CN106817252B - Internet data processing method and processing device - Google Patents

Abstract

The disclosure provides a method and device for processing online data. The method includes: fitting the collected user online data to obtain a data distribution curve, wherein the user online data includes performance indicators of the user online; and obtaining a threshold point by analyzing the data distribution curve, at the threshold point Suitable for anomaly awareness monitoring alarms. The online data processing method and device according to the embodiments of the present invention solve the problem of complex alarm threshold point selection algorithm and low accuracy in the prior art, improve the accuracy of alarm threshold point selection, and reduce complexity.

Description

Internet data processing method and device

technical field

The present disclosure relates to the field of communication, and in particular, relates to a method and device for processing online data.

Background technique

As 4G users develop fragmented online habits, end-to-end experience has become a key factor affecting user perception. On the one hand, the traditional indicator monitoring based on the network and network elements can no longer meet the guarantee requirements of "anytime, anywhere" Internet experience; on the other hand, 4G traffic has increased sharply, and the amount of mobile signaling data generated by mobile terminals every day is also rising rapidly. There is an urgent need to carry out all-weather perceptual monitoring of each user and each service through big data analysis, so as to avoid traditional network management cells and network element-level indicator statistics obliterating users with poor perception quality.

The setting of monitoring thresholds for user-level perception indicators has always been a difficult problem for network monitoring and network analysts, especially the monitoring of full 4G user-level end-to-end key performance indicators. First, the total user base is large, far exceeding the order of magnitude of cells and network elements; second, there are many links in the end-to-end Internet access process, from attachment, bearer establishment, tracking area update, domain name resolution, TCP connection establishment to HTTP business links, involving There are many key performance indicators. There is an urgent need to use big data analysis and mining technology to effectively discover and set the threshold of poor perception quality in massive and complex data, which can not only detect abnormal perception problems in time, but also avoid a large number of invalid alarms. In response to these phenomena, the earliest mobile data operation and maintenance personnel proposed the threshold selection method through experience and the method of calculating the threshold model multiple times, but these methods have obvious shortcomings.

The traditional threshold value selection method is based on empirical threshold selection method, but this method requires the selector to have a high level of business understanding, and must have a deep understanding of different alarm situations, which is difficult to do However, a large amount of alarm information is often missed or non-threshold points are also included in the alarm range. Later, some network analysis and monitoring engineers realized this kind of problem, and proposed improved methods, such as the 7-point difference method. This method relies on experience to select 7 points, and the entire curve is obtained by the distance difference between the points. The point with the largest difference is taken as the threshold point. This method first selects points based on fuzzy rules based on experience, and in the big data alarm model, it is necessary to perform multiple calculations on all threshold points, increasing the system’s Space complexity and time complexity, because the algorithm is repeatedly calculated at multiple points, its calculation amount is as high as 399,000 times.

Contents of the invention

Embodiments of the present disclosure provide a method and device for processing online data, so as to at least solve the problem that the alarm threshold point selection algorithm in the prior art is complex and has low accuracy.

According to one aspect of the present disclosure, a method for processing online data is provided, including: fitting the collected user online data to obtain a data distribution curve, wherein the user online data includes user online performance indicators; The distribution curve is analyzed to obtain a threshold point at which anomaly-aware monitoring alarms are suitable.

According to another aspect of the present disclosure, there is provided an online data processing device, including: a fitting module, used to fit the collected user online data to obtain a data distribution curve, wherein the user online data includes the user online performance An index; and an analysis module, configured to obtain a threshold point by analyzing the data distribution curve, and at the threshold point, it is suitable to issue an abnormality perception monitoring alarm.

According to another aspect of the present disclosure, an apparatus for processing data online is provided, including: a processor and a memory. The memory stores instructions for execution by the processor. When the processor executes these instructions, it is configured to: fit the collected user online data to obtain a data distribution curve, wherein the user online data includes user online performance indicators; and analyze the data distribution curve to obtain A threshold point is suitable for issuing an abnormality perception monitoring alarm at the threshold point.

The embodiments of the present disclosure solve the problem that the alarm threshold point selection algorithm in the prior art is complicated and the accuracy rate is not high, improves the accuracy of the alarm threshold point selection, and reduces the complexity.

