Fault prediction method and system for IP network

Abstract

The invention relates to a fault prediction method and system for an IP network. The method comprises the following steps: collecting network link data; extracting network link characteristics according to the network link data; training a GRU model through the network link features to obtain a prediction model; and inputting real-time network data into the prediction model to obtain a prediction result. According to the invention, the efficiency and accuracy performance of performance monitoring and fault prediction can be improved.

Description

Technical Field

[0001] The present invention belongs to the technical field of network operation and maintenance, and in particular relates to a fault prediction method and system for an IP network. Background Art

[0002] With the continuous development of IT systems, the scale of networks and the number of devices are rapidly expanding. In network operation and management, network quality factors are complex and diverse. Operation and maintenance management is generally done by operation and maintenance personnel who rely on experience to extract data from a large number of network element devices and parameter information and manually define monitoring thresholds, resulting in weak pertinence of monitoring targets and inaccurate setting of quality indicator rules. Especially in specific business operation and maintenance scenarios and fault location processing, manual intervention is intensive and inefficient, and cannot effectively meet the analysis and judgment under multiple indicator dimensions and time spans. Therefore, a more efficient and intelligent method is needed to solve this problem.

[0003] Currently, faults are generally reported proactively from the user side. After the user describes the phenomenon, a ticket is assigned to the front-line personnel for troubleshooting. After troubleshooting, the problem is discovered and solved. This process has poor user perception and is time-consuming. In addition, the manual troubleshooting and problem-solving process is inefficient. When a group of faults occurs, the same type of faults cannot be converged and classified, and the front-line personnel's troubleshooting is time-consuming and labor-intensive. Summary of the invention

[0004] In view of the above deficiencies in the prior art, an object of the present invention is to provide a fault prediction method and system for an IP network.

[0005] A first aspect of the present invention provides a fault prediction method for an IP network, comprising:

[0006] S1: collect network link data;

[0007] S2: extracting network link features according to the network link data;

[0008] S3: training the GRU model through the network link features to obtain a prediction model;

[0009] S4: Input the real-time network data into the prediction model to obtain prediction results.

[0010] According to a fault prediction method for an IP network provided by the present invention, the network link data in step S1 includes: CRC bit error, optical attenuation, port status, optical power, and network performance indicators.

[0011] According to a fault prediction method for an IP network provided by the present invention, the network link data collection method in step S1 includes: SNMP protocol, CLI interface, telemetry method.

[0012] According to a fault prediction method for an IP network provided by the present invention, step S2 further comprises:

[0013] S21: performing preprocessing including standardization and normalization on the network link data to obtain preprocessed data;

[0014] S22: by sliding the window, given the time series, converting the preprocessed data into feature data of the input sequence and the target sequence;

[0015] S23: Perform feature selection and feature combination on the feature data to obtain network link features.

[0016] According to a fault prediction method for an IP network provided by the present invention, step S3 further comprises:

[0017] S31: Build GRU model;

[0018] S32: Inputting the network link features into the GRU model;

[0019] S33: Select a loss function and an optimizer, update and tune the parameters of the GRU model, and obtain a prediction model.

[0020] According to a fault prediction method for an IP network provided by the present invention, the loss function in step S33 is an MSE loss function, and the optimizer is an Adam optimizer.

[0021] According to a fault prediction method for an IP network provided by the present invention, in step S33, the expression for updating the parameters of the GRU model is:

[0022]

[0023] Among them, θ t is the model parameter updated for the tth time, θ t+1 is the model parameter updated for the t+1th time, α is the learning rate, is the first-order moment estimate of the gradient updated for the tth time after bias correction, is the t-th updated gradient second-order moment estimate after bias correction, and ∈ is an anti-zero constant.

[0024] A second aspect of the present invention further provides a fault prediction system for an IP network, comprising:

[0025] Collection module: used to collect network link data;

[0026] Feature extraction module: used to extract network link features according to the network link data;

[0027] Training module: used to train the GRU model through the network link features to obtain a prediction model;

[0028] Prediction module: used to input real-time network data into the prediction model to obtain prediction results.

[0029] A third aspect of the present invention provides a fault prediction device for an IP network, comprising:

[0030] A memory and at least one processor, wherein instructions are stored in the memory;

[0031] At least one of the processors calls the instructions in the memory to enable the fault prediction device for an IP network to execute the fault prediction method for an IP network as described in any one of the above items.

[0032] A fourth aspect of the present invention provides a computer-readable storage medium having instructions stored thereon, and when the instructions are executed by a processor, the fault prediction method for an IP network as described in any one of the above items is implemented.

