CN116963136A - WLAN protocol data filtering method and system - Google Patents
WLAN protocol data filtering method and system Download PDFInfo
- Publication number
- CN116963136A CN116963136A CN202311219081.XA CN202311219081A CN116963136A CN 116963136 A CN116963136 A CN 116963136A CN 202311219081 A CN202311219081 A CN 202311219081A CN 116963136 A CN116963136 A CN 116963136A
- Authority
- CN
- China
- Prior art keywords
- node
- data
- abnormal
- coefficient
- flow
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
- 238000000034 method Methods 0.000 title claims abstract description 57
- 238000001914 filtration Methods 0.000 title claims abstract description 41
- 230000002159 abnormal effect Effects 0.000 claims abstract description 99
- 230000005856 abnormality Effects 0.000 claims description 34
- 239000011159 matrix material Substances 0.000 claims description 29
- 238000004590 computer program Methods 0.000 claims description 4
- 238000004891 communication Methods 0.000 abstract description 7
- 230000005540 biological transmission Effects 0.000 description 7
- 230000007774 longterm Effects 0.000 description 6
- 238000012545 processing Methods 0.000 description 5
- 238000004458 analytical method Methods 0.000 description 3
- 230000000694 effects Effects 0.000 description 3
- 238000004364 calculation method Methods 0.000 description 2
- 238000012544 monitoring process Methods 0.000 description 2
- 230000003287 optical effect Effects 0.000 description 2
- 238000005192 partition Methods 0.000 description 2
- 238000005070 sampling Methods 0.000 description 2
- 238000012216 screening Methods 0.000 description 2
- 239000000758 substrate Substances 0.000 description 2
- 230000009286 beneficial effect Effects 0.000 description 1
- 238000005516 engineering process Methods 0.000 description 1
- 230000002349 favourable effect Effects 0.000 description 1
- 238000010606 normalization Methods 0.000 description 1
- 230000000750 progressive effect Effects 0.000 description 1
- 230000003068 static effect Effects 0.000 description 1
- 230000002123 temporal effect Effects 0.000 description 1
- 239000002699 waste material Substances 0.000 description 1
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W24/00—Supervisory, monitoring or testing arrangements
- H04W24/04—Arrangements for maintaining operational condition
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W24/00—Supervisory, monitoring or testing arrangements
- H04W24/08—Testing, supervising or monitoring using real traffic
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W84/00—Network topologies
- H04W84/02—Hierarchically pre-organised networks, e.g. paging networks, cellular networks, WLAN [Wireless Local Area Network] or WLL [Wireless Local Loop]
- H04W84/10—Small scale networks; Flat hierarchical networks
- H04W84/12—WLAN [Wireless Local Area Networks]
-
- Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
- Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
- Y02D—CLIMATE CHANGE MITIGATION TECHNOLOGIES IN INFORMATION AND COMMUNICATION TECHNOLOGIES [ICT], I.E. INFORMATION AND COMMUNICATION TECHNOLOGIES AIMING AT THE REDUCTION OF THEIR OWN ENERGY USE
- Y02D30/00—Reducing energy consumption in communication networks
- Y02D30/70—Reducing energy consumption in communication networks in wireless communication networks
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Mobile Radio Communication Systems (AREA)
Abstract
The application relates to the field of information communication, in particular to a WLAN protocol data filtering method and a system, which acquire abnormal matrixes of data traffic; obtaining the local difference coefficient of the flow of each node according to the data flow of each neighborhood region, the central region and the eight neighborhood nodes of each node; obtaining the abnormal distribution coefficient of the time window of each node according to the local flow difference coefficient in the time window of each node and the data flow of each node; and obtaining the abnormal index of the infinite network equipment of each node according to the abnormal distribution coefficients of the time windows of each node and sixteen neighborhood nodes, judging the abnormal condition of each node, and completing the filtering of WLAN protocol data. The abnormal point judging method is more in line with the real scene, and the abnormal nodes are accurately judged.
Description
Technical Field
The application relates to the field of information communication processing, in particular to a WLAN protocol data filtering method and system.
Background
WLAN is a wireless local area network protocol for providing wireless data communication in a limited area, and determines a data transmission specification between wireless communication devices, including a data transmission rate, a frequency range, channel management, a data transmission mode, and the like. Because the data bandwidth accessed by users is limited and the wireless channel has uncertainty, WLANs are often subject to noise interference from different devices and spaces. Therefore, it is necessary to filter data in a wireless local area network. The data filtering refers to filtering useless and interference data in a wireless network and selecting useful data in the network.