Description of drawings

The accompanying drawings described here are used to provide a further understanding of the present invention and constitute a part of the application. The schematic embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute improper limitations to the present invention. In the attached picture:

Fig. 1 is a flow chart of a method for processing online data according to an embodiment of the present invention;

Fig. 2 is a schematic diagram of curves of 4G user-level key performance indicators (TCP handshake success rate) according to an optional embodiment of the present invention;

3 is a schematic diagram of an example of threshold point generation according to an embodiment of the present invention;

Fig. 4 is a structural block diagram of an Internet data processing device according to an embodiment of the present invention; and

Fig. 5 is a schematic structural diagram of a data processing device according to an embodiment of the present invention.

Detailed ways

In order to enable those skilled in the art to better understand the solutions of the present invention, the following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only It is an embodiment of a part of the present invention, but not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts shall fall within the protection scope of the present invention.

It should be noted that the terms "first" and "second" in the description and claims of the present invention and the above drawings are used to distinguish similar objects, but not necessarily used to describe a specific sequence or sequence. It is to be understood that the data so used are interchangeable under appropriate circumstances such that the embodiments of the invention described herein can be practiced in sequences other than those illustrated or described herein. Furthermore, the terms "comprising" and "having", as well as any variations thereof, are intended to cover a non-exclusive inclusion, for example, a process, method, system, product or device comprising a series of steps or modules is not necessarily limited to the expressly listed Instead, other steps or modules not explicitly listed or inherent to the process, method, product or apparatus may be included.

The embodiment of the present disclosure provides a method for processing online data. Fig. 1 is a flowchart of a method 100 for processing online data according to an embodiment of the present invention. As shown in Fig. 1, the method 100 includes the following steps:

In step S102, fitting is performed on the collected user access data to obtain a data distribution curve. The user surfing data may include, for example, performance indicators of the user surfing the Internet.

In step S104, the threshold point is obtained by analyzing the data distribution curve. At this threshold point, it is suitable to issue an abnormality perception monitoring alarm. That is to say, when the threshold point is issued, an abnormality perception monitoring alarm can contain most of the abnormal information, and can minimize invalid abnormal alarms.

In some embodiments, for example, a user-defined third-order function may be used to fit the user surfing data to obtain a data distribution curve. Alternatively, in other embodiments, according to actual needs, a second-order function or a higher-order function may be used to fit the user surfing data.

In some embodiments, for example, the data distribution curve can be analyzed in the following manner: obtain the tangents of the two parts of the curve before and after the maximum curvature of the data distribution curve; predict the change of the curvature of the data distribution curve according to these two tangents; And determine the intersection point of the predicted result and the data distribution curve as the threshold point.

As understood by those of ordinary skill in the art, the curvature of a curve is the rate of rotation of the tangent direction angle to the arc length for a point on the curve, which indicates the degree to which the curve deviates from a straight line. Curvature in mathematics is a numerical value that indicates how curved a curve is at a certain point. The greater the curvature, the more curved the curve.

In some embodiments, the step of obtaining the threshold point by analyzing the data distribution curve may further include: connecting the respective tangent lines of the two parts of the curve before and after the maximum curvature of the data distribution curve to the tangent point of the data distribution curve, obtaining a connecting line; determining a perpendicular from the intersection of the two tangents to the above connecting line; and determining the intersection of the perpendicular and the data distribution curve as a threshold point.

Through the above steps, use a custom third-order function to fit the data distribution curve, and then obtain the tangents of the two parts of the curve before and after the maximum curvature of the data distribution curve, and predict the curvature change of the data distribution curve according to these two tangents; The intersection point of the predicted result and the data distribution curve is determined as the threshold point. The online data processing method 100 according to the embodiment of the present disclosure solves the problem of complex alarm threshold point selection algorithm and low accuracy in the prior art, improves the accuracy of alarm threshold point selection, and reduces complexity.