[0033] The beneficial effects of the present invention are as follows:

[0034] The present invention provides a fault prediction method, system, device and storage medium for IP network. Through the construction of GRU algorithm model, IP network performance monitoring, fault location and prediction can be realized. The GRU model of the present invention can learn online and predict in real time, is suitable for real-time network monitoring scenarios, can quickly respond to changes in network status, and can quickly locate specific equipment once the real-time network offset is too large, and can analyze the cause of the problem and the solution. In addition, GRU can identify abnormal patterns and issue fault alarms in time. Operation and maintenance personnel can quickly locate the fault point according to these alarms, reducing the time for manual troubleshooting. Through accurate performance monitoring and fault prediction, network interruption and performance degradation can be reduced, and the end-user experience satisfaction can be improved. Secondly, through the study and analysis of historical data, the GRU model of the present invention can predict potential network failures in advance and provide preventive maintenance suggestions. The GRU model can self-adjust as the network environment and data change, maintain the effectiveness and accuracy of the prediction, and adapt to different network conditions and business needs. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] The accompanying drawings are only used to illustrate specific embodiments and are not considered to limit the present invention. In the entire drawings, the same reference symbols represent the same components. Obviously, the drawings described below are only some embodiments recorded in the embodiments of the present invention. For those of ordinary skill in the art, other drawings can also be obtained based on these drawings.

[0036] Figure 1A schematic diagram of a fault prediction method for an IP network provided by an embodiment of the present invention;

[0037] Figure 2 A schematic diagram of the structure of a fault prediction system for an IP network provided by an embodiment of the present invention;

[0038] Figure 3 A schematic diagram of a loss function adjustment process for training a prediction model for fault prediction of an IP network provided by an embodiment of the present invention;

[0039] Figure 4 A schematic diagram for comparing performance fluctuations predicted by the fault prediction method for IP network of the present invention and actual performance fluctuations provided in an embodiment of the present invention.

[0040] Figure numerals: 100, acquisition module; 200, feature extraction module; 300, training module; 400, prediction module. DETAILED DESCRIPTION

[0041] In order to enable those skilled in the art to better understand the technical solutions in the embodiments of the present invention, the technical solutions of the present invention will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all of the embodiments. It should be understood that these descriptions are only exemplary and are not intended to limit the scope of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in the field without making creative work should fall within the scope of protection of the present invention.

[0042] Furthermore, in the following description, descriptions of well-known structures and technologies are omitted to avoid unnecessarily obscuring the concepts disclosed in the present invention.

[0043] In the description of the present invention, it should be noted that, unless otherwise clearly specified and limited, the orientation or position relationship indicated by the terms "center", "upper", "lower", "left", "right", "vertical", "horizontal", "inside", "outside", etc. is based on the orientation or position relationship shown in the drawings, which is only for the convenience of describing the present invention and simplifying the description, and does not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as a limitation of the present invention. In addition, the terms "first", "second", and "third" are only used for descriptive purposes and cannot be understood as indicating or implying relative importance. The terms "installed", "connected", and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be indirectly connected through an intermediate medium, or it can be a connection between the two elements. For those of ordinary skill in the art, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0044] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present invention. Instead, they are merely examples of methods and systems consistent with some aspects of the present invention as detailed in the appended claims.

[0045] In order to better understand the present invention, the terms appearing in the embodiments of the present invention are first explained below.

[0046] Network equipment: It is a dedicated hardware device used to connect various servers, PCs, application terminals and other nodes to form an information communication network. The network equipment includes but is not limited to switches, routers, firewalls, bridges, hubs, gateways, VPN servers, wireless access points (WAP), modems, etc.

[0047] Device performance: device CPU / memory usage, device temperature, route limit, port traffic rate, bandwidth load, port CRC error, and latency, packet loss, jitter indicators of related network paths, etc.

[0048] Recurrent Neural Network (RNN): It is a type of recursive neural network that takes sequence data as input, recurses in the direction of sequence evolution, and all nodes (recurrent units) are connected in a chain. It is one of the deep learning algorithms. Recurrent neural networks have memory, parameter sharing, and Turing completeness, so they have certain advantages in learning the nonlinear features of sequences. Recurrent neural networks are used in natural language processing (NLP), such as speech recognition, language modeling, machine translation, and other fields, and are also used for various time series forecasts.

[0049] Gated recurrent unit (GRU): It is an implementation of recurrent neural network (RNN). Like long short-term memory (LSTM), it is proposed to solve the problem of gradient calculation in recurrent neural network and the problem that continuous matrix multiplication can lead to gradient vanishing or gradient exploding. However, GRU is simpler and can usually provide the same effect as LSTM, and the calculation speed is significantly faster.

