CN104539471A - Bandwidth metering method and device and computer equipment - Google Patents

Abstract

The present invention provides a bandwidth metering method, device and computer equipment, wherein the method includes: acquiring the flow data collected at the node outlet, and the node outlet is used to connect the node with the external network; When the node has a sudden increase in traffic, it is judged whether there is a network attack event according to the attack characteristics of the network attack event and/or the network attack alarm information of the equipment in the node; if the judgment result is that there is no network attack event, then all The above traffic data is used as the traffic data for node bandwidth metering, otherwise, the above traffic data is not used as the traffic data for node bandwidth metering. The above-mentioned technical solution provided by the present invention improves the accuracy of bandwidth metering, thereby avoiding unreasonable phenomena existing in other metering applications of bandwidth.

Description

Bandwidth measurement method, device and computer equipment

technical field

The invention relates to the technical field of the Internet, in particular to a bandwidth measurement method, device and computer equipment.

Background technique

The Internet is widely used in the current society. For example, people use the Internet to send and receive emails, consult information, shop, watch videos, listen to music, play games, and chat. The Internet has become an important part of people's work and entertainment life.

In the process of using the Internet, the concept of bandwidth is usually involved. Bandwidth is not only very important for families, offices and public places connected to the Internet, but also for some Internet companies; for example, for IDC (Internet For the owner or user of the Data Center (Internet Data Center) node, the ISP (Internet Service Provider, Internet Service Provider) will charge the corresponding fee according to the external network bandwidth (also called Internet bandwidth) used by the IDC node .

At present, bandwidth measurement methods generally include: regularly or irregularly collecting traffic data at the node outlet (such as a switch port connected to the external network) connected to the external network, and using the collected traffic data as the external network bandwidth used by the computing device basic traffic data.

In the process of implementing the present invention, the inventor found that network attack events would cause abnormal traffic at the node outlet, and the traffic data collected at this time was not credible traffic data, and such traffic data would affect the external network bandwidth measurement used by the device Accuracy; further, such traffic data will also have adverse effects on other bandwidth metering applications, such as on the rationality of bandwidth cost metering.

Contents of the invention

One of the technical problems solved by the invention is to improve the accuracy of bandwidth measurement, thereby avoiding unreasonable phenomena existing in other bandwidth measurement applications.

According to an embodiment of one aspect of the present invention, a bandwidth metering method is provided, the method comprising: acquiring the collected traffic data of the node outlet, the node outlet is used for connecting the node to the external network; In the case that the node has a sudden increase in traffic, it is judged whether there is a network attack event according to the attack characteristics of the network attack event and/or the network attack alarm information of the equipment in the node; if the judgment result is that there is no network attack event, the The traffic data is used as the traffic data for node bandwidth metering, otherwise, the traffic data is not used as the traffic data for node bandwidth metering.

According to an embodiment of another aspect of the present invention, a bandwidth metering device is provided, which includes: a traffic data acquisition module, adapted to acquire the collected traffic data of node outlets, and the node outlets are used to connect nodes to external networks The traffic data management module is suitable for judging whether there is a network attack according to the attack characteristics of the network attack event and/or the network attack alarm information of the equipment in the node in the case of detecting a sudden increase in the traffic of the node according to the traffic data. Attack event; if the judgment result is that there is no network attack event, the traffic data is used as the traffic data for node bandwidth metering, otherwise, the traffic data is not used as the traffic data for node bandwidth metering.

According to an embodiment of another aspect of the present invention, a computer device is also provided, including the foregoing bandwidth metering apparatus.

Since the present invention determines whether a network attack event occurs when it is determined that there is a sudden increase in traffic at the node outlet connected to the network, and when it is determined that a network attack event occurs, the collected flow data will not be used as a node The traffic data of bandwidth metering, so that the untrusted traffic data in the collected traffic data will not be used for node bandwidth metering, thus avoiding the adverse impact of untrustworthy traffic data on the accuracy of external network bandwidth metering used by the device; Therefore, the technical solution provided by the present invention improves the accuracy of bandwidth measurement, thereby avoiding unreasonable phenomena existing in other bandwidth measurement applications.

Those of ordinary skill in the art will appreciate that although the following detailed description refers to the illustrated embodiments and accompanying drawings, the invention is not limited to these embodiments. Rather, the scope of the invention is broad and it is intended that the scope of the invention be limited only by the appended claims.

Description of drawings

Other characteristics, objects and advantages of the present invention will become more apparent by reading the detailed description of non-limiting embodiments made with reference to the following drawings:

FIG. 1 is a flow chart of a bandwidth metering method according to an embodiment of the present invention;

Fig. 2 is a schematic diagram of bandwidth metering according to another embodiment of the present invention;

Fig. 3 is a flowchart of a bandwidth metering method according to another embodiment of the present invention;

Fig. 4 is a flowchart of the location review of suspected network attack events in Fig. 3;

Fig. 5 is a schematic diagram of a bandwidth metering device according to yet another embodiment of the present invention.

The same or similar reference numerals in the drawings represent the same or similar components.

Detailed ways

The present invention will be described in further detail below in conjunction with the accompanying drawings.

Embodiment 1. Bandwidth measurement method.

Fig. 1 is a flowchart of a bandwidth measurement method according to Embodiment 1 of the present invention. The bandwidth metering in this embodiment may also be referred to as external network bandwidth metering. The bandwidth metering in this embodiment should be understood in a broad sense, that is, the bandwidth metering not only refers to the metering of the network bandwidth used by nodes, but also refers to the metering of bandwidth fees and other aspects. The method in this embodiment is mainly implemented by an operating system or a processing controller in a computer device. An operating system or processing controller in a computer device may be referred to as a bandwidth meter. The computer equipment includes but is not limited to at least one of the following: a single computer, a computer group composed of multiple computers, a single network server, a server group composed of multiple network servers, and a cloud computing-based network composed of a large number of computers or network servers Cloud; Among them, cloud computing is a kind of distributed computing, which is a super virtual computer composed of a group of loosely coupled computer sets.