The traditional data filtering mode mainly comprises filtering based on MAC addresses, filtering based on IP addresses, filtering based on port numbers and filtering based on public and private keys. The traditional filtering mode lacks flexibility, and only static rules can be set to filter data; lack of security, inability to filter encrypted data; the calculation efficiency is low, and the public and private keys need to be continuously encrypted and decrypted; the method is single, the numerical data is processed, and the analysis method is fixed.
In summary, the present application provides a method for filtering WLAN protocol data, which collects data traffic anomaly matrices at each moment according to data traffic of each device, analyzes features of the data traffic anomaly matrices by adopting an information communication processing mode to obtain anomaly conditions characterizing each device, and performs current limiting on the anomaly devices to realize filtering of data in a wireless network.
Disclosure of Invention
In order to solve the technical problems, the application aims to provide a method and a system for filtering WLAN protocol data, wherein the adopted technical scheme is as follows:
in a first aspect, an embodiment of the present application provides a WLAN protocol data filtering method, including the steps of:
acquiring a data flow abnormal matrix at each data acquisition time;
taking each data point of the data flow abnormal matrix as a node; determining each node searching area, a central area and each neighborhood area;
obtaining data flow distribution non-uniformity coefficients of each neighborhood region according to the data flow of each node in each neighborhood region in each node search region; obtaining wireless equipment flow heterogeneity coefficients of all nodes according to the data flow heterogeneity coefficients of all neighborhood regions and the central region of each node; obtaining the local flow difference coefficient of each node according to the wireless equipment flow difference coefficient of each node and the data flow of each node eight neighborhood nodes;
for each node, forming a time window of the node by data flow corresponding to each data acquisition time of the node; obtaining the abnormal distribution coefficient of the time window of each node according to the local flow difference coefficient of each time of the time window of each node and the data flow of each node; obtaining an infinite network device abnormality index of each node according to the time window abnormality distribution coefficients of each node and sixteen neighborhood nodes;
and obtaining abnormal conditions of each node according to the abnormal indexes of the wireless network equipment of each node, and completing the filtering of WLAN protocol data.
Preferably, the acquiring the data traffic anomaly matrix at each data acquisition time includes:
and counting the data flow of each station at each data acquisition time, and taking the data flow of each station at each data acquisition time as the value of each data point of the data flow anomaly matrix to obtain the data flow anomaly matrix at each data acquisition time.
Preferably, the determining each node searching region, the central region and each neighborhood region includes:
for each node, setting a search area and a central area which take the node as a central node; and taking all sliding windows with the same size as the central area in the central node search area as all neighborhood areas of the central node.
Preferably, the obtaining the data traffic distribution non-uniformity coefficient of each neighborhood region according to the data traffic of each node in each neighborhood region in each node search region includes:
in the method, in the process of the application,a data traffic distribution non-uniformity coefficient indicating that node i is in the jth neighborhood region of the search region,/, is provided>Data traffic representing the ith node in the jth neighborhood of the search area,/for the jth node>Representing the average value of data flow of all nodes of node i in the jth neighborhood region of the search region, ++>Representing the variance of data flow of all nodes of node i in the jth neighborhood region of the search region, +.>Representing the number of nodes in the neighborhood region.
Preferably, the obtaining the wireless device traffic heterogeneity coefficient of each node according to the data traffic heterogeneity coefficients of each neighborhood region and the central region of each node includes:
for each node, acquiring an L2 norm of a data flow non-uniformity coefficient of each neighborhood region and a central region of the node; and taking the L2 norm average value of all neighborhood regions in the node search region as the wireless device flow heterogeneity coefficient of the node.
Preferably, the obtaining the local differential coefficient of the traffic of each node according to the differential coefficient of the traffic of the wireless device of each node and the data traffic of the eight neighboring nodes of each node includes:
for each node, recording the average value of the absolute value of the difference value of the data flow of all nodes in the node and eight adjacent domains as a first difference coefficient of the node; and taking the product of the wireless equipment traffic heterogeneity coefficient of the node and the first difference coefficient as the traffic local difference coefficient of the node.
