TW201916641A - Abnormal traffic detecting server and abnormal traffic detecting method thereof - Google Patents

Abstract

An abnormal traffic detecting server and an abnormal traffic detecting method thereof are provided. In the method, multiple traffic data are analyzed, to obtain multiple abnormal event records. Determining whether the abnormal event records corresponds to an abnormal event ticket, to establish another abnormal event ticket. When abnormal alarm is continued or recovering to normal on an interface, an alarm level of the abnormal event ticket would be increased or decreased. When the accumulated alarm level of the abnormal event ticket reaches an abnormal event report threshold, an event report would be sent. Accordingly, the number of the alarm would be reduced greatly, and combing with fault tolerance mechanism of alarm error, the important abnormal event can be noticed on time.

Description

Abnormal traffic detection server and abnormal traffic detection method thereof

The invention relates to an abnormal monitoring technology, and in particular to an abnormal traffic detecting server and an abnormal traffic detecting method thereof.

Anomaly monitoring is an important procedure used by enterprises, telecommunications providers, or network service providers to transport peer devices. When the conventional traffic analysis system receives the network traffic, network quality, or device performance parameter values collected by the network management system of the terminal device, most of the interfaces, alarm categories, and severity alarms are simultaneously performed at the same time. Threshold judgment and transmission. However, this will cause problems such as excessive alarms, false alarms, and inability to concentrate and comprehensively determine alarm divergence. It can be seen that the existing abnormal monitoring still needs to be improved.

In view of this, the present invention provides an abnormal traffic detection server and an abnormal traffic detection method thereof, which integrates multiple abnormal event records and combines alarm notification and fault tolerance mechanism to greatly reduce the amount of single alarm notification.

The abnormal traffic detection method of the present invention comprises the following steps. Analyze multiple traffic data to obtain multiple abnormal event records. An abnormal event ticket is established based on these abnormal event records, and the abnormal event ticket is consolidated with those abnormal event records. A subsequent abnormal event record of the abnormal event ticket is detected to accumulate the abnormality value of the abnormal event ticket. The end of the abnormal event ticket is judged according to the abnormality value of the abnormal event ticket, and the establishment and the end of the abnormal event ticket are notified.

The abnormal traffic detection server of the present invention comprises an input unit and a processing unit. The input unit obtains multiple pieces of traffic data. The processing unit is coupled to the input unit and configured to perform the following steps. Analyze those traffic data to obtain multiple abnormal event records. An abnormal event ticket is established based on these abnormal event records, and the abnormal event ticket is consolidated with those abnormal event records. A subsequent abnormal event record of the abnormal event ticket is detected to accumulate the abnormality value of the abnormal event ticket. The end of the abnormal event ticket is judged according to the abnormality value of the abnormal event ticket, and the establishment and the end of the abnormal event ticket are notified.

Based on the above, the embodiment of the present invention can integrate the abnormal event record into multiple abnormal event records, and continuously detect the subsequent abnormal alarm record, determine whether the abnormal event continues to appear or return to normal, and when the abnormality value is accumulated to a specific The quantity is reported only. In this way, not only can a single alarm amount be greatly reduced, but also a fault alarm tolerance mechanism can be combined to enable relevant personnel to detect important abnormal events in time and eliminate them early, thereby effectively maintaining network service quality.

The above described features and advantages of the invention will be apparent from the following description.

1 is a schematic diagram showing a system architecture in accordance with an embodiment of the present invention. The system architecture includes an abnormal traffic detection server 100 and a network management server 200. The abnormal traffic detection server 100 and the network management server 200 may be any type of server, personal computer, host computer, workstation, and the like.

The abnormal traffic detection server 100 includes an input unit 110, a storage unit 130, and a processing unit 150. The input unit 110 can be a wireless or wired communication processor (for example, supporting Bluetooth, 4th generation mobile communication (4G), Wi-Fi, optical fiber, Ethernet, etc.), a bus interface, etc. The hardware unit of the terminal's service data (for example, network signal, network quality, device performance, etc.).

The storage unit 130 can be any type of fixed or removable random access memory (RAM), read only memory (ROM), flash memory, hard disk drive, solid state hard A solid-state drive or the like or a combination of the above components, and used to record an alarm item and threshold establishment and management module 131, an event ticket type management module 132, an event ticket and alarm item association management module 133, and an abnormality Event ticket generator 134 software program, traffic data, alarm item, abnormal event record, abnormal event ticket, event ticket type, correspondence table, abnormal degree value, abnormal judgment threshold, weight value, event ticket and alarm item association definition table, etc. Related information, files and parameters. The foregoing modules, parameters, files and materials will be described in detail in the following embodiments.