In FIG. 1 , S100. Obtain the collected flow data of the node outlet.

Specifically, the node egress in this embodiment is used to connect the node to the external network. The node egress connected to the external network usually includes the node connected to the external network and the bandwidth of the external network used by the node can be obtained by performing bandwidth measurement on such an egress. Device port: The node outlet in this embodiment can be a device port connected to the external network, or multiple device ports connected to the external network, or even all device ports connected to the external network. In addition, the inside of the node in this embodiment can usually form an intranet.

A specific example of a node exit, for an IDC node, the node exit connected to the external network is usually a device port connected to an ISP end device in an IDC node, such as a port used to connect to an ISP end device in an IDC node or multiple switch ports. For other application scenarios, the node egress may be a router port in the node, etc. This embodiment does not limit the specific expression form of the egress of the node connected to the external network.

The operation of obtaining the collected traffic data at the node outlet in this embodiment can be performed during the traffic data collection process (that is, the bandwidth metering operation of this embodiment is performed while the traffic data is collected), and can also be executed after the traffic data collection process ends. .

The collection process of the flow data of the node outlet in this embodiment may be: after receiving the collection command, obtain an OID (Object identifier, object identifier) from the information carried by the collection command, and the OID can clearly and uniquely identify the network device For a certain characteristic or state object (such as device name, system version, fan temperature, or device port flow, etc.), after determining the corresponding device port and flow parameters according to the OID, collect the flow data of the corresponding device port.

In this embodiment, the flow data of the node outlet can be the flow data of the node outlet collected by existing collection tools, such as this embodiment can use the existing SNMP-Probe (Simple Network Management Protocol-Probe, Simple Network Management Protocol-Probe, simple network The management protocol-probe) tool is used to realize the collection of traffic data at the node outlet, and the specific collection process of traffic data will not be described in detail here.

In this embodiment, the flow data collected at the node outlet forms a flow data set, which can be in the form of a table or a database, such as the collected flow data can be in the form of RRD (Round Robin Database, ring database) way to store.

In this embodiment, the collected flow data of the node outlet should not only reflect the total flow of the node outlet, but also reflect the inflow and outflow of the node outlet; in addition, when the node outlet contains multiple device ports In this case, the traffic data at the node outlet can not only reflect the traffic of each device port, but also reflect the total traffic of all device ports.

The acquisition of the collected traffic data at the node exit in this embodiment may be the traffic data sequentially read from the collected traffic data set at the node exit according to the storage sequence of the traffic data.

S110. Determine whether the node has a sudden increase in traffic according to the above traffic data. If there is a sudden increase in traffic, go to S120; otherwise, go to S130.

Specifically, this embodiment can refer to the historical traffic data at the node outlet to determine whether the node has a sudden increase in traffic. The collection time of the historical traffic data here should be earlier than the collection time of the traffic data obtained in S100. The historical traffic data can be It can be the traffic data collected for the previous few minutes or tens of minutes, or the traffic data collected for the previous few hours or tens of hours, or the traffic data collected for the previous few days (such as the previous seven days), such as the previous few days Traffic data collected during the same time period. In addition, the historical traffic data here is usually originally collected and stored traffic data.

In this embodiment, the traffic data obtained in S100 can be compared with the aforementioned historical traffic data to determine whether the node has a sudden increase in traffic. In this embodiment, the traffic data for comparison calculation can be the traffic data of one of the device ports connected to the external network in the node, or the sum of the traffic data of multiple device ports connected to the external network in the node, or even the node The sum of traffic data of all device ports connected to the external network. Correspondingly, whether the historical traffic data is the traffic data of one device port or the sum of the traffic data of multiple device ports should be consistent with the obtained traffic data.

A specific example of judging whether a node has a sudden increase in traffic is to judge whether the increase of the obtained traffic data relative to the historical traffic data exceeds the first predetermined increase threshold. If a predetermined increase threshold is reached, the detection result is that the node has a sudden increase in traffic; otherwise, the detection result is that the node does not have a sudden increase in traffic. In this example, the increase of the obtained traffic data relative to the historical traffic data can be the difference between the obtained traffic data and the historical traffic data, or the difference between the obtained traffic data and the historical traffic data accounts for the historical traffic percentage of data etc. The historical traffic data here may be traffic data selected from traffic data in a historical time period, such as selecting a maximum value from traffic data in a certain historical time period.

Another specific example of judging whether there is a sudden increase in traffic at a node is to judge whether the increase of the obtained traffic data relative to the average value of multiple historical traffic data exceeds the first predetermined growth threshold. If the increase of the average value of the flow data exceeds the first predetermined increase threshold, the detection result indicates that the node has a sudden increase in flow; otherwise, the detection result indicates that the node does not have a flow increase. In this example, the increase of the obtained traffic data relative to the average value of multiple historical traffic data can be the difference between the obtained traffic data and the average value of multiple historical traffic data, or the obtained traffic data and multiple historical traffic data. The percentage of the difference of the data mean value to the mean value of multiple historical traffic data, etc.

In this embodiment, the traffic data obtained in S100 can also be compared with the aforementioned historical traffic data in other ways to determine whether a node has a sudden increase in traffic. This embodiment does not limit the specific method for determining whether a node has a sudden increase in traffic. Method to realize.

