Network operation and maintenance monitoring system based on intelligent analysis

Abstract

The invention relates to the technical field of communication management, in particular to a network operation and maintenance monitoring system based on intelligent analysis, and the system comprises a link load balancing module which collects flow input data and output data associated with a current scene in a network link, determines an initial partition range of the network link, and stores the flow input data and output data in the network link; and dividing the link partition with the traffic density exceeding a preset load threshold value into a plurality of sub-segments to obtain link subdivision load distribution information. According to the invention, through multi-level monitoring and adjustment for the link flow, the refinement and dynamic adaptive capacity of network operation is improved. Initial partitioning and detailed analysis are performed on the link based on the traffic density and the topological information, so that a high-load link area can be effectively positioned, and waste of link resources and performance bottleneck are avoided. In the dynamic monitoring link, the abnormal change of the link state is captured by extracting link transmission delay data and analyzing a delay difference matrix, and the fluctuation condition of the link is effectively tracked by marking the maximum value, the minimum value and the change trend.

Description

Technical Field

[0001] The present invention relates to the field of communication management technology, and in particular to a network operation and maintenance monitoring system based on intelligent analysis. Background Art

[0002] The field of communication management technology mainly involves the operation, maintenance and optimization of communication networks, covering the management and monitoring of communication equipment, network performance and data transmission process. The core of this technology field is to ensure the efficient, safe and stable operation of the communication network through real-time monitoring, data collection, analysis and processing, and help improve the service quality and fault handling capabilities of the communication system.

[0003] Among them, the network operation and maintenance monitoring system is a technical tool used to monitor and manage the operation status of the communication network. Its purpose is to promptly discover and handle performance bottlenecks, failure risks and abnormal conditions that occur during network operation, and provide visual data analysis and alarm functions, thereby ensuring the stable operation of the network and optimizing resource utilization.

[0004] When dealing with complex network traffic scenarios, existing technologies have difficulty in accurately partitioning and refining analysis of high-load links. For example, when multiple links are unevenly loaded, it is difficult to distinguish which link is truly a bottleneck only through static traffic thresholds, which may lead to long-term imbalance in link load. For dynamic changes in link status, existing technologies have difficulty accurately capturing abnormal changes based on the fluctuation range of transmission delay. For example, when the link load is unstable, the lack of in-depth analysis of the delay difference can easily miss key fluctuation nodes, resulting in untimely identification of abnormal links. In terms of link risk assessment, existing technologies rely on simple link statistical indicators and find it difficult to fully utilize dynamic characteristics such as bit error rate time series. For example, on some links with a sudden increase in bit error rate, it is impossible to predict the growth trend of risk, resulting in delayed handling of risky links. In terms of traffic optimization, existing technologies have difficulty in re-adjusting paths based on the traffic distribution ratio and resource occupancy of upstream and downstream nodes. For example, when a single link is overloaded, the selection of alternative paths may not be able to comprehensively consider multiple characteristics, ultimately resulting in poor optimization results. Summary of the invention

[0005] The purpose of the present invention is to solve the shortcomings of the prior art and to propose a network operation and maintenance monitoring system based on intelligent analysis.

[0006] In order to achieve the above object, the present invention adopts the following technical solution: A network operation and maintenance monitoring system based on intelligent analysis includes:

[0007] The link load balancing module collects the traffic input and output data associated with the current scenario in the network link, determines the initial partition range of the network link, divides the link partition with a traffic density exceeding a preset load threshold into multiple sub-segments, and obtains link segmentation load distribution information;

[0008] The link status dynamic monitoring module obtains the link pair set corresponding to each sub-segment in the link based on the link segmentation load distribution information, constructs a link delay difference matrix, analyzes the delay difference fluctuation range according to the link delay difference matrix, marks the abnormal growth trend, and obtains the dynamic state abnormal link characteristics;

[0009] The link stability analysis module extracts the abnormal links marked in the dynamic state abnormal link characteristics and collects their bit error rate time series data, obtains the bit error rate growth characteristics, calculates the state score of the abnormal link according to the bit error rate growth characteristics, selects the risk link according to the state score of the abnormal link, predicts the future operation state of the risk link, and generates the link stability trend characteristics;

[0010] Based on the link stability trend characteristics, the network traffic optimization module collects traffic input data and output data of upstream and downstream nodes of the risk link, adjusts the traffic distribution of the risk link, and obtains the traffic optimization result of the risk link.

[0011] As a further solution of the present invention, the step of determining the initial partition range of the network link is specifically:

[0012] Based on the traffic input and output data associated with the current scenario in the network link, the data volume and timestamp information of the traffic entering and flowing out of the link are collected through network monitoring to generate a data set of traffic input and output;

[0013] Based on the data set of the flow input and output, the formula is used:

[0014]

[0015] Calculate the link traffic density ρ;

[0016] Where F represents the total amount of traffic passing through the link during the statistical time period, B is the link bandwidth, and T represents the statistical time window;

[0017] Based on the link traffic density distribution and network topology information, the node connection relationship and bandwidth information in the link are collected, the links whose traffic density exceeds the partition threshold are marked, and the initial partition range is divided according to the connection attributes between the nodes to generate the partition range and the corresponding traffic density record.

