基于自适应网络拓扑和日志聚类的故障定界方法研究

Research on fault bounding method based on adaptive network topology and log clustering

传统的异常检测方法采用不定时巡检和用户反馈等被动方式发现问题,存在效率低、无法主动发现故障的问题。本文提出了一种基于自适应网络拓扑和日志聚类的故障定界方法。首先利用交换机ARP表和主机流量关系构建网络拓扑,再对系统日志进行结构化和聚类处理,最后结合网络拓扑和聚类结果快速定位异常范围,保证异常检测高效及全面。经生产实践表明,本文提出的故障定界方法能快速定位问题主机。

Traditional anomaly detection methods use passive methods such as irregular patrols and user feedback to detect problems,which have low efficiency and cannot proactively detect faults.This paper proposes a fault bounding method based on adaptive network topology and log clustering.Firstly,use the ARP table of the switch and the host traffic relationship to construct a network topology,then structure and cluster the system logs,finally,combine network topology and cluster results to quickly locate the anomaly range,ensure efficient and comprehensive anomaly detection.Production practice shows that the fault boundary method proposed can quickly locate the problem host.