S120, judge whether there is a network attack event according to the attack characteristics of the network attack event and/or the network attack warning information of the equipment in the intranet, if the judgment result is that there is no network attack event, then go to S130, if the judgment result is that there is a network attack event, go to S140.

Specifically, this embodiment can judge whether there is a network attack event only according to the attack characteristics of the network attack event, or judge whether there is a network attack event only according to the network attack alarm information of the device in the node (that is, the device in the intranet) , it is also possible to combine the attack characteristics of the network attack event and the network attack alarm information of the equipment in the node to determine whether there is a network attack event.

Under normal circumstances, when a network attack occurs, the inflow traffic at the node exit (that is, in-direction traffic) and the outflow traffic at the node exit (out-direction traffic) will be different from the characteristics in the normal state, for example, the inflow traffic at the node exit Usually it will be much higher than the outgoing flow of the node exit, thus, the attack characteristics of the network attack event in this embodiment can be reflected by the relationship between the incoming flow of the node exit and the outgoing flow of the node exit; for example, the node exit Whether the difference between the inflow flow of the node outlet and the outflow flow of the node outlet exceeds a predetermined difference; another example, whether the ratio between the inflow flow of the node outlet and the outflow flow of the node outlet exceeds a predetermined ratio; another example, the inflow of the node outlet Whether the percentage of the traffic to the sum of the inflow and outflow of the node outlet exceeds a predetermined percentage. In this embodiment, attack characteristics of other forms of network attack events may also be used, such as traffic waveforms at node egress.

The network attack alarm information of the device in the node in this embodiment is the network attack alarm information generated by other network devices in the intranet where the device connected to the external network is located, such as a server or a gateway device.

In this embodiment, before the judgment of the network attack event in this step, the historical traffic data used for node bandwidth measurement at the node outlet connected to the external network can be used to further screen the traffic surge phenomenon determined above, so as to avoid This method performs judgment operations on unnecessary network attack events. Here, the historical flow data used for node bandwidth measurement is credible historical flow data, for example, the historical flow data used for node bandwidth measurement can be obtained after using the method provided by the present invention to remove untrustworthy flow data. Historical traffic data. The collection time of the historical traffic data used for node bandwidth measurement should be earlier than the collection time of the historical traffic data involved in S110, such as the historical traffic data used for node bandwidth measurement can be the previous month or the same period of the previous months Historical traffic data. In addition, the historical traffic data may also be historical traffic data of the same period last year. The historical traffic data of the same period here may be the historical traffic data of the same day or the same month and the same day, or the highest historical traffic data of the same day or the same month and the same day.

In this embodiment, a specific example of further screening the traffic sudden increase phenomenon determined above by using the historical traffic data of the node outlet connected to the external network for node bandwidth measurement is: judging that the obtained traffic data is compared with the external network Whether the increase of the highest historical traffic data on the same day in the first three months used for node bandwidth measurement at the node outlet connected to the network exceeds the second predetermined increase threshold, if the increase of the obtained traffic data relative to the highest historical traffic data exceeds the second predetermined increase threshold, it is determined that a subsequent network attack event judgment operation is required; otherwise, it is determined that a subsequent network attack event judgment operation is not required, and the processing of the collected node exit traffic data is completed. In this specific example, the increase of the obtained traffic data relative to the highest historical traffic data on the same day in the previous three months used for node bandwidth measurement can be the obtained traffic data and the same day in the previous three months used for node bandwidth measurement The difference of the highest historical traffic data may also be the percentage of the difference between the acquired traffic data and the highest historical traffic data of the same day in the previous three months used for node bandwidth measurement to the highest historical traffic data.

A specific process of judging whether there is a network attack event according to the attack characteristics of the network attack event in this embodiment includes: determining the inflow traffic of the node exit and the outflow traffic of the node exit according to the obtained flow data, and judging the inflow traffic of the node exit and the node exit flow. Whether the outflow traffic at the exit meets certain conditions, such as whether the inflow traffic at the node exit is much larger than the outflow traffic at the node exit, etc. If certain conditions are met, it is determined that there is a network attack event; There are cyber attacks.

A specific process of judging whether there is a network attack event according to the network attack warning information of the equipment in the node in this embodiment includes: obtaining the network attack warning information of other equipment in the node, and judging the alarm corresponding to the obtained network attack warning information Whether the time and the collection time of the traffic data obtained meet certain conditions, for example, whether the difference between the alarm time and the collection time is within the predetermined time difference range, if certain conditions are met, it is determined that there is a network attack event, if not If certain conditions are met, it is determined that there is no network attack event.

A specific process of judging whether there is a network attack event according to the attack characteristics of the network attack event and the network attack alarm information of the equipment in the node in this embodiment includes: determining the inflow traffic of the node exit and the outflow of the node exit according to the obtained flow data Flow rate, to judge whether the inflow flow at the node exit and the outflow flow at the node exit meet certain conditions, such as whether the inflow flow at the node exit is far greater than the outflow flow at the node exit, etc. If the judgment result does not meet certain conditions, then this time The processing process of the collected traffic data of the node outlet connected to the external network is completed; if the judgment result meets certain conditions, the network attack warning information of other devices in the node is obtained, and the network attack warning information corresponding to the obtained network attack warning information is judged. Whether the alarm time of the alarm time and the collection time of the traffic data obtained meet certain conditions, for example, whether the difference between the alarm time and the collection time is within the predetermined time difference range, if certain conditions are met, it is determined that there is a network attack event, If certain conditions are not met, it is determined that there is no network attack event.

S130. Use the above-mentioned acquired traffic data as the traffic data for node bandwidth measurement, and the processing of the collected traffic data at the node exit ends this time; in addition, if it is necessary to continue processing other traffic data collected at the node exit , then return to S100.