The processing unit 150 is connected to the input unit 110 and the storage unit 130, and may be a central processing unit (CPU), or other programmable general purpose or special purpose microprocessor (Microprocessor), digital signal processor (DSP). , a programmable controller, an application specific integrated circuit (ASIC) or other similar component or a combination of the above. In the embodiment of the present invention, the processing unit 150 is configured to execute all the operations of the abnormal traffic detection server 100, and can access and execute the software modules recorded by the input unit 110 and the storage unit 130.

In the embodiment of the present invention, the device for providing the terminal device and the inter-interface traffic data in the communication network for the abnormal traffic detection server 100 is the network management server 200. The network management server 200 may be connected to one or more terminal devices and interfaces to obtain the aforementioned traffic data.

It should be noted that in other embodiments, the abnormal traffic detection server 100 may directly obtain the foregoing traffic data through the input unit 110 (with the built-in network management function), and more preferably through the flash drive. The foregoing traffic data is input by means of data uploading, optical disc, etc., and the invention is not limited.

In order to facilitate the understanding of the operation flow of the embodiment of the present invention, the following describes an abnormal traffic detection method in the embodiment of the present invention in detail. Hereinafter, the method and the module of the abnormal traffic detection server 100 will be described with reference to the methods described in the embodiments of the present invention. The various processes of the method can be adjusted accordingly according to the implementation situation, and are not limited thereto.

Before starting the detection of the traffic data, you need to set the relevant parameters and correspondence table. Since circuit communication will vary and change depending on the network usage environment or the location, a flexible anomaly detection threshold adjustment mechanism is required. Therefore, the alarm item and threshold establishment and management module 131 can provide a user interface for the user to customize the threshold of various class severity detections (ie, abnormality determination thresholds) according to the pre-planned circuit classification. For example, the alarm level is divided into three levels: critical, major, and minor, and different alarm items have three abnormal judgment thresholds, which are smaller than the first abnormality threshold. The second abnormality judgment threshold is regarded as secondary, and between the second and third abnormal judgment thresholds is regarded as the main, and the third abnormality determination threshold is regarded as serious. It should be noted that the abnormality thresholds of different alarm items may be different and may be adjusted by an expert system in the corresponding field or other usage requirements.

In addition, the alarm item and threshold establishing and management module 131 can set the importance priority and the weight value between the alarm items. That is to say, different alarm items are given different weight values. When the processing unit 150 detects a plurality of abnormal event records at the same time, the abnormal event records may be sorted according to the priority order, and then the severity level of the abnormal event record is increased according to the weight value weighting. Taking Table (1) as an example, different alarm items correspond to different weight values and priorities. Table 1)

The event ticket type management module 132 provides a user to define an event ticket type according to the maintenance requirement, and is used by the event ticket and alarm item association management module 133 and the abnormal event ticket generator 134, and the abnormal event ticket can also be generated. The frequency (for example, instant, daily, monthly) is classified. The event ticket and alarm item association management module 133 provides a definition of the attribution relationship between the event ticket type and the alarm item, and stores it in the event ticket and alarm item association definition table of the database in the storage unit 130. Taking the event ticket and alarm item association table of Table (1) as an example, it is assumed that there is a circuit abnormal event ticket AlarmTicket. When the processing unit 150 detects seven alarms such as ERR, PDC, TRF_DNGAP in a circuit appearance table, the processing unit According to this table (1), these seven kinds of alarms can be attributed to the abnormal event ticket AlarmTicket.

After the foregoing related parameters and the correspondence table are established, the core component (ie, the abnormal event ticket generator 134) of the embodiment of the present invention can start to generate and analyze the network abnormal event ticket. The abnormal event ticket generator 134 analyzes the acquired traffic data to acquire a plurality of abnormal event records (step S210). Specifically, the input unit 110 collects and parses the traffic data every specific period (for example, 5, 10, or 20 minutes, etc., time division), and stores it in the transaction database related table of the storage unit 130. The abnormal event ticket generator 134 reads the traffic data every interval scanning time (for example, 5, 10 or 20 minutes, etc.), and monitors the traffic data and circuit quality status of all circuit traffic data. The abnormal alarm level of each alarm item is divided into three alarm levels 1, 2, and 3 (corresponding to the secondary, primary, and severe levels respectively), and the abnormal event ticket generator 134 determines whether the traffic data exceeds according to different alarm items. Corresponding to the abnormality judgment threshold. If the content recorded in the traffic data exceeds the corresponding abnormality threshold, an abnormal event record is generated and stored in the database along with the corresponding alarm level.

