first physical equipment, and obtaining first equipment abnormality probability aiming at the first physical equipment;

Inputting the network port parameters into the network abnormality early warning model to predict port abnormality probability of the first physical equipment, and obtaining first port abnormality probability aiming at the first physical equipment;

and inputting the second equipment parameters into a preset network abnormality early warning model to predict equipment abnormality probability of the third physical equipment, so as to obtain second equipment abnormality probability aiming at the first physical equipment.

Optionally, the second device information includes at least a third device parameter, a second network port parameter, and a fourth device parameter of a fourth physical device in a VLAN pool together with the second physical device, and the inputting the second device information into a preset network anomaly early-warning model performs anomaly probability prediction on the second physical device to obtain a second anomaly probability for the second physical device, which includes:

inputting the third equipment parameters into a preset network abnormality early warning model to predict equipment abnormality probability of the second physical equipment, and obtaining third equipment abnormality probability aiming at the second physical equipment;

inputting the second network port parameters into the network abnormality early warning model to predict port abnormality probability of the second physical equipment, and obtaining second port abnormality probability for the second physical equipment;

and inputting the fourth equipment parameters into a preset network abnormality early warning model to predict the equipment abnormality probability of the fourth physical equipment, so as to obtain the fourth equipment abnormality probability aiming at the second physical equipment.

Optionally, the taking the Pod node with the association probability value satisfying the preset condition among the other Pod nodes as the association Pod node corresponding to the target Pod node includes:

Acquiring weight coefficients corresponding to the other Pod nodes, and calculating weighted probability values corresponding to the other Pod nodes by adopting the weight coefficients and the associated probability values;

and taking the Pod node with the weighting probability value larger than or equal to a preset threshold value of the other Pod nodes as the associated Pod node corresponding to the target Pod node.

Optionally, the method further comprises:

And synchronizing the target data sent by the associated Pod node.

Optionally, the k8s cluster further includes a history database connected to the Node, and the obtaining Node information of the target Pod Node includes:

and acquiring Node information of the target Pod Node from a target history database corresponding to the target Node.

The embodiment of the invention also discloses a network early warning device in the data transmission process, which relates to a k8s cluster, wherein the k8s cluster comprises a Master Node, a plurality of Node nodes connected with the Master Node and at least one Pod Node connected with each Node; the distributed virtualization platform is deployed in the k8s cluster, and the Pod node is deployed on corresponding physical equipment based on the distributed virtualization platform; the apparatus is applied to a target Node, the target Node is deployed with an associated probability prediction model, and the apparatus includes:

The node information acquisition module is used for acquiring node information of a target Pod node, wherein the node information comprises information generated when data interaction occurs between the target Pod node and other Pod nodes;

the association Pod determining module is used for inputting the node information into the association probability prediction model to perform node association probability prediction, obtaining association probability values between the target Pod node and other Pod nodes in the k8s cluster, and taking the Pod nodes with the association probability values meeting preset conditions in the other Pod nodes as association Pod nodes corresponding to the target Pod nodes;

The device information acquisition module is used for determining an associated Node corresponding to the associated Pod Node and acquiring first device information corresponding to first physical devices to which the associated Pod Node belongs and second device information corresponding to second physical devices to which the target Node belongs;

The anomaly probability determining module is used for inputting the first equipment information into a network anomaly early warning model issued by the Master node to conduct anomaly probability prediction on the first physical equipment to obtain first anomaly probability for the first physical equipment, and inputting the second equipment information into a preset network anomaly early warning model to conduct anomaly probability prediction on the second physical equipment to obtain second anomaly probability for the second physical equipment.

Optionally, the anomaly probability determination module is specifically configured to:

Optionally, the first device information includes at least a first device parameter, a first network port parameter, and a second device parameter of a third physical device in a VLAN pool together with the first physical device, and the anomaly probability determining module is specifically configured to:

Optionally, the second device information includes at least a third device parameter, a second network port parameter, and a fourth device parameter of a fourth physical device in a VLAN pool together with the second physical device, and the anomaly probability determining module is specifically configured to:

Optionally, the association Pod determining module is specifically configured to:

Optionally, the method further comprises:

And the data synchronization module is used for synchronizing the target data sent by the associated Pod node.

Optionally, the k8s cluster further includes a history database connected to the Node, and the Node information obtaining module is specifically configured to:

The embodiment of the invention also discloses electronic equipment, which comprises a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory are communicated with each other through the communication bus;

the memory is used for storing a computer program;

the processor is configured to implement the method according to the embodiment of the present invention when executing the program stored in the memory.

Embodiments of the present invention also disclose a computer-readable storage medium having instructions stored thereon, which when executed by one or more processors, cause the processors to perform the method according to the embodiments of the present invention.