Preferably, the obtaining the abnormal distribution coefficient of the time window of each node according to the local difference coefficient of the flow at each moment of the time window of each node and the data flow of each node includes:
in the method, in the process of the application,time window abnormality distribution coefficient representing node i, +.>Data traffic representing node i, +.>Represents the number of data points in the time window, +.>Representing node->Within the time window->The local variance coefficient of the flow of the data points,representing node->Flow local coefficient of difference mean value of all data points in time window, +.>Representing node->In the time windowThe flow local difference coefficient variance of all data points within.
Preferably, the obtaining the abnormal index of the infinite network device of each node according to the abnormal distribution coefficients of the time windows of each node and sixteen neighboring nodes includes:
for each node, calculating the average value of the abnormal distribution coefficients of the time windows of all nodes in sixteen adjacent nodes; recording the difference value between the abnormal distribution coefficient of the time window of the node and the average value of the abnormal distribution coefficient of the time window as a first coefficient;
and taking the absolute value of the ratio of the first coefficient to the abnormal distribution coefficient of the time window of the node as an abnormal index of infinite network equipment of the node.
Preferably, the obtaining the abnormal condition of each node according to the abnormality index of the wireless network device of each node includes:
setting an abnormal threshold, marking a node with the wireless network equipment abnormality index larger than the abnormal threshold as a normal node, and marking a node with the wireless network equipment abnormality index smaller than the abnormal threshold as an abnormal node.
In a second aspect, an embodiment of the present application further provides a WLAN protocol data filtering system, including a memory, a processor, and a computer program stored in the memory and running on the processor, where the processor executes the computer program to implement the steps of any one of the methods described above.
The application has at least the following beneficial effects:
according to the method, the data traffic anomaly matrix is constructed by counting the data traffic conditions of each wireless device at the routing end, the wireless device traffic heterogeneity coefficients of each neighborhood region and the central region of each node are calculated according to the data traffic anomaly matrix partition window to obtain the characteristics for representing the central node, meanwhile, the difference between the wireless device traffic heterogeneity coefficients of each neighborhood region sliding in the search region and the central region is obtained, the local traffic diversity coefficient of the node is constructed, and the influence on the surrounding node traffic bandwidth occupation when the abnormal node appears is analyzed from the space angle, so that the mode of judging the abnormal device is more in line with the real scene.
According to the method, the abnormal distribution coefficient of the time window of each node is calculated by setting the time window, and the abnormal distribution coefficient of the time window is combined with the abnormal distribution coefficient of sixteen neighborhood nodes to obtain the wireless network equipment abnormality index representing each node; compared with the traditional mode, the method can be used for judging the abnormal equipment through equipment flow monitoring, and the method can be used for screening abnormal nodes before other data filtering modes, so that data preliminary filtering is realized, and the data filtering efficiency is improved.
Drawings
In order to more clearly illustrate the embodiments of the application or the technical solutions and advantages of the prior art, the following description will briefly explain the drawings used in the embodiments or the description of the prior art, and it is obvious that the drawings in the following description are only some embodiments of the application, and other drawings can be obtained according to the drawings without inventive effort for a person skilled in the art.
Fig. 1 is a flowchart of a WLAN protocol data filtering method provided by the present application.
Detailed Description
In order to further describe the technical means and effects adopted by the present application to achieve the preset purpose, the following detailed description refers to specific implementation, structure, features and effects of a WLAN protocol data filtering method and system according to the present application with reference to the accompanying drawings and preferred embodiments. In the following description, different "one embodiment" or "another embodiment" means that the embodiments are not necessarily the same. Furthermore, the particular features, structures, or characteristics of one or more embodiments may be combined in any suitable manner.
Unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs.
The following specifically describes a specific scheme of a WLAN protocol data filtering method and system provided by the present application with reference to the accompanying drawings.
The embodiment of the application provides a WLAN protocol data filtering method and system.
Specifically, referring to fig. 1, a method for filtering WLAN protocol data is provided, and the method includes the following steps:
and S001, counting the traffic conditions of each IP address at the router end, and converting the traffic conditions into a data traffic anomaly matrix.
In the embodiment, the WLAN protocol data is filtered through the information communication technology, in a large office scene, a plurality of devices are generally required to be accessed into a wireless network, and the devices accessed into the network are uniformly distributed in terms of space distance because stations are orderly arranged. In order to simplify analysis, the embodiment does not consider that a plurality of routing devices realize even coverage of signals, and simplifies the signal coverage into even coverage of an office scene wireless network by one routing device. Because the optical signals are adopted for transmission between the plurality of routing devices and the total route, the optical signals have higher transmission rate, and therefore, the analysis result is not affected by the simplified operation.
