Data flow forwarding abnormality detection method and system, and controller

A controller, comprising:

• at least one processor;
• and
• a non-transitory computer-readable storage medium coupled to the at least one processor and
• storing programming instructions for execution by the at least one processor, the programming instructions instruct the at least one processor to:
• determine a switching device through which a to-be-detected data flow passes;
• obtain at least one flow entry in the switching device that matches the data flow, wherein the at least one flow entry comprises actual traffic and a match field, and the actual traffic is a value of a counter corresponding to the match field;
• establish an overdetermined equation set based on the actual traffic and theoretical traffic of a data flow in the switching device that matches the match field, wherein the theoretical traffic forms an unknown number vector of the overdetermined equation set, and the actual traffic forms a constant term vector of the overdetermined equation set;
• and
• determine, based on the overdetermined equation set, whether the at least one flow entry is abnormal,
• wherein the programming instructions further instruct the at least one processor to:
• substitute a least square solution of the overdetermined equation set into an unknown number vector side of the overdetermined equation set, to obtain an updated constant term vector;
• obtain a square error norm based on the constant term vector of the overdetermined equation set and the updated constant term vector;
• and
• compare the square error norm with a first threshold to determine whether the at least one flow entry is abnormal.

A system, comprising a controller, wherein the controller comprises:

• at least one processor;
• and
• a non-transitory computer-readable storage medium coupled to the at least one processor and storing programming instructions for execution by the at least one processor, the programming instructions instruct the at least one processor to:
• determine a switching device through which a to-be-detected data flow passes;
• obtain at least one flow entry in the switching device that matches the data flow, wherein the at least one flow entry comprises actual traffic and a match field, and the actual traffic is a value of a counter corresponding to the match field;
• establish an overdetermined equation set based on the actual traffic and theoretical traffic of a data flow in the switching device that matches the match field, wherein the theoretical traffic forms an unknown number vector of the overdetermined equation set, and the actual traffic forms a constant term vector of the overdetermined equation set;
• and
• determine, based on the overdetermined equation set, whether the at least one flow entry is abnormal,
• wherein the programming instructions further instruct the at least one processor to:
• substitute a least square solution of the overdetermined equation set into an unknown number vector side of the overdetermined equation set, to obtain an updated constant term vector;
• obtain a square error norm based on the constant term vector of the overdetermined equation set and the updated constant term vector;
• and
• compare the square error norm with a first threshold to determine whether at least one flow entry is abnormal.