The embodiment of the invention has the following advantages:

In the embodiment of the invention, a Master Node, a plurality of Node nodes connected with the Master Node and at least one Pod Node connected with each Node can be included in a k8s cluster, a distributed virtualization platform is deployed in the k8s cluster, the Pod nodes are deployed on corresponding physical equipment based on the distributed virtualization platform, in a cloud computing scene of the k8s cluster, for a certain target Node in the cluster, the Node information comprises the information generated when data interaction occurs between the target Pod Node and other Pod nodes, the Node information is input into a correlation probability prediction model for carrying out Node correlation probability prediction, the correlation probability value between the target Pod Node and other Pod nodes in the k8s cluster is obtained, the Pod Node with the correlation probability value meeting the preset condition in the other Pod nodes is taken as the correlation Pod Node corresponding to the target Pod Node, and determining associated Node nodes corresponding to the associated Pod nodes, by predicting the associated Pod nodes by the Node nodes, the load and operation pressure of Master nodes deployed in a cluster center server can be effectively reduced, meanwhile, after determining the associated Node nodes, first equipment information corresponding to first physical equipment to which the associated Pod nodes belong and second equipment information corresponding to second physical equipment to which the associated Node nodes belong can be acquired, then inputting the first equipment information into a network anomaly early warning model issued by the Master nodes to conduct anomaly probability prediction on the first physical equipment, obtaining first anomaly probability for the first physical equipment, and inputting the second equipment information into a preset network anomaly early warning model to conduct anomaly probability prediction on the second physical equipment to obtain second anomaly probability for the second physical equipment, the abnormal probability of the physical equipment corresponding to the Node nodes in the cluster and the physical equipment corresponding to the Pod nodes during data transmission is predicted through the network abnormal early warning model so as to timely early warn according to the prediction result, thereby facilitating timely obstacle removal of communication abnormality in the cluster and ensuring the stability of cluster operation.

Drawings

Fig. 1 is a flowchart of steps of a network early warning method in a data transmission process according to an embodiment of the present invention;

FIG. 2 is a schematic diagram of the structure of a k8s cluster provided in an embodiment of the present invention;

FIG. 3 is a schematic illustration of model construction provided in an embodiment of the present invention;

fig. 4 is a block diagram of a network early warning device in a data transmission process according to an embodiment of the present invention;

fig. 5 is a block diagram of an electronic device provided in an embodiment of the invention.

Detailed Description

In order that the above-recited objects, features and advantages of the present invention will become more readily apparent, a more particular description of the invention will be rendered by reference to the appended drawings and appended detailed description.

As an example, in the application of the artificial intelligence technology, through virtualizing the traditional hardware resources, centralized operation and maintenance management on the virtual resources, service resources and user resources is realized, so that the utilization efficiency of the IT (Information Technology ) basic equipment can be effectively improved, the operation and maintenance efficiency is improved, and the IT cost is reduced. In the related art, related performance parameters in the cluster are generally collected and compared with a preset detection threshold value, so that the cluster state is monitored, and in this case, the cluster is easily found when the performance failure occurs, so that the cluster is unstable in operation.

In contrast, one of the core invention points of the invention is that a Master Node, a Node and a Pod Node are deployed in a k8s cluster, wherein the Master Node can be deployed at a central server of the cluster, the Node can be deployed at a local server of the cluster, the Pod Node can be deployed on corresponding physical equipment based on a distributed virtualization platform in the cluster, in the running process of the cluster, the Master Node can send a network anomaly early warning model to the Node, the Node can send Node information corresponding to the Pod Node associated with the Node in the running process, the Node information is input into an association probability prediction model to predict association relations between the Pod Node and other Pod nodes in the cluster, the associated association Pod Node is determined, and the load and operation pressure of the Master Node deployed at the central server of the cluster can be effectively reduced through predicting the associated Pod Node by the Node, then, the first equipment information corresponding to the first physical equipment to which the associated Pod Node belongs and the second equipment information corresponding to the second physical equipment to which the associated Node corresponds in the cluster can be obtained, the first equipment information and the second equipment information are respectively processed according to the network anomaly early warning model issued by the Master Node, the first anomaly probability of the first physical equipment and the second anomaly probability of the second equipment when data communication is carried out between the first physical equipment and the second physical equipment are obtained, so that the anomaly probability of the physical equipment corresponding to the Node in the cluster and the physical equipment corresponding to the Pod Node in data transmission is predicted through the network anomaly early warning model, early warning is carried out in time according to the prediction result, thereby facilitating timely obstacle removal of communication anomalies in the cluster, and the stability of cluster operation is ensured.

Specifically, referring to fig. 1, a step flow chart of a network early warning method in a data transmission process provided in an embodiment of the present invention is shown, where the step flow chart relates to a k8s cluster, and the k8s cluster includes a Master Node, a plurality of Node nodes connected with the Master Node, and at least one Pod Node connected with each Node; the distributed virtualization platform is deployed in the k8s cluster, and the Pod nodes are deployed on corresponding physical devices based on the distributed virtualization platform; the method can be applied to a target Node, and the target Node is deployed with an associated probability prediction model, and specifically comprises the following steps:

Step 101, acquiring node information of a target Pod node, wherein the node information comprises information generated when data interaction occurs between the target Pod node and other Pod nodes;

For k8s, it may be kubernetes, which is an orchestration management tool for portable containers that are generated for container services, multiple physical device/virtual machine compositions may be included in the k8s cluster. Specifically, the k8s cluster may include a Master Node, a Node and a Pod Node, where the Master Node may be a Node disposed in a central server of the cluster and is responsible for associating other nodes, such as managing the Node; the Node is responsible for managing related containers in the operation cluster, managing data transmitted by the containers and the like; the Pod node is an independent, isolated, smallest unit of work in the cluster, which can run one or more containers/services, and by combining multiple containers, corresponding applications can be bold general to implement corresponding data processing services, etc.

