Network detection method and device, computer equipment, readable storage medium and program product

Abstract

The invention relates to a network detection method and device, computer equipment, a computer readable storage medium and a computer program product. The method comprises the following steps: acquiring preset topology resource association information, flow information and first alarm information of a plurality of alarm types of a target network; calculating a target anomaly score corresponding to each piece of first alarm information, and performing preliminary screening on the first alarm information based on the target anomaly score to obtain second alarm information; performing root cause alarm identification on the second alarm information based on the preset topological resource association information and the target abnormal score corresponding to the second alarm information, and extracting to obtain the target alarm information and a dependency relationship corresponding to the target alarm information; and performing root cause alarm analysis processing on the traffic information, the target alarm information and the dependency relationship according to a preset large language model to obtain a network detection result. By adopting the method, the accuracy of a network detection result can be improved.

Description

Technical Field

[0001] The present application relates to the field of artificial intelligence technology, and in particular to a network detection method, apparatus, computer equipment, computer-readable storage medium, and computer program product. Background Art

[0002] With the development of technologies such as cloud computing, the Internet of Things, and big data, network operation and maintenance are also facing new challenges. It is necessary to further strengthen network security operation and maintenance management in terms of cloud resource management, data security protection, and optimization of large-scale network architecture.

[0003] In traditional methods, when operation and maintenance personnel analyze multi-source heterogeneous data based on manual experience, they first integrate diverse data from different systems, devices, and platforms, including logs, monitoring indicators, and alarm information. By comparing historical data and current status, combined with business background and manual experience, abnormal indicators or alarms are identified, and the abnormal data is deeply analyzed to locate the link where the problem may occur, such as the server, network, database, or application. Based on the understanding of the system architecture and operating mechanism, the operation and maintenance personnel comprehensively judge the root cause of the abnormality, analyze the root cause, and determine the hidden danger troubleshooting plan.

[0004] However, in the current traditional methods, as the amount of data on platforms such as cloud computing, the Internet of Things, and big data increases, the amount of alarm information increases accordingly. A large number of minor or invalid alarms interfere with core alarms, covering up the real causes of the alarms. In addition, the subjectivity of operation and maintenance personnel's analysis based on manual experience leads to poor accuracy in detecting the root causes of network alarms and troubleshooting solutions. Summary of the invention

[0005] Based on this, it is necessary to provide a network detection method, apparatus, computer equipment, computer-readable storage medium and computer program product to address the above technical issues.

[0006] In a first aspect, the present application provides a network detection method, comprising:

[0007] Obtaining preset topology resource association information, traffic information, and first alarm information of multiple alarm types of the target network;

[0008] Calculating target anomaly scores corresponding to each of the first alarm information, and preliminarily screening the first alarm information based on the target anomaly scores to obtain second alarm information;

[0009] Performing root cause alarm identification on the second alarm information based on the preset topology resource association information and the target anomaly score corresponding to the second alarm information, and extracting the target alarm information and the dependency relationship corresponding to the target alarm information;

[0010] The flow information, the target alarm information and the dependency relationship are subjected to root cause alarm analysis and processing according to a preset large language model to obtain a network detection result.

[0011] In one embodiment, calculating the target anomaly score corresponding to each of the first alarm information includes:

[0012] Determining, according to the second association relationship between the alarm sample data in the preset transaction library, a first association relationship between the alarm types corresponding to each of the first alarm information;

[0013] Dividing the first alarm information into a plurality of alarm groups according to the first association relationship;

[0014] A target anomaly score corresponding to each of the first alarm information is calculated based on the anomaly detection hybrid model and the first association relationship corresponding to the alarm group.

[0015] In one embodiment, before determining the first association relationship between the alarm types corresponding to the first alarm information according to the first association relationship between the alarm sample data in the preset transaction library, the method further includes:

[0016] Acquire a sample data set, and divide the sample data set into a plurality of sample data subsets; the sample data set includes a plurality of preset types of alarm sample data;

[0017] Determine the time window and sliding step of the correlation analysis model according to the alarm frequency and alarm flow of the alarm sample data, and determine the first weight corresponding to each of the alarm sample data and the second weight of the transaction corresponding to each of the time windows;

[0018] Based on the time window, the sliding step, the first weight, the second weight and the association analysis model, parallel association analysis is performed on the alarm sample data in each of the sample data subsets to obtain a second association relationship of a preset type;

[0019] A preset transaction library is constructed based on the second association relationship.

[0020] In one of the embodiments, the anomaly detection hybrid model includes an independent forest sub-model and a density clustering sub-model;

[0021] The calculating the target anomaly score corresponding to each of the first alarm information based on the anomaly detection hybrid model and the first association relationship corresponding to the alarm group includes:

[0022] Extracting features from the first alarm information to obtain a first feature matrix formed by the first alarm information, and re-dividing feature vectors in the first feature matrix according to the alarm groups to obtain second feature matrices corresponding to the alarm groups;

[0023] For the second feature matrix corresponding to each of the alarm groups, according to the first association relationship in the second feature matrix and the independent forest sub-model, anomaly scores are calculated for the feature vectors in the second feature matrix to obtain first anomaly scores corresponding to each of the first alarm information;

[0024] Calculating anomaly scores of the feature vectors in the first feature matrix based on the density clustering sub-model to obtain second anomaly scores corresponding to each piece of the warning information;

[0025] A target anomaly score is determined according to the first anomaly score and the second anomaly score.

[0026] In one embodiment, before determining a target anomaly score according to the first anomaly score and the second anomaly score, the method further includes:

[0027] Acquire a preset transaction library; the preset transaction library includes alarm sample data and a sample alarm group formed by a second association relationship between the alarm sample data;

[0028] Extracting features from the alarm sample data to obtain a first sample feature matrix composed of the alarm sample data, and re-dividing the sample feature vectors in the first sample feature matrix according to the sample alarm groups to obtain a second sample feature matrix corresponding to each of the sample alarm groups;

[0029] Determine respectively a first weight corresponding to the independent forest sub-model and a second weight corresponding to the density clustering sub-model according to a first chi-square value calculated by the independent forest sub-model for the sample feature vectors in the second sample feature matrix and the second association relationship and a second chi-square value calculated by the density clustering sub-model for each of the sample feature vectors in the first sample feature matrix;

[0030] The determining a target anomaly score according to the first anomaly score and the second anomaly score includes:

[0031] The first anomaly score and the second anomaly score are weightedly summed according to the first weight and the second weight to obtain a target anomaly score.

[0032] In one of the embodiments, the root cause alarm identification of the second alarm information based on the preset topology resource association information and the target abnormality score corresponding to the second alarm information, and the extraction of the target alarm information and the dependency relationship corresponding to the target alarm information include:

[0033] Constructing an alarm graph according to the preset topology resource association information, the target anomaly score corresponding to the second alarm information, and the feature matrix corresponding to the second alarm information;

[0034] Analyzing and processing the warning graph according to the probability graph model to obtain target probability values ​​corresponding to each second warning information, and determining target warning information based on the target probability values ​​and a preset probability threshold;

[0035] Determine the dependency relationship corresponding to the target warning information based on the target warning information and the warning map.