There are many ways to predict changes in the curvature of a data distribution curve. As an optional implementation manner, the change of the curvature is used to predict the position of the threshold point. The location of the threshold point can be predicted according to the trajectory law of the sample points on the left and right sides of the threshold point through the online data processing method 100 according to the embodiment of the present disclosure.

The method 100 for processing online data according to an embodiment of the present disclosure will be described in detail below in conjunction with an optional example.

For the analysis of massive user-level signaling big data, the dynamic real-time distribution of end-to-end indicators of 4G users is generated, so that the data points are not far above or below the data distribution curve, which can not only reflect the overall distribution of data, but also There will not be large local fluctuations, and it can reflect the characteristics of the approximated function, so that the deviation between the approximate function obtained and the known data points is generally the smallest. As mentioned above, the collected user surfing data can be fitted by means of curve fitting.

In order to better match the distribution of data points, interpolation with subdivided granularity is used. In some embodiments, considering the complexity of system implementation, a third-order function is used to fit the collected user surfing data.

For example, assuming that n+1 data points are given, there are n subdivision intervals in total, where n is a natural number. Then the third-order function can be expressed as S _i (x)=a _i +b _i (xx _i )+ _ci (xx _i ) ² +d _i (xx _i ) ³ , i=0,1,…,n-1 , where a _i , b _i , _ci , d _i represent unknown coefficients.

For the curve S _i (x)=a _i +b _i (xx _i )+ _ci (xx _i ) ² +d _i (xx _i ) ³ , calculate the first order derivative and the second order derivative respectively:

S _i '(x)＝b _i +2c _i (xx _i )+3d _i (xx _i ) ² (1)

S _i ”(x)＝2c _i +6d _i (xx _i )

Bring the step size h _i = _xi+1 - _xi into the condition of the spline curve (the so-called spline curve refers to a curve obtained by giving a set of control points, and the general shape of the curve is controlled by these points), by S _i (x _i )=y _i , S _i '(x _i+1 )=S _i+1 '(x _i+1 ), S _i ”(x _i+1 )=S _i+1 ”(x _{i +1} ), which yields:

a _i =y _i

a _i +h _i b _i +h _i ² c _i +h _i ³ d _i =y _i +1 (2)

b _i +2h _i c _i +3h _i ² d _i -b _i+1 ＝0

2c _i +6h _i d _i -2c _i+1 ＝0

Set m _i ＝S _i ”( _xi )＝2c _i , substituting the above formula to get the coefficient of the spline curve, namely

a _i =y _i

where i=0,1,...,n-1. Thus, the fitted data distribution curve can be obtained.

In an optional implementation, the user's performance index for surfing the Internet may include but not limited to one or more of the following parameters, for example: TCP1/2 step handshake success rate, TCP1/2 step handshake delay, TCP2/3 Step handshake success rate, TCP2/3 step handshake delay, HTTP access response delay, HTTP access session delay, HTTP download rate.

FIG. 2 is an example of a curve 200 of a 4G user-level KPI fitted by a third-order function according to an embodiment of the present disclosure. For example, curve 200 may represent a TCP handshake success rate.

It can be seen from the observation of the curve 200 that the fitted data curve presents the following characteristics: the curve trajectory is approximately a smooth straight line at first, with a very large curvature near the threshold point, and becomes approximately a smooth straight line after crossing the threshold point.

The following illustrates how to obtain the threshold point by analyzing the data distribution curve by way of example and with reference to FIG. 3 . Fig. 3 is a schematic diagram of an example of threshold point generation according to an embodiment of the present invention.

For the convenience of description, assume that the data distribution curve is F(x,y)=0, and the tangents of the two parts of the curve before and after the maximum curvature of the data distribution curve are y ₁ =k ₁ x+b ₁ and y ₂ =k ₂ x+ b ₂ , where k ₁ , b ₁ , k ₂ , and b ₂ are unknown parameters.

Substituting the tangent equation into the data distribution curve and expanding according to the power of x, F(x,kx+b)=f ₁ (k)x ^m +f ₂ (k,b)x ^m + . . . is obtained.

Next, the values of k ₁ , b ₁ , k ₂ , and b ₂ can be obtained by solving the following system of equations:

and thus get:

Solving equation group (5) can obtain the intersection point of tangent line y ₁ =k ₁ x+b ₁ and y ₂ =k ₂ x+b ₂ , which is represented as point A in FIG. 3 .