Referring to fig. 2, a schematic structural diagram of a k8s cluster provided in an embodiment of the present invention is shown, where the k8s cluster may include a Master Node disposed on a central server (or the central cluster), and several Node nodes communicatively connected to the Master Node, each Node may be disposed on a local server, each Node may correspond to a database, and each Node may be communicatively connected to several Pod nodes. For Pod nodes, which may be virtual machines built based on a distributed virtualization platform and deployed on corresponding physical devices in a cluster, the Pod nodes may communicate with the physical devices deployed with the Pod nodes through corresponding openapis (Open Application Programming Interface, open interfaces), that is, for Master nodes, node nodes, and Pod nodes, one Master Node may correspond to multiple Node nodes, and one Node corresponds to multiple Pod nodes. Optionally, for Node nodes, the Node nodes can be divided into a first type Node deployed on a local server and a second type Node formed by at least one Pod Node, which are deployed on different physical devices in the cluster respectively; the distributed virtualization platform can be deployed at a central server or a local server, and the invention is not limited in this respect.

Optionally, a network abnormality early warning model can be deployed in the Master node, the probability of abnormality of physical equipment in the data transmission process can be predicted through the network abnormality early warning model, so that early warning can be conveniently and timely performed according to a prediction result through the corresponding abnormality probability, communication abnormality in a cluster can be conveniently and timely cleared, and the stability of cluster operation is ensured; and the Node nodes can be deployed with an associated probability prediction model, and the associated probability between the Pod nodes and other Pod nodes in the cluster is predicted by combining the Node information stored in the database through the associated probability prediction model due to the high availability characteristic of the cluster and the load pressure of the Master Node under the high concurrence condition, and the Node nodes screen out the associated Pod nodes corresponding to each Pod Node, so that the load and the operation pressure of the Master Node in the central server can be reduced.

In the embodiment of the invention, in the process of running the k8s cluster, a Node is taken as an example for illustration, and for a target Node, the Node information corresponding to the target Pod Node associated with the target Node can be acquired. The node information may include information generated when data interaction occurs between the target Pod node and other Pod nodes, for example, a node identifier, an IP address, an interaction data amount, an interaction number, and an interaction port of the Pod node when data interaction occurs.

In a specific implementation, the Master node can manage whether a network port corresponding to the Pod node in the cluster is exposed through a configuration file, if the port is exposed, the Pod node can perform data interaction with the Pod node in the same network or Pod nodes in other networks in the cluster, data in the data interaction process are stored in a log file of a central server, and node information related in the interaction process can be stored in a corresponding database. For the target Node, it may acquire Node information of the target Pod Node from a target history database corresponding to the target Node, so as to predict an associated Pod Node corresponding to the Pod Node according to the Node information.

For example, assuming that the target Node is associated with the Pod Node ①, the Pod Node ②, and the Pod Node ③, the target Node may obtain Node information corresponding to the Pod Node ①, the Pod Node ②, and the Pod Node ③, respectively, so as to predict the associated Pod nodes corresponding to the Pod Node ①, the Pod Node ②, and the Pod Node ③ based on the Node information. In addition, the Pod nodes ①, ②, ③ may be Pod nodes belonging to the same network, pod nodes belonging to different networks, and Pod nodes belonging to the same network may be Pod nodes belonging to the same IP address and DNS Domain name (Domain NAME SYSTEM ), which is not limited in this aspect of the present invention.

102, Inputting the node information into the association probability prediction model to perform node association probability prediction, obtaining association probability values between the target Pod node and other Pod nodes in the k8s cluster, and taking the Pod nodes with the association probability values meeting preset conditions in the other Pod nodes as the association Pod nodes corresponding to the target Pod nodes;

In a specific implementation, after Node information corresponding to the associated target Pod Node is obtained from the corresponding database, the Node information may be input into an association probability prediction model to predict association probabilities between the target Pod Node and other Pod nodes in the same network and other Pod nodes in other networks, and the association degree between the target Pod Node and other Pod nodes in the cluster may be determined by using the association probability value. For a target Pod Node, it may be a Node that interacts data with the target Node, including but not limited to one or more Pod nodes within one network or within a different network. For example, assuming that the Pod Node ①, the Pod Node ②, the Pod Node ③, and the like belong to the same network, for the Pod Node ①, the target Node may predict association probabilities between the Pod Node ① and the Pod Node ② and the Pod Node ③, respectively, according to the Node information corresponding to the Pod Node; assuming that the Pod Node ①, the Pod Node ②, and the Pod Node ③ belong to different networks, the target Node can predict association probabilities between the Pod Node ① and the Pod Node ② and the Pod Node ③, respectively, according to the Node information corresponding to the target Node.

In a specific implementation, when a target Node obtains association probability values between a target Pod Node and other Pod nodes in a cluster according to an association probability prediction model, a weight coefficient corresponding to each other Pod Node can be obtained, a weighted probability value corresponding to the other Pod nodes is calculated by adopting the weight coefficient and the association probability value, and then the Pod Node with the weighted probability value larger than or equal to a preset threshold value in the other Pod nodes is used as the association Pod Node corresponding to the target Pod Node. For the Pod node, the Pod node and the target Pod node are other Pod nodes in the same network, and the weight value corresponding to the Pod node may be a first weight value; the method has the advantages that the target Pod Node is other Pod nodes in different networking, the corresponding weight value can be a second weight value, and the first weight value can be larger than the second weight value so as to represent that the association degree between different Pod nodes in the same networking is higher, so that the association probability value is obtained, weighting is further carried out through a weight coefficient, the more accurate weighting probability value is obtained, further the association Pod Node with the higher association degree with the target Pod Node can be screened out through the weighting probability value, the fact that the Node screens out the associated Pod Node is realized, the quantity of Pod nodes required to be detected in the subsequent network abnormality early warning process is reduced, and the load and operation pressure of Master nodes deployed at a cluster center server are effectively reduced.

