Method, Apparatus, and System for Identifying Abnormal IP Data Stream

A work node, comprising:

• a receiving unit configured to receive, within a current time interval, Y elements sent by a data collection node, wherein Y is greater than or equal to 1, and wherein Y is an integer;
• a mapping unit configured to map the Y elements to N buckets according to a mapping algorithm, wherein N is greater than or equal to 1, and wherein N is an integer;
• a first acquiring unit configured to acquire a bucket in the N buckets as a target bucket, wherein total traffic of all elements mapped to the bucket is greater than or equal to a first threshold;
• a second acquiring unit configured to acquire r upper traffic limits of a first object in r buckets within the current time interval, wherein the r buckets are buckets to which the first object is mapped, wherein the first object is any object mapped to the target bucket, wherein each bucket in the r buckets comprises one upper traffic limit for the first object, wherein r is greater than or equal to 1, and wherein r is an integer;
• and
• an identifying unit configured to identify, according to a preset abnormal object type and the r upper traffic limits within the current time interval, whether the first object is an abnormal object, wherein the preset abnormal object type is one of a heavy hitter type and a heavy changer type.

A system for identifying an abnormal Internet Protocol (IP) data stream, comprising a data collection node and a work node, wherein the data collection node is configured to send Y elements, and wherein the work node comprises:

• a receiving unit configured to receive, within a current time interval, Y elements sent by the data collection node, wherein Y is greater than or equal to 1, and wherein Y is an integer;
• a mapping unit configured to map the Y elements to N buckets according to a mapping algorithm, wherein N is greater than or equal to 1, and wherein N is an integer;
• a first acquiring unit configured to acquire a bucket in the N buckets as a target bucket, wherein total traffic of all elements mapped to the bucket is greater than or equal to a first threshold;
• a second acquiring unit configured to acquire r upper traffic limits of a first object in r buckets within the current time interval, wherein the r buckets are buckets to which the first object is mapped, wherein the first object is any object mapped to the target bucket, wherein each bucket in the r buckets comprises one upper traffic limit for the first object, wherein r is greater than or equal to 1, and wherein r is an integer;
• and
• an identifying unit configured to identify, according to a preset abnormal object type and the r upper traffic limits within the current time interval, whether the first object is an abnormal object, wherein the preset abnormal object type is one of a heavy hitter and a heavy changer.