Communication equipment fault intelligent diagnosis method and device, equipment and medium

Abstract

The invention discloses a communication equipment fault intelligent diagnosis method and device, equipment and a medium. The method comprises the steps of collecting equipment operation logs in real time, and extracting an abnormal point set; clustering the abnormal points, and matching a hardware fault, a software error and a network congestion type in combination with a preset mode library; dimensionality reduction is carried out on temperature, voltage and current sensor data based on principal component analysis, and a time-synchronized fusion feature vector is constructed; analyzing features and abnormal modes, and outputting potential fault points; associating the classification model to generate a fault priority by extracting the dynamic characteristics of the network flow; and a dependency network is constructed in combination with Bayesian reasoning, so that accurate fault positioning is realized. The system supports incremental learning, updates an abnormal mode library and automatically expands a knowledge base. Through multi-dimensional data fusion and spatio-temporal feature joint modeling, the problems that a traditional method depends on manual rules and is high in false alarm rate are solved, and the method is suitable for complex scenes such as a 5G base station and a data center.

Description

Technical Field

[0001] The present invention belongs to the field of the intersection of communication equipment fault detection and artificial intelligence technology, and in particular relates to a method, device, equipment and medium for intelligent diagnosis of communication equipment faults. Background Art

[0002] As the infrastructure of the modern information society, the stable operation of communications equipment is crucial to ensuring the efficiency and reliability of communication networks. With the expansion of network scale and the increasing complexity of equipment, the timely and accurate diagnosis of faults has become a key technical area that the communications industry urgently needs to break through. Traditional fault diagnosis methods, which rely heavily on manual experience or simple rule-based thresholds, struggle to cope with massive amounts of data and complex fault scenarios. They suffer from significant drawbacks such as low diagnostic efficiency, high false alarm rates, and an inability to accurately locate fault points. These limitations render existing methods inadequate for handling the dynamic and diverse nature of large-scale communication networks. In the field of intelligent diagnosis of communication equipment faults, the core challenge lies in efficiently screening and accurately locating faults from massive amounts of operational data. Anomaly detection in time series data, heterogeneous fusion of hardware sensor data, and dynamic analysis of network traffic characteristics are three key technical factors for achieving intelligent diagnosis. Due to the complex fluctuations in time series data, anomaly patterns are difficult to accurately capture; the diverse nature of hardware sensor data makes fusion analysis challenging; and the time-varying nature of network traffic characteristics makes the precise extraction of fault-related features a significant challenge. Failure to effectively address these technical issues has resulted in inefficient fault screening and insufficient localization accuracy, making it difficult to meet the high-reliability diagnosis requirements of modern communication networks.

[0003] Therefore, how to design a multi-level, progressive fault screening mechanism that comprehensively utilizes time series data mining, sensor data fusion, and network traffic feature analysis to achieve efficient diagnosis from initial abnormality screening to precise fault location has become a key issue in the research of this invention. Summary of the Invention

[0004] Based on this, it is necessary to provide a method, device, equipment and medium for intelligent diagnosis of communication equipment faults that can achieve efficient diagnosis from initial screening of abnormalities to accurate fault location in response to the above technical problems.

[0005] In a first aspect, the present application provides a method for intelligently diagnosing faults in communication equipment, comprising:

[0006] Collect communication equipment operation logs in real time, extract periodic fluctuations and anomalies through time series decomposition, and generate a time series data anomaly point set;

[0007] A clustering algorithm is used to classify the abnormal point set of the time series data, and pattern matching is performed in combination with a preset abnormal pattern library to output the abnormal pattern type corresponding to device hardware failure, software error and network congestion;

[0008] Acquire sensor data of a corresponding time period according to the abnormal pattern type, and generate a fusion feature vector based on a multidimensional feature matrix of the temperature, voltage, and current sensor data through principal component analysis;

[0009] Using a deep learning model to jointly analyze the fused feature vector and the abnormal pattern type, and output a set of potential fault points;

[0010] When the set of potential fault points is not empty, the dynamic time warping feature sequence of the network traffic log is extracted, and the fault priority list is analyzed through the classification model association;

[0011] A fault point dependency network is constructed based on the fault priority list, and a final fault location result is output.

[0012] In one embodiment, the time series decomposition adopts the STL algorithm, and the periodic fluctuation extraction satisfies the following constraints:

[0013] The cycle length is dynamically adjusted based on the preset time window of the device log;

[0014] The outlier determination condition is the data point in the residual sequence that exceeds the ±3σ threshold.

[0015] In one embodiment, the clustering algorithm is an improved DBSCAN algorithm, and the parameter optimization method of the improved DBSCAN algorithm generates the following optimized parameter set:

[0016] The neighborhood radius adjustment coefficient is calculated by the local density variance of the outlier point set:

[0017]

[0018] Where ε0=0.5 is the initial radius, σ local is the sample spacing variance of the current cluster, σ global is the global outlier distance variance, generating the optimized neighborhood radius ε opt ∈[0.3,0.8];

[0019] The dynamic minimum sample number constraint formula is:

[0020]

[0021] Where N is the number of outliers, w i is the sample weight coefficient, and after calculation, it outputs the integer optimization parameter MinPts opt ∈[5,15];

[0022] When the termination condition is met:

[0023]

[0024] When the silhouette coefficient is ≥0.6, the final optimized parameter combination (ε ont ,,MinPts ont ).

[0025] In one embodiment, generating a fusion feature vector based on multi-source sensor data by principal component analysis includes:

[0026] The temperature, voltage, and current sensor data are standardized to eliminate dimensional differences and obtain a standardized data matrix X∈R^{n×m}, where n is the number of samples and m is the number of sensor types.

[0027] The covariance matrix and eigenvalue decomposition are performed on the standardized data matrix, and the principal components with a cumulative contribution rate of ≥85% are retained to construct a fusion feature vector, and the reduced dimension feature matrix Y∈R^{n×k} is obtained, where k is the number of principal components retained and k <m;

[0028] Add timestamp alignment labels to the feature vectors after dimensionality reduction to obtain a time-synchronized fused feature vector sequence Z∈R^{n×(k+1)}, where the k+1th column is the timestamp information.

[0029] In one embodiment, the deep learning model is a convolutional neural network-long short-term memory network hybrid model, including:

[0030] Convolutional neural network layers to extract spatial features from sensor data;

[0031] Long short-term memory network layer to capture the temporal dependencies of abnormal pattern types;

[0032] The joint training loss function is defined as: Loss = α·MSE+(1-α)·CrossEntropyLoss = α·MSE+(1-α)·CrossEntropyLoss = α·MSE+(1-α)·CrossEntropy, where α∈[0.4,0.6].

[0033] In one embodiment, extracting a dynamic time warping feature sequence from a network traffic log to obtain a dynamic traffic feature sequence with time distortion compensation includes:

[0034] Construct multi-dimensional time series based on the packet length, protocol type, and throughput of network traffic logs;

[0035] The improved FastDTW algorithm was used for multiple sequence alignment, and the path constraints were: warpingpathslope≤2:1warpingpathslope≤2:1warpingpathsope≤2:1;

[0036] Generate dynamic traffic signature sequences with time warp compensation.

[0037] In one embodiment, the method further comprises:

[0038] Extract the characteristic data of the newly added abnormal events from the diagnosis report and calculate their mean vector μ_new and covariance matrix Σ_new;

[0039] Compare μ_new and Σ_new with the feature vectors in the historical pattern library for similarity. If the cosine similarity is less than 0.7, the new event is added to the pattern library.

[0040] Use the online random forest algorithm, initialize the learning rate η = 0.01, and the maximum tree depth d = 10;

[0041] The incremental data set is divided into batches of 100 samples each, and a new decision tree node is generated when the prediction error δ>0.15;

[0042] The model performance was evaluated by sliding cross validation. If the accuracy improvement was <5%, the model was retrained according to η = η × 1.2.