Step 103, determining an associated Node corresponding to the associated Pod Node, and acquiring first equipment information corresponding to a first physical equipment to which the associated Pod Node belongs and second equipment information corresponding to a second physical equipment to which the target Node belongs;

After determining the associated Pod nodes with a larger degree of association with the target Pod Node, node nodes (the second class Node nodes) to which the associated Pod nodes belong can be further determined, the Node nodes are used as the associated Node nodes corresponding to the target Node, and then the first equipment information corresponding to the first physical equipment where each associated Pod Node is located and the second equipment information corresponding to the second physical equipment where the target Node is located can be obtained, so that the probability of abnormal occurrence of equipment when data transmission occurs between the first physical equipment and the second physical equipment is predicted according to the first equipment information and the second equipment information.

The device information may include a device parameter of the physical device, a network port parameter of the physical device, and a device parameter corresponding to the physical device and other physical devices in a VLAN pool, where the device parameter may include a parameter associated with related hardware (memory, CPU, disk, etc.) of the physical device when performing data transmission; as for the network port parameter, it may include packet loss information, delay information, etc. of the port at the time of data transmission, which is not limited by the present invention.

Step 104, inputting the first device information into a network abnormality early-warning model issued by the Master node to conduct abnormality probability prediction on the first physical device, obtaining first abnormality probability for the first physical device, and inputting the second device information into a preset network abnormality early-warning model to conduct abnormality probability prediction on the second physical device, obtaining second abnormality probability for the second physical device.

In the embodiment of the invention, the target Node can respectively input the first equipment information into the network abnormality early warning model issued by the Master Node to predict the abnormality probability of the first physical equipment while synchronizing the target data sent by the associated Pod Node, obtain the first abnormality probability for the first physical equipment, and input the second equipment information into the preset network abnormality early warning model to predict the abnormality probability of the second physical equipment, so as to obtain the second abnormality probability for the second physical equipment. The first anomaly probability is a probability representing that the first physical device is abnormal when data transmission is performed between the first physical device and the second physical device; the second anomaly probability is a probability representing that the second physical device is anomalous when data transmission is performed between the first physical device and the second physical device.

In a specific implementation, the target Node can respond to a model instruction issued by the Master Node, if a local undeployed network abnormality early warning model is detected according to the model instruction, the network abnormality early warning model is requested to the Master Node, and the network abnormality early warning model issued by the Master Node is deployed locally; if the network abnormality early-warning model is detected to be locally deployed according to the model instruction, a first version corresponding to the network abnormality early-warning model in the Master node and a second version corresponding to the local network abnormality early-warning model are obtained, the first version and the second version are compared, the local network abnormality early-warning model is updated based on the version on the Master node, the local network abnormality early-warning model is consistent with the network abnormality early-warning model in the Master node, then the first equipment information can be input into the network abnormality early-warning model to conduct abnormality probability prediction on the first physical equipment, the first abnormality probability aiming at the first physical equipment is obtained, and the second equipment information is input into the preset network abnormality early-warning model to conduct abnormality probability prediction on the second physical equipment, and the second abnormality probability aiming at the second physical equipment is obtained.

The target Node may input the first device parameter into a preset network anomaly early-warning model to predict the device anomaly probability of the first physical device to obtain the first device anomaly probability of the first physical device, input the network port parameter into the network anomaly early-warning model to predict the port anomaly probability of the first physical device to obtain the first port anomaly probability of the first physical device, and input the second device parameter into the preset network anomaly early-warning model to predict the device anomaly probability of the third physical device to obtain the second device anomaly probability of the first physical device.

And for the second device information at least comprising a third device parameter, a second network port parameter and a fourth device parameter of a fourth physical device in a VLAN pool together with the second physical device, the target Node can input the third device parameter into a preset network anomaly early warning model to conduct device anomaly probability prediction on the second physical device to obtain a third device anomaly probability for the second physical device, input the second network port parameter into the network anomaly early warning model to conduct port anomaly probability prediction on the second physical device to obtain a second port anomaly probability for the second physical device, and input the fourth device parameter into the preset network anomaly early warning model to conduct device anomaly probability prediction on the fourth physical device to obtain a fourth device anomaly probability for the second physical device.

The abnormal probability of the physical equipment corresponding to the Node nodes in the cluster and the physical equipment corresponding to the Pod nodes during data transmission is predicted through the network abnormal early warning model so as to timely early warn according to the prediction result, thereby facilitating timely obstacle removal of communication abnormality in the cluster and ensuring the stability of cluster operation.

In order to enable those skilled in the art to better understand the technical solutions of the embodiments of the present invention, the following is exemplified by an example:

S1, deploying an initial Kubernetes cluster at a central server. A Kubernetes-based cluster mainly includes three objects Master, node, pod. The method is characterized by comprising the following steps: master (Master node): first, a Master (Master node) and a history database are deployed on a cluster management server. For the Master node, whether the Pod corresponding to the network port is exposed or not can be managed through the configuration file, and the Pod of the exposed port can interact data with other cluster Pods in the same group of networks. And store the data in a central server log file.