The points closest to the tangent lines y ₁ =k ₁ x+b ₁ and y ₂ =k ₂ x+b ₂ and the data distribution curve F(x,y)=0, that is, the tangent points, can be found through the following formula.

Assume that the obtained tangent points are M(x,y) and N(x,y) respectively. Then, the function of the connecting line MN between two points can be obtained through the tangent points M and N as f ₃ (x, y). A perpendicular line P is drawn from the intersection point A of the tangent lines y ₁ =k ₁ x+b ₁ and y ₂ =k ₂ x+b ₂ to the connecting line f ₃ (x,y). The vertical line P intersects the data distribution curve at point B(x,y) at F(x,y)=0. Then point B is the threshold point suitable for sending out abnormal perception monitoring alarm.

The online data processing method 100 according to the embodiment of the present disclosure solves the problem that the alarm threshold point selection algorithm in the prior art is complicated and the accuracy rate is not high through the above calculation and analysis, improves the accuracy of the alarm threshold point selection, and reduces the the complexity.

What is shown above is an example flowchart of a method for processing surfing data according to an embodiment of the present disclosure. It should be noted that while the methodologies provided herein are shown and described as a series of acts or events, the disclosure is not limited by the ordering of these acts or events shown. For example, some acts may occur in orders other than those shown and/or described and/or concurrently with other acts or events. In addition, the method may also include other actions not shown in the figure, and not all the actions shown are required.

The online data processing method 100 according to the embodiment of the present disclosure adopts the method of combining the CT communication field and the IT information field, and has the advantages of high reliability, good versatility, and low complexity compared with the traditional simple CT communication field experience scheme.

In an embodiment of the present disclosure, an apparatus for processing data online is also provided. Fig. 4 is a structural block diagram of a data processing device 400 according to an embodiment of the present disclosure. As shown in FIG. 4 , the online data processing device 400 may include, for example, a fitting module 42 and an analysis module 44 . In some embodiments, the device 400 for processing data online may further include other modules as required. The various modules can be communicatively connected to coordinate operations.

In some embodiments, the fitting module 42 may be used to fit the collected user surfing data to obtain a data distribution curve. As an example, the user surfing data may include user surfing performance indicators. For example, the performance indicators of users surfing the Internet may include but not limited to one or more of the following parameters, for example: TCP1/2-step handshake success rate, TCP1/2-step handshake delay, TCP2/3-step handshake success rate, TCP2/ 3-step handshake delay, HTTP access response delay, HTTP access session delay, HTTP download rate.

In some embodiments, the analysis module 44 is used to obtain the threshold point by analyzing the data distribution curve. At this threshold point, it is suitable to issue an abnormality perception monitoring alarm. That is to say, when the threshold point is issued, an abnormality perception monitoring alarm can contain most of the abnormal information, and can minimize invalid abnormal alarms.

In some embodiments, considering the complexity of system implementation, the fitting module 42 may be configured to use a third-order function (for example, the above-mentioned third-order function S _i (x)=a _i + _{bi (xx i )} +c _i (xx _i ) ² +d _i (xx _i ) ³ ) to fit the user surfing data. Alternatively, in other embodiments, according to actual needs, the fitting module 42 may use a second-order function or a higher-order function to fit the user surfing data.

In some embodiments, the analysis module 44 may include an acquisition submodule 441 , a prediction submodule 442 , and a threshold determination submodule 443 .

In an example, the acquiring sub-module 441 is used to acquire the tangents of the data distribution curve (for example, the above-mentioned data distribution curve equation is F(x, y)=0) before and after the maximum curvature (for example, as mentioned above tangents y ₁ =k ₁ x+b ₁ and y ₂ =k ₂ x+b ₂ ).

_{In an} example, the prediction sub _- module ₄₄₂ is _used to predict the data distribution curve ₍ eg, The data distribution curve equation described above is the change in curvature of F(x,y)=0).