[0018] As a further solution of the present invention, the step of acquiring the link subdivision load distribution information is specifically as follows:

[0019] Based on the partition range and the corresponding traffic density records, the traffic density of each link in the partition is monitored and compared, links with traffic density exceeding a load threshold are screened out and divided into multiple sub-segments, and sub-segment data of the link partition is obtained;

[0020] Based on the sub-segment data of the link partition, the formula is adopted:

[0021]

[0022] Calculate the traffic distribution ratio β of the i-th sub-segment i , obtain link segmentation load distribution information;

[0023] Among them, ρ i represents the flow density of the ith subsegment, and ∑ρ represents the sum of the flow densities of all subsegments.

[0024] As a further solution of the present invention, the step of constructing the link delay difference matrix is ​​specifically as follows:

[0025] Based on the link segmentation load distribution information, a link pair set corresponding to each sub-segment in the link is obtained, transmission delay data of the link pair is extracted from the link pair set, and a transmission delay data set of the link is established;

[0026] Based on the transmission delay data set of the established link, the formula is used:

[0027]

[0028] Calculate the relative transmission delay difference Δt between link i′ and link j at time point k i′j (k), constructing a link delay difference matrix according to the transmission delay difference;

[0029] Among them, t i′ (k) represents the transmission delay of link i′ at time point k, t j (k) represents the transmission delay of link j at time point k, t avg (k) represents the average transmission delay of all monitored links at time point k.

[0030] As a further solution of the present invention, the step of acquiring the dynamic state abnormal link feature is specifically:

[0031] According to the link delay difference matrix, extract the delay difference sequence of the link pair corresponding to each column from the matrix, obtain the maximum value and the minimum value in the delay difference sequence, analyze the fluctuation range of the delay difference sequence, compare the fluctuation range with the preset fluctuation range, record whether the state exceeds the preset range, and obtain abnormal marking information of the link pair;

[0032] Based on the abnormal marking information of the link pair, the difference change at the time point is analyzed according to the maximum and minimum values ​​of each column, and the abnormal growth situation is recorded by judging the changing trend of the continuous difference to generate the dynamic state abnormal link feature.

[0033] As a further solution of the present invention, the step of calculating the status score of the abnormal link is specifically:

[0034] Based on the abnormal link marked in the dynamic state abnormal link feature, extract its bit error rate time series data, normalize the bit error rate data according to the time series and draw it into a curve, identify the fluctuation inflection point in the curve and its corresponding growth characteristics, and obtain the bit error rate change analysis result;

[0035] Based on the bit error rate change analysis results, the formula is used:

[0036] S = α·G + β·V;

[0037] Calculate the status score S of the abnormal link;

[0038] Wherein, G represents the growth rate of the bit error rate, V represents the growth amplitude of the bit error rate, and α and β are weight factors of the growth rate G and the growth amplitude V respectively.

[0039] As a further solution of the present invention, the step of acquiring the link stability trend feature is specifically:

[0040] Selecting risky links according to the status scores of the abnormal links, extracting historical bit error rate data and performing normalization processing, converting the normalized bit error rate values ​​into curve representations, analyzing fluctuation inflection points and growth characteristics in combination with the curves, and generating bit error rate growth characteristic data;

[0041] Based on the bit error rate growth characteristic data, the bit error rate change trend and the status score change trend are analyzed, the future operation status of the risk link is predicted, and the link stability trend characteristics are generated.

[0042] As a further solution of the present invention, the steps of obtaining the traffic optimization result of the risk link are specifically as follows:

[0043] Based on the link stability trend characteristics, the flow input data and output data of the upstream and downstream nodes of the risk link are collected, the flow ratio of the upstream and downstream nodes and the resource occupancy of the links in the transmission path are analyzed, and a link resource occupancy table is generated;

[0044] Based on the link resource occupancy table, risk links whose resource occupancy exceeds a threshold are screened, alternative paths are extracted and traffic paths of risk links are reallocated, traffic distribution is adjusted, and traffic optimization results of risk links are generated.

[0045] Compared with the prior art, the advantages and positive effects of the present invention are:

[0046] In the present invention, the refinement and dynamic adaptability of network operation are improved through multi-level monitoring and adjustment for link traffic. Based on traffic density and topology information, the initial partitioning and refinement analysis of the link can effectively locate the high-load link area and avoid the waste of link resources and performance bottlenecks. In the dynamic monitoring link, by extracting the link transmission delay data and delay difference matrix analysis, the abnormal changes of the link state are captured, and the fluctuation of the link is effectively tracked by marking the maximum value, minimum value and change trend. This analysis method can quickly discover potential risks and avoid the chain effect of faulty links. In the link stability assessment, the link state score is calculated by normalizing the bit error rate time series and extracting the fluctuation inflection point, combining the growth characteristics to provide data support for the determination and trend prediction of risk links, and improving the ability to predict the network operation status. By analyzing the traffic distribution and resource occupancy of the upstream and downstream nodes of the risk link, and adjusting the traffic path based on this, load balancing optimization is achieved, and the utilization rate of the overall network resources and the stability of link operation are improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Figure 1 is a system flow chart of the present invention;

[0048] Figure 2 A flow chart for determining an initial partition range of a network link for the present invention;

[0049] Figure 3 A flow chart of obtaining link segmentation load distribution information according to the present invention;

[0050] Figure 4 A flow chart for constructing a link delay difference matrix for the present invention;

[0051] Figure 5 A flow chart of the present invention for obtaining the characteristics of abnormal links in dynamic states;

[0052] Figure 6 A flow chart of calculating the status score of an abnormal link according to the present invention;

[0053] Figure 7 A flow chart of obtaining link stability trend characteristics of the present invention;

[0054] Figure 8 The present invention is a flow chart for obtaining the flow optimization result of the risk link. DETAILED DESCRIPTION

[0055] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0056] In the description of the present invention, it should be understood that the terms "length", "width", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside" and the like indicate positions or positional relationships based on the positions or positional relationships shown in the drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as limiting the present invention. In addition, in the description of the present invention, "multiple" means two or more, unless otherwise clearly and specifically defined.