S2, a Markov chain algorithm is adopted to construct a network anomaly early warning model, and in consideration of the high availability characteristic and the high concurrency condition of multiple clusters, a random forest algorithm is adopted to construct a correlation probability prediction model and combines historical database data operation to predict the correlation probability values of Pod, other Pods in the clusters and other cluster Pod nodes in the same network. And the load and the operation pressure of the central server cluster Master are reduced.

For the network anomaly early-warning model, a flag (issuing a model instruction) and the network anomaly early-warning model can be sent from a central server cluster Master Node to servers corresponding to distributed Node nodes in all places. After receiving the flag (issuing instruction), the servers in all places check whether the network abnormality early warning model is deployed locally, wherein flag=1 indicates that the network abnormality early warning model is deployed, flag=0 indicates that the network abnormality early warning model is not deployed, and if the network abnormality early warning model is not deployed, the server in the center is informed of requesting to issue the model through a program sending instruction. And after receiving the request instruction, the central server sends the network abnormality early warning model to the local server. And the deployment is that the local network abnormality early warning model is updated and kept synchronous with the central server.

Specifically, for the network anomaly early warning model, it may be X (k+1) =x (k) ×p. Wherein, in the formula: x (k) represents a state vector of the trend analysis and prediction object at time t=k, P represents a one-step transition probability matrix, and X (k+1) represents a state vector of the trend analysis and prediction object at time t=k+1.

Generating a data set using a two-step transfer matrix, for example: the data collection rate of the local server resources (network equipment, port network quality and host) in the last month is 100%. Wherein, the faults are 30% and 70% of normal. 60% of the faults may continue to be faults in this month, and 40% may change to normal in this month. The aggregate data is [ 0.6, 0.4 ]. The local server resources (network equipment, port network quality, host) of this month collect the data to account for 100%. Wherein 30% of the faults may still be faults, and 70% of the normal faults may be converted into faults [ 0.3, 0.7 ], and the previous month prediction probabilities [ 0.6, 0.4 ]; the month transition probabilities (0.3 and 0.7) are calculated by a model, wherein the failure probability of acquired data of the next month is=0.3x0.6+0.3x0.7=0.39; data collected next month normal probability=0.3x0.4+0.7x0.7=0.61.

For the associated probability prediction model, it may be constructed by a random forest algorithm, specifically, referring to fig. 3, a schematic diagram of model construction provided in an embodiment of the present invention is shown:

1. Firstly, inputting a sample set |D|;

2. randomly selecting a trained data set and sample characteristics to perform Di round training;

2-1, carrying out ith random sampling on the training set, and collecting N times in total to obtain a sampling set containing N samples;

2-2 training an nth decision tree model H (i) with a sampling set |di|:

when training the nodes of the decision tree model, selecting a part of sample features from all sample features on the nodes, and selecting an optimal feature from the randomly selected part of sample features in a voting mode to make a left subtree and right subtree division result H (i) of the decision tree;

3. H (j) is equal to the weighted average of all probability predictions H (i) for the cluster for which the Pod-associated probability weighted average occurs.

S3, firstly, pod with Pod association probability weighted average value of more than 50% of S2 are gathered together to be called association Pod set for short. And secondly, acquiring Node sets of the associated Pod set together by using a Master configuration file, wherein the Node sets are abbreviated as associated Node sets. And then mapping the first physical equipment corresponding to the associated Node set with the second physical equipment corresponding to the distributed virtualized platform resource. And respectively collecting data of monitoring indexes (related information such as network equipment, port network, a host associated with VLAN pool and the like) corresponding to the second physical equipment. Finally, server resource alarm data (related information such as network equipment, port network, VLAN pool associated hosts and the like) corresponding to the Node (first physical equipment) mapped by the virtualized resources of the virtualized platform in the local historical database are obtained, and abnormal probability which can occur when the virtualized platform synchronizes resources with the second physical equipment mapped by the k8s cluster Node through an open structure is obtained by combining network abnormal early warning model operation.

S4, solving the problem of distributed network differentiation in various places through a distributed network, synchronizing the physical equipment corresponding to the Node set resources by the created distributed virtualized platform resources through an OpenAPI, and predicting possible fault probability in the synchronizing process. The method solves the problem of differential shielding and fault early warning of k8s clusters and virtualized resources and data.

It should be noted that, for simplicity of description, the method embodiments are shown as a series of acts, but it should be understood by those skilled in the art that the embodiments are not limited by the order of acts, as some steps may occur in other orders or concurrently in accordance with the embodiments. Further, those skilled in the art will appreciate that the embodiments described in the specification are presently preferred embodiments, and that the acts are not necessarily required by the embodiments of the invention.