Specifically, in this embodiment, the traffic data may be retained in the traffic data set, or the traffic data may be stored in a new traffic data set, for example, stored in a trusted traffic data set; the new traffic data set may In the form of tables or databases, for example, trusted traffic data can be stored in the form of RRD.

In the case that all flow data in the flow data set need to be processed according to the method of this embodiment, in this step it can also be judged whether the currently acquired flow data is the last flow data in the flow data set, if it is flow If it is the last traffic data in the data set, the bandwidth measurement method of this embodiment ends, and if it is not the last traffic data in the traffic data set, return to S100. The traffic data set in this embodiment may be traffic data based on a bandwidth billing period, such as traffic data based on one month.

S140. The traffic data is not used as the traffic data for node bandwidth measurement, and the processing process of the collected node outlet traffic data is completed; in addition, if it is necessary to continue processing other collected node outlet traffic data, then Can return to S100.

Specifically, in this embodiment, the traffic data may be directly deleted from the traffic data set, or the traffic data may not be stored in a new traffic data set, for example, the traffic data may not be stored in a trusted traffic data set. In the case that all flow data in the flow data set need to be processed according to the method of this embodiment, in this step it can also be judged whether the currently acquired flow data is the last flow data in the flow data set, if it is flow If it is the last traffic data in the data set, the bandwidth measurement method of this embodiment ends, and if it is not the last traffic data in the traffic data set, return to S100.

In this embodiment, after performing the operations of the steps described above, all credible traffic data can be obtained, and accurate bandwidth metering values can be obtained by using the obtained credible traffic data for bandwidth measurement; using the obtained credible traffic data Other metering applications of bandwidth will also produce good metering results. For example, when using the obtained credible traffic data to measure bandwidth charges, reasonable bandwidth cost metering results can be obtained.

The trusted traffic data obtained in this embodiment can also be applied to the application scenario of bandwidth charging method selection. Specifically, for the current multiple bandwidth charging methods (ie, multiple charging rules), the obtained The trusted traffic data of each bandwidth billing method is separately processed for bandwidth billing, so as to obtain multiple bandwidth billing results. Measurement is carried out to facilitate subsequent negotiation of a billing method that is more in line with actual billing requirements, so that bandwidth cost metering can benefit bandwidth users, such as reducing bandwidth usage costs. The multiple bandwidth charging methods in this embodiment may include: one or more of the 95 charging method, the peak charging method, and the third peak charging method. This embodiment does not limit the specific implementation process of the bandwidth charging method and the number of bandwidth charging methods participating in the bandwidth charging.

Embodiment 2, bandwidth fee measurement method. The method of this embodiment provides a complete set of solutions for IDC nodes to collect, store, measure bandwidth and select a bandwidth charging method for traffic data using external network bandwidth. The method of this embodiment will be described below with reference to the accompanying drawings 2-4.

The IDC node of this embodiment is connected with the external network through two switches in the internal network, as shown in Figure 2, the IDC-A external network core switch in the IDC node is connected with the ISP-A switch, and the IDC-B external network core switch Connect with ISP-B switch. The flow data (that is, the original flow data) of data exchange between the IDC-A external network core switch and the external network ISP-A switch is collected by the traffic collection server A using the SNMP_Probe tool regularly, and the IDC-B external network core switch and the external network The flow data (that is, the original bandwidth data) of the ISP-B switch for data interaction is collected regularly by the flow collection server B using the SNMP_Probe tool; the flow data collected by the flow collection server A and the flow collection server B can be provided to RRD respectively The storage server, the RRD storage server uses the RRD file format to store traffic data; the billing bandwidth calculation service performs bandwidth metering and traversal bandwidth billing processing for the traffic data stored in the RRD storage server.

A more specific flow of data in this embodiment is shown in FIG. 3 .

In Figure 3, the DC (Data Center, data center) stores the description information of the IDC node exit, such as the asset information and OID of each port are stored in the network management data system of the DC, and the SNMP_Probe tool collects the information based on the received OID Traffic data (that is, original bandwidth data), the traffic data is stored in the form of RRD files (such as stored in the RRD database), and the suspected attack location review is performed on the traffic data stored in the RRD file format. According to the suspected attack location review results, the original bandwidth The traffic data when a network attack event occurs is removed from the data; the traffic data after the traffic data removal operation is applied to various billing methods (that is, various billing rules), and bandwidth billing calculations are performed separately. By comparing As a result of various bandwidth charging calculations, a charging method that is beneficial to the IDC node can be selected, for example, a charging method with the lowest bandwidth charging cost can be selected. In addition, the above-mentioned bandwidth charging calculation result can also be used to verify the charging calculation result provided by the ISP side, so as to supervise the bandwidth charging of the ISP side.

An implementation process of the location review of suspected network attack events in FIG. 3 is shown in FIG. 4 .

In Fig. 4, in step S402, at first obtain the sign of the corresponding network port of IDC node outlet; Then, enter step S403, query and read the current flow data (being current bandwidth value) of IDC node export from RRD database according to this sign ); then enter step S404, determine whether the increase relative to the recent historical flow data (as the historical flow data of the same moment in the previous minute or the previous seven days) exceeds the predetermined increase threshold, if not exceed the predetermined increase threshold, then keep the flow data, And return to step S403, the step of inquiring and reading the current flow data of the IDC node outlet according to the identification, so as to judge the next current flow data in the RRD database; if it exceeds the predetermined increase threshold, then perform a sudden increase in step S405 Report to the police; enter step S408, screen for the sudden increase alarm event, to determine whether there is a suspected attack event in step S407, for the suspected attack event, further confirmation can be carried out, if it is further confirmed that there is a suspected attack event, then in step S406 , keep the suspected attack event, and return to step S403 to query and read the current flow data of the IDC node outlet according to the identification, so as to judge the next current flow data in the RRD database; if it is further confirmed that there is no suspected attack event attack event, then delete the suspected attack event in step S409, and return to step S403 to query and read the current flow data of the IDC node outlet according to the identification, so as to judge the next current flow data in the RRD database.