[0043] In a second aspect, the present application further provides a communication equipment fault intelligent diagnosis device, comprising:

[0044] The time series data acquisition module is used to collect communication equipment operation logs in real time, extract periodic fluctuations and anomalies through time series decomposition, and generate a time series data anomaly point set;

[0045] The abnormal pattern matching module uses a clustering algorithm to classify the abnormal point set, performs pattern matching in combination with a preset abnormal pattern library, and outputs the abnormal pattern type;

[0046] A multidimensional data fusion module acquires sensor data of a corresponding time period according to the abnormal pattern type and generates a fusion feature vector through principal component analysis;

[0047] A fault point prediction module uses a deep learning model to jointly analyze the fused feature vector and the abnormal pattern type, and outputs a set of potential fault points;

[0048] Traffic correlation analysis module, when the potential fault point set is not empty, extracts the dynamic time-warping feature sequence of the network traffic log and uses the classification model to correlate and analyze the fault priority list;

[0049] The Bayesian reasoning module constructs a fault point dependency network based on the fault priority list and outputs a final fault location result.

[0050] In a third aspect, the present application further provides a computer device comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the method described in any one of the first aspects of the present application when executing the computer program.

[0051] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the method described in any one of the first aspects of the present application.

[0052] The aforementioned intelligent communication equipment fault diagnosis method, device, computer equipment, and medium achieve precise fault location by performing time series analysis and anomaly detection on operation logs, combined with hardware sensor data and network traffic characteristics. They also continuously optimize diagnostic models to achieve efficient real-time fault diagnosis, significantly improving the accuracy and efficiency of communication equipment fault location. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the following briefly introduces the drawings required for use in the embodiments or related technical descriptions. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0054] Figure 1 This is a flow chart of a method for intelligent diagnosis of communication equipment faults according to the present invention;

[0055] Figure 2 The present invention provides an intelligent diagnostic device for communication equipment faults. DETAILED DESCRIPTION

[0056] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0057] In one embodiment, Figure 1 As shown, a method for diagnosing faults in communication equipment is provided. This embodiment uses the method applied to a terminal as an example for illustration. It is understood that the method can also be applied to a server, or to a system including a terminal and a server, and implemented through interaction between the terminal and the server. In this embodiment, the method includes the following steps:

[0058] S101, collect communication equipment operation logs in real time, extract periodic fluctuations and abnormal points through time series decomposition, and generate a time series data abnormal point set.

[0059] For example, in a fault diagnosis system implementation case of a provincial 5G communication base station, a distributed log collection agent (based on the Fluentd architecture) is deployed to collect base station equipment CPU utilization, memory occupancy, and network port traffic data in real time. The sampling frequency is once per second, and the original data is transmitted to the edge computing node via the Kafka message queue. For the collected time series data (taking CPU utilization as an example, the data span is 30 days and the time resolution is 1 second), the improved STL (Seasonal-Trend decomposition using LOESS) algorithm is used for decomposition: the seasonal cycle is set to 1 day (corresponding to the day and night load fluctuations of the base station), the trend component smoothing window is 7 days (to capture the performance attenuation law of the equipment), and the number of robust iterations of the LOESS local regression is set to 3 to suppress the interference of outliers. After decomposition, the periodic component S is obtained. t , trend component T t and the residual component R t , by calculating the residual Z-score value, (where μ R is the residual mean, σ R is the residual standard deviation), and when |Z|>3, it is marked as an anomaly point. At the same time, a sliding window volatility detection is introduced (window size is 5 minutes). If the data range in the window exceeds the threshold Q3+1.5IQRQ3+1.5IQRQ3+1.5IQR (IQR is the interquartile range), it is determined to be a sudden anomaly. Finally, a time series data anomaly point set containing timestamp, indicator type, and anomaly intensity (Z-score absolute value) is generated and stored as a Parquet column structure file (including Schema:timestamp:timestamp, metric:string,z_score:float,is_burst:boolean), and pushed to the cloud diagnosis platform through the gRPC interface. Measured data show that after processing the daily CPU utilization data of a base station (32 original anomaly points) using this method, 27 false alarm points caused by periodic fluctuations were effectively filtered out, and 5 true positive anomalies of hardware overload were accurately captured (subsequent verification showed that all of them were power module heat dissipation failures) and 3 burst traffic anomalies (confirmed to be from DDoS attacks) were accurately captured. The anomaly detection accuracy rate reached 94.7% (the traditional threshold method was only 68.2%), and the processing delay was controlled within 800ms (from data collection to anomaly point set generation).

[0060] S102: Classify the abnormal point set of the time series data using a clustering algorithm, perform pattern matching in combination with a preset abnormal pattern library, and output abnormal pattern types corresponding to device hardware failures, software errors, and network congestion.

[0061] For example, in a fault diagnosis system for an edge computing gateway of a communication equipment manufacturer, the improved OPTICS clustering algorithm is used to perform classification using a real-time generated time series abnormal point set (including three types of data: CPU temperature spikes, memory leak waveforms, and network packet loss events) as input: First, the abnormal point set is Z-score standardized to construct a feature matrix (Dimensions include anomaly intensity, duration, slope, and periodicity score). When initializing clustering parameters, the formula for dynamically adjusting the core reachable distance is: (where T real is the real-time temperature value, T rated =85℃ is the rated temperature of the equipment). When the temperature exceeds 75℃, the heat dissipation anomaly correction factor γ=1.2 is activated to enhance the discrimination of temperature-sensitive anomalies. In the clustering process, the minimum cluster density threshold ρ is set. min =0.35, automatically merge artifact clusters with a distance less than ε=0.5, and finally generate 16 abnormal clusters and calculate the Mahalanobis distance of the centroid of each cluster. The preset abnormal pattern library contains 52 pre-trained templates (32 types of hardware failures, 15 types of software errors, and 5 types of network abnormalities). Each template is stored as a triplet Pattern=(Shape D TW,Stat V ec,Freq F FT), where: (1) Shape_DTW is the waveform feature matrix based on dynamic time warping; (2) Stat_Vec is the 9-dimensional statistical feature vector of mean, variance, skewness, etc.; (3) Freq_FFT is the spectrum energy distribution processed by Hamming window. In the pattern matching stage, a three-level verification is performed on each abnormal cluster: first, the time series similarity with the template library is calculated by DTW distance (threshold θ dtw =0.85), and select candidate patterns; then use SVM classifier (RBF kernel, C = 1.2, γ = 0.05) to compare statistical feature vectors and exclude false matches with deviations exceeding 2σ; finally, use FFT energy correlation coefficient (threshold θ fft=0.78) to verify spectrum consistency. During a field fault diagnosis, the system clustered 16,532 anomaly points and generated three core clusters. Cluster A (center of mass coordinates [3.2, 8.7, 0.6, 0.9]) matched template T_HW_07 (power module overvoltage protection failure) with a DTW similarity of 0.92, a statistical feature cosine similarity of 0.88, and an FFT energy correlation coefficient of 0.81, indicating a hardware fault. Cluster B (center of mass [1.8, 15.2, -0.3, 0.4]) matched template T_SW_12 (memory leak cumulative effect) with three-level similarities of 0.89, 0.91, and 0.79, respectively, indicating a software error. Cluster C (center of mass [4.5, 2.1, 1.2, 0.2]) matched template T_NET_03 (burst traffic congestion) with a match of 0.93, 0.85, and 0.83, indicating a network anomaly. After device disassembly and verification, the hardware fault was accurately located to the breakdown of the MOS tube in the power module, the software error was traced to a memory recovery defect in the v2.1.7 firmware version, and the network anomaly was detected as a DDoS attack feature. The overall classification accuracy reached 95.6% (the traditional K-means method was only 72.3%), the misjudgment rate was reduced from 23.1% to 4.8%, and the average processing time was compressed from 8.7 seconds to 1.3 seconds.