Referring to fig. 4, a block diagram of a network early warning device in a data transmission process provided in an embodiment of the present invention is shown, which relates to a k8s cluster, where the k8s cluster includes a Master Node, a plurality of Node nodes connected to the Master Node, and at least one Pod Node connected to each Node; the distributed virtualization platform is deployed in the k8s cluster, and the Pod node is deployed on corresponding physical equipment based on the distributed virtualization platform; the device is applied to a target Node, and the target Node is deployed with an associated probability prediction model, and specifically can comprise the following modules:

A node information obtaining module 401, configured to obtain node information of a target Pod node, where the node information includes information generated when data interaction occurs between the target Pod node and other Pod nodes;

The association Pod determining module 402 is configured to input the node information into the association probability prediction model to perform node association probability prediction, obtain association probability values between the target Pod node and other Pod nodes in the k8s cluster, and use Pod nodes in the other Pod nodes, where the association probability values satisfy a preset condition, as association Pod nodes corresponding to the target Pod node;

The device information obtaining module 403 is configured to determine an associated Node corresponding to the associated Pod Node, and obtain first device information corresponding to a first physical device to which the associated Pod Node belongs and second device information corresponding to a second physical device to which the target Node belongs;

the anomaly probability determining module 404 is configured to input the first device information into a network anomaly early warning model issued by the Master node to perform anomaly probability prediction on the first physical device, obtain a first anomaly probability for the first physical device, and input the second device information into a preset network anomaly early warning model to perform anomaly probability prediction on the second physical device, and obtain a second anomaly probability for the second physical device.

In an alternative embodiment, the first anomaly probability is a probability that characterizes an anomaly of the first physical device when data is transmitted between the first physical device and the second physical device; the second anomaly probability is a probability representing that the second physical device is anomalous when data transmission is performed between the first physical device and the second physical device.

In an alternative embodiment, the anomaly probability determination module 404 is specifically configured to:

In an alternative embodiment, the first device information includes at least a first device parameter, a first network port parameter, and a second device parameter of a third physical device that is in a VLAN pool with the first physical device, and the anomaly probability determining module 404 is specifically configured to:

In an alternative embodiment, the second device information includes at least a third device parameter, a second network port parameter, and a fourth device parameter of a fourth physical device in a VLAN pool together with the second physical device, and the anomaly probability determining module 404 is specifically configured to:

In an alternative embodiment, the association Pod determination module 402 is specifically configured to:

In an alternative embodiment, further comprising:

In an optional embodiment, the k8s cluster further includes a history database connected to the Node, and the Node information obtaining module 401 is specifically configured to:

For the device embodiments, since they are substantially similar to the method embodiments, the description is relatively simple, and reference is made to the description of the method embodiments for relevant points.

In addition, the embodiment of the invention also provides electronic equipment, which comprises: the processor, the memory, store the computer program that can run on the processor on the memory, this computer program is realized each process of the network early warning method embodiment in the above-mentioned data transmission process when being carried out by the processor, and can reach the same technical effect, in order to avoid repetition, will not be repeated here.

The embodiment of the invention also provides a computer readable storage medium, on which a computer program is stored, which when executed by a processor, realizes the processes of the network early warning method embodiment in the data transmission process, and can achieve the same technical effects, and in order to avoid repetition, the description is omitted here. The computer readable storage medium is, for example, a Read-Only Memory (ROM), a random access Memory (Random Access Memory RAM), a magnetic disk or an optical disk.

Fig. 5 is a schematic diagram of a hardware structure of an electronic device implementing various embodiments of the present invention.

The electronic device 500 includes, but is not limited to: radio frequency unit 501, network module 502, audio output unit 503, input unit 504, sensor 505, display unit 506, user input unit 507, interface unit 508, memory 509, processor 510, and power source 511. It will be appreciated by those skilled in the art that the electronic device structure shown in fig. 5 is not limiting of the electronic device and that the electronic device may include more or fewer components than shown, or may combine certain components, or a different arrangement of components. In the embodiment of the invention, the electronic equipment comprises, but is not limited to, a mobile phone, a tablet computer, a notebook computer, a palm computer, a vehicle-mounted terminal, a wearable device, a pedometer and the like.

It should be understood that, in the embodiment of the present invention, the radio frequency unit 501 may be used to receive and send information or signals during a call, specifically, receive downlink data from a base station, and then process the downlink data with the processor 510; and, the uplink data is transmitted to the base station. Typically, the radio frequency unit 501 includes, but is not limited to, an antenna, at least one amplifier, a transceiver, a coupler, a low noise amplifier, a duplexer, and the like. In addition, the radio frequency unit 501 may also communicate with networks and other devices through a wireless communication system.

The electronic device provides wireless broadband internet access to the user through the network module 502, such as helping the user to send and receive e-mail, browse web pages, access streaming media, and the like.

The audio output unit 503 may convert audio data received by the radio frequency unit 501 or the network module 502 or stored in the memory 509 into an audio signal and output as sound. Also, the audio output unit 503 may also provide audio output (e.g., a call signal reception sound, a message reception sound, etc.) related to a specific function performed by the electronic device 500. The audio output unit 503 includes a speaker, a buzzer, a receiver, and the like.

The input unit 504 is used for receiving an audio or video signal. The input unit 504 may include a graphics processor (Graphics Processing Unit, GPU) 5041 and a microphone 5042, the graphics processor 5041 processing image data of still pictures or video obtained by an image capturing device (e.g., a camera) in a video capturing mode or an image capturing mode. The processed image frames may be displayed on the display unit 506. The image frames processed by the graphics processor 5041 may be stored in the memory 509 (or other storage medium) or transmitted via the radio frequency unit 501 or the network module 502. Microphone 5042 may receive sound and may be capable of processing such sound into audio data. The processed audio data may be converted into a format output that can be transmitted to the mobile communication base station via the radio frequency unit 501 in case of a phone call mode.