[0050] Mean Squared Error (MSE): It is a commonly used indicator to measure the difference between the model prediction value and the actual observation value. It is used to evaluate the degree of fit of the model on the given data. MSE is obtained by calculating the average of the squares of the differences between the prediction value and the actual observation value.

[0051] Mean Absolute Error (MAE): It is a commonly used indicator to measure the difference between the model prediction value and the actual observation value. It is used to evaluate the degree of fit of the model on the given data. MAE is obtained by calculating the average of the absolute values ​​of the difference between the predicted value and the actual observation value.

[0052] Combine the following Figures 1 to 4 Embodiments of the present invention are described.

[0053] like Figure 1 As shown, the present invention provides a fault prediction method for an IP network, comprising:

[0054] S1: Collect network link data.

[0055] The network link data in step S1 includes: CRC bit error, optical attenuation, port status, optical power, and network performance indicators.

[0056] Furthermore, among the above-mentioned performance indicators, CRC is a cyclic redundancy check code. The CRC error correction control method can effectively reduce the bit error rate of the communication line, and the communication data transmission information obtained is more accurate; optical attenuation refers to the degradation of signal quality due to certain reasons during the communication process, which may cause communication abnormalities. The reasons for excessive optical attenuation include but are not limited to long transmission distance, damaged or aged optical cables, poor connector contact, low light source power, and small or long optical fiber radius; port status usually refers to the state of the network port during data transmission. The abnormal port status may be caused by hardware failure, software configuration, network security and other factors. Optical power refers to the power of the optical network unit in the optical fiber transmission network. Too high or too low optical power will affect the performance and stability of the network; network performance refers to the quality and efficiency of the network transmission process, usually including bandwidth, delay, packet loss, jitter and other indicators.

[0057] Among them, the collection method of the network link data in step S1 includes: SNMP protocol, CLI interface, and telemetry method.

[0058] Furthermore, the above-mentioned SNMP method is used to collect data from network devices. Common OIDs (object identifiers) include: CRC error: 1.3.6.1.2.1.2.2.1.14; port status: 1.3.6.1.2.1.2.2.1.7; optical power: OID specific to the device manufacturer.

[0059] The CLI method is to automatically log in to the CLI interface of the device through a script (such as a Python script using the Paramiko library), execute the corresponding command and parse the output, for example: view CRC errors: show interfaces; view optical power: showinterfaces transceiver details; view port status: show interfaces status.

[0060] Network performance indicators can be collected through telemetry. For example, the Cisco device configures telemetry with the following code:

[0061] telemetry ietf subscription 1

[0062] encoding encode-json

[0063] filter xpath / interfaces / interface

[0064] stream yang-push

[0065] update-policy periodic 1000

[0066] receiver ip address 192.168.1.100 57000protocol grpc-tcp.

[0067] S2: Extracting network link features according to the network link data.

[0068] In step S2, the collected data is first denoised, missing values ​​are filled by mean filling or interpolation methods, and data is standardized by Z-score or min-max standardization methods. Then, features are extracted from the preprocessed data, including network links, topology structures, router / switch parameters, network performance thresholds, etc., and sensitive factors are analyzed by GRU algorithm technology to form a digital matrix.

[0069] Wherein, step S2 further comprises:

[0070] S21: performing preprocessing including standardization and normalization on the network link data to obtain preprocessed data.

[0071] Specifically, in step S21, data is first standardized / normalized. Standardization is to convert data into a distribution with a mean of 0 and a standard deviation of 1, while normalization scales the data to a specified range, which in this embodiment is [0, 1].

[0072] S22: Convert the preprocessed data into feature data of an input sequence and a target sequence through a sliding window and a given time series.

[0073] S23: Perform feature selection and feature combination on the feature data to obtain network link features.

[0074] In steps S22 to S23, the time series data is first converted into a supervised learning problem, that is, an input sequence and a target sequence are created through a sliding window. Specifically, for a given time series, an input-output pair is created, and then features that are helpful for prediction are selected to obtain network link features.

[0075] S3: The GRU model is trained using the network link features to obtain a prediction model.

[0076] Wherein, step S3 further comprises:

[0077] S31: Build the GRU model.

[0078] Furthermore, in step S31, a GRU model is first constructed, specifically by using the Sequential API of Keras to construct the model, and then adding a GRU layer and a Dense layer.

[0079] S32: Input the network link features into the GRU model.

[0080] S33: Select a loss function and an optimizer, update and tune the parameters of the GRU model, and obtain a prediction model.