[0036] In a second aspect, the present application also provides a network detection device, including:

[0037] A first acquisition module, used to acquire preset topology resource association information, traffic information and first alarm information of multiple alarm types of the target network;

[0038] a calculation module, configured to calculate a target anomaly score corresponding to each of the first alarm information, and preliminarily screen the first alarm information based on the target anomaly score to obtain second alarm information;

[0039] An identification module, configured to identify the root cause alarm of the second alarm information based on the preset topology resource association information and the target abnormality score corresponding to the second alarm information, and extract the target alarm information and the dependency relationship corresponding to the target alarm information;

[0040] The analysis module is used to perform root cause alarm analysis on the traffic information, the target alarm information and the dependency relationship according to a preset large language model to obtain a network detection result.

[0041] In one of the embodiments, the calculation module is specifically used to determine the first association relationship between the alarm types corresponding to each of the first alarm information according to the second association relationship between the alarm sample data in the preset transaction library;

[0042] Dividing the first alarm information into a plurality of alarm groups according to the first association relationship;

[0043] A target anomaly score corresponding to each of the first alarm information is calculated based on the anomaly detection hybrid model and the first association relationship corresponding to the alarm group.

[0044] In one embodiment, the device further comprises:

[0045] A second acquisition module is used to acquire a sample data set and divide the sample data set into a plurality of sample data subsets; the sample data set includes alarm sample data of a plurality of preset types;

[0046] A first determination module is used to determine the time window and sliding step of the correlation analysis model according to the alarm frequency and alarm flow of the alarm sample data, and determine the first weight corresponding to each of the alarm sample data and the second weight of the transaction corresponding to each of the time windows;

[0047] A correlation analysis module, configured to perform parallel correlation analysis on the alarm sample data in each of the sample data subsets based on the time window, the sliding step, the first weight, the second weight and the correlation analysis model to obtain a second correlation relationship of a preset type;

[0048] A construction module is used to construct a preset transaction library based on the second association relationship.

[0049] In one of the embodiments, the anomaly detection hybrid model includes an independent forest sub-model and a density clustering sub-model;

[0050] The calculation module is specifically used to extract features from the first alarm information to obtain a first feature matrix formed by the first alarm information, and to re-divide the feature vectors in the first feature matrix according to the alarm groups to obtain a second feature matrix corresponding to each of the alarm groups;

[0051] For the second feature matrix corresponding to each of the alarm groups, according to the first association relationship in the second feature matrix and the independent forest sub-model, anomaly scores are calculated for the feature vectors in the second feature matrix to obtain first anomaly scores corresponding to each of the first alarm information;

[0052] Calculating anomaly scores of the feature vectors in the first feature matrix based on the density clustering sub-model to obtain second anomaly scores corresponding to each piece of the warning information;

[0053] A target anomaly score is determined according to the first anomaly score and the second anomaly score.

[0054] In one embodiment, the device further comprises:

[0055] A third acquisition module is used to acquire a preset transaction library; the preset transaction library includes alarm sample data and a sample alarm group formed by a second association relationship between the alarm sample data;

[0056] A feature extraction module, used to extract features from the alarm sample data to obtain a first sample feature matrix composed of the alarm sample data, and to re-divide the sample feature vectors in the first sample feature matrix according to the sample alarm groups to obtain a second sample feature matrix corresponding to each of the sample alarm groups;

[0057] A second determination module is used to determine the first weight corresponding to the independent forest sub-model and the second weight corresponding to the density clustering sub-model respectively according to the first chi-square value calculated by the independent forest sub-model for the sample feature vectors in the second sample feature matrix and the second association relationship and the second chi-square value calculated by the density clustering sub-model for each of the sample feature vectors in the first sample feature matrix;

[0058] The calculation module is specifically configured to perform a weighted sum of the first anomaly score and the second anomaly score according to the first weight and the second weight to obtain a target anomaly score.

[0059] In one of the embodiments, the identification module is specifically used to construct an alarm map according to the preset topology resource association information, the target anomaly score corresponding to the second alarm information, and the feature matrix corresponding to the second alarm information;

[0060] Analyzing and processing the warning graph according to the probability graph model to obtain target probability values ​​corresponding to each second warning information, and determining target warning information based on the target probability values ​​and a preset probability threshold;

[0061] Determine the dependency relationship corresponding to the target warning information based on the target warning information and the warning map.

[0062] In a third aspect, the present application further provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0063] Obtaining preset topology resource association information, traffic information, and first alarm information of multiple alarm types of the target network;

[0064] Calculating target anomaly scores corresponding to each of the first alarm information, and preliminarily screening the first alarm information based on the target anomaly scores to obtain second alarm information;

[0065] Performing root cause alarm identification on the second alarm information based on the preset topology resource association information and the target anomaly score corresponding to the second alarm information, and extracting the target alarm information and the dependency relationship corresponding to the target alarm information;

[0066] The flow information, the target alarm information and the dependency relationship are subjected to root cause alarm analysis and processing according to a preset large language model to obtain a network detection result.

[0067] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the following steps are implemented:

[0068] Obtaining preset topology resource association information, traffic information, and first alarm information of multiple alarm types of the target network;

[0069] Calculating target anomaly scores corresponding to each of the first alarm information, and preliminarily screening the first alarm information based on the target anomaly scores to obtain second alarm information;

[0070] Performing root cause alarm identification on the second alarm information based on the preset topology resource association information and the target anomaly score corresponding to the second alarm information, and extracting the target alarm information and the dependency relationship corresponding to the target alarm information;

[0071] The flow information, the target alarm information and the dependency relationship are subjected to root cause alarm analysis and processing according to a preset large language model to obtain a network detection result.

[0072] In a fifth aspect, the present application further provides a computer program product, including a computer program, which implements the following steps when executed by a processor:

[0073] Obtaining preset topology resource association information, traffic information, and first alarm information of multiple alarm types of the target network;

[0074] Calculating target anomaly scores corresponding to each of the first alarm information, and preliminarily screening the first alarm information based on the target anomaly scores to obtain second alarm information;

[0075] Performing root cause alarm identification on the second alarm information based on the preset topology resource association information and the target anomaly score corresponding to the second alarm information, and extracting the target alarm information and the dependency relationship corresponding to the target alarm information;

[0076] The flow information, the target alarm information and the dependency relationship are subjected to root cause alarm analysis and processing according to a preset large language model to obtain a network detection result.