[0057] See also Figure 1 , the network operation and maintenance monitoring system based on intelligent analysis includes:

[0058] The link load balancing module collects the traffic input and output data associated with the current scenario in the network link, determines the initial partition range of the network link according to the traffic density and network link topology information, compares the traffic density of the initial partition range with the preset load threshold, divides the link partition with a traffic density exceeding the preset load threshold into multiple sub-segments, analyzes the traffic distribution ratio of each sub-segment, and obtains the link segmentation load distribution information;

[0059] The link status dynamic monitoring module obtains the link pair set corresponding to each sub-segment in the link based on the link segmentation load distribution information, extracts the transmission delay data of the link pair from the link pair set and calculates the transmission delay difference, constructs a link delay difference matrix, analyzes the delay difference fluctuation range according to the link delay difference matrix, determines whether the delay difference exceeds the preset fluctuation range, integrates the maximum value, minimum value and change trend of the delay difference fluctuation range, marks the abnormal growth trend, and obtains the dynamic state abnormal link characteristics;

[0060] The link stability analysis module extracts abnormal links marked in the dynamic state abnormal link characteristics and collects their bit error rate time series data, normalizes the bit error rate time series data and converts it into a curve representation, analyzes the fluctuation inflection point of the bit error rate curve with reference to the change trend of abnormal growth, obtains the bit error rate growth characteristics, calculates the state score of the abnormal link according to the bit error rate growth characteristics, selects the risk link according to the state score of the abnormal link, predicts the future operation status of the risk link, and generates the link stability trend characteristics;

[0061] Based on the trend characteristics of link stability, the network traffic optimization module collects the traffic input and output data of the upstream and downstream nodes of the risk link, analyzes the traffic distribution ratio of the upstream and downstream nodes and the link resource occupancy in the transmission path, and reallocates the traffic path of the risk link according to the analysis results, adjusts the traffic distribution of the risk link, and obtains the traffic optimization result of the risk link;

[0062] The link segmentation load distribution information includes the sub-segment traffic allocation ratio, traffic density distribution and the corresponding load pressure assessment of the sub-segment. The dynamic state abnormal link characteristics include abnormal link marking, delay difference limit range and growth trend type classification. The link stability trend characteristics include link status score, bit error rate growth characteristics and future operating status change range. The traffic optimization results of risky links include traffic allocation path adjustment plan, upstream and downstream node traffic distribution optimization plan and link resource occupancy optimization parameters.

[0063] See also Figure 2 , the steps to determine the initial partition range of the network link are as follows:

[0064] Based on the traffic input and output data associated with the current scenario in the network link, the data volume and timestamp information of the traffic entering and flowing out of the link are collected through network monitoring to generate a data set of traffic input and output;

[0065] To collect the flow input and output data associated with the current scenario in the network link, it is necessary to deploy link monitoring equipment, including network flow monitors, data packet collectors, and log analysis tools. The flow monitor captures the flow size per second entering the link in real time (expressed as the total number of data packets or bandwidth utilization). The data packet collector is used to extract information about outbound flow, such as packet size, protocol type, and transmission path. At the same time, the timestamps of flow input and output are recorded. These data are cleaned to eliminate outliers, such as duplicate data packets or lost transmission records, and valid flow data is stored in time series to form a data set.

[0066] Based on the data set of flow input and output, the formula is used:

[0067]

[0068] Calculate the link traffic density ρ;

[0069] Among them, F represents the total amount of traffic passing through the link during the statistical time period, in bytes. The traffic data of the link during the statistical time period can be directly recorded by network traffic monitoring equipment (such as NetFlow or sFlow). B is the link bandwidth, which also represents the maximum transmission capacity of the link, in bytes / second. The link bandwidth is usually provided by the specification parameters of the network device and can be directly obtained from the network management system (such as SNMP). T is the time period length, which represents the time window used for statistics, in seconds. For example, the sampling time period is set to 1 minute (60 seconds).

[0070] If the traffic size per unit time is F = 300,000,000 bytes, the total traffic record of link AB is directly read through the monitoring device, the link bandwidth B = 100,000,000 bytes / second, and the time period length T = 60 seconds, substitute the parameters into the formula: The results showed that the flow density was 5%.