In an example, the threshold determination sub-module 443 is used to calculate the intersection point (for example, B in FIG. point) is determined as the threshold point suitable for sending out abnormal perception monitoring alarms.

In another embodiment, the analysis module 44 may further include a connection submodule 444, a vertical line determination submodule 445, and other required submodules. The various sub-modules can be communicatively connected to coordinate operations.

For example, the connection sub-module 444 is used to connect the respective tangents of the two parts of the curve before and after the maximum curvature of the data distribution curve (for example, the above-mentioned data distribution curve equation is F(x, y)=0) (for example, as above The tangent lines y ₁ =k ₁ x+b ₁ and y ₂ =k ₂ x+b ₂ ) are connected to the tangent points of the data distribution curve (for example, the M point and the N point as mentioned above), to obtain A connecting line (eg, connecting line f ₃ (x,y) as described above).

In an example, the perpendicular line determination sub-module 445 is used to determine intersection points from tangents (eg, tangents y ₁ =k ₁ x+b ₁ and y ₂ =k ₂ x+b ₂ as described above) (eg, FIG. 3 Point A in ) to the above-mentioned connecting line (eg, connecting line f ₃ (x, y) as described above) perpendicular (eg, perpendicular line P as described above).

In an example, the threshold determination sub-module 443 may be configured to calculate the intersection point (for example, Point B in Fig. 3) is determined as a threshold point suitable for issuing an abnormality perception monitoring alarm.

What has been shown above is an example of the surfing data processing device according to the present disclosure. It should be noted that although the Internet access data processing device provided here is shown and described as including multiple modules, the detection module according to the present disclosure may include more or fewer modules according to the requirements of the realized functions.

FIG. 5 shows a schematic structural diagram of a data processing device 500 . The apparatus 400 for processing data online in the embodiment of the present application may be implemented by a device 500 . As shown in FIG. 5 , device 500 may include one or more of the following components: processor 520, memory 530, power supply component 540, input/output (I/O) interface 560, communication interface 580, and these components may, for example, Communicatively connected via bus 510 .

The processor 520 controls operations of the device 500 as a whole, such as operations associated with data communication and computational processing, and the like. The processor 520 may include one or more processing cores, and is capable of executing instructions to implement all or part of the steps of the methods described in this application. Processor 520 may include various devices with processing capabilities, including but not limited to general purpose processors, special purpose processors, microprocessors, microcontrollers, graphics processing units (GPUs), digital signal processors (DSPs), application specific integrated circuit (ASIC), programmable logic device (PLD), field programmable logic gate array (FPGA), etc. The processor 520 may include or be in communication with a cache 525 to increase data access speed.

The memory 530 is configured to store various types of instructions and/or data to support the operation of the device 500 . Examples of data include instructions, data, etc. for any application or method operating on device 500 . Memory 530 may be implemented by any type or combination of volatile or non-volatile storage devices. Memory 530 may include semiconductor memory such as random access memory (RAM), static random access memory (SRAM), dynamic random access memory (DRAM), read only memory (ROM), programmable read only memory (PROM), erasable In addition to programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), flash memory, etc. Memory 530 may also include, for example, any memory using paper, magnetic, and/or optical media, such as paper tape, hard disk, magnetic tape, floppy disk, magneto-optical disk (MO), CD, DVD, Blue-ray, and the like.

The power supply component 540 provides power to various components of the device 500 . Power component 540 may include an internal battery and/or an external power interface, and may include a power management system and other components associated with generating, managing, and distributing power for device 500 .

I/O interface 560 provides an interface that enables a user to interact with device 500 . The I/O interface 560 may include, for example, interfaces based on technologies such as PS/2, RS-232, USB, FireWire, Lightening, VGA, HDMI, DisplayPort, etc. Peripheral devices such as a microphone, a speaker, a display, a camera, and a projection port interact with the device 500 .

The communication interface 580 is configured to enable the device 500 to communicate with other devices in a wired or wireless manner. The device 500 can access wireless networks based on one or more communication standards through the communication interface 580, such as WiFi, 2G, 3G, and 4G communication networks. In an exemplary embodiment, the communication interface 580 may also receive a broadcast signal or broadcast related information from an external broadcast management system via a broadcast channel. Exemplary communication interfaces 580 may include interfaces based on communication methods such as Near Field Communication (NFC) technology, Radio Frequency Identification (RFID) technology, Infrared Data Association (IrDA) technology, Ultra Wide Band (UWB) technology, Bluetooth (BT) technology and the like.