[0077] The above-mentioned network detection method, device, computer equipment, computer-readable storage medium and computer program product obtain preset topology resource association information, first alarm information according to preset periodic traffic information and multiple alarm types; calculate the target anomaly score corresponding to each first alarm information based on the anomaly detection hybrid model, and preliminarily screen the first alarm information based on the target anomaly score to obtain the second alarm information and the target anomaly score corresponding to the second alarm information; determine the target alarm information and the dependency relationship corresponding to the target alarm information in the second alarm information based on the preset topology resource association information, the target anomaly score corresponding to the second alarm information, the feature matrix corresponding to the second alarm information and the probability graph model; analyze and process the traffic information, target alarm information and the dependency relationship according to the preset large language model to obtain the object detection result. This method is adopted to obtain the preset topology resource association information, periodic traffic information and the first alarm information of multiple alarm types, use the anomaly detection hybrid model to calculate the target anomaly score and perform preliminary screening, and combine the probability graph model analysis to obtain the target alarm information and alarm dependency relationship, and then use the large language model for comprehensive analysis and processing to achieve accurate identification, efficient screening and intelligent analysis of network alarms, avoid human intervention, effectively reduce false alarms and missed alarms, and significantly improve the accuracy of identifying the target alarm information as the root cause of the alarm in network security management, as well as improve the accuracy of network detection results. BRIEF DESCRIPTION OF THE DRAWINGS

[0078] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0079] Figure 1 A schematic diagram of a flow chart of a network detection method in an embodiment;

[0080] Figure 2 is a schematic diagram of a network detection architecture in one embodiment;

[0081] Figure 3 A schematic diagram of a process for calculating a target anomaly score in one embodiment;

[0082] Figure 4 A schematic diagram of a process for building a preset transaction library in one embodiment;

[0083] Figure 5 A schematic diagram of a process for obtaining a target anomaly score according to an independent forest sub-model and a density clustering sub-model in one embodiment;

[0084] Figure 6A schematic diagram of a process of determining a first weight and a second weight in one embodiment;

[0085] Figure 7 A schematic diagram of a process of constructing an alarm map and identifying target alarm information according to the alarm map in an embodiment;

[0086] Figure 8 is a structural block diagram of a network detection device in an embodiment;

[0087] Fig. 9 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0088] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0089] In one embodiment, Figure 1 As shown, a network detection method is provided. This embodiment takes the method applied to a terminal as an example. It can be understood that the method can also be applied to a server, and can also be applied to a system including a terminal and a server, and is implemented through the interaction between the terminal and the server. In this embodiment, the method includes the following steps:

[0090] Step 102: Obtain preset topology resource association information, traffic information, and first alarm information of multiple alarm types of the target network.

[0091] In the embodiment of the present application, for large-scale enterprise networks, data centers or cloud platforms, the terminal can collect traffic data, Syslog (system log) logs and preset topology resource association information according to a preset period or in real time, where the Syslog log of the network device contains alarm information, device status, etc., the traffic data of the network device includes traffic rate, traffic mode, etc., and the preset topology resource association information can be the connection relationship between the devices and resources in the network, including the connection status of routers, switches, servers and other devices, as well as the configuration of each subnet and VLAN. Then, as Figure 2As shown, after the terminal completes data collection, it pre-processes the traffic data and Syslog logs, that is, the terminal extracts key information from the collected data to obtain traffic information with high value for network root cause detection and first alarm information of multiple alarm types, such as traffic rate, alarm type, alarm time, IP (Internet Protocol) address, etc. Among them, the first alarm information is the alarm information of the full amount of Syslog logs, and the first alarm information contains the corresponding log information. For example, log 1 includes device: router A (IP: 192.168.xx); time: 2024-12-25 08:00:00; alarm type: interface traffic abnormality; alarm description: the traffic rate of interface GigabitEthernet0 / 1 exceeds the threshold (100 Mbps).

[0092] Step 104 , calculate the target anomaly score corresponding to each first alarm information, and preliminarily screen the first alarm information based on the target anomaly score to obtain second alarm information.

[0093] In an embodiment of the present application, the terminal evaluates the degree of abnormality of the collected first alarm information, and calculates the target abnormality score of each alarm information to quantify the degree of abnormality of each first alarm information. Specifically, the terminal can calculate the target abnormality scores corresponding to each first alarm information according to a preset strategy, for example, weighted calculation is performed according to the preset weights corresponding to the alarm type and alarm time of the first alarm information, for example, different alarm types correspond to different preset scores, different alarm time periods have interval scores, and the alarm type and alarm time have preset weights, and then according to the scores corresponding to the alarm type and alarm time, and combined with the preset weights, the target abnormality score corresponding to each first alarm information is calculated. Alternatively, the terminal can also input the first alarm information into a neural network model, analyze and map each first alarm information through the neural network model, and output the target abnormality score of each first alarm information through the neural network model.

[0094] The terminal performs preliminary screening of the first alarm information based on the calculated target anomaly score. The terminal may include a pre-set threshold, and only the first alarm information whose target anomaly score exceeds the threshold will be retained as the second alarm information, so as to reduce the number of alarms to be processed later, so that when the terminal performs root cause alarm analysis later, it can focus on the alarm that is most likely to represent the real problem.

[0095] Step 106: perform root cause alarm identification on the second alarm information based on the preset topology resource association information and the target abnormality score corresponding to the second alarm information, and extract the target alarm information and the dependency relationship corresponding to the target alarm information.

[0096] In an embodiment of the present application, the terminal combines the preset topology resource association information with the target anomaly score of the second alarm information, identifies the root cause alarm in the second alarm information as the target alarm information, that is, the target alarm information is the root cause of other alarms. The terminal analyzes the connection relationship between network devices and the target anomaly score of the second alarm information through the preset topology resource association information, and further infers which second alarm information is the source of other alarms, thereby extracting the target alarm information and its dependencies. Specifically, the terminal can construct a graph structure based on the preset topology resource association information, the second alarm information and its corresponding target anomaly score, and analyze the graph structure based on the graph neural network model to identify the target alarm information and the dependency relationship between the target alarm information.

[0097] Step 108, performing root cause alarm analysis and processing on the traffic information, target alarm information and dependency relationship according to the preset large language model to obtain a network detection result.

[0098] In the present application embodiment, Figure 2 As shown, the preset large language model can be a fine-tuned large model. The terminal integrates the traffic information, target alarm information, and the dependency relationship of the target alarm information, and obtains the network detection result through comprehensive analysis of the preset large language model. The network detection result is a specific hidden danger investigation plan. Utilizing the language understanding and generation capabilities of the large model, combined with the analysis results of each module, the system can automatically generate specific hidden danger investigation plans and optimization suggestions, and provide intelligent decision-making support to assist operation and maintenance personnel to quickly develop effective solutions and improve the accuracy and efficiency of problem solving. Among them, the analysis and calculation of the preset large language model obtains the hidden danger investigation plan , as shown in the following formula:

[0099]

[0100] Among them, F represents the characteristics of network traffic, logs and preset topology resource association information, and R represents the target alarm information (root alarm) and its dependencies.

[0101] In the above network detection method, by obtaining preset topology resource association information, periodic traffic information and the first alarm information of multiple alarm types, the target anomaly detection hybrid model is used to calculate the target anomaly score and perform preliminary screening, and the target alarm information and alarm dependency are obtained by combining the probability graph model analysis, and then through comprehensive analysis and processing with a large language model, accurate identification, efficient screening and intelligent analysis of network alarms are achieved, avoiding human intervention, effectively reducing false alarms and missed alarms, and significantly improving the accuracy of identifying the target alarm information as the root cause of the alarm in network security management, as well as improving the accuracy of network detection results.