[0071] Based on the link traffic density distribution and network topology information, the node connection relationship and bandwidth information in the link are collected, and the links with traffic density exceeding the partition threshold are marked. The initial partition range is divided according to the connection attributes between nodes, and the partition range and corresponding traffic density records are generated;

[0072] First, obtain the network topology information, and use the SNMP protocol to collect the link connection information and corresponding bandwidth between devices from routers and switches. For example, the bandwidth of link node pair AB is 100Mbps (converted to B = 100000000 bytes / second), and the bandwidth of node pair CD is 200Mbps (converted to B = 200000000 bytes / second). Use the topology drawing tool to organize the link connection relationship diagram of the network and identify all link node pairs and their corresponding bandwidths; then combine the calculated traffic density value ρ = 0.05 to calculate the load conditions of different areas in the link. , further screen the links whose traffic density exceeds the specified partition threshold (for example, ρ>0.05), and combine the links with high traffic density and the nodes connected to them to form an initial partition range. For example, if the traffic density of link AB is 0.05, the node will not subdivide the link of AB for the time being, but if the traffic density of link CD is 0.10, then mark the link where CD is located. Combined with the connection properties of the nodes in the network topology, the area where the high traffic density link CD is located is divided into an independent initial partition range, and the traffic density distribution of these partitions is recorded to provide input for the formulation of subsequent load balancing strategies.

[0073] See also Figure 3 ,The specific steps for obtaining link segmentation load distribution information are:

[0074] Based on the partition range and the corresponding traffic density records, the traffic density of each link in the partition is monitored and compared, and the links with traffic density exceeding the load threshold are screened out and divided into multiple sub-segments to obtain the sub-segment data of the link partition;

[0075] The traffic density of the initial partition range is compared with the preset load threshold. First, the calculated results of the link traffic density are classified, and the traffic density value ρ is compared with the preset load threshold τ, for example, τ = 0.08. For the calculated traffic density values, such as the traffic density ρ = 0.05 of link AB and the traffic density ρ = 0.10 of link CD, the links exceeding the load threshold (such as link CD) are screened out according to the condition of ρ>τ, and then these links are partitioned and refined. The refinement process includes dividing the high-load links into multiple sub-segments according to time periods. For example, link CD records the traffic data of different time periods as one minute per time slice, and calculates the traffic density in each time slice. The segmentation results will be sub-segments C-D1, C-D2 and other sub-links, while retaining their corresponding time range and traffic density information to provide input data for the subsequent analysis of the traffic distribution ratio.

[0076] Based on the sub-segment data of the link partition, the formula is used:

[0077]

[0078] Calculate the traffic distribution ratio β of the i-th sub-segment i , obtain link segmentation load distribution information;

[0079] Among them, ρ i represents the flow density of the ith subsegment, and ∑ρ represents the sum of the flow densities of all subsegments.

[0080] For example, according to experimental monitoring, the traffic of link C-D1 in one minute is 720MB (720×10 bytes), the bandwidth is 100Mbps, and the time is 60 seconds. The calculation result is

[0081] Similarly, according to experimental monitoring, the traffic of link C-D2 in one minute is 480MB (480×10 bytes), the bandwidth is 100Mbps, and the time is 60 seconds. The calculation shows

[0082] The total flow density is ∑ρ=ρ1+ρ2=0.12+0.08=0.20.

[0083] Calculate the traffic distribution ratio of each sub-segment:

[0084] For sub-segment C-D1:

[0085] For sub-segment C-D2:

[0086] The results show that the traffic distribution ratio of sub-segment C-D1 is 60%, and the traffic distribution ratio of sub-segment C-D2 is 40%, which indicates that among the two sub-segments of link CD, C-D1 carries a higher proportion of traffic and the link load is more concentrated on this sub-segment.

[0087] See also Figure 4 , the steps of constructing the link delay difference matrix are as follows:

[0088] Based on the link segmentation load distribution information, a link pair set corresponding to each sub-segment in the link is obtained, transmission delay data of the link pair is extracted from the link pair set, and a transmission delay data set of the link is established;

[0089] First, through network performance monitoring tools such as Ping or Traceroute, the real-time transmission delay data of each link is collected from the node pairs of the link segmentation, and the collected data is recorded according to time periods to generate a delay sequence of each link in multiple time slices. For example, for links AB and CD, their transmission delay data per minute are recorded respectively. It is assumed that the transmission delay of link AB in the first minute, the second minute, and the third minute are 10ms, 15ms, and 20ms respectively, and the corresponding delays of link CD are 12ms, 18ms, and 24ms respectively. Subsequently, the extracted transmission delay data are stored in a matrix form to construct a delay data set for each link.

[0090] Based on the transmission delay data set of the established link, the formula is used:

[0091]

[0092] Calculate the relative transmission delay difference Δt between link i′ and link j at time point k i′j (k), constructing a link delay difference matrix according to the transmission delay difference;

[0093] Among them, t i′ (k) represents the transmission delay of link i′ at time point k. The transmission delay of the link is collected in real time through the network monitoring tool Ping or Traceroute. For example, the delay of link AB in the second minute (time point 2) is t i′ (2) = 15 ms, t j (k) represents the transmission delay of link j at time point k, which is obtained in the same way as t i′ (k), t avg (k) represents the average transmission delay of all monitored links at time point k, which is defined as: N is the total number of links, t n(k) is the transmission delay of link n at time point k.

[0094] Get the transmission delays of links AB and CD in the first, second, and third minutes:

[0095] Minute 1: t i′ (1) = 10 ms, t j (1) = 12 ms.

[0096] Minute 2: t i′ (2) = 15 ms, t j (2) = 18 ms.

[0097] Minute 3: t i′ (3) = 20ms, t j (3) = 24ms.