The abnormal event ticket generator 134 creates an abnormal event ticket based on these abnormal event records, and the abnormal event ticket is a normal event record (step S220). Specifically, according to the single interface and according to the event ticket and the alarm item association table, the abnormal event ticket generator 134 performs weighting operations (alarm level * weight value) on different abnormal alarms of the same event ticket type, and checks whether the interface exists. (or belong to) the corresponding event ticket.

Taking FIG. 3 as an example, the abnormal event ticket generator 134 detects that the traffic data exceeds the upper limit abnormality (TRF_BL, alarm level (2)) at 01:00, and also detects that the circuit packet loss rate is too high (PDC, The alarm level (3)) and the traffic usage rate (UTL, alarm level 1) are abnormal, and can be sorted into the abnormal event record details shown in Figure 4.

If there is no corresponding abnormal event ticket (or does not belong to the existing abnormal event ticket), the abnormal event ticket generator 134 establishes an abnormal event ticket of the interface, and takes the most severe abnormal event record as the representative of the abnormal event ticket. The weighted abnormal alarm level value (ie, the weighted alarm level) of the most serious abnormal event record is used as the abnormality value of the abnormal event ticket. If there are multiple records of the most serious abnormal events, the abnormal event ticket generator 134 compares according to the priority order of the corresponding alarm items, and takes the highest priority as the representative. When the abnormal event ticket generator 134 establishes the event ticket, it also stores the association between the event ticket and the abnormal event record, so as to facilitate the exception event ticket query analysis or the event ticket notification, which can be used to present the details of the abnormal event record.

Referring to FIG. 3, the timing data record of the traffic data in FIG. 3 can be used to find that the circuit inflow service exceeds the upper limit (3, 587, 279 > 3, 567, 660) for the first time at 01:00, because there are also PDC and UTL alarms at the same time, so three alarms are required. The type of alarm item associated with the weight calculation and sequence. After referring to the weighting operation sequence of each alarm item in Table (1), take TRF_BL as the circuit abnormal event ticket as the representative, and establish the abnormal event ticket shown in Figure 4 (TRF_BL [alarm level (2) * weight value (3) =6] > PDC [alarm level (3) * weight value (1) = 3] > UTL [alarm level (1) * weight value (1) = 1]), and the abnormality of the abnormal event ticket of this circuit The degree value is 6 (ie, the cumulative alarm level, which is the weighted maximum of the alarm level of the three alarm items), and the interface information is displayed in the abnormal event ticket and the related PDC, UTL, and TRF_BL alarm information is displayed.

On the other hand, if there is a corresponding abnormal event ticket (or belongs to the existing abnormal event ticket), the abnormal event ticket generator 134 first calculates the alarm event record (that is, the subsequent abnormal event record of the existing abnormal event ticket). The weighted abnormal alarm degree value is cumulatively calculated for the abnormality value of the abnormal event ticket to which it belongs (that is, the abnormality level value plus the abnormal alarm degree value of the most severe abnormal event record) (step S230).

When the abnormality value of the abnormal event ticket reaches the set event ticket notification threshold (assumed to be 6), the processing unit 150 notifies the manager of the abnormal event ticket. If the abnormal event record (the maximum alarm event per time period) occurs continuously such that the accumulated abnormality value exceeds 6 points, it is calculated as 6 points. Taking the alarm diagram shown in Figure 3 as an example, the first abnormal event ticket is issued at 01:00; the second abnormal event ticket is established at 04:00, but the abnormality value accumulated by this abnormal event ticket is at 04:05. Only the event ticket was notified to the threshold. Therefore, the notice was issued at 04:05; the third event ticket was established with the second condition at 08:50, but the ticket was notified at 08:55, and the notice was issued at this time.

If there is no abnormal event record in a certain check, the abnormal event ticket generator 134 decrements the abnormality value by 2 points, so that if there is no abnormal event record for three consecutive times, the abnormal degree value will be deducted to 0, and it is regarded as abnormally released. The abnormal event generator 134 closes the event ticket (ie, the end of the abnormal event ticket) and notifies the relevant manager. Taking the alarm diagram shown in Figure 3 as an example, after the second event ticket is notified at 04:05, the abnormal event record continues to exist until 05:45. During this time, the abnormality value accumulated by the abnormal event ticket Always maintained at a maximum of 6. At 05:50 and 05:55, no abnormal event record is detected. After the abnormality value is reduced by 2 points, the abnormality value of the current abnormal event ticket at 05:55 is 2. However, an abnormal event record occurs again at 06:00, so that the abnormality value accumulated by the abnormal event ticket will continue to be accumulated until the alarm notification of the abnormal event ticket is released at 06:45.