The above-mentioned screening for sudden increase alarm events can be realized according to whether the growth rate of the relatively long-term historical traffic data used for bandwidth measurement (such as the historical traffic data at the same time in the previous month or the same time last year) exceeds a predetermined growth threshold. The further confirmation of the suspected attack event can be realized according to the attack characteristics of the network attack event and the network attack alarm information of the equipment in the node. For details, please refer to the description in the first embodiment above, and the description will not be repeated here.

Embodiment 3, bandwidth metering device. The structure of the device is shown in Figure 5.

In FIG. 5 , the bandwidth metering device mainly includes: a traffic data acquisition module 500 and a traffic data acquisition module 510 , and the device may further include: a traffic data acquisition module 520 and a bandwidth billing management module 530 .

The traffic data acquisition module 500 is mainly adapted to acquire the collected traffic data of node outlets, and the node outlets are used to connect the nodes to the external network.

Specifically, the operation of the traffic data acquisition module 500 to acquire the collected traffic data at the node outlet can be performed during the traffic data collection process (that is, the bandwidth metering operation of this embodiment is performed while the traffic data is collected), or it can be performed during the traffic data collection Executed after the process ends. The collected traffic data of the node outlet acquired by the traffic data acquisition module 500 may be the traffic data sequentially read from the collected traffic data set of the node outlet according to the storage sequence of the traffic data. The traffic data set may be traffic data based on a bandwidth billing period, such as traffic data based on one month.

The traffic data management module 510 is mainly adapted to judge whether there is a network attack event according to the attack characteristics of the network attack event and/or the network attack alarm information of the equipment in the node in the case of detecting a sudden increase in the traffic of the node according to the traffic data; if If the judgment result is that there is no network attack event, the above-mentioned acquired traffic data is used as the traffic data for node bandwidth metering, otherwise, the above-mentioned acquired traffic data is not used as the traffic data for node bandwidth metering.

Specifically, the traffic data management module 510 can refer to the historical traffic data at the node outlet to determine whether the node has a sudden increase in traffic. The collection time of the historical traffic data here should be earlier than the collection time of the traffic data obtained by the traffic data acquisition module 500. The historical traffic data can be the traffic data collected in the previous few minutes or tens of minutes, or the traffic data collected in the previous few hours or tens of hours, or the traffic data collected in the previous few days (such as the previous seven days). , such as traffic data collected in the same time period in previous days. In addition, the historical traffic data here is usually the traffic data originally collected and stored by the traffic data collection module 520 .

The traffic data management module 510 can compare the traffic data acquired by the traffic data acquisition module 500 with the aforementioned historical traffic data, so as to determine whether there is a sudden increase in the traffic of the node.

A specific example for the traffic data management module 510 to determine whether a sudden increase in traffic occurs at a node is that the traffic data management module 510 judges whether the increase of the traffic data obtained by the traffic data acquisition module 500 relative to the historical traffic data exceeds a first predetermined increase threshold, If the increase of the flow data obtained by the flow data acquisition module 500 relative to the historical flow data exceeds the first predetermined increase threshold, the detection result is that the node has a sudden increase in traffic; otherwise, the detection result is that the node does not have a sudden increase in flow. In this example, the increase rate of the traffic data acquired by the traffic data acquisition module 500 relative to the historical traffic data may be the difference between the acquired traffic data and the historical traffic data, or it may be the difference between the traffic data acquired by the traffic data acquisition module 500 and the historical traffic data. The percentage of the difference in traffic data to the historical traffic data, etc. The historical traffic data mentioned above may be the traffic data selected by the traffic data management module 510 from the traffic data in a historical time period, for example, the traffic data management module 510 selects the maximum value from the traffic data in a certain historical time period.

Another specific example for the traffic data management module 510 to determine whether a sudden increase in traffic occurs at a node is that the traffic data management module 510 judges whether the traffic data acquired by the traffic data acquisition module 500 has an increase of more than the first average value of a plurality of historical traffic data. Predetermined increase threshold, if the increase of the flow data obtained by the flow data acquisition module 500 relative to the average value of multiple historical flow data exceeds the first predetermined increase threshold, the detection result is that the node has a sudden increase in flow; otherwise, the detection result is that the node does not A sudden increase in traffic occurs. In this example, the increase rate of the traffic data acquired by the traffic data acquisition module 500 relative to the average value of multiple historical traffic data can be the difference between the acquired traffic data and the average value of multiple historical traffic data, or can be the difference between the acquired traffic data and multiple historical traffic data. The percentage of the difference between the average values of historical traffic data to the average values of multiple historical traffic data, etc.

The traffic data management module 510 may also perform other comparison operations on the traffic data acquired by the traffic data acquisition module 500 and the aforementioned historical traffic data to determine whether a sudden increase in traffic occurs at a node. This embodiment does not limit the traffic data management module 510 A specific implementation method for judging whether a node has a sudden increase in traffic.

The traffic data management module 510 can judge whether there is a network attack event only according to the attack characteristics of the network attack event, or can only judge whether there is a network attack event according to the network attack alarm information of the equipment in the node (ie, the equipment in the intranet), It is also possible to combine the attack characteristics of the network attack event and the network attack alarm information of the equipment in the node to determine whether there is a network attack event.