[0081] Among them, the loss function in step S33 is the MSE loss function, and the optimizer is the Adam optimizer.

[0082] In step S33, a suitable loss function and optimizer are selected to compile the model. The loss function is used to measure the difference between the model prediction value and the true value. The optimizer is used to adjust the model parameters to minimize the loss function. The Adam optimizer combines momentum and adaptive learning rate adjustment, has good convergence, and updates the model parameters by calculating the first-order moment estimate (momentum) and second-order moment estimate (variance) of the gradient.

[0083] Wherein, in step S33, the expression for updating the parameters of the GRU model is:

[0084]

[0085] Among them, θ t is the model parameter updated for the tth time, θ t+1 is the model parameter updated for the t+1th time, α is the learning rate, is the first-order moment estimate (momentum) of the gradient after bias correction for the tth update, is the t-th updated gradient second-order moment estimate (variance) after bias correction, ∈ is the anti-zero constant, and ∈ is 10 -8 .

[0086] After selecting a suitable loss function and optimizer, set the training parameters according to the training data input in step S32, perform model training, and then use the validation set to monitor the model performance. Then, use the test set to evaluate the model performance and calculate the relevant evaluation indicators (loss function). According to the evaluation results, adjust the model's hyperparameters (such as the number of GRU layers, the number of units, the learning rate, etc.), or perform feature selection and data enhancement to improve model performance.

[0087] S4: Input the real-time network data into the prediction model to obtain prediction results.

[0088] The present invention mainly monitors network performance and security with the GRU algorithm model, and analyzes the future situation of the network based on this algorithm. For network monitoring and prediction, the accuracy of the model is very important, so after the model is built, it is necessary to continuously tune the model to achieve a prediction result that is infinitely close to the actual situation. The model of the present invention is based on the Bayesian optimization GRU algorithm, which is a neural network model suitable for time series data and other continuous data. Compared with traditional recursive neural networks, GRU can avoid the gradient disappearance problem, and improve the training speed and accuracy, and finally obtain a prediction model.

[0089] In the process of continuously optimizing the GRU model training process, the present invention inputs massive training data, sets training parameters (epochs and batch size), performs model training, and adjusts weights and offsets to minimize the loss function. The loss function (loss) adjustment process is as follows: Figure 3 As shown, this embodiment uses a test set to evaluate model performance, calculates relevant evaluation indicators (such as mean square error, mean absolute error, etc.), and adjusts the model's hyperparameters (such as the number of GRU layers, the number of units, the learning rate, etc.) according to the evaluation results, or performs feature selection and data enhancement to improve model performance.

[0090] Furthermore, the present invention also continuously supplements the characteristic variables of the model in order to improve the accuracy of the model. Specifically, the characteristic variables such as holidays, weather, shopping festivals, equipment cutover, etc. are all factors that affect network fluctuations. When defining characteristic variables, infinite tuning is required. The data format of the supplemented characteristic variables is shown in Table 1.

[0091]

[0092] Table 1 Data format of characteristic variables

[0093] In addition, feature engineering is required for the collected data, that is, converting features such as holidays, weather, shopping festivals, and device cutovers into a format acceptable to the model. One-Hot Encoding can be used to process categorical variables. The specific code is as follows.

[0094] #0ne-Hot Encoding Categorical Variables

[0095] categorical_features=['Holiday',"Weather','Shopping Festival',"Device Maintenance']

[0096] one_hot_encoder=0neHotEncoder()

[0097] encoded_features=one_hot_encoder,fit_transform(datacategorical_features]).toarray()

[0098] #Merge the encoded features and numerical features

[0099] num_features=['Delay',"Jitter','Packet Loss','Throughput']all_features=np.hstack((data[num_features].values,encoded_features)).

[0100] like Figure 2 As shown, the present invention also provides a fault prediction system for an IP network, comprising:

[0101] Collection module 100: used to collect network link data;

[0102] Feature extraction module 200: used to extract network link features according to the network link data;

[0103] Training module 300: used to train the GRU model through the network link features to obtain a prediction model;

[0104] Prediction module 400: used to input real-time network data into the prediction model to obtain prediction results.

[0105] The present invention also provides a fault prediction device for an IP network, comprising:

[0106] A memory and at least one processor, wherein instructions are stored in the memory;

[0107] At least one of the processors calls the instructions in the memory to enable the fault prediction device for an IP network to execute the fault prediction method for an IP network as described in any one of the above items.

[0108] The present invention also provides a computer-readable storage medium, on which instructions are stored, and when the instructions are executed by a processor, the fault prediction method for an IP network as described in any one of the above items is implemented.