And carrying out statistics on the flow of each device access network at a routing end, and carrying out linear normalization on the statistics value. Since traffic data is changed in real time, the number of devices accessing the network in a large office scene is thousands, and thus the amount of data to be analyzed is very large. In order to reduce the calculation cost, the flow data of each device is sampled and counted, and the embodiment adopts a sampling interval of 0.5 seconds to count the flow condition of each device of the wireless network once.
And acquiring a data flow abnormal matrix at each data sampling moment, analyzing the abnormal condition of each device for each data flow abnormal matrix, finding out the abnormality and timely processing the abnormality, thereby realizing the effect of data filtering. Wherein,,indicate->Office at momentData traffic anomaly matrix formed by scenery access radio network equipment, and value of each data point represents +.>The station equipment accesses the flow condition of the network at the moment.
So far, the data flow abnormal matrix at each data acquisition time can be obtained by the method.
Step S002, calculating the wireless network equipment abnormality index of each node of the data flow abnormality matrix.
For the situation that the value of each data point in the data flow abnormal matrix at any data acquisition time represents the data flow of the network equipment at the acquisition time, when the network equipment at one position occupies a larger network bandwidth, the data transmission of the neighborhood network equipment can be influenced. In order to simplify the expression, when analyzing the data traffic anomaly matrix at one data acquisition time, each data point in the data traffic anomaly matrix is called a node, and each node represents a network device.
In order to analyze the difference condition between a single node and surrounding nodes, the idea of dividing the NLM into parts is used for reference. Taking each node in the data traffic anomaly matrix as a central node, and selecting one for each central nodeIs denoted as +.>The method comprises the steps of carrying out a first treatment on the surface of the About the central node +.>The window is taken as the central area of the central node, denoted +.>In the search area, a sliding window with the same size as the central area is used as a neighborhood area, and is marked as +.>. At the position ofCalculating a quasi-second order center distance in each neighborhood region to obtain a data flow distribution non-uniformity coefficient of each neighborhood region:
in the method, in the process of the application,a data traffic distribution non-uniformity coefficient indicating that node i is in the jth neighborhood region of the search region,/, is provided>Data traffic representing the ith node in the jth neighborhood of the search area,/for the jth node>Representing the average value of data flow of all nodes of node i in the jth neighborhood region of the search region, ++>Representing the variance of data flow of all nodes of node i in the jth neighborhood region of the search region, +.>Representing the number of nodes in the neighborhood region.
It should be noted that the number of the substrates,is->Is a neighborhood region size; the data traffic distribution non-uniformity coefficient represents the degree of uniformity of the data distribution in a neighborhood region. When abnormal nodes exist in the window, a large difference occurs between the data flow and the data flow average value of the neighborhood region, so that ++>The absolute value of (2) is increased and the variance of the data traffic in the neighborhood region is also increased, thereby making +.>Increasing. When all nodes in the neighborhood region are normal, namely the data flow of all nodes is relatively balanced and is near the average value, the node is +.>Smaller.
By calculating the data flow distribution non-uniformity coefficient of the neighborhood regionIn search area->Slide until the complete search area is traversed +.>. Will->Calculates the neighborhood region and the center region for each sliding of (a)The difference of the data traffic distribution heterogeneity coefficients, thereby obtaining wireless device traffic heterogeneity coefficients for each node:
in the method, in the process of the application,representing node->Wireless device traffic heterogeneity coefficient, +.>A data traffic distribution non-uniformity coefficient indicating that node i is in the jth neighborhood region of the search region,/, is provided>Data traffic distribution non-uniformity coefficient representing node i center region, +.>Represents L2 norm->Indicating the number of times the neighborhood region is slid within the search region.
And repeating the steps to obtain the wireless device flow heterogeneity coefficient of each node in the data flow anomaly matrix.
It should be noted that, when a single node occupies a large data bandwidth, the node may encroach on traffic bandwidth of other nodes. Thus, when the data traffic of the central node is abnormal, the central node and the data traffic of the neighborhood region are distributed unevenlyThere will be a large difference such that +.>And thus the wireless device traffic heterogeneity coefficient of node i becomes large.