Before the traffic data management module 510 judges the network attack event, it can use the historical traffic data used for node bandwidth measurement of the node connected to the external network to further screen the previously determined traffic surge phenomenon, so as to avoid Perform unnecessary judgment operations on network attack incidents by itself. The historical traffic data used for node bandwidth measurement here is credible historical traffic data. For example, the historical traffic data used for node bandwidth measurement may be historical traffic data after the device has eliminated untrustworthy traffic data. The historical traffic data used for node bandwidth measurement may be the historical traffic data of the previous month or the same period of the previous months. In addition, the historical traffic data may also be historical traffic data of the same period last year. The historical traffic data of the same period here may be the historical traffic data of the same day or the same month and the same day, or the highest historical traffic data of the same day or the same month and the same day.

A specific example of the flow data management module 510 using the historical flow data used for node bandwidth measurement at the node outlet connected to the external network to further screen the aforementioned sudden increase in traffic is: the flow data management module 510 judges the flow Whether the increase of the traffic data acquired by the data acquisition module 500 relative to the highest historical traffic data of the same day in the first three months used for node bandwidth measurement at the node outlet connected to the external network exceeds the second predetermined increase threshold, if the traffic data acquisition module 500 If the increase of the obtained flow data relative to the highest historical flow data exceeds the second predetermined increase threshold, it is determined that a subsequent network attack event needs to be judged; otherwise, it is determined that a subsequent network attack event does not need to be judged, and The current flow data management module 510 finishes processing the collected flow data of the node outlet. The increase of the traffic data acquired by the traffic data acquisition module 500 relative to the highest historical traffic data on the same day in the previous three months used for node bandwidth measurement can be the difference between the traffic data acquired by the traffic data acquisition module 500 and the previous three months used for node bandwidth measurement. The difference between the highest historical traffic data on the same day in three months can also be the difference between the traffic data obtained by the traffic data acquisition module 500 and the highest historical traffic data on the same day in the previous three months used for node bandwidth measurement. Percentage of traffic data.

A specific process for the traffic data management module 510 to determine whether there is a network attack event according to the attack characteristics of the network attack event includes: the traffic data management module 510 determines the inflow traffic of the node exit and the outflow traffic of the node exit according to the obtained traffic data, and determines the node Whether the inflow flow of the exit and the outflow flow of the node exit meet certain conditions, such as whether the inflow flow of the node exit is far greater than the outflow flow of the node exit, etc. If certain conditions are met, the flow data management module 510 determines that there is a network attack event , if certain conditions are not met, the traffic data management module 510 determines that there is no network attack event.

A specific process for the traffic data management module 510 to determine whether there is a network attack event according to the network attack warning information of the equipment in the node includes: the traffic data management module 510 obtains the network attack warning information of other equipment in the node, and determines the acquired network attack information. Whether the alarm time corresponding to the alarm information and the collection time of the acquired traffic data meet certain conditions, for example, whether the difference between the alarm time and the collection time is within the predetermined time difference range, if certain conditions are met, the traffic data management The module 510 determines that there is a network attack event, and if certain conditions are not met, the traffic data management module 510 determines that there is no network attack event.

A specific process for the traffic data management module 510 to determine whether there is a network attack event according to the attack characteristics of the network attack event and the network attack alarm information of the equipment in the node includes: the traffic data management module 510 according to the traffic data acquired by the traffic data acquisition module 500 Determine the inflow flow at the node exit and the outflow flow at the node exit, and the flow data management module 510 judges whether the inflow flow at the node exit and the outflow flow at the node exit meet certain conditions, such as whether the inflow flow at the node exit is much greater than the outflow flow at the node exit Traffic, etc., if the judgment result does not meet certain conditions, the processing process of the collected traffic data of the node outlet connected to the external network ends this time; if the judgment result meets certain conditions, other devices in the node will be obtained network attack alarm information, and determine whether the alarm time corresponding to the obtained network attack alarm information and the collection time of the traffic data obtained meet certain conditions, for example, whether the difference between the alarm time and the collection time is within the predetermined time difference range If a certain condition is met, the traffic data management module 510 determines that there is a network attack event, and if the certain condition is not satisfied, the traffic data management module 510 determines that there is no network attack event.

When the traffic data management module 510 determines that there is a network attack event, the traffic data may be retained in the traffic data set, or the traffic data may be stored in a new traffic data set, for example, stored in a trusted traffic data set; The new flow data set may be in the form of a table or a database, for example, the trusted flow data may be stored in the form of an RRD file. In the case where the device needs to perform the above-mentioned processing on all the flow data in the flow data set, the flow data management module 510 may also determine whether the flow data currently acquired by the flow data acquisition module 500 is the last flow data in the flow data set, If it is the last flow data in the flow data set, the device of this embodiment will not continue to execute the removal processing operation of the flow data, if it is not the last flow data in the flow data set, then notify the flow data acquisition module 500 to continue to acquire corresponding flow data.

When the flow data management module 510 determines that there is no network attack event, it may directly delete the flow data from the flow data set, or may not store the flow data in a new flow data set, for example, do not store the flow data in the trusted traffic data set. When the device needs to process all the flow data in the flow data set, the flow data management module 510 can also determine whether the flow data currently acquired by the flow data acquisition module 500 is the last flow data in the flow data set, if is the last flow data in the flow data set, then the device of this embodiment will not continue to execute the flow data removal processing operation, if it is not the last flow data in the flow data set, then notify the flow data acquisition module 500 to continue to acquire the corresponding traffic data.

The traffic data collection module 520 is mainly adapted to receive a collection command, and collect traffic data of a corresponding device port in a node according to an object identifier carried in the collection command.