[0098] Get the average delay t at a time point avg (k):

[0099] First minute: Assume that the delays of links AB, CD, and EF are 10 ms, 12 ms, and 8 ms, respectively. Then:

[0100]

[0101] Second minute: Assuming that the delays of links AB, CD, and EF are 15 ms, 18 ms, and 12 ms, respectively, then:

[0102]

[0103] Minute 3: Assume that the delays of links AB, CD, and EF are 20 ms, 24 ms, and 16 ms, respectively. Then:

[0104]

[0105] Calculate the relative transmission delay difference:

[0106] Minute 1:

[0107] Minute 2:

[0108] Minute 3:

[0109] Arrange the calculated relative delay differences row by row according to the time points to construct a transmission delay difference matrix. For example, the calculation results for links AB and CD are as follows: If there are more link pairs (such as AB and EF, CD and EF), the columns of the matrix can be expanded sequentially, for example: Each column of the matrix represents the relative time delay difference between two certain links at different time points, and each row of the matrix corresponds to the time delay differences of multiple link pairs at a time point.

[0110] Please refer to Figure 5 , and the steps for obtaining the characteristics of dynamically abnormal links are specifically as follows:

[0111] According to the link time delay difference matrix, extract the time delay difference sequence of the link pairs corresponding to each column from the matrix, obtain the maximum value and the minimum value in the time delay difference sequence, analyze the fluctuation range of the time delay difference sequence, compare the fluctuation range with a preset fluctuation interval, record the status of whether it exceeds the preset range, and obtain the abnormal marking information of the link pair;

[0112] Analyze the fluctuation range of the time delay difference according to the link time delay difference matrix, and judge whether the time delay difference exceeds the preset fluctuation interval. First, extract the time delay difference sequence of the link pairs corresponding to each column from the constructed link time delay difference matrix. For example, each column of the matrix ΔT corresponds to the time delay difference record of a link pair. Assume that the time delay difference sequence of link i′-j is [0.2, 0.3, 0.5, 0.8, 0.4]. First, calculate the maximum value max(Δt i′j ) = 0.8 and the minimum value min(Δt i′j ) = 0.2. Then, calculate the fluctuation range Range = max(Δt i′j ) - min(Δt i′j ) = 0.8 - 0.2 = 0.6. Here, Range represents the difference between the maximum difference and the minimum difference of the link pair in the entire time series, and is used to quantify the time delay fluctuation amplitude of the link pair. Next, compare this fluctuation range with the preset fluctuation interval [L, U], where the values of the preset interval upper limit L and lower limit U can be calculated by statistically analyzing historical time delay difference data. For example, the 95% confidence interval of historical data is [0.1, 0.5], and judge whether the condition Range > U or Range < L is satisfied through conditional judgment. If the fluctuation range exceeds the preset interval, mark the link pair as an abnormal link, record the abnormal status information in the marking column attached to the matrix, and at the same time record the detailed data of the link pair at the abnormal time point for subsequent processing and analysis. For link pairs that do not exceed the preset fluctuation interval, record them as "normal status" with a marking value of 0.

[0113] Based on the abnormal marking information of the link pair, analyze the change of the difference at the time point according to the maximum value and the minimum value of each column, record the situation of abnormal growth by judging the change trend of the continuous difference, and generate the characteristics of dynamically abnormal links;

[0114] Integrate the maximum and minimum values ​​of the delay difference fluctuation range and the change trend, and mark the abnormal growth trend. First, extract the maximum and minimum values ​​of each column in the link delay difference matrix. For example, the maximum value of link i′-j is max(Δt i′j )=0.8, the minimum value is min(Δt i′j )=0.2, and record the corresponding time point positions at the same time. For example, the maximum value appears at time point k=4, and the minimum value appears at time point k=1. Among them, k+1 represents the next time point of the current time point k, which is used to calculate the difference between adjacent time points. Then calculate the fluctuation trend of the link pair, by analyzing the difference change Diff at each adjacent time point, Diff=Δt i′j (k+1)-Δt i′j (k) Determine the change trend. For example, the difference in the time point sequence is calculated as [0.2, 0.3, 0.5, 0.8, 0.4], and the difference sequence is [+0.1, +0.2, +0.3, -0.4]. By judging the sign and amplitude of the continuous difference, if the continuous change difference is positive and exceeds the preset growth threshold Threshold = 0.2, for example, three consecutive changes are +0.1, +0.2, +0.3, then the link pair is marked as having an abnormal growth trend, and the abnormal growth mark value is recorded in the additional matrix. Finally, the maximum value, minimum value, fluctuation range and abnormal mark are integrated to generate a dynamic state abnormal link feature matrix. Each row in the matrix corresponds to a link pair, including the link number, maximum value, minimum value, fluctuation range and abnormal mark, such as [i′-j, 0.8, 0.2, 0.6, abnormal], so as to be used for subsequent dynamic state monitoring and analysis.