In some embodiments, each step or module of the online data processing device 100 and the online data processing device 400 may be implemented as hardware, software, firmware or a combination thereof. When implemented in hardware, it may be, for example, an electronic circuit, an Application Specific Integrated Circuit (ASIC), a Field Programmable Gate Array (FPGA), suitable firmware, a plug-in, a function card, or the like. When implemented in software, the elements of the present invention are programs or code segments used to realize desired functions. Programs or code segments can be stored in machine-readable media, or transmitted over transmission media or communication links by data signals carried in carrier waves.

Embodiments of the present disclosure also provide a storage medium. The storage medium may include but not limited to: flash disk, read-only memory (Read-Only Memory, ROM), random access device

(Random Access Memory, RAM), disk or CD. Embodiments of the present disclosure may also be implemented by other storage media appearing with the development of technology.

The storage medium in this embodiment stores a computer program or a software program, and when the computer program or software program is run, it is operable to perform the following steps: fitting the collected user online data to obtain a data distribution curve, wherein The user surfing data may include, for example, user surfing performance indicators; and the threshold point is obtained by analyzing the data distribution curve. At this threshold point, it is suitable to issue an abnormality perception monitoring alarm. That is to say, when the threshold point is issued, an abnormality perception monitoring alarm can contain most of the abnormal information, and can minimize invalid abnormal alarms.

In order to better illustrate the advantages of the online data processing method 100 and the online data processing device 400 according to the embodiments of the present disclosure, the beneficial effects obtained by the online data processing method 100 and the online data processing device 400 in practical applications will be described below in conjunction with Table 1 .

In the actual application of the current network, the online data processing method 100 and the online data processing device 400 are used to obtain the early warning threshold for 15-minute granularity user perception index detection through data mining of the data within a week. Threshold floating gap within 2 time periods during busy hours. It can be seen that the threshold point obtained by using the online data processing method 100 and the online data processing device 400 has achieved good technical results and basically meets expectations.

Table 1

Specifically, one or more of the following technical effects can be achieved according to one or more embodiments of the method and device for processing online data in the present invention:

(1) High reliability

Using the method of combining the CT communication field and the IT information field, through the curve fitting, the fitting curve is geometrically analyzed, the trend of the curve is judged, and the point with the largest difference between the movement trend of the curve and the real situation is found, which is judged as the threshold point. The method completes the monitoring of the dynamic threshold point completely through mathematical analysis, does not rely on the judgment of human experience, and is more convincing and reliable than other solutions that only use CT communication.

(2) Good versatility

The curve fitting method is used to analyze 8 key performance indicators of 4G users online, which can not only effectively mine 4G users with poor perception quality, but also generalize to other complex problem monitoring and demarcation. Its data analysis function will change according to the value of different performance indicators, and there is no need to mark the points in the function curve. Some of the points are analyzed separately, which has good applicability in the actual case of the live network .

(3) Small complexity

In the past, the threshold point selection scheme for perception monitoring, such as the 7-point difference method, obtained the final result by performing multiple calculations on several candidate points and repeated iterations, which would greatly increase the space complexity and time complexity of the system. However, the present invention only needs to perform curve fitting once, turns all the points into a curve, and converts the problem of delimiting the problem into the geometric judgment of the delimiting curve of the problem. The complexity of the algorithm is small, and it is easy to implement.

In the above-mentioned embodiments of the present invention, the descriptions of each embodiment have their own emphases, and for parts not described in detail in a certain embodiment, reference may be made to relevant descriptions of other embodiments.

In addition, each functional module in each embodiment of the present invention may be integrated into one processing module, each module may exist separately physically, or two or more modules may be integrated into one module. The above-mentioned integrated modules can be implemented in the form of hardware or in the form of software function modules.