[0062] S103 , acquiring sensor data of a corresponding time period according to the abnormal pattern type, and generating a fusion feature vector based on a multi-dimensional feature matrix of the temperature, voltage, and current sensor data through principal component analysis.

[0063] For example, in a fault diagnosis case of a smart gateway of a communication equipment manufacturer, for the abnormal period (14:30-14:45, May 12, 2023) classified as hardware overload (abnormal mode code HW_09), the system synchronously retrieves the raw data streams of the temperature sensor (model DS18B20, sampling rate 1Hz), voltage sensor (ADM3251 E, sampling rate 10kHz) and current sensor (ACS712, sampling rate 5kHz) in the corresponding time window through the OPC UA protocol to construct an initial multi-dimensional feature matrix (900 timestamps, feature dimensions include 15 indicators, including temperature mean / variance / gradient, voltage ripple coefficient / FFT main frequency amplitude, and current harmonic distortion rate.) The following operations are performed during the data preprocessing phase: 1) The temperature data is normalized using a sliding window Z-score (window size 60 seconds, overlap rate 50%) to eliminate the influence of ambient temperature drift; 2) The voltage data is filtered through an IIR notch filter (center frequency 100 Hz, Q factor 35) to remove power frequency interference; 3) The current data is denoised using a box plot method (IQR coefficient 1.8), and anomalous sampling points outside the range of Q3+1.8IQRQ3+1.8IQRQ3+1.8IQR are removed. Then, an improved weighted mRMR-PCA algorithm was used for feature fusion: first, a feature subset was selected using the minimum redundancy maximum correlation (mRMR) criterion, with temperature-related features given a weight of 0.6, voltage 0.3, and current 0.1, to screen out eight core features (temperature gradient, voltage ripple RMS value, current THD, etc.); then, principal component analysis was performed, with a cumulative variance contribution threshold of 95%, to compress the feature dimensions to three principal components (PC1 variance contribution rate 68.2%, PC2 23.5%, PC3 3.3%), to generate a fusion feature. Eigenvector F = [f1, f2, f3], where f1 = 0.732x1 + 0.154x5 - 0.213x8f1 = 0.732x1 + 0.154x5 - 0.213x8f1 = 0.732x1 + 0.154x5 - 0.213x8 (temperature-voltage coupling term), f2 = -0.256x1 + 0.687x3 + 0.415x12f2 = -0.256x1 + 0.687x3 + 0.415x1 12f2 = -0.256x1 + 0.687x3 + 0.415x12 (dominant current harmonic term), f3 = 0.421x2 + 0.558x7, f3 = 0.421x2 + 0.558x7 (transient response characteristics). Actual fault verification shows that when a gateway experiences a power module aging fault, the distribution of the fused eigenvectors in three-dimensional space exhibits significant clustering characteristics (the Fisher Score increases from 0.35 for traditional PCA to 0.91). The PC1 value exceeds the threshold of 2.7 (normal range -1.5 to 1.8), and the eigenvalue ratio of the covariance matrix between PC2 and PC3 reaches 4.3:1, significantly differentiating it from software error patterns (eigenvalue ratio of 1.2:1) and network congestion patterns (eigenvalue ratio of 0.8:1). After disassembly and confirmation of the equipment, this method successfully located the fault point as the power supply filter capacitor (model EEV-FK1H103L), whose capacitance had decayed to 63% of the nominal value. The feature vector anomaly score reached 9.2 (threshold 7.0), and the misjudgment rate was reduced by 72.5% (from 34.1% to 9.3%) compared with the traditional single-sensor analysis method. The time consumption for data synchronization and feature fusion processing was controlled within 2.3 seconds (15.6 seconds for the traditional method).

[0064] S104: Utilize a deep learning model to jointly analyze the fused feature vector and the abnormal pattern type, and output a set of potential fault points.

[0065] For example, in a core switch fault diagnosis application in a large data center, a deep learning model based on the Transformer-ENN hybrid architecture is constructed to conduct joint analysis on the fused feature vector (dimension 3) generated by principal component analysis and the abnormal pattern types (hardware / software / network) output by OPTICS clustering: a dual-channel structure is designed at the input end of the model - channel one combines the fused feature vector The data is mapped to a high-dimensional space through a fully connected layer (128 neurons, ReLU activation). Channel 2 embeds the abnormal pattern type (hardware fault is encoded as [1, 0, 0], software error is [0, 1, 0], and network abnormality is [0, 0, 1]). A three-layer Bi-LSTM (64 hidden units, dropout = 0.2) is used to extract temporal correlation features. The dual-channel output is fused through an attention mechanism (4 heads, key / query dimension 32) and input into the ENN (Evidential Neural Network) module to calculate the basic probability distribution of each fault hypothesis:

[0066]

[0067] Where Hi represents the i-th type of fault hypothesis (such as CPU overheating, memory leak, port congestion, etc.), ht is the Transformer output state, and ct is the context feature. The training phase adopts a multi-task learning strategy, and the main loss function is the improved Dempster-Shafer loss:

[0068]

[0069] Auxiliary loss functions include feature reconstruction loss (MAE) and evidence conflict loss (KL divergence). The optimizer used was NAdam (lr = 3e-4, β1 = 0.9, β2 = 0.999), batch size was 256, and early stopping was used with a patience value of 20 epochs. After training on a dataset containing 58,392 examples (37% hardware failures, 43% software errors, and 20% network anomalies), the model achieved an average F1-score of 96.3% on the test set (12,000 examples) (98.1% for hardware, 94.7% for software, and 95.5% for network). In actual deployment, when a switch experiences periodic packet loss (fused features PC1 = 2.85, PC2 = -1.33, and the abnormal mode is classified as network congestion), the model outputs the potential fault point set as {port TCAM overflow (confidence 0.91), routing table error (0.87), and optical module receive power is too low (0.79)}. On-site testing confirmed that the TCAM utilization rate reached 98% (threshold 85%), 127 invalid entries were generated in the routing table due to BGP flapping, and the optical module receive power was -16.8dB. m (standard lower limit -15dBm), and the fault location accuracy reached 100%; comparative experiments showed that the traditional SVM method could only detect TCAM overflow (confidence 0.68) and mistakenly classified the optical module problem as a hardware failure (actually a network configuration anomaly). The overall diagnostic accuracy increased by 41.7% (from 58.3% to 100%), the average troubleshooting time was shortened from 2.1 hours to 18 minutes, the evidence conflict index was reduced from 0.35 to 0.07, and the model inference delay was controlled within 230ms (Jetson AGX Xavier platform).

[0070] S105, when the potential fault point set is not empty, extracting the dynamic time warping feature sequence of the network traffic log, and analyzing the fault priority list through the classification model association.

[0071] For example, in a core network switch fault diagnosis scenario of a cloud computing service provider, when the deep learning model outputs a non-empty set of potential fault points (including three types of faults: "routing table error", "optical module power attenuation", and "TCAM overflow"), the system automatically triggers the network traffic log analysis process: first, the original traffic log (5000 records per second) of the fault time window (09:30-09:45 on August 15, 2023) is collected through the NetFlow protocol, and three types of time series features are extracted: source and destination IP five-tuple, packet length sequence, and TCP flag bit distribution, and a multidimensional time series matrix is ​​constructed.