Indicating the abnormal condition of the data traffic of the node i, because the abnormal node can encroach on the traffic bandwidth of the neighborhood node, the node i is about to be +.>Combining the data traffic of the eight neighborhood nodes can obtain the local difference coefficient of the traffic of the node i:
in the method, in the process of the application,representing node->Flow local difference coefficient of>Representing node->Wireless device traffic heterogeneity coefficient, +.>Representing node->Data flow of>Representing node->Data traffic of node j in eight neighborhoods, +.>Representing the number of nodes in eight neighborhoods, wherein +.>Is the first coefficient of difference for node i.
It should be noted that eight neighbors are chosen here, namelyThe method comprises the steps of carrying out a first treatment on the surface of the The flow local difference coefficient represents the difference between the data flow of the node and the data flow of the eight neighborhood nodes, and simultaneously, the abnormal condition of the node is reflected by combining the infinite equipment flow difference coefficient of the node.
And repeating the steps to obtain the local flow difference coefficient of each node in the data flow abnormal matrix.
A local difference coefficient of traffic of a single node at a certain moment being larger than a difference threshold value can only indicate that the node possibly has an abnormality, if the node occupies a larger bandwidth for a long time, the node can be determinedAbnormal state. Thus setting a time windowAnd calculating the skewness of each node to obtain the abnormal distribution coefficient of the time window. The present embodiment sets the time window to +.>。
In the method, in the process of the application,time window abnormality distribution coefficient representing node i, +.>Data traffic representing node i, +.>Represents the number of data points in the time window, +.>Representing node->Within the time window->The local variance coefficient of the flow of the data points,representing node->Flow local coefficient of difference mean value of all data points in time window, +.>Representing node->The flow local difference coefficient variance of all data points over a time window.
It should be noted that the number of the substrates,representing the distribution condition of the local flow difference coefficient of the node i in the time window, calculating the data flow condition of the node i at each moment in the time window, and if the node has the characteristic of long-term abnormality or long-term normal, the node is +.>The value of (2) will be smaller, indicating that the node has less variation in the time window; in order to distinguish more accurately whether the node is a long-term abnormal node or a long-term normal node, this can be distinguished by combining the data traffic of the node, if +.>The greater is +.>The larger the node is, the longer the node is an abnormal node.
And repeating the steps, and calculating the abnormal distribution coefficients of the time windows of all the nodes in the data flow abnormal matrix.
Obtaining abnormal distribution coefficients of each node in a time window, wherein the abnormal distribution coefficients only represent the abnormal distribution coefficients of the time window of the local node, and the abnormal indexes of the wireless network equipment of each node are represented by combining the abnormal distribution coefficients of the time window of sixteen neighborhood nodes of each node:
in the method, in the process of the application,wireless network device abnormality index indicating node i, +.>Representing node->Is a temporal window abnormality distribution coefficient of->Representing node->Time window abnormal distribution coefficient mean value of all nodes in sixteen neighborhoods, wherein->Is the first coefficient of node i.
When the nodeWhen the node is a real abnormal node, the distribution of the node in a long-term time window is abnormal, and the abnormal node can encroach on the bandwidths of other nodes in the neighborhood, so that the abnormal distribution coefficient of the time window of the node in the sixteen neighborhood is smaller, namely the average abnormal distribution coefficient of the time window of all the nodes in the sixteen neighborhood is smaller; therefore, the time window abnormal distribution coefficient of the node has larger average difference with the time window abnormal distribution coefficient in sixteen adjacent areas; eventually leading to a larger wireless network device abnormality index for node i.
Step S003, judging the abnormal condition of each node according to the abnormal index of the wireless network equipment of each node.
According to the last step, the abnormality index of the wireless network equipment of each node can be obtained，/>The larger the node is, the greater the likelihood of abnormality.
Setting an abnormality threshold, marking a node with an abnormality index smaller than the abnormality threshold of the infinite network device as a normal node, and marking a node with an abnormality index larger than the abnormality threshold of the infinite network device as an abnormal node.
Aiming at the abnormal node, the position of the abnormal node in the data traffic abnormal matrix is determined, and the connection of the abnormal node is disconnected at the wireless router, so that the filtering of transmission data of abnormal equipment in an infinite network can be realized, useless or abnormal data is prevented from being transmitted in the network, and the waste of bandwidth resources of a company is reduced.
The abnormality threshold is set by the practitioner himself, and the abnormality threshold is set to 1 in this embodiment.