The foregoing are only optional implementations of the present invention. It should be pointed out that for those of ordinary skill in the art, some improvements and modifications can also be made without departing from the principle of the present invention. These improvements and modifications It should also be regarded as the protection scope of the present invention.

Claims (9)

1. a kind of Internet data processing method characterized by comprising

Collected user's Internet data is fitted, to obtain data distribution curve, wherein user's Internet data packet Include the performance indicator of user's online；And

Threshold point is obtained by being analyzed the data distribution curve, is suitable for issuing abnormality sensing in the threshold point Monitoring, alarming；

The step of data distribution curve is analyzed to obtain threshold point include:

Two parts curve near tangent before and after obtaining at the data distribution curve maximum curvature；

The variation of the curvature of the data distribution curve is predicted according to the tangent line；And

The intersection point of the result of prediction and the data distribution curve is determined as the threshold point.

2. the method according to claim 1, wherein the step of being fitted to collected user's Internet data It include: to be fitted using function of third order to user's Internet data.

3. the method according to claim 1, wherein being obtained by being analyzed the data distribution curve The step of threshold point further include:

By the respective tangent line of two parts curve and the data distribution curve before and after at the data distribution curve maximum curvature Point of contact be connected, to obtain connecting line；

It determines from the intersection point of the tangent line to the vertical line of the connecting line；And

The intersection point of the vertical line and the data distribution curve is determined as the threshold point.

4. according to the method in any one of claims 1 to 3, which is characterized in that the performance indicator packet of user's online Include at least one of the following:

TCP1/2 walks success rate of shaking hands, TCP1/2 step is shaken hands, and time delay, TCP2/3 walk success rate of shaking hands, TCP2/3 walks time delay of shaking hands, HTTP access response time delay, HTTP access session time delay, HTTP downloading rate.

5. a kind of Internet data processing unit characterized by comprising

Fitting module, for being fitted collected user's Internet data to obtain data distribution curve, wherein the use Family Internet data includes the performance indicator of user's online；And

Analysis module is suitble to for obtaining threshold point by being analyzed the data distribution curve in the threshold point In sending abnormality sensing monitoring, alarming；

The analysis module includes:

Acquisition submodule, for two parts curve near tangent before and after obtaining at the data distribution curve maximum curvature；

Predict submodule, the variation of the curvature for predicting the data distribution curve according to the tangent line；And

Threshold value determines submodule, for the intersection point of the result of prediction and the data distribution curve to be determined as the threshold point.

6. device according to claim 5, which is characterized in that the fitting module is configured as using function of third order to institute User's Internet data is stated to be fitted.

7. device according to claim 5, which is characterized in that the analysis module further include:

Connect submodule, for by before and after at the data distribution curve maximum curvature the respective tangent line of two parts curve and institute The point of contact for stating data distribution curve is connected, to obtain connecting line；

Vertical line determines submodule, for determining from the intersection point of the tangent line to the vertical line of the connecting line；And

The threshold value determines that submodule is configured as the intersection point of the vertical line and the data distribution curve being determined as the threshold Value point.

8. device according to any one of claims 5 to 7, which is characterized in that the performance indicator packet of user's online Include at least one of the following:

TCP1/2 walks success rate of shaking hands, TCP1/2 step is shaken hands, and time delay, TCP2/3 walk success rate of shaking hands, TCP2/3 walks time delay of shaking hands, HTTP access response time delay, HTTP access session time delay, HTTP downloading rate.

9. a kind of Internet data processing unit characterized by comprising

Processor；And

Memory, for storing the instruction executed for the processor；

Wherein, the processor is configured as when executed:

Collected user's Internet data is fitted, to obtain data distribution curve, wherein user's Internet data packet Include the performance indicator of user's online；And

Threshold point is obtained by being analyzed the data distribution curve, is suitable for issuing abnormality sensing in the threshold point Monitoring, alarming；

The step of data distribution curve is analyzed to obtain threshold point include:

Two parts curve near tangent before and after obtaining at the data distribution curve maximum curvature；

The variation of the curvature of the data distribution curve is predicted according to the tangent line；And

The intersection point of the result of prediction and the data distribution curve is determined as the threshold point.