[0102] In an exemplary embodiment, Figure 3As shown, step 104 includes steps 302 to 306. Among them:

[0103] Step 302: Determine a first association relationship between alarm types corresponding to each first alarm information according to a second association relationship between alarm sample data in a preset transaction library.

[0104] In an embodiment of the present application, the preset transaction library is a pre-built database, which serves as a knowledge graph in network detection and includes association relationships (second association relationships) between various alarm sample data. The transaction library containing the second association relationships between various alarm types is pre-built based on the alarm sample data and aims to capture common combinations and dependencies between different alarm types. The specific construction process of the preset transaction library is described in detail in the following embodiments.

[0105] The terminal matches the alarm type of each first alarm information in the preset transaction library, and obtains the first association relationship between the first alarm information. For example, if the second association relationship between the alarm sample data in the preset transaction library is {A, B, C, D} and {C, E, F}, and the alarm type of the first alarm information includes B, C, F, then according to the alarm type and the second association relationship, the first association relationship obtained is {B, C} and {C, F}.

[0106] Step 304: divide the first alarm information into multiple alarm groups according to the first association relationship.

[0107] In an embodiment of the present application, the terminal groups alarm information with correlation to facilitate more effective anomaly detection and analysis. By classifying related first alarm information together, their overall impact and potential root causes can be more accurately evaluated. Specifically, based on the first association relationship of the first alarm information, the terminal divides the first alarm information into different alarm groups, and each alarm group contains alarm information with correlation. For example, the first association relationship of the first alarm information is {B, C} and {C, F}, the first alarm information of type B includes alarm 1 and alarm 2, the first alarm information of type C includes alarm 3, and the first alarm information of type F includes alarm 4 and alarm 5. The divided alarm groups are alarm group 1 and alarm group 2, alarm group 1 includes alarm 1, alarm 2, and alarm 3, and alarm group 2 includes alarm 3, alarm 4, and alarm 5.

[0108] Step 306: Calculate a target anomaly score corresponding to each first alarm information based on the anomaly detection hybrid model and the first association relationship corresponding to the alarm group.

[0109] In an embodiment of the present application, the anomaly detection hybrid model is a comprehensive model that can combine multiple anomaly detection algorithms to perform a first correlation calculation on the alarm group, analyze the correlation between the alarm types within each alarm group, and then for each first alarm information, the terminal calculates a target anomaly score through the anomaly detection hybrid model based on the alarm group to which it belongs and the correlation between the alarm types within the group.

[0110] In this embodiment, the first association relationship between the first alarm information is determined by presetting the second association relationship between the alarm sample data in the transaction library, and the relevant alarm information is divided into multiple alarm groups. The target anomaly score is calculated in combination with the anomaly detection hybrid model, thereby achieving accurate grouping and anomaly detection of alarm information, which can effectively capture common combinations and dependencies between alarm types, improve the accuracy and efficiency of alarm analysis, and at the same time, through the division of alarm groups and the calculation of anomaly scores, it can assist in the identification and positioning of potential root causes (target alarm information), and improve the accuracy of target alarm information identification, thereby improving the accuracy of network detection results.

[0111] In an exemplary embodiment, Figure 4 As shown, before step 302, the method further includes steps 402 to 408. Among them:

[0112] Step 402: Obtain a sample data set, and divide the sample data set into multiple sample data subsets.

[0113] The sample data set includes alarm sample data of multiple preset types.

[0114] In the embodiment of the present application, the terminal can collect a sample data set from the historical alarm records, and the sample data set covers various types of alarm information, such as equipment failure, network congestion, and security threats. Then, the terminal divides the sample data set into multiple data subsets to achieve parallel processing for multiple sample data subsets.

[0115] Step 404, determine the time window and sliding step of the correlation analysis model according to the alarm frequency and alarm flow of the alarm sample data, and determine the first weight corresponding to each alarm sample data and the second weight of the transaction corresponding to each time window.

[0116] In the embodiment of the present application, by dynamically adjusting the time window size and adaptive sliding step size The terminal optimizes the construction of the transaction library according to the real-time network traffic and alarm frequency to ensure the timeliness and flexibility of the alarm correlation analysis. Among them, the time window refers to the time range for analyzing the alarm data. For example, the terminal can determine the trial window as 10 minutes, 30 minutes or 1 hour; the adaptive sliding step refers to the step size of moving between time windows. For example, if the time window is 30 minutes, the sliding step can be 5 minutes, which can ensure the overlap between each time window and improve the accuracy of the analysis. Time window size and adaptive sliding step size The calculation formula is as follows:

[0117]

[0118]

[0119] The size of the time window determines the granularity of the analysis. A larger time window can capture patterns over a longer time range, but may result in loss of details; a smaller time window is more suitable for capturing short-term local anomalies. The adaptive sliding step size can be dynamically adjusted according to the characteristics of the alarm data. For example, if there are fewer alarm events in the current time window (for example, during low traffic or low activity), the adaptive sliding step size can be appropriately reduced to capture more details; if there are more alarm events, the adaptive sliding step size can be appropriately increased to improve analysis efficiency.

[0120] Step 406 , based on the time window, the sliding step, the first weight, the second weight and the association analysis model, parallel association analysis is performed on the alarm sample data in each sample data subset to obtain a second association relationship of a preset type.

[0121] In the embodiment of the present application, the association analysis model can be a model that analyzes the alarm sample data in the sample data subset based on the Apriori algorithm, and the first weight is the weight corresponding to the alarm type to which the alarm sample data belongs. The second weight is the weight of each alarm sample data constituted in the time window Among them, the time window, the sliding step, the first weight and the second weight can be set by the operation and maintenance personnel based on prior experience, or obtained based on the neural network model used for weight mapping.

[0122] The terminal uses the association analysis model to perform association analysis on the sample data subsets in parallel according to the preset time window, sliding step, first weight and second weight. Specifically, the terminal calls the GPU (Graphics Processing Unit) to perform association analysis on each sample data subset at the same time, introduces weighted support calculation and multi-level association rule mining, and assigns weights to different types of alarm sample data. , the importance of the alarm sample data is considered in the support calculation, and it is extended to multi-level association rules to ensure that high-weight alarms have a greater influence in the association rule mining, and then the alarm sample data with strong correlation is obtained as the second association relationship between the alarm sample data. and confidence The calculation formula is as follows:

[0123]

[0124] In an exemplary embodiment, the terminal uses parallel computing and incremental Apriori methods to improve the computational efficiency of frequent item set mining. The sample data set consisting of alarm sample data is divided into multiple subsets for parallel processing during the construction process of the transaction library. When the network architecture changes, the preset transaction library is dynamically updated. During the update process, only the frequent item sets of newly added transactions are updated to reduce the computational complexity and time overhead. The formulas for correlation analysis of the original sample data set and the correlation analysis of the newly added transactions are as follows:

[0125]

[0126] in, Represents the kth subset in the preset transaction library, where K is the number of subsets. Represents newly added transactions. In incremental transaction processing, New Frequent Itemsets is applied to new transactions through the Apriori algorithm. Specifically, for incremental transactions , the terminal uses the Apriori algorithm to discover the frequent itemsets, recorded as New Frequent Itemsets.