The electronic device 500 also includes at least one sensor 505, such as a light sensor, a motion sensor, and other sensors. Specifically, the light sensor includes an ambient light sensor that can adjust the brightness of the display panel 5061 according to the brightness of ambient light, and a proximity sensor that can turn off the display panel 5061 and/or the backlight when the electronic device 500 is moved to the ear. As one of the motion sensors, the accelerometer sensor can detect the acceleration in all directions (generally three axes), and can detect the gravity and direction when stationary, and can be used for recognizing the gesture of the electronic equipment (such as horizontal and vertical screen switching, related games, magnetometer gesture calibration), vibration recognition related functions (such as pedometer and knocking), and the like; the sensor 505 may further include a fingerprint sensor, a pressure sensor, an iris sensor, a molecular sensor, a gyroscope, a barometer, a hygrometer, a thermometer, an infrared sensor, etc., which are not described herein.

The display unit 506 is used to display information input by a user or information provided to the user. The display unit 506 may include a display panel 5061, and the display panel 5061 may be configured in the form of a Liquid crystal display (Liquid CRYSTAL DISPLAY, LCD), an Organic Light-Emitting Diode (OLED), or the like.

The user input unit 507 is operable to receive input numeric or character information and to generate key signal inputs related to user settings and function control of the electronic device. Specifically, the user input unit 507 includes a touch panel 5071 and other input devices 5072. Touch panel 5071, also referred to as a touch screen, may collect touch operations thereon or thereabout by a user (e.g., operations of the user on touch panel 5071 or thereabout using any suitable object or accessory such as a finger, stylus, etc.). Touch panel 5071 may include two parts, a touch detection device and a touch controller. The touch detection device detects the touch azimuth of a user, detects a signal brought by touch operation and transmits the signal to the touch controller; the touch controller receives touch information from the touch detection device, converts the touch information into touch point coordinates, sends the touch point coordinates to the processor 510, and receives and executes commands sent by the processor 510. In addition, the touch panel 5071 may be implemented in various types such as resistive, capacitive, infrared, and surface acoustic wave. In addition to the touch panel 5071, the user input unit 507 may include other input devices 5072. In particular, other input devices 5072 may include, but are not limited to, physical keyboards, function keys (e.g., volume control keys, switch keys, etc.), trackballs, mice, joysticks, and so forth, which are not described in detail herein.

Further, the touch panel 5071 may be overlaid on the display panel 5061, and when the touch panel 5071 detects a touch operation thereon or thereabout, the touch operation is transmitted to the processor 510 to determine a type of touch event, and then the processor 510 provides a corresponding visual output on the display panel 5061 according to the type of touch event. Although in fig. 5, the touch panel 5071 and the display panel 5061 are two independent components for implementing the input and output functions of the electronic device, in some embodiments, the touch panel 5071 and the display panel 5061 may be integrated to implement the input and output functions of the electronic device, which is not limited herein.

The interface unit 508 is an interface for connecting an external device to the electronic apparatus 500. For example, the external devices may include a wired or wireless headset port, an external power (or battery charger) port, a wired or wireless data port, a memory card port, a port for connecting a device having an identification module, an audio input/output (I/O) port, a video I/O port, an earphone port, and the like. The interface unit 508 may be used to receive input (e.g., data information, power, etc.) from an external device and transmit the received input to one or more elements within the electronic apparatus 500 or may be used to transmit data between the electronic apparatus 500 and an external device.

The memory 509 may be used to store software programs as well as various data. The memory 509 may mainly include a storage program area and a storage data area, wherein the storage program area may store an operating system, an application program required for at least one function (such as a sound playing function, an image playing function, etc.), and the like; the storage data area may store data (such as audio data, phonebook, etc.) created according to the use of the handset, etc. In addition, the memory 509 may include high-speed random access memory, and may also include non-volatile memory, such as at least one magnetic disk storage device, flash memory device, or other volatile solid-state storage device.

The processor 510 is a control center of the electronic device, connects various parts of the entire electronic device using various interfaces and lines, and performs various functions of the electronic device and processes data by running or executing software programs and/or modules stored in the memory 509, and calling data stored in the memory 509, thereby performing overall monitoring of the electronic device. Processor 510 may include one or more processing units; preferably, the processor 510 may integrate an application processor that primarily handles operating systems, user interfaces, applications, etc., with a modem processor that primarily handles wireless communications. It will be appreciated that the modem processor described above may not be integrated into the processor 510.

The electronic device 500 may also include a power supply 511 (e.g., a battery) for powering the various components, and preferably the power supply 511 may be logically connected to the processor 510 via a power management system that performs functions such as managing charging, discharging, and power consumption.

In addition, the electronic device 500 includes some functional modules, which are not shown, and will not be described herein.

It should be noted that, in this document, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one … …" does not exclude the presence of other like elements in a process, method, article, or apparatus that comprises the element.

From the above description of the embodiments, it will be clear to those skilled in the art that the above-described embodiment method may be implemented by means of software plus a necessary general hardware platform, but of course may also be implemented by means of hardware, but in many cases the former is a preferred embodiment. Based on such understanding, the technical solution of the present invention may be embodied essentially or in a part contributing to the prior art in the form of a software product stored in a storage medium (e.g. ROM/RAM, magnetic disk, optical disk) comprising instructions for causing a terminal (which may be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) to perform the method according to the embodiments of the present invention.