[0115] See also Figure 6 ,The steps for calculating the status score of abnormal links are as follows:

[0116] Based on the abnormal links marked in the dynamic state abnormal link characteristics, extract their bit error rate time series data, normalize the bit error rate data according to the time series and draw a curve, identify the fluctuation inflection point in the curve and its corresponding growth characteristics, and obtain the bit error rate change analysis results;

[0117] The abnormal links marked in the dynamic state abnormal link characteristics are extracted and their bit error rate time series data are collected. The bit error rate time series data are normalized and converted into curve representation. First, the bit error rate time series data of the abnormal links are obtained from the network monitoring system. These data are collected at fixed time intervals. For example, the bit error rate of link i′-j at time points [t1, t2, t3, t4, t5] is [0.02, 0.04, 0.08, 0.12, 0.10]. The normalization process is to unify the bit error rate value into a fixed interval (such as [0, 1]). The normalization process is based on the maximum and minimum values ​​of the time series. Each bit error rate value is mapped to a unified range by scaling. For example, the maximum bit error rate of the time series is 0.12, and the minimum bit error rate is 0.02. The processed data is [0, 0.2, 0.6, 1, 0.8]. The normalized data points are plotted into a curve in chronological order, and the curve shows the dynamic change trend of the bit error rate. By analyzing the curve, determine the fluctuation inflection point in the bit error rate curve, for example, by calculating the bit error rate increment between adjacent time points to identify the time point with a large change or obvious increase, mark the corresponding fluctuation area and record the inflection point characteristics, such as the location of the fast growth time period, the bit error rate increment and change amplitude, etc. Combined with the characteristics of the abnormal link in the dynamic state, extract the growth characteristics of the bit error rate, including the growth rate, growth amplitude and distribution of abnormal change points.

[0118] Based on the bit error rate change analysis results, the formula is used:

[0119] S = α·G + β·V;

[0120] Calculate the status score S of the abnormal link. The higher the value, the worse the link status.

[0121] Among them, G represents the growth rate of the bit error rate, which is obtained by calculating the average increment of the bit error rate in the time series. The formula is: x k′ is the k'th value in the bit error rate time series, N' is the total number of time points, V represents the growth rate of the bit error rate, which is defined as the difference between the maximum and minimum values ​​of the time series, and the formula is: V = x max -x min , α and β are weight factors of the growth rate G and the growth amplitude V, respectively, which are determined by analyzing the significance of the impact of historical data on link performance. For example, in the analysis, it is found that the impact of the growth rate on the link performance accounts for 60%, and the growth amplitude accounts for 40%, then α = 0.6, β = 0.4.

[0122] For example, obtain the bit error rate time series [0.02, 0.04, 0.08, 0.12, 0.10] and calculate the growth rate G:

[0123]

[0124] Calculate the growth rate V:

[0125] V = x max -x min =0.12-0.02=0.10;

[0126] Substitute the weight coefficients α = 0.6, β = 0.4:

[0127] S=α·G+β·V=0.6·0.02+0.4·0.10=0.052

[0128] The results show that the status score S = 0.052, indicating that the link status is slightly abnormal. The risk level of the link can be further classified by the status score. For example, a threshold can be set according to the score (such as S>0.1 is a high-risk link) to screen out risky links.

[0129] See also Figure 7 ,The steps for obtaining the link stability trend features are as follows:

[0130] Select risky links based on the status scores of abnormal links, extract historical bit error rate data and perform normalization, convert the normalized bit error rate values ​​into curve representation, analyze the fluctuation inflection points and growth characteristics based on the curve, and generate bit error rate growth characteristic data;

[0131] First, extract the status score data corresponding to each abnormal link, and record the status score in a table according to the link number, for example, the score of link AB is 0.15, the score of link CD is 0.08, and the score of link EF is 0.25. Then sort the score data and arrange them from high to low according to the score, so as to screen out the links with higher scores as high-risk links. For links with score data greater than a specific threshold, such as links with scores greater than 0.1, they are marked as high-risk links, and the threshold range is determined by statistical analysis of the historical score data, such as the 90% quantile status score as the threshold. In the screening process, the historical bit error rate characteristics of the link are combined, for example, the historical change records of the bit error rate growth rate and growth range of the links with scores higher than the threshold are further checked to verify the accuracy of the scoring results. Finally, the numbers of the screened high-risk links are recorded in a list, for example, link EF and link AB are marked as high-risk links.

[0132] Based on the bit error rate growth characteristic data, the bit error rate change trend and status score change trend are analyzed to predict the future operation status of the risk link and generate the link stability trend characteristics;

[0133] Based on the historical operation data of the high-risk links selected in the previous paragraph, extract the bit error rate time series and status score time series. For example, the bit error rate of link EF in the past five time points is recorded as [0.02, 0.04, 0.06, 0.08, 0.12], and the status score is recorded as [0.10, 0.15, 0.20, 0.25, 0.30]. Through the trend analysis of the time series, the linear regression method is used to predict the future bit error rate and status score changes. The goal of linear regression is to find an optimal fitting line y = ax' + b, where x' represents the time point, y represents the bit error rate or status score value predicted at the time point, a represents the slope of the trend (i.e., the growth rate at each time point), and b represents the intercept (i.e., the starting value of the trend line when the time point is zero). The fitting process uses the least squares method to calculate the specific values ​​of a and b. For example, for the bit error rate time series of link EF, with time points x'=1,2,3,4,5 as the horizontal coordinate and the bit error rate value as the vertical coordinate, the slope a=0.025 and the intercept b=0.01 are calculated, and the fitting formula is y=0.025x'+0.01. According to the fitting formula, the bit error rate at the next time point x=6 is predicted to be y=0.025·6+0.01=0.16. Similarly, for the state score time series, the same method is used for fitting calculation to obtain the fitting formula for predicting score changes. For example, the fitting result is y=0.05x'+0.05, and the state score predicted at the next time point x'=6 is y=0.05·6+0.05=0.35. During the prediction process, the growth rate and fluctuation range can also be calculated in combination with historical data. By adjusting the fluctuation range of the predicted value, the robustness of the prediction results can be increased. For example, the predicted bit error rate is fluctuated by 5% to obtain a bit error rate range of [0.152, 0.168] and a predicted status score range of [0.332, 0.368]. Finally, the prediction results are integrated into link stability trend features, including the bit error rate variation range at future time points, the predicted status score variation trend, and the preliminary judgment of the risk level (for example, a predicted score exceeding 0.4 is a high-risk link). Combined with the predicted bit error rate and score trend, a link operation status trend chart is generated, and relevant results are recorded to generate a high-risk link operation status report, providing data support for subsequent link operation and maintenance and risk intervention.