In summary, the embodiment of the present application provides a WLAN protocol data filtering method, which collects data traffic anomaly matrices at each moment according to data traffic of each device, analyzes features of the data traffic anomaly matrices by adopting an information communication processing manner, obtains anomaly conditions characterizing each device, and performs current limiting on the anomaly devices to implement filtering of data in a wireless network.
According to the embodiment of the application, the data traffic anomaly matrix is constructed by counting the data traffic conditions of each wireless device at the routing end, the wireless device traffic heterogeneity coefficients of each neighborhood region and the central region of each node are calculated according to the data traffic anomaly matrix partition window to obtain the characteristics for representing the central node, meanwhile, the difference between the wireless device traffic heterogeneity coefficient of each neighborhood region sliding in the search region and the central region is obtained, the local traffic diversity coefficient of the node is constructed, and the influence on the surrounding node traffic bandwidth occupation when the abnormal node appears is analyzed from the space angle, so that the mode of judging the abnormal device is more in line with the real scene.
According to the embodiment of the application, the abnormal distribution coefficient of the time window of each node is calculated by setting the time window, and the abnormal distribution coefficient of the time window is combined with the abnormal distribution coefficient of sixteen neighborhood nodes to obtain the wireless network equipment abnormality index for representing each node, so that the method can construct the long-term abnormality characteristic of the abnormal node, analyze the abnormal matrix of the data flow of the data points at each moment in the time window, and is favorable for combining the distribution characteristic of the abnormal node at the time level, and more accurately judging the abnormal node; compared with the traditional mode, the method can be used for judging the abnormal equipment through equipment flow monitoring, and the method can be used for screening abnormal nodes before other data filtering modes, so that data preliminary filtering is realized, and the data filtering efficiency is improved.
It should be noted that: the sequence of the embodiments of the present application is only for description, and does not represent the advantages and disadvantages of the embodiments. And the foregoing description has been directed to specific embodiments of this specification. In addition, the processes depicted in the accompanying figures do not necessarily require the particular order shown, or sequential order, to achieve desirable results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.
In this specification, each embodiment is described in a progressive manner, and the same or similar parts of each embodiment are referred to each other, and each embodiment mainly describes differences from other embodiments.
The above embodiments are only for illustrating the technical solution of the present application, and not for limiting the same; the technical solutions described in the foregoing embodiments are modified or some of the technical features are replaced equivalently, so that the essence of the corresponding technical solutions does not deviate from the scope of the technical solutions of the embodiments of the present application, and all the technical solutions are included in the protection scope of the present application.
Claims (10)
1. A method for filtering WLAN protocol data, the method comprising the steps of:
acquiring a data flow abnormal matrix at each data acquisition time;
taking each data point of the data flow abnormal matrix as a node; determining each node searching area, a central area and each neighborhood area;
obtaining data flow distribution non-uniformity coefficients of each neighborhood region according to the data flow of each node in each neighborhood region in each node search region; obtaining wireless equipment flow heterogeneity coefficients of all nodes according to the data flow heterogeneity coefficients of all neighborhood regions and the central region of each node; obtaining the local flow difference coefficient of each node according to the wireless equipment flow difference coefficient of each node and the data flow of each node eight neighborhood nodes;
for each node, forming a time window of the node by data flow corresponding to each data acquisition time of the node; obtaining the abnormal distribution coefficient of the time window of each node according to the local flow difference coefficient of each time of the time window of each node and the data flow of each node; obtaining an infinite network device abnormality index of each node according to the time window abnormality distribution coefficients of each node and sixteen neighborhood nodes;
and obtaining abnormal conditions of each node according to the abnormal indexes of the wireless network equipment of each node, and completing the filtering of WLAN protocol data.
2. The method for filtering WLAN protocol data according to claim 1, wherein said obtaining a data traffic anomaly matrix for each data acquisition time comprises:
and counting the data flow of each station at each data acquisition time, and taking the data flow of each station at each data acquisition time as the value of each data point of the data flow anomaly matrix to obtain the data flow anomaly matrix at each data acquisition time.
3. The method of filtering WLAN protocol data according to claim 1, wherein said determining each node search area, center area and each neighborhood area includes:
for each node, setting a search area and a central area which take the node as a central node; and taking all sliding windows with the same size as the central area in the central node search area as all neighborhood areas of the central node.