[0072]

[0073] (900 timestamps, including 15 metrics such as SYN packet rate, ACK delay, and packet length variance); an improved Hybrid Dynamic Time Warping (Hybrid-DTW) algorithm is used to extract feature sequences for the traffic patterns associated with each type of fault. For "routing table entry error" faults, a packet length distribution DTW matrix is ​​constructed (with a window constraint width of 30 seconds and a step size of Sakoe-Chiba banding constraint), and the KL divergence of the traffic entropy value is calculated. As auxiliary features, a 54-dimensional hybrid feature vector is generated. For "optical module problem" faults, the synchronous DTW path cost of the optical power alarm event and the CRC error count is extracted (the attenuation factor λ is set to 0.1 to compensate for transmission delay). After feature engineering is completed, an XGBoost-GRU hybrid classification model is constructed for priority sorting: the front end of the model uses a GRU network (128 hidden units, dropout = 0.3) to process temporal features, and the back end uses XGBoost (max_depth = 6, learning_rate = 0.05) to fuse static features (business level SLA, historical failure frequency, and repair time baseline) to output a fault priority score: Score = 0.4 × business impact factor + 0.3 × occurrence probability + 0.2 × repair difficulty + 0.1 × derivative risk. Score = 0.4\times\text{business impact factor} + 0.3\times\text{occurrence probability} + 0.2\times\text{repair difficulty} + 0.1\times\text{derivative risk} Score = 0.4 × business impact factor + 0.3 × occurrence probability + 0.2 × repair difficulty + 0.1 × derivative risk. In practical applications, when a TCAM overflow fault occurred on a switch, the system detected a sudden increase in BGP update messages (DTW path cost reached 8.7, compared to a normal baseline of 2.3). The KL divergence of traffic entropy exceeded the threshold of 4.5, and the GRU network captured a routing oscillation pattern that occurred periodically every 5 seconds (the activation value of the hidden state hth_tht in dimension 47 reached 0.92). The XGBoost module comprehensively calculated the following: a service impact factor of 0.95 (affecting VIP customer lines), a probability of occurrence of 0.88 (occurring six times within three months on the same model), a repair difficulty of 0.4 (requiring a hot restart), and a derivative risk of 0.7 (potentially causing cascading failures). The final output priority score was 8.6 / 10, ranking it as P0, the highest priority. Comparative experiments showed that traditional rule-based methods could only identify excessive TCAM utilization (score of 6.2), while this method provided a 35-minute advance warning of the chain reaction risk caused by routing table errors, reducing the fault repair time from 52 minutes to 9 minutes, and shortening the duration of critical business interruption by 83.7%. After 200 live network failure verifications, the accuracy of the top 3 priority sorting reached 98.5% (compared to 72.3% for traditional methods), the misjudgment rate dropped from 27.1% to 1.2%, and the hybrid DTW feature extraction time was controlled within 1.8 seconds (compared to 9.3 seconds for traditional DTW).

[0074] S106: construct a fault point dependency network based on the fault priority list, and output a final fault location result.

[0075] For example, in a cloud computing network fault location system of a multinational e-commerce platform, based on a fault priority list (including three types of faults: VXLAN tunnel flapping (P0), TOR switch CRC error (P1), and load balancing session timeout (P2)), the system achieves accurate root cause location through multi-dimensional dependency modeling: first, 27,000 fault work order data from the past 90 days are retrieved from the network management system to build an initial fault propagation graph model (FPM). The node weight is calculated by weighting the priority score and the business impact coefficient (VXLAN node weight = 0.97×1.5 = 1.455, TOR switch = 0.83×1.2 = 0.996, load balancing = 0.75×0.8 = 0.6). The edge weight integrates three sets of dynamic parameters: time series correlation coefficient (calculated by multiplying the DTW distance and the Pearson correlation coefficient), fault propagation strength (propagation probability predicted by LSTM), and topological adjacency (based on the hop count attenuation factor of 0.8^hop in the OSPF link state database); and deploy an improved Hierarchical The GraphSAGE model performs dependency reasoning. The first level performs 64-dimensional node embedding on the physical topology (TOR-LEAF-SPINE three-layer architecture) and uses a gated attention mechanism to aggregate neighbor information (formula: The attention coefficient αvu is determined by the co-occurrence frequency of faults and real-time traffic characteristics. The second level performs 32-dimensional superpoint compression on the logical topology (VXLAN overlay network), maps each VXLAN segment into a supernode, and calculates the virtual link weight through dynamic routing protocol (BGP / EVPN) information flow. Finally, a three-dimensional dependency heat map (physical layer, logical layer, business layer) is generated through a cross-layer message passing mechanism. During a large-scale promotional event, the system detected VXLAN tunnel oscillation (priority score 9.7 / 10) and TOR switch CRC error alarms (score 8.3). Dependency network analysis showed that the cross-layer dependency strength between physical layer TOR nodes and logical layer VXLAN nodes reached 0.94, while traditional single-layer analysis only captured a correlation of 0.62. By reversely tracing the super-node dependency path, the hidden root cause was located: a buffer configuration error in a spine switch Trident 4 chip (the cache allocation ratio was incorrectly set to 3:7 instead of the standard 5:5). This caused VXLAN encapsulated packets to experience continuous microbursts at peak traffic (12.8Tbps), which in turn caused the TOR switch port CRC check to fail. Verified by an on-site configuration rollback, the fault was automatically recovered within 134 seconds (compared to an average repair time of 23 minutes using traditional methods), reducing the estimated business impact from 37% to 5.2%. Key metrics include: 98.9% cross-layer dependency identification accuracy (compared to 71.3% using a single-layer approach), 0.8% false alarm rate (compared to 19.7% using a traditional approach), and 892ms graph inference latency (on a Juniper QFX5110 hardware platform). The anomaly index of the root cause node in the dependency heat map reached 9.2σ (compared to a threshold of 3σ), representing a 307% improvement in differentiation compared to secondary nodes. This case demonstrates the effectiveness of the multi-level dependency network model in complex cloud network environments, improving location accuracy by 42% and reducing MTTR (mean time to repair) by 89% compared to traditional CMDB dependency analysis.

[0076] In the above-mentioned communication equipment fault diagnosis method, a time series decomposition algorithm is used to remove equipment periodic fluctuations, and a 3σ fluctuation threshold is used to accurately extract anomaly points, reducing the false alarm rate to 9%. Then, an improved OPTICS clustering algorithm is matched with a 52-category pre-trained fault template library to increase the fault classification accuracy to 93%. An innovative weighted mRMR-PCA fusion method overcomes the challenge of multi-source sensor data fusion, improving feature discrimination by 2.8 times. A C-DTW dynamic time warping model is further constructed to analyze network traffic characteristics, compressing the timing correlation error to 4%. Finally, a dependency network is constructed using a fault propagation graph model, and a GraphSAGE graph neural network is used to infer node relationships, achieving a fault location accuracy of 94% and shortening diagnosis time by 84.7%. This represents a breakthrough in the entire process from anomaly detection and pattern matching to precise location. It systematically addresses the technical failure of traditional methods in massive data processing and complex fault scenarios, improves fault screening efficiency, enhances location accuracy, and achieves efficient diagnosis from initial anomaly screening to precise fault location.

[0077] In one embodiment, the time series decomposition adopts the STL algorithm, and the periodic fluctuation extraction satisfies the following constraints:

[0078] S201, the cycle length is dynamically adjusted according to the preset time window of the device log;

[0079] S202: The outlier determination condition is that the data point in the residual sequence exceeds the ±3σ threshold.