The embodiments of the present invention have been described above with reference to the accompanying drawings, but the present invention is not limited to the above-described embodiments, which are merely illustrative and not restrictive, and many forms may be made by those having ordinary skill in the art without departing from the spirit of the present invention and the scope of the claims, which are to be protected by the present invention.

Those of ordinary skill in the art will appreciate that the various illustrative elements and algorithm steps described in connection with the embodiments disclosed herein may be implemented as electronic hardware, or combinations of computer software and electronic hardware. Whether such functionality is implemented as hardware or software depends upon the particular application and design constraints imposed on the solution. Skilled artisans may implement the described functionality in varying ways for each particular application, but such implementation decisions should not be interpreted as causing a departure from the scope of the present invention.

It will be clear to those skilled in the art that, for convenience and brevity of description, specific working procedures of the above-described systems, apparatuses and units may refer to corresponding procedures in the foregoing method embodiments, and are not repeated herein.

In the embodiments provided in the present application, it should be understood that the disclosed apparatus and method may be implemented in other manners. For example, the apparatus embodiments described above are merely illustrative, e.g., the division of the units is merely a logical function division, and there may be additional divisions when actually implemented, e.g., multiple units or components may be combined or integrated into another system, or some features may be omitted or not performed. Alternatively, the coupling or direct coupling or communication connection shown or discussed with each other may be an indirect coupling or communication connection via some interfaces, devices or units, which may be in electrical, mechanical or other form.

The units described as separate units may or may not be physically separate, and units shown as units may or may not be physical units, may be located in one place, or may be distributed on a plurality of network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

In addition, each functional unit in the embodiments of the present invention may be integrated in one processing unit, or each unit may exist alone physically, or two or more units may be integrated in one unit.

The functions, if implemented in the form of software functional units and sold or used as a stand-alone product, may be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention may be embodied essentially or in a part contributing to the prior art or in a part of the technical solution, in the form of a software product stored in a storage medium, comprising several instructions for causing a computer device (which may be a personal computer, a server, a network device, etc.) to perform all or part of the steps of the method according to the embodiments of the present invention. And the aforementioned storage medium includes: a usb disk, a removable hard disk, a ROM, a RAM, a magnetic disk, or an optical disk, etc.

The foregoing is merely illustrative of the present invention, and the present invention is not limited thereto, and any person skilled in the art will readily recognize that variations or substitutions are within the scope of the present invention. Therefore, the protection scope of the invention is subject to the protection scope of the claims.

Claims

1. The network early warning method in the data transmission process is characterized by involving a k8s cluster, wherein the k8s cluster comprises a Master Node, a plurality of Node nodes connected with the Master Node and at least one Pod Node connected with each Node; the distributed virtualization platform is deployed in the k8s cluster, and the Pod node is deployed on corresponding physical equipment based on the distributed virtualization platform; the method is applied to a target Node, and the target Node is deployed with an associated probability prediction model, and comprises the following steps:

2. The method of claim 1, wherein the first anomaly probability is a probability that characterizes an anomaly in the first physical device when data is transferred between the first physical device and the second physical device; the second anomaly probability is a probability representing that the second physical device is anomalous when data transmission is performed between the first physical device and the second physical device.

3. The method of claim 1, wherein the inputting the first device information into the network anomaly early-warning model issued by the Master node predicts the anomaly probability of the first physical device, obtains a first anomaly probability for the first physical device, and inputting the second device information into the preset network anomaly early-warning model predicts the anomaly probability of the second physical device, obtains a second anomaly probability for the second physical device, comprising:

4. The method of claim 3, wherein the first device information includes at least a first device parameter, a first network port parameter, and a second device parameter of a third physical device that is in a VLAN pool with the first physical device, and wherein inputting the first device information into a preset network anomaly early warning model predicts an anomaly probability for the first physical device, and obtaining a first anomaly probability for the first physical device comprises:

5. A method according to claim 3, wherein the second device information includes at least a third device parameter, a second network port parameter, and a fourth device parameter of a fourth physical device that is in a VLAN pool with the second physical device, and the inputting the second device information into a preset network anomaly early warning model predicts an anomaly probability for the second physical device, and obtaining a second anomaly probability for the second physical device includes:

6. The method of claim 1, wherein the step of using, as the association Pod node corresponding to the target Pod node, the Pod node whose association probability value satisfies a preset condition, includes:

7. The method of claim 1, wherein the k8s cluster further comprises a history database connected to the Node, and wherein the obtaining Node information of the target Pod Node comprises:

8. The network early warning device in the data transmission process is characterized by relating to a k8s cluster, wherein the k8s cluster comprises a Master Node, a plurality of Node nodes connected with the Master Node and at least one Pod Node connected with each Node; the distributed virtualization platform is deployed in the k8s cluster, and the Pod node is deployed on corresponding physical equipment based on the distributed virtualization platform; the apparatus is applied to a target Node, the target Node is deployed with an associated probability prediction model, and the apparatus includes:

9. An electronic device comprising a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus;

the memory is used for storing a computer program;

the processor is configured to implement the method according to any one of claims 1-7 when executing a program stored on a memory.

10. A computer-readable storage medium having instructions stored thereon, which when executed by one or more processors, cause the processors to perform the method of any of claims 1-7.