[0134] See also Figure 8 ,The specific steps for obtaining the traffic optimization results of the risk link are:

[0135] Based on the trend characteristics of link stability, the flow input and output data of the upstream and downstream nodes of the risk link are collected, the flow ratio of the upstream and downstream nodes and the resource occupancy of the links in the transmission path are analyzed, and a link resource occupancy table is generated;

[0136] First, the marked risk link and its upstream and downstream node information are extracted through the network monitoring module, and the flow input and output data of the upstream and downstream nodes are obtained in real time in combination with the flow collection device. For example, for the risk link AB, its upstream and downstream nodes are nodes X and Y. The flow input data of node X is collected as [500, 600, 700, 800] Mbps, and the flow output data is collected as [480, 580, 690, 780] Mbps, and the flow input data of node Y is collected as [300, 400, 500, 600] Mbps, and the flow output data is collected as [290, 390, 480, 590] Mbps. After obtaining the data, the flow distribution ratio of the upstream and downstream nodes is calculated. For example, the ratio of the flow output to the input of node X is calculated at the time point to obtain the ratio sequence [0.96, 0.97, 0.99, 0.975], and the flow ratio of node Y is [0.97, 0.975, 0.96, 0.983]. At the same time, the resource occupancy of the links in the transmission path is analyzed, for example, the bandwidth utilization of link AB is calculated. Bandwidth utilization is defined as the ratio of the total link traffic to its physical bandwidth. Assuming that the bandwidth of link AB is 1000Mbps, its utilization is [80%, 98%, 117%, 137%] at different time points. Based on the above analysis results, the upstream and downstream node traffic characteristic table and link resource occupancy table are generated to provide a basis for subsequent risk link traffic optimization.

[0137] Based on the link resource occupancy table, filter out risk links whose resource occupancy exceeds the threshold, extract alternative paths and reallocate the traffic paths of risk links, adjust traffic distribution, and generate traffic optimization results for risk links;

[0138] First, based on the link resource occupancy obtained in the previous section, the links whose bandwidth utilization exceeds the threshold are screened out. For example, the utilization of link AB at time points [t3, t4] has reached 117% and 137% respectively, and is marked as a link that needs to be optimized. Next, based on the network topology information, the available alternative paths are extracted. For example, the alternative paths of link AB are ACDB and AEB, and the resource occupancy, transmission delay and link stability data of these paths are collected. For example, the average utilization of path ACDB is 75%, the transmission delay is 30ms, and the stability score is 0.85; the average utilization of path AEB is 60%, the transmission delay is 50ms, and the stability score is 0.80. In the comprehensive analysis of the alternative paths, the path with the highest priority is selected, such as path ACDB, and part of the traffic of the original link AB is switched to this path. After adjustment, the traffic is redistributed at a ratio of 50% to ensure that the utilization of link AB drops to a safe range. For example, the utilization is adjusted to [80%, 90%, 95%, 98%] after optimization. Finally, the adjusted traffic path and allocation ratio are recorded, and a traffic optimization result report is generated to provide input data for subsequent link performance monitoring and operation and maintenance adjustments.

[0139] The above are only preferred embodiments of the present invention and are not intended to limit the present invention in other forms. Any technician familiar with the profession may use the technical contents disclosed above to change or modify them into equivalent embodiments with equivalent changes and apply them to other fields. However, any simple modification, equivalent change and modification made to the above embodiments based on the technical essence of the present invention without departing from the technical solution of the present invention still falls within the protection scope of the technical solution of the present invention.

Claims

1. A network operation and maintenance monitoring system based on intelligent analysis, characterized in that: The system comprises: The link load balancing module collects the traffic input and output data associated with the current scenario in the network link, determines the initial partition range of the network link, divides the link partition with a traffic density exceeding a preset load threshold into multiple sub-segments, and obtains link segmentation load distribution information; The link status dynamic monitoring module obtains the link pair set corresponding to each sub-segment in the link based on the link segmentation load distribution information, constructs a link delay difference matrix, analyzes the delay difference fluctuation range according to the link delay difference matrix, marks the abnormal growth trend, and obtains the dynamic state abnormal link characteristics; The link stability analysis module extracts the abnormal links marked in the dynamic state abnormal link characteristics and collects their bit error rate time series data, obtains the bit error rate growth characteristics, calculates the state score of the abnormal link according to the bit error rate growth characteristics, selects the risk link according to the state score of the abnormal link, predicts the future operation state of the risk link, and generates the link stability trend characteristics; Based on the link stability trend characteristics, the network traffic optimization module collects traffic input data and output data of upstream and downstream nodes of the risk link, adjusts the traffic distribution of the risk link, and obtains the traffic optimization result of the risk link.