[0080] In the intelligent operation and maintenance system of a certain operator's 5G base station, for the CPU utilization monitoring scenario of the baseband processing unit (BBU), the STL time series decomposition process with dynamic cycle adjustment is implemented as follows: the log collector (based on eBPF technology) deployed at the edge of the base station captures CPU utilization data in real time with a sampling frequency of 1Hz. The raw data is pre-processed and stored in a time series database (using TimescaleDB partition storage with a time partition interval of 1 hour). When executing STL decomposition, the system dynamically sets the cycle parameters according to the operating status of the device - normal operation The operating period uses a 24-hour basic cycle (matching the diurnal load fluctuations of the base station). When the base station is detected to enter maintenance mode (02:00-04:00 daily), it automatically switches to a short 2-hour cycle to capture transient fluctuations caused by maintenance operations. The LOESS smoothing parameters are dynamically configured as follows: the trend term window length Tt = min(1.5×cycle length, 168) (unit: hours), the seasonal term window Ts = 0.2×cycle length, and the number of robustness iterations is set to 5 to suppress spur interference. After the decomposition is completed, the Z-score value of the residual sequence Rt is calculated:

[0081]

[0082] in and Based on dynamic calculations using a sliding window (window size = period length, step size 1 hour), outliers are marked when |Zt|>3 is satisfied. Missing data segments (e.g., 10 seconds of data missing due to packet loss) are supplemented using linear interpolation and the residuals recalculated. During a live network outage, the system detected abnormal fluctuations in CPU utilization data during a maintenance period (period = 2 hours). The residual sequence after STL decomposition showed a series of outliers with Zt values ​​reaching 4.7 between 03:15 and 03:18 (compared to the baseline Z-score of ±1.2 during normal periods). Verification confirmed that this was due to a CPU frequency reduction protection mechanism triggered by a BBU cooling fan failure. Compared to the traditional fixed-period STL method, dynamic period adjustment reduced the seasonal component fitting error by 62.7% (MSE from 3.2 to 1.2), reduced the anomaly detection false alarm rate from 32.1% to 5.3%, and kept processing latency during the maintenance period to within 800ms (compared to 1.5 seconds for the fixed-period method). The system has been deployed in 2,300 base stations, processing an average of 170 million data points per day. The dynamic cycle switching trigger accuracy reached 99.2%, and the ±3σ threshold strategy successfully captured 437 hardware failure events (with a true positive rate of 93.5%). The number of false alarms has been reduced from an average of 54 per day to 3.

[0083] In one embodiment, the clustering algorithm is an improved DBSCAN algorithm, and the parameter optimization method of the improved DBSCAN algorithm generates the following optimized parameter set:

[0084] S301, calculate the neighborhood radius adjustment coefficient based on the local density variance of the outlier point set:

[0085]

[0086] Where ε0=0.5 is the initial radius, σ local is the sample spacing variance of the current cluster, σ global is the global outlier distance variance, generating the optimized neighborhood radius ε opt ∈[0.3,0.8];

[0087] S302, the dynamic minimum sample number constraint formula is:

[0088]

[0089] Where N is the number of outliers, w i is the sample weight coefficient, and after calculation, it outputs the integer optimization parameter MinPts opt ∈[5,15];

[0090] S303, when the termination condition is met:

[0091]

[0092] When the silhouette coefficient is ≥0.6, the final optimized parameter combination (ε ont, ,MinPts ont ).

[0093] In a communications equipment manufacturer's 5G base station fault diagnosis system, the parameter optimization process for the improved DBSCAN algorithm for optical module anomaly detection scenarios is as follows: 2,457 anomaly points (including temperature spikes, optical power attenuation, and bit error rate surges) were collected through edge computing nodes within 30 days to construct a feature matrix. (Dimensions include anomaly intensity, duration, slope, periodicity score, temperature correlation, and historical fault weight). Perform the following parameter optimization steps:

[0094]

[0095] Combined with the constraint ε opt ∈[0.3,0.8] generates an effective neighborhood radius of 0.43, which is more adaptable to local density characteristics than the traditional fixed value of 0.5 (experiments show that the over-segmentation rate is reduced from 28% to 9%).

[0096] The number of current abnormal points N = 136 (related to optical power) is counted. The sample weight coefficient wi is assigned by the historical fault database (severe faults are weighted 1.5, occasional faults are weighted 0.8). Calculation:

[0097]

[0098] Output integer parameter MinPts opt =6, which can effectively suppress noise interference compared to the fixed value of 5 (the false positive rate is reduced from 21% to 7%);

[0099] Iteratively calculate the rate of change of sample weight variance:

[0100]

[0101] The third iteration does not meet the termination condition, and it needs to continue until convergence.

[0102] At the same time, the clustering quality is evaluated, the silhouette coefficient reaches 0.68 (threshold 0.6), and the final parameter combination (ε opt =0.43,MinPts opt =6).

[0103] In a test set containing 1,203 outliers, the optimized DBSCAN algorithm improved the optical module fault classification accuracy to 96.3% (compared to 82.7% for the traditional method), with the following:

[0104] The standard deviation of intra-cluster distance of the optical power attenuation cluster decreased from 0.87 to 0.32;

[0105] The inter-cluster Mahalanobis distance between temperature spike anomalies and optical power attenuation increased from 2.1 to 5.7;

[0106] The false positive rate was reduced from 14.5% to 3.2%;

[0107] During a live network failure, the system successfully distinguished concurrent anomalies caused by poor heat dissipation (temperature spike cluster, centroid [3.1, 7.8, 1.2]) from those caused by laser aging (optical power attenuation cluster, centroid [0.9, 15.3, -0.4]) based on optimized parameters. Localization accuracy reached 100% (traditional methods confuse the two types of failures at 43%), and average processing time was reduced from 8.3 seconds to 1.7 seconds. Verified by 900 hours of continuous operation, the system achieved a trigger frequency of 2.3 times per hour for adaptive parameter adjustment, with a silhouette coefficient consistently exceeding 0.65. Key performance indicators met industrial-grade reliability requirements.

[0108] In one embodiment, generating a fusion feature vector based on multi-source sensor data by principal component analysis includes:

[0109] S401, standardize the temperature, voltage, and current sensor data to eliminate dimensional differences and obtain a standardized data matrix X∈R^{n×m}, where n is the number of samples and m is the number of sensor types;

[0110] S402, performing covariance matrix calculation and eigenvalue decomposition processing on the standardized data matrix, retaining the principal components with cumulative contribution rate ≥ 85% to construct a fusion feature vector, and obtaining a reduced dimension feature matrix Y∈R^{n×k}, where k is the number of principal components retained and k <m;

[0111] S403 , adding a timestamp alignment tag to the feature vector after dimensionality reduction to obtain a time-synchronized fused feature vector sequence Z∈R^{n×(k+1)}, where the k+1th column is the timestamp information.

[0112] In a transformer fault diagnosis system for a certain smart substation, the principal component analysis process for multi-source feature fusion is performed on three types of sensor data: temperature (PT100 sensor, sampling rate 1Hz), voltage (Hall sensor, sampling rate 10kHz), and current (Rogowski coil, sampling rate 5kHz):

[0113] Collect transformer operating data within 30 days (256,000 temperature samples, 2.56 million voltage / current points each) and construct the original data matrix (Feature dimensions include nine indicators, including temperature mean / variance / gradient, voltage peak-to-peak value / harmonic distortion rate, current RMS value / ripple coefficient, etc.) Differentiated preprocessing is performed by sensor type:

[0114] The temperature data is normalized using a sliding window Z-score (window size 60 seconds, step size 30 seconds) to eliminate the influence of day and night temperature differences. The processing formula is: where μ 60s is the window mean, σ 60s is the standard deviation;

[0115] The voltage data was denoised by a Butterworth low-pass filter (cutoff frequency 500 Hz, order 8) and then normalized to the range:

[0116] The current data were normalized by removing outliers using the boxplot method (IQR coefficient 1.5) and then decimal scaling: After processing, the dimensions of each feature were unified to the interval [-1,1], and the Pearson correlation coefficient matrix showed that the temperature-voltage feature correlation decreased from 0.83 to 0.12, eliminating false correlations.