In the embodiment of the present invention, the types of alarms are integrated according to their severity and continuity, and finally three event tickets as shown in FIG. 5 are generated. For Weiyun Tongren, the number of abnormal notifications in one circuit in Figure 3 was reduced from 42 to 6 times, a sevenfold reduction. When managing a large network, the size of the number of abnormal alarms is greatly reduced. At this time, when an important abnormal event ticket alarm occurs, it will help to immediately grasp the abnormal situation, so that relevant personnel can intervene as soon as possible.

It should be noted that the foregoing abnormal degree value (ie, 6) and the decrement value (ie, 2) may be other values in other implementations, and are adjusted according to the requirements of the embodiments of the present invention. The maximum value of the abnormality value in this embodiment is the event ticket notification threshold, but in other embodiments, it may be increased or decreased according to actual needs.

On the other hand, the processing unit 150 further determines the establishment and the end of the abnormal event ticket based on the abnormality value of the abnormal event ticket, and notifies the establishment and the end of the abnormal event ticket (step S240). In other words, the abnormal event generator 134 performs the analysis management of the opening or closing of the event ticket, and records and records the creation and termination of the abnormal event ticket (the start and end time of different abnormal event tickets shown in FIG. 5) in the database. And notify relevant personnel in due course.

In summary, the idea of the embodiment of the present invention is derived from the collation and observation analysis, and the abnormality alarm is found when a single interface is in a period of time, the time and frequency distribution of the traffic abnormality alarm generated by the traffic detection system occurs. There will be occasional and continuous phenomena. If a continuous traffic anomaly alarm can be generated for the first time, an abnormal event ticket is created and its opening time is recorded, and after the traffic returns to normal, the abnormal event ticket is closed and the closing time is recorded, and when the abnormal event ticket is opened When the system is closed and then notified to the operating unit, the continuous single alarm can be consolidated to reduce the single alarm amount, and the important abnormal alarm is prevented from being flooded in many alarm events.

During the analysis process, for occasional or discontinuous alarm conditions, such as the mechanism of weight adjustment and alarm severity, it is more fault-tolerant for condition detection of severe abnormalities or false alarms. Since network anomalies not only include traffic anomalies, if you can further consider the same interface and various anomalies at the same time, such as packet loss rate and packet error rate, the detection of a single interface anomaly A more comprehensive grasp can be achieved.

Accordingly, in addition to greatly reducing the single alarm amount, the embodiment of the present invention also has a false alarm fault tolerance mechanism, and the comprehensive analysis is more helpful for realizing important abnormal events, achieving early detection and early elimination, thereby reducing the guest. V., reduce losses, and thus achieve the purpose of effectively maintaining the quality of network services.

Although the present invention has been disclosed in the above embodiments, it is not intended to limit the present invention, and any one of ordinary skill in the art can make some changes and refinements without departing from the spirit and scope of the present invention. The scope of the invention is defined by the scope of the appended claims.

100‧‧‧Abnormal traffic detection server

110‧‧‧Input unit

130‧‧‧storage unit

131‧‧‧ Alarm Project and Threshold Establishment and Management Module

132‧‧‧ Event Ticket Type Management Module

133‧‧‧Event ticket and alarm project association management module

134‧‧‧Exception event ticket generator

200‧‧‧Network Management Server

S210~S240‧‧‧Steps

1 is a schematic diagram showing a system architecture in accordance with an embodiment of the present invention. 2 is a flow chart of an abnormal traffic detection method according to an embodiment of the invention. Figure 3 is an example of an abnormal event record. FIG. 4 is an example of an abnormal event record and an established abnormal event ticket. Figure 5 is an illustration of the establishment and termination of an abnormal event ticket.