[0127] At the same time, the frequent itemsets of existing transactions are obtained by The frequent item sets of are merged, that is .

[0128] When processing incremental transactions, New Frequent Itemsets are added to the frequent itemsets of the stock transactions, thereby updating the overall frequent itemsets. The specific update method may include simple merging, or using some strategies to handle item set changes and delete obsolete item sets.

[0129] Step 408: construct a preset transaction library based on the second association relationship.

[0130] In the embodiment of the present application, the terminal stores the second association relationship corresponding to the alarm type to which the alarm sample data belongs in the database, and obtains the preset transaction library. ,in, The size of the time window Transactions of internal alarm sample data, and is the adaptive sliding step size And as the knowledge graph of the anomaly detection hybrid model and the preset large language model in network detection.

[0131] In this embodiment, firstly, by integrating the preset large language model, knowledge graph and traditional artificial intelligence model, the system construction method can fully integrate the advantages of various models, realize the efficient fusion and collaborative analysis of multi-source data, and improve the overall performance and intelligence level of the system.

[0132] Secondly, by obtaining historical alarm records and dividing them into multiple data subsets, dynamically adjusting the time window and sliding step size, combining weight allocation and weighted support calculation, and using parallel computing and incremental Apriori algorithm to perform efficient correlation analysis on alarm sample data, we finally built a preset transaction library. This method improves the timeliness, flexibility, and accuracy of alarm correlation analysis, while reducing computational complexity and time overhead through dynamic updates and incremental processing, ultimately providing strong knowledge support for anomaly detection in network detection, and improving the efficiency and accuracy of network alarm root cause identification and anomaly detection.

[0133] In an exemplary embodiment, the anomaly detection hybrid model includes an independent forest sub-model and a density clustering sub-model; Figure 5 As shown, step 306 includes steps 502 to 508. Among them:

[0134] Step 502: extract features from the first alarm information to obtain a first feature matrix formed by the first alarm information, and re-divide the feature vectors in the first feature matrix according to the alarm groups to obtain a second feature matrix corresponding to each alarm group.

[0135] In the embodiment of the present application, the terminal can extract features from the first alarm information through a word embedding model, convert the first alarm information into a numerical feature vector, and combine the feature vectors corresponding to the full amount of the first alarm information into a large feature matrix as the first feature matrix. At the same time, the terminal re-divides the feature vectors in the first feature matrix according to the alarm groups divided in the preset transaction library, so that each alarm group corresponds to a second feature vector, and then the terminal can perform independent anomaly detection analysis for each alarm group.

[0136] Step 504 , for the second feature matrix corresponding to each alarm group, calculate the abnormality score of the feature vector in the second feature matrix according to the first association relationship in the second feature matrix and the independent forest sub-model, and obtain the first abnormality score corresponding to each first alarm information.

[0137] In the embodiment of the present application, the terminal processes the second feature matrix corresponding to each alarm group separately, and inputs the first alarm information in the alarm group and the second association relationship of each alarm information in the alarm group into the independent forest sub-model (a sub-model based on the Isolation Forest algorithm). The independent forest sub-model uses the feature vector corresponding to the first alarm information as the node (data point) of the independent forest, and determines the independent forest structure of each node in the alarm group according to the second association relationship, and then calculates the first abnormal score of each feature vector in the second feature matrix. , the first anomaly score The calculation formula is as follows:

[0138]

[0139] in, For data points The average path length, For the sample size The associated expected path length, is the adaptive tree depth.

[0140] Step 506: calculate anomaly scores of the eigenvectors in the first feature matrix based on the density clustering sub-model to obtain second anomaly scores corresponding to each warning information.

[0141] In the embodiment of the present application, the density clustering sub-model can be a clustering model based on the DBSCAN algorithm. The terminal calculates the abnormality score for each eigenvector in the first feature matrix according to the DBSCAN algorithm. Specifically, the terminal uses each first alarm information as a cluster center, and analyzes the correlation between the first alarm information as the cluster center and other alarm information, and then uses the area with higher density as a normal cluster, and the node with low density as an abnormal node, and calculates the second abnormality score of the eigenvector corresponding to each alarm information. Among them, the clustering algorithm of the core point is as follows:

[0142]

[0143] Among them, ϵ is the density condition, and MinPts is the minimum number of points. That is, the second anomaly score of the core point can be the minimum value in the basic score, and the anomaly score of the boundary point in the clustering result can be calculated according to the proximity between the number of its neighbors and the minimum number of points MinPts, and the second anomaly score of the noise point is set to the maximum value in the basic score, indicating that the point is a significant anomaly point. Optionally, the terminal can also adjust the second anomaly score in combination with the first association relationship. For example, if a first alarm information is strongly correlated with other alarm information (that is, they often appear at the same time), its anomaly score can be reduced. If a first alarm information is weakly correlated with other alarm information, its anomaly score can be increased, because it means that it is more likely to be an independent anomaly point, that is, the second anomaly score = basic anomaly score × (1 + correlation adjustment factor).

[0144] Step 508: Determine a target anomaly score according to the first anomaly score and the second anomaly score.

[0145] In the embodiment of the present application, ultimately, the terminal may take the sum of the first anomaly score and the second anomaly score as the target anomaly score, or the terminal may also perform weighted summation of the first score and the second anomaly score to obtain the target anomaly score.

[0146] In this embodiment, by combining the target anomaly score calculation method of the independent forest sub-model and the density clustering sub-model, multi-dimensional anomaly detection is performed on the alarm information, which not only considers the isolated points in the feature space, but also considers the density difference, thereby providing a more comprehensive and accurate anomaly detection result. In addition, by adjusting the weight, the performance of network anomaly detection can be further optimized, and the accuracy of identifying the root cause alarm (target alarm information) in a complex network environment can be improved.

[0147] In addition, by combining the independent forest sub-model and the density clustering sub-model, the real-time processing capabilities of alarm correlation analysis and hidden danger detection are significantly improved. The terminal can analyze and respond to data at the moment of data generation, realize real-time detection, accurate positioning and rapid investigation of hidden dangers, greatly shorten the problem response time, and improve operation and maintenance efficiency.

[0148] In an exemplary embodiment, the first weight and the second weight may be obtained in advance based on analysis of alarm sample data contained in a preset transaction library, such as Figure 6 As shown, before step 508, the method further includes steps 602 to 606. Among them:

[0149] Step 602, obtaining a preset transaction library.

[0150] The preset transaction library includes alarm sample data and a sample alarm group formed by a second association relationship between the alarm sample data.

[0151] In the embodiment of the present application, the preset transaction library is constructed from historical alarm data through association analysis, and includes various alarm sample data and the second association relationship between them, as well as different sample alarm groups composed of these association relationships. The terminal first loads the preset transaction library to obtain each alarm group and various alarm sample data and the second association relationship between them in the preset transaction library.