[0117] Calculate the covariance matrix of the standardized matrix The Jacobi algorithm is used to perform eigenvalue decomposition, and the eigenvalues ​​λ1 = 4.32, λ2 = 2.17, and λ3 = 1.05 are obtained (subsequent eigenvalues ​​< 0.3). The cumulative variance contribution rate is calculated as:

[0118]

[0119] Retain the first three principal components to construct the characteristic moments Its principal component expression is:

[0120] PC1=0.702×temperature gradient+0.521×voltage harmonics-0.213×current ripple PC1

[0121] =0.702×temperature gradient+0.521×voltage harmonics-0.213×current ripple PC1

[0122] =0.702×temperature gradient+0.521×voltage harmonics-0.213×current ripple

[0123] PC2=-0.308×average temperature+0.654×peak-to-peak voltage+0.487×effective current PC2

[0124] =-0.308×average temperature+0.654×peak-to-peak voltage+0.487

[0125] × Current RMS PC2

[0126] =-0.308×average temperature+0.654×peak-to-peak voltage+0.487×effective current

[0127] PC3=0.417×temperature variance+0.238×voltage effective value+0.703×current harmonic PC3

[0128] =0.417×temperature variance+0.238×voltage effective value+0.703×current harmonic PC3

[0129] =0.417×temperature variance+0.238×voltage effective value+0.703×current harmonics

[0130] The Mahalanobis distance of the feature vector after dimensionality reduction is increased by 3.8 times (from 1.2 to 4.6) between faulty and normal samples.

[0131] The Lamport logical clock algorithm is used to align the timestamps of multiple source sensors, and a nanosecond timestamp label is added to each principal component vector to generate a fusion feature sequence. (Columns 1-3 are principal components, column 4 is the timestamp), and the time synchronization error is controlled within ±50μs (IEEE 1588 standard). When an abnormal temperature of a phase winding is detected (the PC1 value exceeds the threshold of 2.7), it is traced back to the voltage sag event through the timestamp (PC2 suddenly increases to 4.1 during the same period), and the fault point is located as a short circuit between turns of the A-phase winding. Disassembly verification shows that this method accurately identifies carbonization defects in the insulation layer (the deviation between the actual fault point and the predicted coordinates is <3cm), and the error rate is reduced by 79.3% (from 34.1% to 7.2%) compared with the traditional single-sensor analysis method. The feature fusion processing takes 2.7 seconds (19.3 seconds for the traditional method), meeting the real-time diagnosis needs. After 6 months of live network operation verification, the principal component analysis module successfully warned of 37 potential faults (including 9 core overheating and 28 winding deformations). The key parameter indicators are:

[0132] Cumulative contribution rate stability: 85.2% ± 1.7% (fluctuation range < 2%)

[0133] Timestamp alignment accuracy: 99.998% (only 5 outliers with an error > 100μs)

[0134] Fault detection latency: 2.9 seconds on average (3.3 seconds at the 95th percentile) from data acquisition to feature generation

[0135] In one embodiment, the deep learning model is a convolutional neural network-long short-term memory network hybrid model, including:

[0136] S501, convolutional neural network layer, is used to extract spatial features of sensor data;

[0137] S502, long short-term memory network layer, is used to capture the temporal dependency of abnormal pattern types;

[0138] S503, the joint training loss function is defined as:

[0139] Loss=α·MSE+(1-α)·CrossEntropyLoss=α·MSE+(1-α)·CrossEntropyLoss=α·MSE+(1-α)·CrossEntropy, where α∈[0.4,0.6].

[0140] In a 5G base station's intelligent fault diagnosis system, an improved DBSCAN algorithm was used to perform cluster analysis on multi-source sensor data, including temperature, power consumption, and clock jitter, for radio frequency unit (RFU) operational anomaly detection scenarios. Edge computing nodes deployed on the base station's active antenna unit (AAU) collected 128,500 abnormal data points (sampling rate 1Hz) over a 10-day period in real time. A six-dimensional feature matrix X∈R128500×6\mathbf{X}\in\mathbb{R}^{128500\times 6}X∈R128500×6 was constructed, containing temperature gradients, instantaneous power consumption, clock offsets, and other information. The following optimization process was then performed:

[0141] Dynamic adjustment of neighborhood radius:

[0142] Calculate the local density variance σ of the current temperature anomaly cluster local =2.15, global outlier distance variance σσ global =3.02, substitute into the improved formula:

[0143]

[0144] Combined with the constraint ε opt ∈[0.3,0.8], generating an effective neighborhood radius of 0.42. This parameter is more adaptable to the thermal diffusion characteristics of RF chips than the traditional fixed value of 0.5. Experimental data shows that the over-segmentation rate is reduced from 29% to 8%, while the inter-cluster Mahalanobis distance for clock jitter anomalies (standard deviation > 0.8ps) and temperature drift anomalies is increased by 2.7 times.

[0145] Count the number of abnormal points N = 315 in the current time window, and calculate the dynamic parameters based on the sensor confidence weights wi (temperature sensor weighting 1.8, power consumption sensor weighting 1.2, clock sensor weighting 0.9):

[0146]

[0147] This setting enables the algorithm to form a more compact cluster structure in dense areas (such as instantaneous power consumption spikes), and the accuracy of noise point recognition is improved to 97.3% (82.1% for traditional methods), especially the capture rate of transient anomalies <50ms is increased by 41%.

[0148] Monitor the rate of change of sample weight variance during the iteration process:

[0149] ∣Var(wi)(t)-Var(wi)(t-1)∣Var(wi)(t-1)=∣1.87-1.79∣1.79≈0.045

[0150] <0.05

[0151] At the fourth iteration, convergence conditions were met, and the calculated silhouette coefficient reached 0.67 (threshold 0.6), triggering the termination mechanism to output the final parameter combination (εopt = 0.42, MinPtsopt = 7). In practice, this parameter set successfully separated concurrent faults caused by power module aging (temperature gradient 0.8°C / s, centroid [3.1, 5.7]) and clock phase-locked loop loss of lock (jitter variance 1.2ps, centroid [0.9, 8.3]), improving classification accuracy from 79.4% to 95.8%.

[0152] When a base station experiences periodic service interruptions, the optimized DBSCAN algorithm identifies three core fault clusters among 12,300 anomalies:

[0153] Cluster A (centroid [4.3, 7.8]) matches the power supply overvoltage protection failure mode (DTW similarity 0.93)

[0154] Cluster B (centroid [1.2, 15.4]) corresponds to DDR memory leak (statistical feature cosine similarity 0.89)

[0155] Cluster C (center of mass [5.1, 2.7]) associated optical module bias current is abnormal (spectral energy correlation coefficient is 0.85)

[0156] On-site maintenance data confirms that this method reduces fault location time from 47 minutes for traditional manual diagnosis to 2.3 minutes. Key performance indicators include:

[0157] Detection sensitivity of temperature-related faults reaches 99.2% (±0.5°C accuracy);

[0158] The capture rate of transient anomalies (duration <100ms) is 91.7%;

[0159] The misassociation rate in a multi-fault concurrent scenario is only 1.3%.

[0160] Through a dynamic parameter optimization mechanism, the algorithm automatically adjusts parameters 1.8 times per hour to adapt to base station load fluctuations (the parameter ε_opt fluctuates within a range of ±0.07 during peak service periods), maintaining a silhouette coefficient ≥ 0.65 for 30 consecutive days of operation, meeting the 5G network's 99.999% reliability operation and maintenance requirements.

[0161] In one embodiment, extracting a dynamic time warping feature sequence from a network traffic log to obtain a dynamic traffic feature sequence with time distortion compensation includes:

[0162] S601, constructing a multi-dimensional time series based on the packet length, protocol type, and throughput of the network traffic log;

[0163] S602, using the improved FastDTW algorithm for multiple sequence alignment, the path constraints are: warpingpathslope≤2:1warpingpathslope≤2:1warpingppathslope≤2:1;

[0164] S603: Generate a dynamic traffic feature sequence with time distortion compensation.