Claims (10)

An abnormal traffic detection method includes: analyzing a plurality of traffic data to obtain a plurality of abnormal event records; and establishing an abnormal event ticket according to the abnormal event records, wherein the abnormal event ticket is integrated with the abnormal event records; Detecting a subsequent abnormal event record of the abnormal event ticket to accumulate the abnormality value of the abnormal event ticket; and determining the end of the abnormal event ticket according to the abnormality value of the abnormal event ticket, and establishing the abnormal event ticket and End the notification. The abnormal traffic detection method according to claim 1, wherein the step of determining the end of the abnormal event ticket based on the abnormality value of the abnormal event ticket, and the step of notifying the establishment and ending of the abnormal event ticket, The method includes: notifying the abnormal event ticket when the abnormality value of the abnormal event ticket exceeds an abnormal event notification threshold. The abnormal traffic detection method according to the first aspect of the patent application, wherein the step of establishing the abnormal event ticket according to the abnormal event records comprises: setting a plurality of alarm items, and respectively assigning different weight values to the alarm items According to the set of alarm items, a plurality of abnormality determination thresholds are respectively set, and the abnormality value of the abnormal event records is determined according to the abnormality determination thresholds; the alarm types recorded by the abnormal events and the alarm items Correlating; and according to the alarm items and weight values corresponding to the abnormal event records, weighting the abnormal alarm degree values recorded by the abnormal events to determine the representative of the abnormal event ticket. The abnormal traffic detection method according to claim 3, wherein the determining the representative of the abnormal event ticket comprises: using one of the abnormal event records with the highest severity and the highest priority as the abnormality A representative of the event ticket; and an abnormal alarm degree value of the representative of the abnormal event ticket as an abnormality value of the abnormal event ticket. The method for detecting an abnormality of the abnormal event ticket according to the first aspect of the patent application, wherein the step of detecting the abnormal event value of the abnormal event ticket to accumulate the abnormality value of the abnormal event ticket comprises: determining the subsequent abnormal event Whether the record belongs to the abnormal event ticket; if it belongs to the abnormal event ticket, the abnormal degree value of the subsequent abnormal event record is accumulated in the abnormality value of the abnormal event ticket; and if it does not belong to the abnormal event ticket, another Abnormal event ticket. The abnormal traffic detection method according to claim 1, wherein the step of determining the end of the abnormal event ticket according to the abnormality value of the abnormal event ticket includes: detecting a subsequent abnormality of the abnormal event ticket by time-sharing The event record; when the subsequent abnormal event record is not detected once, the abnormality value of the abnormal event ticket is reduced; and if the abnormality value of the abnormal event ticket is zero, the end of the abnormal event ticket is determined. An abnormal traffic detection server includes: an input unit that acquires a plurality of traffic data; a processing unit coupled to the input unit and configured to perform: analyzing the plurality of traffic data to obtain multiple An abnormal event record; an abnormal event ticket is established according to the abnormal event records, wherein the abnormal event ticket is integrated with the abnormal event records; and the subsequent abnormal event record of the abnormal event ticket is detected to accumulate the abnormality of the abnormal event ticket And determining the end of the abnormal event ticket according to the abnormality value of the abnormal event ticket, and notifying the establishment and ending of the abnormal event ticket. The abnormality traffic detection server according to claim 7, wherein the processing unit is configured to: notify the abnormal event ticket when an abnormality value of the abnormal event ticket exceeds an abnormal event notification threshold . The abnormality service detection server according to claim 7, wherein the processing unit is configured to: set a plurality of alarm items, and respectively assign different weight values to the alarm items; For each of the alarm items, a plurality of abnormality determination thresholds are respectively set, and the abnormality value of the abnormal event records is determined according to the abnormality determination thresholds; the alarm types of the abnormal event records are associated with the alarm items; The abnormal events record corresponding alarm items and weight values, and the abnormal alarm severity values recorded by the abnormal events are weighted to determine the representative of the abnormal event ticket. The abnormality service detection server according to claim 7, wherein the processing unit is configured to perform: using one of the abnormal event records with the highest severity and the highest priority as the abnormal event ticket The representative of the abnormal event ticket has the abnormal alarm degree value as the abnormality value of the abnormal event ticket: time-lapse detection of the subsequent abnormal event record of the abnormal event ticket; determining whether the subsequent abnormal event record belongs to the abnormal event If the subsequent abnormal event record belongs to the abnormal event ticket, the abnormality value recorded by the subsequent abnormal event is accumulated in the abnormality value of the abnormal event ticket; when the subsequent abnormal event record is not detected once, the decrease is The abnormality value of the abnormal event ticket; if the abnormality value of the abnormal event ticket is zero, determining the end of the abnormal event ticket; and if the subsequent abnormal event record does not belong to the abnormal event ticket, establishing another abnormal event ticket.