[0152] Step 604 , extract features from the alarm sample data to obtain a first sample feature matrix composed of the alarm sample data, and re-divide the sample feature vectors in the first sample feature matrix according to the sample alarm groups to obtain a second sample feature matrix corresponding to each sample alarm group.

[0153] In the embodiment of the present application, the terminal constructs the first sample feature matrix and the second sample feature matrix according to the same principle as step 502, and the construction process of the first sample feature matrix and the second sample feature matrix will not be described in detail in this embodiment.

[0154] Step 606, based on the first chi-square value calculated by the independent forest sub-model for the sample feature vectors and the second correlation relationship in the second sample feature matrix and the second chi-square value calculated by the density clustering sub-model for each sample feature vector in the first sample feature matrix, respectively determine the first weight corresponding to the independent forest sub-model and the second weight corresponding to the density clustering sub-model.

[0155] In the embodiment of the present application, the terminal evaluates the performance of the independent forest sub-model when calculating the second sample feature matrix according to the same principle as in step 504 and step 506 according to the chi-square test to obtain a first chi-square value, and simultaneously evaluates the performance of the density clustering sub-model when processing the first sample feature matrix to obtain a second chi-square value, and then calculates the first weight according to the first chi-square value and the second chi-square value, wherein the calculation formula of the first weight is:

[0156]

[0157] in, The first chi-square value of the independent forest sub-model for calculating the second sample feature matrix, is the second chi-square value when the density clustering sub-model processes the first sample feature matrix. Furthermore, the second weight is .

[0158] Step 508 includes step 5081, wherein:

[0159] Step 5081: Perform a weighted sum of the first anomaly score and the second anomaly score according to the first weight and the second weight to obtain a target anomaly score.

[0160] In the embodiment of the present application, finally, the terminal generates a comprehensive anomaly score by weighted fusion of the first anomaly score and the second anomaly score:

[0161]

[0162] Among them, α is the weight coefficient, It is the chi-square value reflecting the reliability of the hybrid model for anomaly detection on multiple tasks.

[0163] In this embodiment, by combining the advantages of the traditional AI model of the independent forest sub-model and the density clustering sub-model, the incompatibility problem between the large language model and the traditional AI model in data format and accuracy is solved, and the collaborative work of different types of models is achieved. This compatibility improves the resource utilization and flexibility in network detection, making it possible to dynamically adjust the model combination according to actual needs and optimize the configuration and use efficiency of operation and maintenance resources.

[0164] At the same time, the chi-square test is used to dynamically adjust the weights, and the alarm sample data is weighted and fused to generate a comprehensive anomaly score, thereby improving the accuracy and reliability of anomaly detection, effectively identifying isolated anomalies, and capturing density differences, providing support for network fault diagnosis and anomaly detection, and achieving deep compatibility between the preset large language model and the knowledge graph, ensuring seamless transmission and sharing of data between different models. Through this compatibility, the terminal can provide more accurate and intelligent network risk detection and analysis, while ensuring the security and integrity of the data, and avoiding information leakage or misprocessing due to data incompatibility.

[0165] In an exemplary embodiment, Figure 7 As shown, step 106 includes steps 702 to 706. Among them:

[0166] Step 702: construct an alarm graph according to the preset topology resource association information, the target abnormality score corresponding to the second alarm information, and the feature matrix corresponding to the second alarm information.

[0167] The characteristic matrix corresponding to the second warning information includes the characteristic vectors of each second warning information.

[0168] In an embodiment of the present application, the terminal obtains the characteristic vector of each second alarm information from the characteristic matrix corresponding to the second alarm information, and splices the target anomaly score corresponding to the second alarm information with the characteristic vector of the second alarm information to obtain a spliced ​​vector. The terminal uses the spliced ​​vector as a node of the alarm graph, and determines the relationship between each second alarm information according to the preset topology resource association information as the edge of the alarm graph, thereby obtaining the alarm graph G=(V, E). Specifically, based on the physical connection, dependency or logical association between the topology resource association information, for example, the network connection between network devices, the calling relationship between services, etc., the terminal can identify the direct or indirect association between the second alarm information, and then abstract the association relationship as an edge in the alarm graph.

[0169] Step 704: Analyze and process the warning graph according to the probability graph model to obtain the target probability value corresponding to each second warning information, and determine the target warning information based on the target probability value and a preset probability threshold.

[0170] Among them, the probabilistic graphical model is a dynamic Bayesian network.

[0171] In the embodiment of the present application, the terminal uses graph embedding technology to convert the alarm graph G=(V, E) into a low-dimensional vector representation Embedding( ), construct a dynamic Bayesian network BN, and capture the causal relationship between the second alarm information through a probabilistic graph model:

[0172]

[0173] in, is the number of nodes V in the alarm graph, is the node V in the alarm graph, The target probability value that indicates each second warning information is the target warning information. Then, the terminal compares the target probability value with a preset probability threshold, and determines the second warning information whose target probability value is higher than the preset probability threshold as the target warning information.

[0174] For the training process of the dynamic Bayesian network BN, the terminal can adopt dynamic structure learning based on the second-order optimization method to update the structural parameters θ of the Bayesian network in real time, where η is the learning rate, is the Hessian matrix of the loss function:

[0175]

[0176] Through the causal inference of the Bayesian network, the target alarm information Root Cause ( ), thereby optimizing network security response strategies:

[0177]

[0178] in, Characterize given evidence In the case of, the probability that the second warning information is the target warning information, It includes the second alarm information, the dependency relationship related to the second alarm information in the preset topology resource association information, and the target anomaly score.

[0179] Step 706: Determine the dependency relationship corresponding to the target alarm information based on the target alarm information and the alarm map.

[0180] In an embodiment of the present application, the terminal determines the node corresponding to the target alarm information in the alarm graph, and searches for the edges directly connected to the nodes of the target alarm information by traversing the alarm graph. The edges represent direct dependencies, and the dependencies are extracted from these edges, including the direction of the dependency, the strength of the dependency, or other attributes. Optionally, the terminal can further traverse the nodes indirectly connected to the target alarm information nodes to obtain deeper dependencies, and finally obtain the dependencies corresponding to the target alarm information, and organize the extracted dependencies, including operations such as classification, sorting, or calculating correlation, to facilitate subsequent analysis and processing.

[0181] In this embodiment, the feature vector of the second alarm information and the target anomaly score are spliced ​​to form a node of the alarm graph, which can comprehensively capture the multi-dimensional characteristics of the alarm information and provide richer anomaly detection basis; by pre-setting the topological resource association information, the edges in the alarm graph are constructed, which can reflect the physical connection, dependency or logical association between the alarm information, and help identify the causal relationship between the alarm information; using the dynamic Bayesian network for probabilistic inference, it is possible to capture the dynamic causal relationship between the alarm information, and by updating the network structure parameters in real time to adapt to changes in the network environment, the accuracy of the probabilistic graph model in identifying the target alarm information is improved, thereby improving the accuracy of the network detection results.