Specifically, the flow data collection module 520 collects the flow data at the node outlet. After receiving the collection command, the flow data collection module 520 obtains the OID from the information carried in the collection command. The OID can clearly indicate a certain device For a certain type of collection parameter of a port, after determining the corresponding device port and flow parameters according to the OID, the flow data collection module 520 collects flow data of the corresponding device port.

The traffic data collection module 520 can utilize the existing collection tool to collect the traffic data of the node exit, such as the traffic data collection module 520 can use the existing SNMP-Probe tool to realize the collection of the traffic data of the node exit, and the specific collection of the traffic data The process will not be described in detail here.

The flow data collected by the flow data collection module 520 at the node outlet forms a flow data set, which can be in the form of a table or a database. For example, the flow data collected by the flow data collection module 520 can be stored in the form of an RRD file.

The flow data of the node outlet collected by the flow data collection module 520 should not only reflect the total flow of the node outlet, but also reflect the inflow and outflow of the node outlet; in addition, when the node outlet includes multiple device ports , the traffic data at the node outlet can also reflect not only the traffic of each device port, but also the total traffic of all device ports.

The bandwidth charging management module 530 is mainly adapted to use multiple charging methods to perform bandwidth charging according to the traffic data used for node bandwidth metering, and select a charging method that meets predetermined charging requirements according to each bandwidth charging result.

Specifically, after the traffic data acquisition module 500 and the traffic data management module 510 perform their respective operations, they can obtain all credible traffic data, and the bandwidth accounting management module 530 can obtain accurate bandwidth metering value; when the bandwidth billing management module 530 utilizes the obtained credible flow data to carry out other metering applications of bandwidth, it will also produce a good metering effect, for example, when the bandwidth billing management module 530 utilizes the obtained credible flow data When bandwidth cost measurement is performed on data, reasonable bandwidth cost measurement results can be obtained.

The bandwidth charging management module 530 can realize the technical solution for selecting the optimal bandwidth charging method. Specifically, for the current multiple bandwidth charging methods (ie, multiple charging rules), the bandwidth charging management module 530 can use The obtained credible traffic data is separately processed for bandwidth charging for each bandwidth charging method, so as to obtain multiple bandwidth charging results. After that, the bandwidth charging management module 530 according to the actual charging demand (ie, the predetermined charging demand) Multiple bandwidth billing results are measured to select a billing method that meets actual billing requirements, so that bandwidth cost metering can benefit bandwidth users, such as reducing bandwidth usage costs. The bandwidth charging methods involved in the bandwidth charging management module 530 may include: one or more of the 95 charging method, the peak charging method, and the third peak charging method. This embodiment does not limit the specific implementation process of the bandwidth accounting method used by the bandwidth accounting management module 530 and the number of bandwidth accounting methods used by the bandwidth accounting management module 530 .

Embodiment 4, computer equipment.

The computer equipment can be a single computer, a computer group composed of multiple computers, a single network server, a server group composed of multiple network servers, or a cloud composed of a large number of computers/network servers based on cloud computing. The computer equipment in this embodiment includes the bandwidth metering apparatus described in Embodiment 3 above, which will not be described in detail here.

Those skilled in the art know that the present invention can be realized as a device, an apparatus, a method or a computer program product. Therefore, the present disclosure can be specifically implemented in the following forms, namely: it can be completely hardware, it can be completely software, and it can also be a combination of hardware and software.

The flowchart and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, program segment, or part of code that includes one or more Executable instructions. It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks in succession may, in fact, be executed substantially concurrently, or they may sometimes be executed in the reverse order, depending upon the functionality involved. It should also be noted that each block of the block diagrams and/or flowchart illustrations, and combinations of blocks in the block diagrams and/or flowchart illustrations, can be implemented by a dedicated hardware-based system that performs the specified functions or operations , or may be implemented by a combination of dedicated hardware and computer instructions.

It should be noted that the present invention can be implemented in software and/or a combination of software and hardware, for example, it can be implemented by an application specific integrated circuit (ASIC), a general purpose computer or any other similar hardware devices. In one embodiment, the software program of the present invention can be executed by a processor to realize the steps or functions described above. Likewise, the software program (including associated data structures) of the present invention can be stored in a computer-readable recording medium such as RAM memory, magnetic or optical drive or floppy disk and the like. In addition, some steps or functions of the present invention may be implemented by hardware, for example, as a circuit that cooperates with a processor to execute each step or function.

In addition, a part of the present invention can be applied as a computer program product, such as a computer program instruction. When it is executed by a computer, the method and/or technical solution according to the present invention can be invoked or provided through the operation of the computer. The program instructions for invoking the method of the present invention may be stored in a fixed or removable recording medium, and/or transmitted through broadcasting or data streams in other signal-carrying media, and/or stored in the in the working memory of the computer device on which the program instructions described above are executed. Here, an embodiment according to the present invention comprises an apparatus comprising a memory for storing computer program instructions and a processor for executing the program instructions, wherein when the computer program instructions are executed by the processor, a trigger The operation of the device is based on the foregoing methods and/or technical solutions according to multiple embodiments of the present invention.

It will be apparent to those skilled in the art that the invention is not limited to the details of the above-described exemplary embodiments, but that the invention can be embodied in other specific forms without departing from the spirit or essential characteristics of the invention. Accordingly, the embodiments should be regarded in all points of view as exemplary and not restrictive, the scope of the invention being defined by the appended claims rather than the foregoing description, and it is therefore intended that the scope of the invention be defined by the appended claims rather than by the foregoing description. All changes within the meaning and range of equivalents of the elements are embraced in the present invention. Any reference sign in a claim should not be construed as limiting the claim concerned. In addition, it is obvious that the word "comprising" does not exclude other elements or steps, and the singular does not exclude the plural. A plurality of units or devices stated in the system claims may also be realized by one unit or device through software or hardware. The words first, second, etc. are used to denote names and do not imply any particular order.