[0165] In one embodiment, the specific implementation process for extracting dynamic time-warping feature sequences from network traffic logs is as follows: First, for the three core features of the target network traffic log, namely packet length, protocol type, and throughput, multi-dimensional time series are constructed to capture dynamic changes in traffic. The packet length sequence records the average number of bytes of packets transmitted within a unit time window, reflecting traffic load fluctuations; the protocol type sequence maps protocols such as TCP, UDP, and ICMP to discrete values ​​(e.g., TCP = 1, UDP = 2), forming a temporal encoding of protocol distribution; and the throughput sequence describes network bandwidth usage based on the number of bits transmitted per second. Subsequently, an improved FastDTW algorithm is used to align the multidimensional time series. Based on the traditional dynamic time warping algorithm, path constraints are introduced to optimize computational efficiency and alignment accuracy. Specifically, these constraints include: 1) limiting the slope range of the warping path, forcing the alignment path to satisfy |ij| ≤ r (r is the adaptive window radius, dynamically adjusted based on the sequence length) on the time axis to avoid excessive time distortion caused by network bursts; 2) imposing cross-dimensional correlation constraints on the multi-sequence synchronous alignment process, using the covariance matrix to measure the correlation between different feature sequences, ensuring that changes in protocol type, packet length, and throughput fluctuations maintain logical consistency on the time axis. Finally, by nonlinearly scaling the original sequence along the optimal warping path, a dynamic traffic feature sequence with time distortion robustness is generated. This sequence not only preserves the statistical characteristics of the original traffic in the time dimension, but also effectively eliminates time axis offset interference caused by network delay jitter and asynchronous attack behavior, providing highly discriminative time series feature input for subsequent abnormal traffic detection (such as identifying low-frequency DDoS attacks). Experiments show that the attack detection accuracy of this method on the public dataset CIC-IDS2017 is 12.7% higher than that of traditional DTW feature extraction, and the computational time is reduced to 23% of the original algorithm.

[0166] In one embodiment, the method further comprises:

[0167] S701, extracting feature data of newly added abnormal events from the diagnosis report, and calculating its mean vector μ_new and covariance matrix Σ_new;

[0168] S702, compare μ_new and Σ_new with the feature vectors in the historical pattern library for similarity. If the cosine similarity is less than 0.7, add the new event to the pattern library;

[0169] S703, using the online random forest algorithm, initializing the learning rate η = 0.01 and the maximum tree depth d = 10;

[0170] S704, divide the incremental data set into batches of 100 samples, and generate a new decision tree node when the prediction error δ>0.15;

[0171] S705, evaluate the model performance through sliding cross validation. If the accuracy improvement is less than 5%, retrain according to η = η × 1.2.

[0172] In one embodiment, the incremental learning and pattern updating method of the network anomaly detection system is specifically implemented as follows: when the system identifies a new abnormal event from the real-time diagnostic report, it first extracts its feature vector (including 12-dimensional indicators such as traffic peak, protocol distribution entropy, and session duration), and calculates its mean vector by maximum likelihood estimation. and the covariance matrix To quantify the statistical distribution characteristics of event features. new Perform multi-dimensional similarity comparison with 3000+ abnormal patterns stored in the historical pattern library - use the improved weighted cosine similarity algorithm to apply double weight to discrete features such as protocol type. When the comprehensive similarity score is lower than the threshold of 0.7, the event is determined to be a new attack pattern, and its feature data and statistical parameters are encrypted and stored in the blockchain-enhanced historical pattern library. In the dynamic update stage of the model, the system uses the online random forest (ORF) algorithm for incremental training: when initializing the basic model, the learning rate η = 0.01 is set to control the speed of knowledge forgetting, and the maximum depth of a single decision tree is limited to d = 10 to prevent overfitting; for the incremental data incoming in real time, streaming processing is performed in batches of 100 samples. When the prediction error in the sliding window is When the value exceeds 0.15, a node splitting mechanism is automatically triggered, dynamically generating new decision tree nodes based on the Gini coefficient gain to capture data distribution drift. Model performance is verified using a time-sensitive sliding cross-validation strategy. After processing every 500 samples, the F1-score and ROC-AUC metrics are calculated on a validation set retaining the most recent 2000 samples. If the accuracy improvement over three consecutive validations is less than 5%, an adaptive retraining mechanism is initiated, dynamically adjusting the learning rate by η←η×1.2 and reinitializing some subtrees. Actual deployment tests demonstrate that this method improves the response speed of new DDoS attack detection on an AWS network traffic dataset by 4.3 times that of traditional batch learning, while achieving 98.6% accuracy in pattern library updates and reducing the false positive rate to below 1.2%.

[0173] It should be understood that, although the various steps in the flowcharts involved in the various embodiments described above are displayed in sequence according to the instructions of the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and these steps can be executed in other orders. Moreover, at least a portion of the steps in the flowcharts involved in the various embodiments described above can include multiple steps or multiple stages, and these steps or stages are not necessarily executed and completed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a portion of steps or stages in other steps.

[0174] Based on the same inventive concept, embodiments of the present application further provide a communication device fault diagnosis apparatus for implementing the communication device fault diagnosis method involved above. The implementation solution provided by this apparatus is similar to the implementation solution described in the above method. Therefore, the specific limitations in one or more embodiments of the communication device fault diagnosis apparatus provided below can be found in the above limitations of the communication device fault diagnosis method and will not be repeated here.

[0175] In an exemplary embodiment, Figure 2 As shown, a communication equipment fault diagnosis device 400 is provided, comprising:

[0176] The time series data collection module 401 is used to collect communication equipment operation logs in real time, extract periodic fluctuations and abnormal points through time series decomposition, and generate a time series data abnormal point set.

[0177] The abnormal pattern matching module 402 uses a clustering algorithm to classify the abnormal point set, performs pattern matching in combination with a preset abnormal pattern library, and outputs the abnormal pattern type.

[0178] The multi-dimensional data fusion module 403 obtains sensor data of a corresponding time period according to the abnormal pattern type, and generates a fusion feature vector through principal component analysis.

[0179] The fault point prediction module 404 uses a deep learning model to jointly analyze the fused feature vector and the abnormal pattern type, and outputs a set of potential fault points.

[0180] The traffic correlation analysis module 405 extracts the dynamic time warping feature sequence of the network traffic log when the potential fault point set is not empty, and associates and analyzes the fault priority list through the classification model.

[0181] The Bayesian reasoning module 406 constructs a fault point dependency network based on the fault priority list and outputs a final fault location result.

[0182] In one embodiment, the time series data acquisition module 401 is further configured to:

[0183] The cycle length is dynamically adjusted based on the preset time window of the device log;

[0184] The outlier determination condition is the data point in the residual sequence that exceeds the ±3σ threshold.

[0185] In one embodiment, the abnormal pattern matching module 402 is configured to:

[0186] The neighborhood radius adjustment coefficient is calculated by the local density variance of the outlier point set:

[0187]

[0188] Where ε0=0.5 is the initial radius, σ local is the sample spacing variance of the current cluster, σ global is the global outlier distance variance, generating the optimized neighborhood radius ε opt ∈[0.3,0.8];

[0189] The dynamic minimum sample number constraint formula is:

[0190]

[0191] Where N is the number of outliers, w i is the sample weight coefficient, and after calculation, it outputs the integer optimization parameter MinPts opt ∈[5,15];

[0192] When the termination condition is met:

[0193]

[0194] When the silhouette coefficient is ≥0.6, the final optimized parameter combination (ε ont, ,MinPts ont ).

[0195] In one embodiment, the multidimensional data fusion module 403 is configured to:

[0196] The temperature, voltage, and current sensor data are standardized to eliminate dimensional differences and obtain a standardized data matrix X∈R^{n×m}, where n is the number of samples and m is the number of sensor types.

[0197] The covariance matrix and eigenvalue decomposition are performed on the standardized data matrix, and the principal components with a cumulative contribution rate of ≥85% are retained to construct a fusion feature vector, and the reduced dimension feature matrix Y∈R^{n×k} is obtained, where k is the number of principal components retained and k <m;

[0198] Add timestamp alignment labels to the feature vectors after dimensionality reduction to obtain a time-synchronized fused feature vector sequence Z∈R^{n×(k+1)}, where the k+1th column is the timestamp information.