[0182] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0183] Based on the same inventive concept, the embodiment of the present application also provides a network detection device for implementing the network detection method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more network detection device embodiments provided below can refer to the limitations on the network detection method above, and will not be repeated here.

[0184] In an exemplary embodiment, Figure 8 As shown, a network detection device 800 is provided, comprising: a first acquisition module 801, a calculation module 802, an identification module 803 and an analysis module 804, wherein:

[0185] A first acquisition module 801 is used to acquire preset topology resource association information, traffic information and first alarm information of multiple alarm types of a target network;

[0186] A calculation module 802 is used to calculate a target anomaly score corresponding to each first alarm information, and preliminarily screen the first alarm information based on the target anomaly score to obtain second alarm information;

[0187] An identification module 803 is used to identify the root cause alarm of the second alarm information based on the preset topology resource association information and the target abnormality score corresponding to the second alarm information, and extract the target alarm information and the dependency relationship corresponding to the target alarm information;

[0188] The analysis module 804 is used to perform root cause alarm analysis on the traffic information, target alarm information and dependency relationship according to a preset large language model to obtain a network detection result.

[0189] In one embodiment, the calculation module 802 is specifically used to determine the first association relationship between the alarm types corresponding to each first alarm information according to the second association relationship between the alarm sample data in the preset transaction library;

[0190] Dividing the first alarm information into a plurality of alarm groups according to the first association relationship;

[0191] A target anomaly score corresponding to each first alarm information is calculated based on the anomaly detection hybrid model and the first association relationship corresponding to the alarm group.

[0192] In one embodiment, the apparatus 800 further includes:

[0193] The second acquisition module is used to acquire a sample data set and divide the sample data set into a plurality of sample data subsets; the sample data set includes alarm sample data of a plurality of preset types;

[0194] A first determination module is used to determine the time window and sliding step of the correlation analysis model according to the alarm frequency and alarm flow of the alarm sample data, and determine the first weight corresponding to each alarm sample data and the second weight of the transaction corresponding to each time window;

[0195] A correlation analysis module, for performing parallel correlation analysis on the alarm sample data in each sample data subset based on the time window, the sliding step, the first weight, the second weight and the correlation analysis model to obtain a second correlation relationship of a preset type;

[0196] A construction module is used to construct a preset transaction library based on the second association relationship.

[0197] In one of the embodiments, the anomaly detection hybrid model includes an independent forest sub-model and a density clustering sub-model;

[0198] The calculation module 802 is specifically used to extract features from the first alarm information to obtain a first feature matrix formed by the first alarm information, and to re-divide the feature vectors in the first feature matrix according to the alarm groups to obtain a second feature matrix corresponding to each alarm group;

[0199] For the second feature matrix corresponding to each alarm group, according to the first association relationship in the second feature matrix and the independent forest sub-model, anomaly scores are calculated for the feature vectors in the second feature matrix to obtain first anomaly scores corresponding to each first alarm information;

[0200] Calculate the anomaly score of the eigenvectors in the first feature matrix based on the density clustering sub-model to obtain a second anomaly score corresponding to each alarm information;

[0201] A target anomaly score is determined according to the first anomaly score and the second anomaly score.

[0202] In one embodiment, the apparatus 800 further includes:

[0203] A third acquisition module is used to acquire a preset transaction library; the preset transaction library includes alarm sample data and a sample alarm group formed by a second association relationship between the alarm sample data;

[0204] A feature extraction module is used to extract features from the alarm sample data to obtain a first sample feature matrix composed of the alarm sample data, and to re-divide the sample feature vectors in the first sample feature matrix according to the sample alarm groups to obtain a second sample feature matrix corresponding to each sample alarm group;

[0205] A second determination module is used to determine the first weight corresponding to the independent forest sub-model and the second weight corresponding to the density clustering sub-model according to the first chi-square value calculated by the independent forest sub-model for the sample feature vectors and the second association relationship in the second sample feature matrix and the second chi-square value calculated by the density clustering sub-model for each sample feature vector in the first sample feature matrix;

[0206] The calculation module 802 is specifically configured to perform a weighted summation of the first anomaly score and the second anomaly score according to the first weight and the second weight to obtain a target anomaly score.

[0207] In one of the embodiments, the identification module 803 is specifically used to construct an alarm map according to the preset topology resource association information, the target abnormality score corresponding to the second alarm information, and the feature matrix corresponding to the second alarm information;

[0208] Analyzing and processing the warning graph according to the probability graph model to obtain the target probability value corresponding to each second warning information, and determining the target warning information based on the target probability value and a preset probability threshold;

[0209] Determine the dependency relationship corresponding to the target warning information based on the target warning information and the warning map.

[0210] Each module in the above network detection device can be implemented in whole or in part by software, hardware and their combination. Each module can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory in the computer device in the form of software, so that the processor can call and execute the operations corresponding to each module above.

[0211] In an exemplary embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as shown in FIG. Fig. 9 As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store data of a preset transaction library. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a network detection method is implemented.

[0212] Those skilled in the art will understand that Fig. 9 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0213] In an exemplary embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, the following steps are implemented:

[0214] Obtaining preset topology resource association information, traffic information, and first alarm information of multiple alarm types of the target network;

[0215] Calculate the target anomaly score corresponding to each first alarm information, and preliminarily screen the first alarm information based on the target anomaly score to obtain second alarm information;

[0216] Based on the preset topology resource association information and the target anomaly score corresponding to the second alarm information, the root cause alarm of the second alarm information is identified, and the target alarm information and the dependency relationship corresponding to the target alarm information are extracted;

[0217] According to the preset large language model, the root cause alarm analysis and processing is performed on the traffic information, target alarm information and dependency relationship to obtain the network detection results.

[0218] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0219] Determine, according to the second association relationship between the alarm sample data in the preset transaction library, the first association relationship between the alarm types corresponding to the first alarm information;

[0220] Dividing the first alarm information into a plurality of alarm groups according to the first association relationship;

[0221] A target anomaly score corresponding to each first alarm information is calculated based on the anomaly detection hybrid model and the first association relationship corresponding to the alarm group.

[0222] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0223] Acquire a sample data set, and divide the sample data set into a plurality of sample data subsets; the sample data set includes alarm sample data of a plurality of preset types;

[0224] Determine the time window and sliding step of the correlation analysis model according to the alarm frequency and alarm flow of the alarm sample data, and determine the first weight corresponding to each alarm sample data and the second weight of the transaction corresponding to each time window;

[0225] Based on the time window, the sliding step, the first weight, the second weight and the association analysis model, parallel association analysis is performed on the alarm sample data in each sample data subset to obtain a second association relationship of a preset type;

[0226] A preset transaction library is constructed based on the second association relationship.

[0227] In one embodiment, the anomaly detection hybrid model includes an independent forest sub-model and a density clustering sub-model; when the processor executes the computer program, the following steps are also implemented:

[0228] Extracting features from the first alarm information to obtain a first feature matrix formed by the first alarm information, and re-dividing feature vectors in the first feature matrix according to alarm groups to obtain second feature matrices corresponding to each alarm group;

[0229] For the second feature matrix corresponding to each alarm group, according to the first association relationship in the second feature matrix and the independent forest sub-model, anomaly scores are calculated for the feature vectors in the second feature matrix to obtain first anomaly scores corresponding to each first alarm information;

[0230] Calculate the anomaly score of the eigenvectors in the first feature matrix based on the density clustering sub-model to obtain a second anomaly score corresponding to each alarm information;

[0231] A target anomaly score is determined according to the first anomaly score and the second anomaly score.