[0109] like Figure 4As shown, the performance prediction performed by the fault prediction method for IP network of the present invention is compared with the actual performance fluctuation. The figure uses two curves, namely the actual performance fluctuation curve (blue) and the predicted performance fluctuation curve (orange), to intuitively compare the difference between the actual performance and the predicted performance. The ups and downs on the curve represent the fluctuation of the performance at different time points. This curve represents the prediction of the performance in the same time period. By comparing with the actual performance fluctuation curve, it can be seen that the predicted performance is highly consistent with the actual performance, and the predicted performance curve is very close to the actual performance curve, indicating that the prediction accuracy of the present invention is high.

[0110] The present invention provides a fault prediction method, system, device and storage medium for IP networks, aiming to solve the problem that it is inefficient and low-precision to select monitoring objects and indicators and set parameters such as monitoring frequency and comparison rules based on the personal experience of operation and maintenance personnel. The present invention analyzes and predicts historical data of the actual operation of the network, and can recommend a more scientific and reliable network performance monitoring configuration scheme. Secondly, the present invention innovatively uses a machine learning algorithm to extract the operation characteristics of the IP network and select the most suitable monitoring rule algorithm, replacing the original manual analysis and selection of rule-making methods based on discrete original monitoring data, thereby greatly improving the efficiency of operation and maintenance work. In addition, the present invention also realizes automatic monitoring configuration, reduces the time for manual intervention and parameter trial and error, and can not only recommend monitoring parameters, thresholds and rules that best meet the actual situation by regularly collecting real network performance, link reliability and fault alarm data, but also provide customized configuration strategies for operation and maintenance personnel, such as delay sensitivity, packet loss sensitivity, bandwidth load sensitivity, etc.

[0111] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the embodiments of the present invention, rather than to limit them. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that they can still modify the technical solutions recorded in the above embodiments, or replace some of the technical features therein by equivalents; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present invention. Any changes or replacements that can be easily thought of by those skilled in the art within the technical scope disclosed in the present invention should be covered within the protection scope of the present invention.

Claims

1. A fault prediction method for an IP network, characterized in that: include: S1: collect network link data; S2: extracting network link features according to the network link data; S3: training the GRU model through the network link features to obtain a prediction model; S4: Input the real-time network data into the prediction model to obtain prediction results.

2. A fault prediction method for an IP network according to claim 1, characterized in that: The network link data in step S1 includes: CRC bit error, optical attenuation, port status, optical power, and network performance indicators.

3. A fault prediction method for an IP network according to claim 1, characterized in that: The network link data collection methods in step S1 include: SNMP protocol, CLI interface, and telemetry method.

4. A fault prediction method for an IP network according to claim 1, characterized in that: Step S2 further comprises: S21: performing preprocessing including standardization and normalization on the network link data to obtain preprocessed data; S22: by sliding the window, given the time series, converting the preprocessed data into feature data of the input sequence and the target sequence; S23: Perform feature selection and feature combination on the feature data to obtain network link features.

5. A fault prediction method for IP network according to claim 1, characterized in that: Step S3 further comprises: S31: Build GRU model; S32: Inputting the network link features into the GRU model; S33: Select a loss function and an optimizer, update and tune the parameters of the GRU model, and obtain a prediction model.

6. A fault prediction method for IP network according to claim 5, characterized in that: The loss function in step S33 is the MSE loss function, and the optimizer is the Adam optimizer.

7. A fault prediction method for an IP network according to claim 5, characterized in that: In step S33, the expression for updating the parameters of the GRU model is: Among them, θ t is the model parameter updated for the tth time, θ t+1 is the model parameter updated for the t+1th time, α is the learning rate, is the first-order moment estimate of the gradient updated for the tth time after bias correction, is the t-th updated gradient second-order moment estimate after bias correction, and ∈ is an anti-zero constant.

8. A fault prediction system for an IP network, characterized in that: include: Collection module: used to collect network link data; Feature extraction module: used to extract network link features according to the network link data; Training module: used to train the GRU model through the network link features to obtain a prediction model; Prediction module: used to input real-time network data into the prediction model to obtain prediction results.

9. A fault prediction device for an IP network, characterized in that: include: A memory and at least one processor, wherein instructions are stored in the memory; At least one of the processors calls the instructions in the memory to enable the fault prediction device for an IP network to execute the fault prediction method for an IP network according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores instructions, and when the instructions are executed by the processor, the fault prediction method for an IP network according to any one of claims 1 to 7 is implemented.

Images