4. The method for filtering WLAN protocol data according to claim 1, wherein said obtaining the data traffic distribution non-uniformity coefficient of each neighborhood region according to the data traffic of each node in each neighborhood region in each node search region comprises:
in the method, in the process of the application,a data traffic distribution non-uniformity coefficient indicating that node i is in the jth neighborhood region of the search region,/, is provided>Data traffic representing the ith node in the jth neighborhood of the search area,/for the jth node>Representing the average value of data flow of all nodes of node i in the jth neighborhood region of the search region, ++>Representing the variance of data flow of all nodes of node i in the jth neighborhood region of the search region, +.>Representing the number of nodes in the neighborhood region.
5. The method as set forth in claim 1, wherein the obtaining the wireless device traffic heterogeneity coefficient of each node according to the data traffic heterogeneity coefficients of each neighboring region and the central region of each node includes:
for each node, acquiring an L2 norm of a data flow non-uniformity coefficient of each neighborhood region and a central region of the node; and taking the L2 norm average value of all neighborhood regions in the node search region as the wireless device flow heterogeneity coefficient of the node.
6. The method as set forth in claim 1, wherein the obtaining the local differential coefficient of the traffic of each node according to the differential coefficient of the traffic of the wireless device of each node and the data traffic of each node in eight neighboring nodes includes:
for each node, recording the average value of the absolute value of the difference value of the data flow of all nodes in the node and eight adjacent domains as a first difference coefficient of the node; and taking the product of the wireless equipment traffic heterogeneity coefficient of the node and the first difference coefficient as the traffic local difference coefficient of the node.
7. The method as set forth in claim 1, wherein the obtaining the abnormal distribution coefficient of the time window of each node according to the local difference coefficient of the traffic of each time of each node time window and the data traffic of each node includes:
in the method, in the process of the application,time window abnormality distribution coefficient representing node i, +.>Data traffic representing node i, +.>Represents the number of data points in the time window, +.>Representing node->Within the time window->Local difference coefficient of flow of data points, +.>Representing node->Flow locality for all data points within a time windowMean value of difference coefficient>Representing node->The flow local difference coefficient variance of all data points over a time window.
8. The method as set forth in claim 1, wherein the obtaining the abnormal index of the wireless network device of each node according to the abnormal distribution coefficients of the time window of each node and sixteen neighboring nodes includes:
for each node, calculating the average value of the abnormal distribution coefficients of the time windows of all nodes in sixteen adjacent nodes; recording the difference value between the abnormal distribution coefficient of the time window of the node and the average value of the abnormal distribution coefficient of the time window as a first coefficient;
and taking the absolute value of the ratio of the first coefficient to the abnormal distribution coefficient of the time window of the node as an abnormal index of infinite network equipment of the node.
9. The method for filtering WLAN protocol data according to claim 1, wherein said obtaining the abnormal condition of each node according to the wireless network device abnormality index of each node comprises:
setting an abnormal threshold, marking a node with the wireless network equipment abnormality index larger than the abnormal threshold as a normal node, and marking a node with the wireless network equipment abnormality index smaller than the abnormal threshold as an abnormal node.
10. A WLAN protocol data filtering system comprising a memory, a processor and a computer program stored in the memory and running on the processor, characterized in that the processor implements the steps of the method according to any one of claims 1-9 when executing the computer program.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202311219081.XA CN116963136B (en) | 2023-09-21 | 2023-09-21 | WLAN protocol data filtering method and system |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202311219081.XA CN116963136B (en) | 2023-09-21 | 2023-09-21 | WLAN protocol data filtering method and system |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN116963136A true CN116963136A (en) | 2023-10-27 |
| CN116963136B CN116963136B (en) | 2023-11-28 |
Family
ID=88458777
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202311219081.XA Active CN116963136B (en) | 2023-09-21 | 2023-09-21 | WLAN protocol data filtering method and system |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN116963136B (en) |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN118075025A (en) * | 2024-04-17 | 2024-05-24 | 莱芜职业技术学院 | Big data-based computer data security assessment method and system |