[0232] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0233] Acquire a preset transaction library; the preset transaction library includes alarm sample data and a sample alarm group formed by a second association relationship between the alarm sample data;

[0234] Extract features from the alarm sample data to obtain a first sample feature matrix composed of the alarm sample data, and re-divide the sample feature vectors in the first sample feature matrix according to the sample alarm groups to obtain a second sample feature matrix corresponding to each sample alarm group;

[0235] Determine the first weight corresponding to the independent forest sub-model and the second weight corresponding to the density clustering sub-model respectively according to the first chi-square value calculated by the independent forest sub-model for the sample feature vector and the second association relationship in the second sample feature matrix and the second chi-square value calculated by the density clustering sub-model for each sample feature vector in the first sample feature matrix;

[0236] Determining a target anomaly score according to the first anomaly score and the second anomaly score includes:

[0237] The first anomaly score and the second anomaly score are weightedly summed according to the first weight and the second weight to obtain a target anomaly score.

[0238] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0239] Constructing an alarm graph according to preset topology resource association information, a target anomaly score corresponding to the second alarm information, and a feature matrix corresponding to the second alarm information;

[0240] Analyzing and processing the warning graph according to the probability graph model to obtain the target probability value corresponding to each second warning information, and determining the target warning information based on the target probability value and a preset probability threshold;

[0241] Determine the dependency relationship corresponding to the target warning information based on the target warning information and the warning map.

[0242] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0243] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0244] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0245] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0246] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0247] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A network detection method, characterized in that: The method comprises: Obtaining preset topology resource association information, traffic information, and first alarm information of multiple alarm types of the target network; Calculating target anomaly scores corresponding to each of the first alarm information, and preliminarily screening the first alarm information based on the target anomaly scores to obtain second alarm information; Performing root cause alarm identification on the second alarm information based on the preset topology resource association information and the target anomaly score corresponding to the second alarm information, and extracting the target alarm information and the dependency relationship corresponding to the target alarm information; The flow information, the target alarm information and the dependency relationship are subjected to root cause alarm analysis and processing according to a preset large language model to obtain a network detection result.

2. The method according to claim 1, characterized in that The calculating the target anomaly score corresponding to each of the first alarm information includes: Determining, according to the second association relationship between the alarm sample data in the preset transaction library, a first association relationship between the alarm types corresponding to each of the first alarm information; Dividing the first alarm information into a plurality of alarm groups according to the first association relationship; A target anomaly score corresponding to each of the first alarm information is calculated based on the anomaly detection hybrid model and the first association relationship corresponding to the alarm group.

3. The method according to claim 2, characterized in that Before determining the first association relationship between the alarm types corresponding to the first alarm information according to the first association relationship between the alarm sample data in the preset transaction library, the method further includes: Acquire a sample data set, and divide the sample data set into a plurality of sample data subsets; the sample data set includes a plurality of preset types of alarm sample data; Determine the time window and sliding step of the correlation analysis model according to the alarm frequency and alarm flow of the alarm sample data, and determine the first weight corresponding to each of the alarm sample data and the second weight of the transaction corresponding to each of the time windows; Based on the time window, the sliding step, the first weight, the second weight and the association analysis model, parallel association analysis is performed on the alarm sample data in each of the sample data subsets to obtain a second association relationship of a preset type; A preset transaction library is constructed based on the second association relationship.

4. The method according to claim 2, characterized in that: The anomaly detection hybrid model includes an independent forest sub-model and a density clustering sub-model; The calculating the target anomaly score corresponding to each of the first alarm information based on the anomaly detection hybrid model and the first association relationship corresponding to the alarm group includes: Extracting features from the first alarm information to obtain a first feature matrix formed by the first alarm information, and re-dividing feature vectors in the first feature matrix according to the alarm groups to obtain second feature matrices corresponding to the alarm groups; For the second feature matrix corresponding to each of the alarm groups, according to the first association relationship in the second feature matrix and the independent forest sub-model, anomaly scores are calculated for the feature vectors in the second feature matrix to obtain first anomaly scores corresponding to each of the first alarm information; Calculating anomaly scores of the feature vectors in the first feature matrix based on the density clustering sub-model to obtain second anomaly scores corresponding to each piece of the warning information; A target anomaly score is determined according to the first anomaly score and the second anomaly score.

5. The method according to claim 4, characterized in that Before determining a target anomaly score according to the first anomaly score and the second anomaly score, the method further includes: Acquire a preset transaction library; the preset transaction library includes alarm sample data and a sample alarm group formed by a second association relationship between the alarm sample data; Extracting features from the alarm sample data to obtain a first sample feature matrix composed of the alarm sample data, and re-dividing the sample feature vectors in the first sample feature matrix according to the sample alarm groups to obtain a second sample feature matrix corresponding to each of the sample alarm groups; Determine respectively a first weight corresponding to the independent forest sub-model and a second weight corresponding to the density clustering sub-model according to a first chi-square value calculated by the independent forest sub-model for the sample feature vectors in the second sample feature matrix and the second association relationship and a second chi-square value calculated by the density clustering sub-model for each of the sample feature vectors in the first sample feature matrix; The determining a target anomaly score according to the first anomaly score and the second anomaly score includes: The first anomaly score and the second anomaly score are weightedly summed according to the first weight and the second weight to obtain a target anomaly score.

6. The method according to claim 1, characterized in that The performing root cause alarm identification on the second alarm information based on the preset topology resource association information and the target abnormality score corresponding to the second alarm information, and extracting the target alarm information and the dependency relationship corresponding to the target alarm information, includes: Constructing an alarm graph according to the preset topology resource association information, the target anomaly score corresponding to the second alarm information, and the feature matrix corresponding to the second alarm information; Analyzing and processing the warning graph according to the probability graph model to obtain target probability values ​​corresponding to each second warning information, and determining target warning information based on the target probability values ​​and a preset probability threshold; Determine the dependency relationship corresponding to the target warning information based on the target warning information and the warning map.

7. A network detection device, characterized in that: The device comprises: A first acquisition module, used to acquire preset topology resource association information, traffic information and first alarm information of multiple alarm types of the target network; a calculation module, configured to calculate a target anomaly score corresponding to each of the first alarm information, and preliminarily screen the first alarm information based on the target anomaly score to obtain second alarm information; An identification module, configured to identify the root cause alarm of the second alarm information based on the preset topology resource association information and the target abnormality score corresponding to the second alarm information, and extract the target alarm information and the dependency relationship corresponding to the target alarm information; The analysis module is used to perform root cause alarm analysis on the traffic information, the target alarm information and the dependency relationship according to a preset large language model to obtain a network detection result.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images