2. The network operation and maintenance monitoring system based on intelligent analysis according to claim 1 is characterized in that: The step of determining the initial partition range of the network link is specifically as follows: Based on the traffic input and output data associated with the current scenario in the network link, the data volume and timestamp information of the traffic entering and flowing out of the link are collected through network monitoring to generate a data set of traffic input and output; Based on the data set of the flow input and output, the formula is used: Calculate the link traffic density ρ; Where F represents the total amount of traffic passing through the link during the statistical time period, B is the link bandwidth, and T represents the statistical time window; Based on the link traffic density distribution and network topology information, the node connection relationship and bandwidth information in the link are collected, the links whose traffic density exceeds the partition threshold are marked, and the initial partition range is divided according to the connection attributes between the nodes to generate the partition range and the corresponding traffic density record.

3. The network operation and maintenance monitoring system based on intelligent analysis according to claim 2 is characterized in that: The steps for obtaining the link subdivision load distribution information are specifically as follows: Based on the partition range and the corresponding traffic density records, the traffic density of each link in the partition is monitored and compared, links with traffic density exceeding a load threshold are screened out and divided into multiple sub-segments, and sub-segment data of the link partition is obtained; Based on the sub-segment data of the link partition, the formula is adopted: Calculate the traffic distribution ratio β of the i-th sub-segment i , obtain link segmentation load distribution information; Among them, ρ i represents the flow density of the ith subsegment, and ∑ρ represents the sum of the flow densities of all subsegments.

4. The network operation and maintenance monitoring system based on intelligent analysis according to claim 3 is characterized in that: The steps of constructing the link delay difference matrix are specifically as follows: Based on the link segmentation load distribution information, a link pair set corresponding to each sub-segment in the link is obtained, transmission delay data of the link pair is extracted from the link pair set, and a transmission delay data set of the link is established; Based on the transmission delay data set of the established link, the formula is used: Calculate the relative transmission delay difference Δt between link i′ and link j at time point k i′j ( k ) , construct a link delay difference matrix according to the transmission delay difference; Among them, t i′ (k) represents the transmission delay of link i′ at time point k, t j (k) represents the transmission delay of link j at time point k, t avg (k) represents the average transmission delay of all monitored links at time point k.

5. The network operation and maintenance monitoring system based on intelligent analysis according to claim 4 is characterized in that: The steps for acquiring the dynamic state abnormal link characteristics are specifically as follows: According to the link delay difference matrix, extract the delay difference sequence of the link pair corresponding to each column from the matrix, obtain the maximum value and the minimum value in the delay difference sequence, analyze the fluctuation range of the delay difference sequence, compare the fluctuation range with the preset fluctuation range, record whether the state exceeds the preset range, and obtain abnormal marking information of the link pair; Based on the abnormal marking information of the link pair, the difference change at the time point is analyzed according to the maximum and minimum values ​​of each column, and the abnormal growth situation is recorded by judging the changing trend of the continuous difference to generate the dynamic state abnormal link feature.

6. The network operation and maintenance monitoring system based on intelligent analysis according to claim 5 is characterized in that: The step of calculating the status score of the abnormal link is specifically as follows: Based on the abnormal link marked in the dynamic state abnormal link feature, extract its bit error rate time series data, normalize the bit error rate data according to the time series and draw it into a curve, identify the fluctuation inflection point in the curve and its corresponding growth characteristics, and obtain the bit error rate change analysis result; Based on the bit error rate change analysis results, the formula is used: S = α·G + β·V; Calculate the status score S of the abnormal link; Wherein, G represents the growth rate of the bit error rate, V represents the growth amplitude of the bit error rate, and α and β are weight factors of the growth rate G and the growth amplitude V respectively.

7. The network operation and maintenance monitoring system based on intelligent analysis according to claim 6 is characterized in that: The steps for obtaining the link stability trend feature are specifically as follows: Selecting risky links according to the status scores of the abnormal links, extracting historical bit error rate data and performing normalization processing, converting the normalized bit error rate values ​​into curve representations, analyzing fluctuation inflection points and growth characteristics in combination with the curves, and generating bit error rate growth characteristic data; Based on the bit error rate growth characteristic data, the bit error rate change trend and the status score change trend are analyzed, the future operation status of the risk link is predicted, and the link stability trend characteristics are generated.

8. The network operation and maintenance monitoring system based on intelligent analysis according to claim 7 is characterized in that: The steps for obtaining the traffic optimization result of the risk link are specifically as follows: Based on the link stability trend characteristics, the flow input data and output data of the upstream and downstream nodes of the risk link are collected, the flow ratio of the upstream and downstream nodes and the resource occupancy of the links in the transmission path are analyzed, and a link resource occupancy table is generated; Based on the link resource occupancy table, risk links whose resource occupancy exceeds a threshold are screened, alternative paths are extracted and traffic paths of risk links are reallocated, traffic distribution is adjusted, and traffic optimization results of risk links are generated.

Images