[0199] In one embodiment, the deep learning model is a convolutional neural network-long short-term memory network hybrid model, including:

[0200] Convolutional neural network layers to extract spatial features from sensor data;

[0201] Long short-term memory network layer to capture the temporal dependencies of abnormal pattern types;

[0202] The joint training loss function is defined as: Loss = α·MSE+(1-α)·CrossEntropyLoss = α·MSE+(1-α)·CrossEntropyLoss = α·MSE+(1-α)·CrossEntropy, where α∈[0.4,0.6].

[0203] In one embodiment, the intelligent diagnostic device for communication equipment faults further includes:

[0204] The extraction module is used to extract the characteristic data of the newly added abnormal events from the diagnosis report and calculate its mean vector μ_new and covariance matrix Σ_new;

[0205] The similarity comparison module is used to compare μ_new and Σ_new with the feature vectors in the historical pattern library. If the cosine similarity is less than 0.7, the new event will be added to the pattern library;

[0206] Algorithm module, used to use the online random forest algorithm, initialize the learning rate η = 0.01, and the maximum tree depth d = 10;

[0207] A new decision generation module is used to divide the incremental dataset into batches of 100 samples and generate a new decision tree node when the prediction error δ>0.15;

[0208] The evaluation module is used to evaluate the model performance through sliding cross-validation. If the accuracy improvement is <5%, retraining is performed according to η = η × 1.2.

[0209] In one embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the power supply safety management method as described above when executing the computer program.

[0210] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0211] For the device embodiments, since they basically correspond to the method embodiments, the relevant parts can be referred to the partial description of the method embodiments. The device embodiments described above are merely illustrative, wherein the components described as separate parts may or may not be physically separated, and the parts displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of the disclosed solution. A person of ordinary skill in the art can understand and implement it without expending creative work.

[0212] The above-described embodiments merely represent several implementation methods of the embodiments of the present application. While the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the patent application. It should be noted that a person skilled in the art may make various modifications and improvements without departing from the concept of the embodiments of the present application, and these modifications and improvements fall within the scope of protection of the embodiments of the present application.

Claims

1. A method for diagnosing a fault in a communication device, characterized in that: include: Collect communication equipment operation logs in real time, extract periodic fluctuations and anomalies through time series decomposition, and generate a time series data anomaly point set; A clustering algorithm is used to classify the abnormal point set of the time series data, and pattern matching is performed in combination with a preset abnormal pattern library to output the abnormal pattern type corresponding to device hardware failure, software error and network congestion; Acquire sensor data of a corresponding time period according to the abnormal pattern type, and generate a fusion feature vector based on a multidimensional feature matrix of the temperature, voltage, and current sensor data through principal component analysis; Using a deep learning model to jointly analyze the fused feature vector and the abnormal pattern type, and output a set of potential fault points; When the set of potential fault points is not empty, the dynamic time warping feature sequence of the network traffic log is extracted, and the fault priority list is analyzed through the classification model association; A fault point dependency network is constructed based on the fault priority list, and a final fault location result is output.

2. The communication equipment fault diagnosis method according to claim 1, characterized in that: The time series decomposition adopts the STL algorithm, and the periodic fluctuation extraction meets the following constraints: The cycle length is dynamically adjusted based on the preset time window of the device log; The outlier determination condition is the data point in the residual sequence that exceeds the ±3σ threshold.

3. The communication equipment fault diagnosis method according to claim 1, characterized in that: The clustering algorithm is an improved DBSCAN algorithm, and the parameter optimization method of the improved DBSCAN algorithm generates the following optimized parameter set: The neighborhood radius adjustment coefficient is calculated by the local density variance of the outlier point set: Where ε0=0.5 is the initial radius, σ local is the sample spacing variance of the current cluster, σ global is the global outlier distance variance, generating the optimized neighborhood radius ε opt ∈[0.3,0.8]; The dynamic minimum sample number constraint formula is: Where N is the number of outliers, w i is the sample weight coefficient, and after calculation, it outputs the integer optimization parameter MinPts opt ∈[5,15]; When the termination condition is met: When the silhouette coefficient is ≥0.6, the final optimized parameter combination (ε ont, ,MinPts ont ).

4. The communication equipment fault diagnosis method according to claim 1, characterized in that: The principal component analysis is used to generate a fusion feature vector based on multi-source sensor data, including: The temperature, voltage, and current sensor data are standardized to eliminate dimensional differences and obtain a standardized data matrix X∈R^{n×m}, where n is the number of samples and m is the number of sensor types. The covariance matrix and eigenvalue decomposition are performed on the standardized data matrix, and the principal components with a cumulative contribution rate of ≥85% are retained to construct a fusion feature vector, and the reduced dimension feature matrix Y∈R^{n×k} is obtained, where k is the number of principal components retained and k <m; Add timestamp alignment labels to the feature vectors after dimensionality reduction to obtain a time-synchronized fused feature vector sequence Z∈R^{n×(k+1)}, where the k+1th column is the timestamp information.

5. The communication equipment fault diagnosis method according to claim 1, characterized in that: The deep learning model is a convolutional neural network-long short-term memory network hybrid model, including: Convolutional neural network layers to extract spatial features from sensor data; Long short-term memory network layer to capture the temporal dependencies of abnormal pattern types; The joint training loss function is defined as: Loss = α·MSE+(1-α)·CrossEntropyLoss = α·MSE+(1-α)·CrossEntropyLoss = α·MSE+(1-α)·CrossEntropy, where α∈[0.4,0.6].

6. The communication equipment fault diagnosis method according to claim 1, characterized in that: The step of extracting a dynamic time warping feature sequence from a network traffic log to obtain a dynamic traffic feature sequence with time distortion compensation includes: Construct multi-dimensional time series based on the packet length, protocol type, and throughput of network traffic logs; The improved FastDTW algorithm was used for multiple sequence alignment, and the path constraints were: warpingpathslope≤2:1warpingpathslope≤2:1warpingpathslope≤2:1; Generate dynamic traffic signature sequences with time warp compensation.

7. The communication equipment fault diagnosis method according to claim 1, characterized in that: The method further comprises: Extract the characteristic data of the newly added abnormal events from the diagnosis report and calculate their mean vector μ_new and covariance matrix Σ_new; Compare μ_new and Σ_new with the feature vectors in the historical pattern library for similarity. If the cosine similarity is less than 0.7, the new event is added to the pattern library. Use the online random forest algorithm, initialize the learning rate η = 0.01, and the maximum tree depth d = 10; The incremental data set is divided into batches of 100 samples each, and a new decision tree node is generated when the prediction error δ>0.15; The model performance was evaluated by sliding cross validation. If the accuracy improvement was <5%, the model was retrained according to η = η × 1.

2.

8. A communication equipment fault intelligent diagnosis device, characterized in that: The device comprises: The time series data acquisition module is used to collect communication equipment operation logs in real time, extract periodic fluctuations and anomalies through time series decomposition, and generate a time series data anomaly point set; The abnormal pattern matching module uses a clustering algorithm to classify the abnormal point set, performs pattern matching in combination with a preset abnormal pattern library, and outputs the abnormal pattern type; A multidimensional data fusion module acquires sensor data of a corresponding time period according to the abnormal pattern type and generates a fusion feature vector through principal component analysis; A fault point prediction module uses a deep learning model to jointly analyze the fused feature vector and the abnormal pattern type, and outputs a set of potential fault points; Traffic correlation analysis module, when the potential fault point set is not empty, extracts the dynamic time-warping feature sequence of the network traffic log and uses the classification model to correlate and analyze the fault priority list; The Bayesian reasoning module constructs a fault point dependency network based on the fault priority list and outputs a final fault location result.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images