Abnormal Traffic Detection and Analysis System - ATA

NPM provides network-traffic/quality monitoring and detailed link, host, subnet, workgroup and session analysis. Traditional SNMP/log management monitors hosts/devices, faults, changes, traffic, topology and resources, but critical network-dependent applications need faster recovery for productivity. Limitations include poor insight into trends for proactive planning, insufficient visibility of application ports/bandwidth/KPIs, inability to separate business/nonbusiness traffic, and lack of real-time warnings for latency, server response and retransmissions. The NPM appliance integrates OS/software, collection, computation, analysis and storage, accessed through a browser. Deployed at key nodes, it captures critical-area traffic via switch mirroring, analyzes/stores it, and loads modules for operating/performance metrics and alarms. Browser-based centralized management provides alarm analysis, aggregated reports, configuration, viewing/search and data mining.

This observability platform combines live probe data, service logs, system files, tracing logs and cloud data into business-context views. Cloud, big data, AI and blockchain drive digital transformation and changes in operations/consumption, increasing competition in business models/efficiency. Complex internal/external IT directly affects digital-service quality, efficiency, market development and competitiveness. IT has shifted from delivery to business-integrated operations; understanding customer/prospect behavior and IT's effect on experience is essential. Availability/performance supports digital growth. Observability is part of full-traffic retrospective analysis: users create/share views for a live global picture. More than ten dimensions, hundreds of metrics and dozens of components combine freely. Any automatically identified traffic/object or drill-down result becomes a scenario-, industry-, department- or person-specific live monitoring/alarm dashboard, with further drill-down. The solution combines observability-analysis software with full-traffic retrospective-analysis hardware. The software securely reads metrics/data from analysis appliances and other sources for comprehensive monitoring. Each independent appliance integrates OS/software, collection, computation, analysis and storage; both systems are browser-accessible. Each appliance is only one platform data source, read securely and displayed independently or relationally. Appliances at key nodes/areas/locations collect mirrored traffic, analyze/store it and run modules for network/application metrics and alarms. Installed beside monitored links, they import switch-mirrored traffic. Installation/configuration is stated to finish within one hour with zero network impact and no server/client agents, including SNMP agents. Platform software can install on any OS; platform and appliances run independently without affecting one another.

BPM monitors business access in real time and analyzes root causes of individual transaction-performance problems. Distributed/cloud applications make logic, networks and traffic increasingly complex, complicating reliable efficient operation, fault location and detection of security/business risks. Time-sensitive services need fast recovery. Conventional management is reactive to complaints, lacks proactive KPI warnings, cannot promptly flag latency/server response/retransmissions, lacks historical records for slowdowns/outages and struggles to resolve root causes. Needs include multidimensional performance monitoring from end-user perception, historical replay for fast diagnosis,7×24 regional experience monitoring with prompt response, and open APIs for third-party integration, real-time secondary analysis, operational big data, market intelligence, BI dashboards, custom reports, ad hoc queries and online analysis. The BPM appliance integrates OS/software, collection, computation, analysis and storage behind browser access. Out-of-band deployment near important business-server zones captures mirrored traffic, analyzes/stores it and runs modules for operating/performance metrics and alarms. No third-party client is needed: browsers centrally manage alarms, aggregated reports, configuration, viewing/search and data mining.

APM provides real-time application-performance monitoring, analysis/alarms and end-user-experience analysis. It warns before performance issues and helps locate/resolve failures. Needs include proactive health/user-experience visibility rather than complaints; historical-traffic replay to diagnose slowdowns/outages; real-time latency, server-response and access-quality warnings; detection/control of illegal traffic; live experience, business status, access quality and abnormal-communication alarms. API access supplies richer data for secondary development, operational big data, market intelligence, third-party integration, BI dashboards, custom reports, ad hoc queries and online analysis. The APM appliance integrates OS/software, collection, computation, analysis and storage behind browser access. Deployed near applications, it captures mirrored traffic from key areas, stores/analyzes it and loads modules for application operating/performance metrics and alarms. Central browser management provides alarm analysis, report aggregation, configuration, viewing/search and data mining.