| CN118784458A (en) * | 2024-09-10 | 2024-10-15 | 腾讯科技（深圳）有限公司 | Fault handling method and related device based on large model cluster training |
Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20150341376A1 (en) * | 2014-05-26 | 2015-11-26 | Solana Networks Inc. | Detection of anomaly in network flow data |
| CN110048905A (en) * | 2019-03-26 | 2019-07-23 | 清华大学 | The recognition methods of internet of things equipment communication pattern and device |
| CN113542060A (en) * | 2021-07-07 | 2021-10-22 | 电子科技大学中山学院 | Abnormal equipment detection method based on equipment communication data characteristics |
| CN114389974A (en) * | 2022-03-23 | 2022-04-22 | 中国人民解放军国防科技大学 | Method, device and medium for searching abnormal flow node in distributed training system |
| CN116055413A (en) * | 2023-03-07 | 2023-05-02 | 云南省交通规划设计研究院有限公司 | Tunnel network anomaly identification method based on cloud edge cooperation |
| CN116545764A (en) * | 2023-06-26 | 2023-08-04 | 烟台大学 | Abnormal data detection method, system and equipment of industrial Internet |
-
2023
- 2023-09-21 CN CN202311219081.XA patent/CN116963136B/en active Active
Patent Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20150341376A1 (en) * | 2014-05-26 | 2015-11-26 | Solana Networks Inc. | Detection of anomaly in network flow data |
| CN110048905A (en) * | 2019-03-26 | 2019-07-23 | 清华大学 | The recognition methods of internet of things equipment communication pattern and device |
| CN113542060A (en) * | 2021-07-07 | 2021-10-22 | 电子科技大学中山学院 | Abnormal equipment detection method based on equipment communication data characteristics |
| CN114389974A (en) * | 2022-03-23 | 2022-04-22 | 中国人民解放军国防科技大学 | Method, device and medium for searching abnormal flow node in distributed training system |
| CN116055413A (en) * | 2023-03-07 | 2023-05-02 | 云南省交通规划设计研究院有限公司 | Tunnel network anomaly identification method based on cloud edge cooperation |
| CN116545764A (en) * | 2023-06-26 | 2023-08-04 | 烟台大学 | Abnormal data detection method, system and equipment of industrial Internet |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN118075025A (en) * | 2024-04-17 | 2024-05-24 | 莱芜职业技术学院 | Big data-based computer data security assessment method and system |
| CN118784458A (en) * | 2024-09-10 | 2024-10-15 | 腾讯科技（深圳）有限公司 | Fault handling method and related device based on large model cluster training |
Also Published As
| Publication number | Publication date |
|---|---|
| CN116963136B (en) | 2023-11-28 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN116963136B (en) | WLAN protocol data filtering method and system | |
| Toledo et al. | Robust detection of selfish misbehavior in wireless networks | |
| EP3694149A1 (en) | Network quality determining method and apparatus, and storage medium | |
| CN107820255B (en) | An Improved Covariance Absolute Value Cooperative Spectrum Sensing Method | |
| FR3004309A1 (en) | DISTRIBUTED METHOD FOR SELECTING A CONFIGURATION IN MOBILE NETWORKS | |
| CN118367999A (en) | Anti-interference communication method and system | |
| CN118101101B (en) | Cloud computing system and method based on WIFI network | |
| CN114584993A (en) | Method for identifying deployment position of access point and position identification equipment | |
| CN101754404A (en) | Cooperative frequency spectrum sensing method based on consistency in cognitive radio electric network | |
| CN113691333B (en) | Communication channel optimization method and device, electronic device, and storage medium | |
| CN115379476B (en) | Methods, devices, equipment and storage media for determining cell interference types | |
| Nishio et al. | Anomaly traffic detection with federated learning toward network-based malware detection in IoT | |
| CN115941511B (en) | Network traffic modeling and prediction method and device based on mixed integer programming | |
| Unnikrishnan et al. | Dynamic spectrum access with learning for cognitive radio | |
| CN111106888B (en) | Multi-mode correlation based step-by-step spectrum sensing method and storage medium | |
| Vishwakarma et al. | A Cooperative Spectrum Sensing Scheme using Particle Swarm Optimization and Cultural Algorithm | |
| US20170005898A1 (en) | Distributed saturation detection method for wireless network nodes | |
| CN114449444A (en) | Cross-intelligent portable equipment association method based on WiFi-BLE signal passive sniffing | |
| CN117440427B (en) | WiFi network networking quality diagnosis method, device and equipment | |
| CN107911182B (en) | A method for detecting mutation of wireless channel environment characteristic parameters | |
| CN119652777B (en) | Communication signal monitoring method and system for repeater | |
| JP2022543911A (en) | Cooperative spectral detection method based on backscattering and airborne computation | |
| CN110798271A (en) | Pseudo path eliminating method based on neural network in wireless channel measurement | |
| CN117156485B (en) | Link quality detection method | |
| CN115134831B (en) | Method for designing user fairness index of downlink NOMA system based on rate variance |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |