A network device fault dynamic monitoring method

Abstract

The application discloses a kind of network equipment failure dynamic monitoring methods, comprising the following steps: collection equipment state data and log data;Preset threshold rule and abnormality detection model, equipment state data and log data are analyzed, obtain fault message set;Get equipment historical state data;Equipment historical state data are aggregated and counted, obtain the failure mode and abnormal trend of equipment;Based on fault message set, and the failure mode and abnormal trend of equipment, generate fault diagnosis report;Based on fault diagnosis report, the discrete fault message of different equipment, different time period is associated, constructs fault propagation graph atlas;Based on fault propagation graph atlas, in combination with shortest path analysis, realize fault location.The application realizes efficient fault monitoring, intelligent diagnosis and fast positioning under the heterogeneous network environment, significantly improves the availability and stability of network, provides strong support for the operation and maintenance management of large-scale complex network.

Description

Technical Field

[0001] This invention belongs to the field of network fault monitoring technology, and in particular relates to a method for dynamic monitoring of network device faults. Background Technology

[0002] Dynamic monitoring of network device faults is a complex technical challenge. In real-world network environments, there is a wide variety of devices, and fault messages generated by devices from different manufacturers vary in format. How to efficiently and accurately collect and parse these heterogeneous message formats is a problem that urgently needs to be solved. Furthermore, the sheer number of network devices generates massive amounts of status data and logs every moment. Facing such massive amounts of data, quickly filtering out genuine fault messages and eliminating redundant and irrelevant information is also a significant challenge.

[0003] Meanwhile, fault messages from a single device may be discrete and fragmented, making it difficult to directly pinpoint the root cause of the problem. Therefore, how to perform correlation analysis on fault messages from different devices and time periods to find the context and causal chain of the fault, and thus achieve accurate fault localization, is also a technical challenge.

[0004] On the other hand, network failures are sudden and dynamic, making it difficult for traditional periodic polling methods to detect them in real time. While event-triggered proactive reporting mechanisms can capture failures promptly, they may also generate a large number of duplicate and redundant messages, increasing the burden on the analysis system. Finding a balance between real-time performance and efficiency is another problem that dynamic monitoring methods need to address.

[0005] In summary, dynamic monitoring of network device faults involves multiple stages, including message collection, data parsing, information filtering, correlation analysis, and real-time response. It requires comprehensive consideration of multiple factors such as heterogeneity, massive scale, fragmentation, and dynamism, making it a complex systems engineering project. To address these issues, there is an urgent need to propose a method for dynamic monitoring of network device faults. Summary of the Invention

[0006] To address the aforementioned technical problems, this invention proposes a dynamic monitoring method for network device faults, thereby resolving the issues present in the prior art.

[0007] To achieve the above objectives, the present invention provides a method for dynamic monitoring of network device faults, comprising the following steps:

[0008] Collect device status data and log data;

[0009] A set of fault messages is obtained by analyzing device status data and log data based on preset threshold rules and anomaly detection models.

[0010] Obtain historical device status data;

[0011] By aggregating and statistically analyzing the historical status data of the equipment, the failure modes and abnormal trends of the equipment can be obtained.

[0012] Based on the set of fault messages, as well as the fault modes and abnormal trends of the device, a fault diagnosis report is generated.

[0013] Based on the fault diagnosis report, discrete fault messages from different devices and time periods are correlated to construct a fault propagation map;

[0014] Based on the aforementioned fault propagation map and combined with shortest path analysis, fault location is achieved.

[0015] Optionally, after collecting device status data and log data, the process may also include:

[0016] A distributed message queue is used to access and cache the device status data and log data in real time to obtain a real-time data stream; a streaming processing framework is used to process the real-time data stream in real time.

[0017] Optionally, the process of aggregating and statistically analyzing the historical status data of the equipment to obtain the equipment's failure modes and abnormal trends includes:

[0018] A time window segmentation method is used to divide the historical status data of the equipment into multiple time segments. For the historical status data of the equipment within each time segment, a batch processing framework is used for parallel computing. A clustering algorithm is used to perform cluster analysis on the historical status data of the equipment, and the normal working state and abnormal state of the equipment are determined based on the clustering results. Based on the abnormal state data, an association rule mining algorithm is used to mine the association rules between abnormal states of the equipment to obtain the failure modes of the equipment. For the historical status data of the equipment, a time series analysis method is used to obtain the abnormal trends of the equipment.

[0019] Optionally, based on the fault diagnosis report, the process of associating discrete fault messages from different devices and different time periods to construct a fault propagation map includes:

[0020] A network topology graph is pre-constructed, mapping fault messages to corresponding device nodes to form a network topology graph with fault attributes. An association rule mining algorithm is used to analyze the fault correlation between different device nodes, obtaining a fault propagation probability matrix between devices. A directed weighted graph is constructed based on the fault propagation probability matrix, and a shortest path algorithm is applied to obtain the shortest propagation path from each fault node to other nodes. Key propagation paths are determined based on path length and edge weight. The network topology graph with fault attributes is partitioned using a connected component algorithm, grouping strongly correlated fault nodes into the same connected component to form multiple independent fault propagation graphs.

[0021] In the directed weighted graph, nodes represent devices, edges represent fault propagation relationships between devices, and edge weights represent fault propagation probabilities.

[0022] Optionally, based on the fault propagation map and combined with shortest path analysis, the process of fault localization includes:

[0023] In each fault propagation graph, the root cause node is identified, and then combined with the shortest path analysis results, the critical propagation path triggered by the root cause node is determined, thereby achieving fault location.

[0024] Optionally, the anomaly detection model is constructed using a decision tree algorithm or a random forest algorithm.

[0025] The present invention also provides a network device fault dynamic monitoring system for implementing a network device fault dynamic monitoring method, comprising: a data acquisition module, a fault detection module, a historical statistics module, a report generation module, a fault association module, and a fault location module;

[0026] The data acquisition module is used to collect device status data and log data in real time;

[0027] The fault detection module is used to preset threshold rules and anomaly detection models, and analyzes equipment status data and log data based on the threshold rules and anomaly detection models to obtain a set of fault messages.

[0028] The historical statistics module is used to acquire historical status data of the equipment and aggregate and statistically analyze the historical status data of the equipment to obtain the equipment's failure modes and abnormal trends.

[0029] The report generation module is used to generate a fault diagnosis report based on the fault message set, as well as the fault modes and abnormal trends of the device.

[0030] The fault association module is used to associate discrete fault messages from different devices and different time periods based on the fault diagnosis report, and construct a fault propagation map.

[0031] The fault location module is used to locate faults based on the fault propagation map and shortest path analysis.

[0032] Optionally, the fault association module includes a topology graph construction unit, an association analysis unit, and a topology graph partitioning unit;

[0033] The topology graph construction unit is used to pre-build a network topology graph, map fault messages to corresponding device nodes, and form a network topology graph with fault attributes.

[0034] The correlation analysis unit is used to analyze the fault correlation between different device nodes using the association rule mining algorithm, obtain the fault propagation probability matrix between devices, construct a directed weighted graph based on the fault propagation probability matrix, apply the shortest path algorithm on the directed weighted graph to obtain the shortest propagation path from each fault node to other nodes, and determine the key propagation path according to the path length and edge weight.

[0035] The topology graph partitioning unit is used to partition the network topology graph with fault attributes using the connected component algorithm, and to partition strongly correlated fault nodes into the same connected component to form multiple independent fault propagation graphs.

[0036] The present invention also provides an electronic device, comprising: a memory and a processor; the memory for storing a program; and the processor for executing the program to implement the various steps of the network device fault dynamic monitoring method.

[0037] The present invention also provides a readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, it implements the various steps of a method for dynamic monitoring of network device faults.

[0038] Compared with the prior art, the present invention has the following advantages and technical effects:

[0039] Real-time monitoring and fault early warning: This invention collects equipment status data and log data in real time, and analyzes them in conjunction with preset threshold rules and anomaly detection models. This enables timely detection of equipment faults and anomalies, providing fault early warning and alarms. This helps maintenance personnel respond quickly and take measures to avoid downtime or business interruptions caused by equipment failures.

[0040] Fault Diagnosis Report Generation: This invention aggregates and statistically analyzes historical equipment status data to obtain fault modes and anomaly trends, and generates a fault diagnosis report by combining this data with a set of fault messages. Such reports help maintenance personnel gain a deeper understanding of the equipment's operational status and trends, providing support for decision-making.

[0041] Fault Propagation Map Construction: Based on fault diagnosis reports, this invention correlates discrete fault messages from different devices and time periods to construct a fault propagation map. This step helps analyze the mutual influence and propagation paths between faults, thereby providing a more comprehensive understanding of the global impact of the faults.

[0042] Fault Localization: This invention utilizes a fault propagation map and combines it with shortest path analysis to achieve precise fault localization. This method simplifies the algorithm process, updating only the affected portion of the map without needing to repair the entire map, thus improving the efficiency and accuracy of fault localization.

[0043] This invention enables efficient fault monitoring, intelligent diagnosis, and rapid location in heterogeneous network environments, significantly improving network availability and stability, and providing strong support for the operation and maintenance management of large-scale complex networks. Attached Figure Description

[0044] The accompanying drawings, which form part of this application, are used to provide a further understanding of this application. The illustrative embodiments and descriptions of this application are used to explain this application and do not constitute an undue limitation of this application. In the drawings:

[0045] Figure 1 This is a flowchart of a method according to an embodiment of the present invention. Detailed Implementation

[0046] It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other. This application will now be described in detail with reference to the accompanying drawings and embodiments.

[0047] It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.

[0048] Example 1

[0049] like Figure 1 As shown, this embodiment provides a method for dynamic monitoring of network device faults, including the following steps:

[0050] Collect device status data and log data;

[0051] A set of fault messages is obtained by analyzing device status data and log data based on preset threshold rules and anomaly detection models.

[0052] Obtain historical device status data;

[0053] By aggregating and statistically analyzing the historical status data of the equipment, the failure modes and abnormal trends of the equipment can be obtained.

[0054] Based on the set of fault messages, as well as the fault modes and abnormal trends of the device, a fault diagnosis report is generated.

[0055] Based on the fault diagnosis report, discrete fault messages from different devices and time periods are correlated to construct a fault propagation map;

[0056] Based on the aforementioned fault propagation map and combined with shortest path analysis, fault location is achieved.

[0057] It is feasible to collect device status data and log data in real time. For massive amounts of device status data and logs, a distributed big data processing framework such as Spark is used to perform real-time streaming computation and batch analysis on the data. By setting threshold rules and anomaly detection algorithms, potential fault messages can be quickly identified. The specific process includes:

[0058] The system acquires device status data and log data, and uses a distributed message queue to perform real-time access and caching of the data to obtain a real-time data stream. For this real-time data stream, a streaming processing framework is used for real-time processing. Potential fault messages are identified through preset threshold rules and anomaly detection models to obtain a fault message set. Historical device status data is acquired, and a batch processing framework is used to perform aggregation calculations and statistical analysis on this data to uncover device fault patterns and anomaly trends. Based on the fault message set and the fault patterns and anomaly trends, fault alarms and diagnostic reports are automatically generated. The fault alarms are acquired and centrally managed. The system displays and presents fault messages; for the set of fault messages, a rule-based expert system and a decision tree model are used to automatically generate fault handling suggestions and solutions; wherein, the rule base of the expert system contains common causes of equipment faults and handling measures, and the decision tree model predicts the most common fault causes based on a combination of equipment status characteristics; historical fault data of the fault management module is obtained, and time series analysis and correlation analysis models are used to mine the temporal patterns and correlations of equipment faults, and predict the health status and potential risks of the equipment; for the historical fault data, a machine learning classification algorithm is used to train a fault prediction model through feature extraction and selection, and to provide early warning of future equipment faults.

[0059] Furthermore, in fault diagnosis and source tracing analysis, machine learning algorithms such as decision trees and random forests are used to learn from historical fault cases, summarize the patterns and rules of fault occurrence, build anomaly detection models, automatically classify and deduce the causes of newly occurring faults, and assist maintenance personnel in quickly locating and solving problems.

[0060] Furthermore, the process of acquiring historical equipment status data, and using a batch processing framework to aggregate, calculate, and statistically analyze this historical equipment status data to uncover equipment failure modes and abnormal trends includes:

[0061] Historical equipment status data over a given period is acquired and divided into multiple time segments using a time window method. For each time segment, a batch processing framework is employed for parallel computation to improve data processing efficiency. Within this framework, a clustering algorithm is used to analyze the equipment status data, determining normal and abnormal states based on the clustering results. For the abnormal state data obtained from the clustering analysis, an association rule mining algorithm is used to uncover association rules between abnormal states, identifying equipment failure modes. Based on the association rule mining results, it is determined whether the current equipment status conforms to a known failure mode; if so, a failure alarm is triggered. For the historical status data, time series analysis is used to determine if there are abnormal fluctuation trends in equipment status parameters; if so, a warning is issued indicating potential equipment failure. Based on the historical statistical analysis results of equipment status, combined with an equipment health management knowledge base, the health status of the equipment is assessed, generating an equipment health report.

[0062] As an feasible approach, historical equipment status data over a period of time is acquired, such as sensor data from the past week, including temperature, pressure, and vibration frequency. A time windowing method is used to divide the week's data into seven time segments, each based on a day. For each day's equipment status data, the Spark batch processing framework is used for parallel computation, distributing the daily data across different computing nodes to accelerate data processing. Within the Spark framework, the K-Means clustering algorithm is used to perform cluster analysis on the equipment status data. For example, based on the three indicators of temperature, pressure, and vibration frequency, the equipment status is clustered into three categories: normal, inefficient, and faulty. The cluster centers are (25℃, 1.0MPa, 10Hz), (30℃, 1.2MPa, 15Hz), and (40℃, 1.5MPa, 20Hz), respectively. Based on the clustering results, the normal and abnormal states of the equipment in different time segments are determined. If the cluster center of the equipment status data for a particular day is (40℃, 1.5MPa, 20Hz), then the equipment is determined to be in a faulty state. For the abnormal state data obtained from cluster analysis, the Apriori association rule mining algorithm is used to mine association rules between abnormal equipment states. For example, the rule "high temperature → high pressure" was found, with a support of 80% and a confidence of 90%. This means that when the temperature rises, there is a 90% probability that the pressure will also rise. This rule reveals the equipment failure mode: increased temperature leads to increased pressure, which may eventually cause equipment failure. Based on the results of association rule mining, it is determined whether the current equipment state conforms to the known failure mode. For example, if the current equipment temperature is 38℃ and the pressure is 1.4MPa, it is considered to conform to the "high temperature → high pressure" failure mode, triggering a fault alarm and notifying maintenance personnel for repair. For historical state data, the ARIMA time series analysis method is used to determine whether there are abnormal fluctuation trends in equipment state parameters. For example, analyzing the temperature data of the past week and finding that the temperature shows an upward trend and exceeds the normal range, a warning is issued that the equipment may fail, and maintenance is arranged in advance to avoid failure. Based on historical statistical analysis of equipment status, such as the average, maximum, and minimum temperatures over the past month, and combined with an equipment health management knowledge base (e.g., temperatures exceeding 45℃ can cause equipment damage), the equipment's health status is assessed, and an equipment health report is generated. For example, the report might show a health score of 80, indicating good condition, but with an upward trend in temperature, requiring attention. This approach provides a comprehensive assessment of the equipment's health status, offers early warnings, and guides maintenance efforts.

[0063] This embodiment obtains the equipment's fault modes and anomaly trends by aggregating and statistically analyzing historical equipment status data, and generates a fault diagnosis report by combining this data with a set of fault messages. Such a report helps maintenance personnel gain a deeper understanding of the equipment's operating status and trends, providing support for decision-making.

[0064] Feasible methods include using graph-based association analysis algorithms to associate discrete fault messages from different devices and time periods, constructing a fault propagation graph, and using graph algorithms such as shortest path and connected component analysis to identify the root cause device and critical propagation paths, thus achieving precise fault localization.

[0065] This process involves acquiring discrete fault messages generated by different devices within different time periods, and extracting key information such as the faulty device, fault time, and fault description for each message. Based on a pre-constructed network topology, fault messages are mapped to corresponding device nodes, forming a network topology with fault attributes. An association rule mining algorithm is used to analyze the fault correlations between different device nodes, obtaining a fault propagation probability matrix between devices. A directed weighted graph is constructed based on the fault propagation probability matrix, where nodes represent devices, edges represent fault propagation relationships between devices, and edge weights represent fault propagation probabilities. A shortest path algorithm is applied to the directed weighted graph to calculate the shortest propagation path from each faulty node to other nodes, and critical propagation paths are determined based on path length and edge weights. A connected component algorithm is used to partition the graph, grouping strongly correlated faulty nodes into the same connected component, forming multiple independent fault propagation subgraphs. In each fault propagation subgraph, the node with an in-degree of 0 is identified as the root node. Combined with the shortest path analysis results, the critical propagation path triggered by the root node is determined, thereby achieving precise fault location.

[0066] As an feasible approach, discrete fault messages generated by different devices at different time periods are obtained. For example, within a certain time period, router A experiences a connection timeout fault, server B experiences a CPU overload fault, and switch C experiences a port congestion fault. For each fault message, key information is extracted. For example, the fault information for router A includes: device name is router A, fault time is October 27, 2024, 10:00 AM, and fault description is connection timeout. Extracting this key information is for subsequent fault analysis and processing. Based on a pre-constructed network topology diagram, fault messages are mapped to corresponding device nodes. For example, the connection timeout fault of router A is mapped to the router A node in the network topology diagram, and the fault information is used as an attribute of the node. In this way, the network topology diagram not only includes the connection relationships of devices but also the fault information of devices. Forming a network topology diagram with fault attributes can intuitively show which devices have failed and the types of failures. Association rule mining algorithms are used to analyze the fault correlations between different device nodes. For example, the analysis found that when router A experiences a connection timeout fault, server B has an 80% probability of experiencing a CPU overload fault. This indicates that a failure in router A may lead to a failure in server B. The analysis results can be represented by a fault propagation probability matrix, where the rows and columns represent device nodes, and the matrix elements represent the probability of fault propagation between devices. A directed weighted graph is constructed based on the fault propagation probability matrix. For example, if the probability of fault propagation from router A to server B is 80%, then in the directed weighted graph, there is a directed edge from router A to server B with a weight of 0.8. Constructing a directed weighted graph can more clearly show the fault propagation relationships between devices. The shortest path algorithm is applied to the directed weighted graph. For example, the shortest path for a connection timeout fault from router A to database server D is calculated. If the sum of the path weights from router A to server B and then to database server D is minimized, then this path is the shortest propagation path. The shortest path algorithm can help quickly find the critical path for fault propagation. The graph is partitioned using a connected component algorithm. For example, strongly related routers A, server B, and load balancer E are partitioned into one connected component, and switch C and server F are partitioned into another connected component. This approach simplifies complex fault propagation graphs into multiple independent fault propagation subgraphs, facilitating analysis and processing. In each subgraph, the node with an in-degree of 0 is identified as the root source node. For example, in a subgraph containing router A, server B, and load balancer E, if router A has an in-degree of 0, then router A is the root source node. This indicates that a failure of router A is likely the root cause of failures in other devices within that subgraph. Combining the shortest path analysis results, the critical propagation path originating from the root source node is determined. For instance, if the shortest path from router A to server B and then to load balancer E is the shortest and the edges along that path have high weights, then that path is the critical propagation path.This indicates that a fault in router A is likely propagating along this path to server B and load balancer E. By analyzing the root cause and critical propagation path, the source of the fault can be precisely located, and corresponding measures can be taken to address it, such as fixing the connection timeout fault in router A, thereby preventing other devices from being affected. This approach improves the efficiency of fault handling and reduces the losses caused by the fault.

[0067] Furthermore, based on the pre-established network topology and key device list, lightweight monitoring probes are deployed on each key device. These probes employ an event-driven mechanism to collect real-time status data such as CPU utilization, memory usage, and network traffic. The monitoring probes compare the collected status data with preset anomaly thresholds. If any indicator exceeds the threshold, an anomaly event is immediately triggered, and the anomaly data is packaged into a message and sent to the monitoring center via a message queue. A peak-shaving and valley-filling module is deployed at the monitoring center. This module subscribes to anomaly messages in the message queue. When a large number of anomaly messages are received in a short period, the peak-shaving and valley-filling module prioritizes the messages, handling anomalies with higher urgency first. The module extracts key information from the anomaly messages, such as the faulty device's IP address, fault occurrence time, and fault type. It then uses a fault diagnosis algorithm to make a preliminary judgment on the cause of the fault, ranking the probabilities of the causes. Based on this ranking, the module retrieves corresponding fault handling solutions from a knowledge base. Simultaneously, the fault information is notified to on-duty personnel, who execute the steps in the fault handling solution, addressing the faulty device through remote control, parameter adjustments, or other methods. During the troubleshooting process, equipment status data is collected and fed back to the monitoring center. The monitoring center determines whether the fault has been resolved based on changes in equipment status after fault handling. If the fault has been resolved, the fault handling plan in the knowledge base is updated; if the fault has not been resolved, the fault information is submitted to experts for further analysis.

[0068] As an implementable approach, network topology can be understood as a "map" of connections and interactions between devices. A list of critical devices refers to those playing important roles in the network, such as core routers and critical servers. Deploying lightweight monitoring probes on these critical devices can be understood as installing "mini-monitors" on these important nodes to monitor the operational status of the devices in real time. The probes use an event-driven mechanism, acting like an alarm, only triggering when device metrics exceed preset thresholds, thus avoiding unnecessary resource consumption. For example, a CPU utilization threshold can be set to 80%; when the probe detects CPU utilization exceeding 80%, it will immediately trigger an abnormal event. Assume there is a critical server in the network with the IP address 192.168.1.10. The monitoring probe collects the server's CPU utilization, memory usage, and network traffic in real time. At a certain moment, the probe detected that the CPU utilization had reached 95%, exceeding the preset threshold of 80%, thus triggering an anomaly event and packaging the abnormal data into a message: "Server 192.168.1.10, Time 2024-07-27 10:00:00, CPU utilization 95%". This message was sent to the monitoring center via a message queue. The peak shaving and valley filling module in the monitoring center acts like a "traffic scheduler," receiving abnormal messages from various probes. If a large number of abnormal messages are received in a short period, it will process them according to their priority. For example, a failure of the core router has a higher priority than a failure of a regular server. Suppose that at the same time, in addition to the CPU alarm from server 192.168.1.10, a disk space shortage alarm is also received from another server, 192.168.1.20. Since excessively high CPU utilization is usually more urgent than insufficient disk space, the peak shaving and valley filling module will prioritize processing the CPU alarm from server 192.168.1.10. The peak shaving and valley filling module extracts key information from abnormal messages, such as server 192.168.1.10 having a CPU utilization of 95%. Then, it uses a fault diagnosis algorithm to make a preliminary judgment on the cause of the fault. For example, excessive CPU utilization might be due to a process consuming too many resources. The fault diagnosis algorithm will provide several possible causes and their probability ranking, such as: process A consuming too many resources (probability 80%), virus infection (probability 15%), hardware failure (probability 5%). Based on the probability ranking of the fault causes, the peak shaving and valley filling module retrieves the corresponding fault handling solution from the knowledge base. The module sends this solution to the on-duty personnel and attempts to restart process A. During the process, it collects device status data, such as changes in CPU utilization, and feeds the data back to the monitoring center. The monitoring center determines whether the fault has been recovered based on the changes in the device status after fault handling. For example, if the CPU utilization of server 192.168.1.10 drops to a normal level, the fault is considered recovered.At this point, the monitoring center updates its knowledge base, for example, marking "restarting process A" as a valid solution. If the fault is not resolved, the fault information is submitted to experts for further analysis. For example, experts might analyze the log files of process A to determine the root cause of its excessive resource consumption. This process continuously improves the knowledge base, increases the efficiency of fault handling, and provides experts with more detailed information for in-depth analysis.

[0069] This embodiment, based on fault diagnosis reports, correlates discrete fault messages from different devices and time periods to construct a fault propagation graph. This step helps analyze the mutual influence and propagation paths between faults, thus providing a more comprehensive understanding of the global impact of the fault. Then, using the fault propagation graph and combining it with shortest path analysis, precise fault location can be achieved. This method simplifies the algorithm process, updating only the affected portion of the graph without needing to repair the entire graph, thus improving the efficiency and accuracy of fault location.

[0070] This embodiment also provides a network device fault dynamic monitoring system for implementing a network device fault dynamic monitoring method, including: a data acquisition module, a fault detection module, a historical statistics module, a report generation module, a fault association module, and a fault location module;

[0071] The data acquisition module is used to collect device status data and log data in real time;

[0072] The fault detection module is used to preset threshold rules and anomaly detection models, and analyzes equipment status data and log data based on the threshold rules and anomaly detection models to obtain a set of fault messages;

[0073] The historical statistics module is used to acquire historical status data of the equipment and aggregate and statistically analyze the historical status data to obtain the equipment's failure modes and abnormal trends.

[0074] The report generation module is used to generate a fault diagnosis report based on the fault message set, as well as the fault modes and abnormal trends of the device;

[0075] The fault association module is used to associate discrete fault messages from different devices and time periods based on the fault diagnosis report, and to construct a fault propagation map.

[0076] The fault location module is used to locate faults based on the fault propagation map and shortest path analysis.

[0077] In practice, the fault association module includes a topology graph construction unit, an association analysis unit, and a topology graph partitioning unit;

[0078] The topology graph construction unit is used to pre-build the network topology graph, mapping fault messages to corresponding device nodes to form a network topology graph with fault attributes;

[0079] The correlation analysis unit is used to analyze the fault correlation between different device nodes using the association rule mining algorithm, obtain the fault propagation probability matrix between devices, construct a directed weighted graph based on the fault propagation probability matrix, apply the shortest path algorithm on the directed weighted graph to obtain the shortest propagation path from each fault node to other nodes, and determine the key propagation path according to the path length and edge weight.

[0080] The topology graph partitioning unit is used to partition the network topology graph with fault attributes using the connected component algorithm, assigning strongly correlated faulty nodes to the same connected component to form multiple independent fault propagation graphs.

[0081] Example 2

[0082] This embodiment also provides an electronic device, including: a memory and a processor; the memory is used to store a program; the processor is used to execute the program to implement the various steps of the network device fault dynamic monitoring method.

[0083] Example 3

[0084] This embodiment also provides a readable storage medium storing a computer program thereon, which, when executed by a processor, implements the various steps of the network device fault dynamic monitoring method.

[0085] The above are merely preferred embodiments of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for dynamic monitoring of network device faults, characterized in that, Includes the following steps: Collect device status data and log data; A set of fault messages is obtained by analyzing device status data and log data based on preset threshold rules and anomaly detection models. Obtain historical device status data; By aggregating and statistically analyzing the historical status data of the equipment, the failure modes and abnormal trends of the equipment can be obtained. Based on the set of fault messages, as well as the fault modes and abnormal trends of the device, a fault diagnosis report is generated. Based on the fault diagnosis report, discrete fault messages from different devices and time periods are correlated to construct a fault propagation map; Based on the aforementioned fault propagation map and combined with shortest path analysis, fault location is achieved. Based on the fault diagnosis report, the process of associating discrete fault messages from different devices and time periods to construct a fault propagation map includes: A network topology graph is pre-constructed, mapping fault messages to corresponding device nodes to form a network topology graph with fault attributes. An association rule mining algorithm is used to analyze the fault correlation between different device nodes, obtaining a fault propagation probability matrix between devices. A directed weighted graph is constructed based on the fault propagation probability matrix, and a shortest path algorithm is applied to obtain the shortest propagation path from each fault node to other nodes. Key propagation paths are determined based on path length and edge weight. The network topology graph with fault attributes is partitioned using a connected component algorithm, grouping strongly correlated fault nodes into the same connected component to form multiple independent fault propagation graphs. In the directed weighted graph, nodes represent devices, edges represent fault propagation relationships between devices, and edge weights represent fault propagation probabilities. Based on the aforementioned fault propagation map and combined with shortest path analysis, the process of fault localization includes: In each fault propagation graph, the root cause node is identified, and then combined with the shortest path analysis results, the critical propagation path triggered by the root cause node is determined, thereby achieving fault location.

2. The method according to claim 1, characterized in that, After collecting device status data and log data, the following is also included: A distributed message queue is used to access and cache the device status data and log data in real time to obtain a real-time data stream; a streaming processing framework is used to process the real-time data stream in real time.

3. The method according to claim 1, characterized in that, The process of aggregating and statistically analyzing the historical status data of the equipment to obtain the equipment's failure modes and abnormal trends includes: A time window segmentation method is used to divide the historical status data of the equipment into multiple time segments. For the historical status data of the equipment within each time segment, a batch processing framework is used for parallel computing. A clustering algorithm is used to perform cluster analysis on the historical status data of the equipment, and the normal working state and abnormal state of the equipment are determined based on the clustering results. Based on the abnormal state data, an association rule mining algorithm is used to mine the association rules between abnormal states of the equipment to obtain the failure modes of the equipment. For the historical status data of the equipment, a time series analysis method is used to obtain the abnormal trends of the equipment.

4. The method according to claim 1, characterized in that, The anomaly detection model is constructed using either a decision tree algorithm or a random forest algorithm.

5. A dynamic monitoring system for network device faults, characterized in that, The method for implementing the network device fault dynamic monitoring method according to any one of claims 1-4 includes: a data acquisition module, a fault detection module, a historical statistics module, a report generation module, a fault association module, and a fault location module; The data acquisition module is used to collect device status data and log data in real time; The fault detection module is used to preset threshold rules and anomaly detection models, and analyzes equipment status data and log data based on the threshold rules and anomaly detection models to obtain a set of fault messages. The historical statistics module is used to acquire historical status data of the equipment and aggregate and statistically analyze the historical status data of the equipment to obtain the equipment's failure modes and abnormal trends. The report generation module is used to generate a fault diagnosis report based on the fault message set, as well as the fault modes and abnormal trends of the device. The fault association module is used to associate discrete fault messages from different devices and different time periods based on the fault diagnosis report, and construct a fault propagation map. The fault location module is used to locate faults based on the fault propagation map and shortest path analysis.

6. The system according to claim 5, characterized in that, The fault association module includes a topology graph construction unit, an association analysis unit, and a topology graph partitioning unit; The topology graph construction unit is used to pre-build a network topology graph, map fault messages to corresponding device nodes, and form a network topology graph with fault attributes. The correlation analysis unit is used to analyze the fault correlation between different device nodes using the association rule mining algorithm, obtain the fault propagation probability matrix between devices, construct a directed weighted graph based on the fault propagation probability matrix, apply the shortest path algorithm on the directed weighted graph to obtain the shortest propagation path from each fault node to other nodes, and determine the key propagation path according to the path length and edge weight. The topology graph partitioning unit is used to partition the network topology graph with fault attributes using the connected component algorithm, and to partition strongly correlated fault nodes into the same connected component to form multiple independent fault propagation graphs.

7. An electronic device, characterized in that, include: Memory and processor; The memory is used to store programs; The processor is used to execute the program to implement each step of the network device fault dynamic monitoring method as described in any one of claims 1-4.

8. A readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements each step of the network device fault dynamic monitoring method as described in any one of claims 1-4.

Images