Claims (19)

1. a bandwidth meter metering method, comprising:

Obtain the data on flows of the node exit gathered, described node exit is used for node and is connected with outer net;

According to described data on flows when detect described node occur flow uprush phenomenon, judge whether to there is assault according to the network attack warning information of equipment in the attack signature of assault and/or node;

If for there is not assault in judged result, then using described data on flows as be used for node bandwidth metering data on flows, otherwise, not using described data on flows as be used for node bandwidth metering data on flows.

2. method according to claim 1, the gatherer process of the data on flows of wherein said node exit comprises:

Receive acquisition, and according to the data on flows of device port corresponding in the object identifier acquisition node carried in acquisition.

3. method according to claim 1, the data on flows of wherein said node exit utilizes the collection of Simple Network Management Protocol-probe tool.

4. method according to claim 1, the data on flows of wherein said node exit comprises: the data on flows of the device port be connected with ISP ISP in Internet data center IDC node.

5. method according to claim 1, the data on flows of the node exit of wherein said collection stores with the document form of ring-type database RRD.

6. according to described data on flows, method according to claim 1, is wherein saidly detecting that described node occurs that flow phenomenon of uprushing comprises:

When judging the data on flows of described acquisition relative to the amplification of the historical traffic data of the node exit collected more than the first predetermined amplification threshold value, detect that described node occurs that flow is uprushed phenomenon.

7. method according to claim 6, in the wherein said attack signature according to assault and/or node, the network attack warning information of equipment judges whether that there is assault comprises:

When judging the amplification of the data on flows of described acquisition relative to the historical traffic data for node bandwidth metering of described node exit more than the second predetermined amplification threshold value, judge whether the data on flows of described acquisition meets the attack signature of assault;

When judging that the data on flows of described acquisition meets the attack signature of assault, obtain the network attack warning information of the equipment in node;

The acquisition time of the alarm time corresponding according to described network attack warning information and the data on flows of described acquisition determines whether there is assault;

The acquisition time corresponding to historical traffic data for node bandwidth metering of wherein said node exit is early than acquisition time corresponding to the historical traffic data of described node exit.

8. the method according to claim arbitrary in claim 1 to 7, the attack signature of wherein said assault comprises:

Difference or the ratio of the inflow flow of described node exit and the outflow flow of described node exit meet pre-conditioned.

9. the method according to claim arbitrary in claim 1 to 7, wherein said method also comprises:

Multiple charging way is utilized to carry out bandwidth charging respectively according to the described data on flows for node bandwidth metering;

The charging way meeting predetermined accounting requirements is selected according to each bandwidth charging result.

10. a bandwidth metering device, comprising:

Data on flows acquisition module, is suitable for the data on flows obtaining the node exit gathered, and described node exit is used for node and is connected with outer net;

Data on flows administration module, be suitable for according to described data on flows when detect described node occur flow uprush phenomenon, judge whether to there is assault according to the network attack warning information of equipment in the attack signature of assault and/or node; If for there is not assault in judged result, then using described data on flows as be used for node bandwidth metering data on flows, otherwise, not using described data on flows as be used for node bandwidth metering data on flows.

11. devices according to claim 10, wherein said device also comprises:

Flow data collector module, is suitable for receiving acquisition, and according to the data on flows of device port corresponding in the object identifier acquisition node carried in acquisition.

12. devices according to claim 11, wherein said flow data collector module utilizes Simple Network Management Protocol-probe tool to gather data on flows.

13. devices according to claim 11, the data on flows of the node exit of wherein said flow data collector module acquires stores with the document form of ring-type database RRD.

14. devices according to claim 10, the data on flows of wherein said node exit comprises: the data on flows of the device port be connected with ISP ISP in Internet data center IDC node.

15. devices according to claim 10, wherein said data on flows administration module is specifically suitable for:

When judging the data on flows of described acquisition relative to the amplification of the historical traffic data of the node exit collected more than the first predetermined amplification threshold value, detect that described node occurs that flow is uprushed phenomenon.

16. devices according to claim 15, wherein said data on flows administration module is specifically suitable for:

When judging the amplification of the data on flows of described acquisition relative to the historical traffic data for node bandwidth metering of described node exit more than the second predetermined amplification threshold value, judge whether the data on flows of described acquisition meets the attack signature of assault;

When judging that the data on flows of described acquisition meets the attack signature of assault, obtain the network attack warning information of the equipment in node;

The acquisition time of the alarm time corresponding according to described network attack warning information and the data on flows of described acquisition determines whether there is assault;

The acquisition time corresponding to historical traffic data for node bandwidth metering of wherein said node exit is early than acquisition time corresponding to the historical traffic data of described node exit.

17. according to claim 10 to the device described in arbitrary claim in 16, and the attack signature of wherein said assault comprises:

Difference or the ratio of the inflow flow of described node exit and the outflow flow of described node exit meet pre-conditioned.

18. according to claim 10 to the device described in arbitrary claim in 16, and wherein said device also comprises:

Bandwidth billing management module, is suitable for utilizing multiple charging way to carry out bandwidth charging respectively according to the described data on flows for node bandwidth metering, and selects according to each bandwidth charging result the charging way meeting predetermined accounting requirements.

19. 1 kinds of computer equipments, comprise the bandwidth metering device in claim 10-18 described in arbitrary claim.