Flow mode analysis method and system for PON topology anomaly recognition

Abstract

The invention discloses a flow mode analysis method and system for PON topology anomaly recognition, and relates to the technical field of optical communication network management, and the method comprises the steps: collecting the flow, optical power, frame error rate and other operation and maintenance indexes of each optical network unit, constructing a flow distribution vector based on the data, and carrying out the time sequence feature modeling in combination with a historical normal state; performing mode learning and anomaly detection on traffic behaviors by using an auto-encoder model and calculating a reconstruction error and information theory divergence; the change of the topological structure is further quantified by adopting traffic correlation matrix difference analysis, three abnormal indexes are integrated to form a comprehensive abnormal index, and PON topology abnormity can be judged once the comprehensive abnormal index exceeds a set threshold value. Therefore, real-time monitoring and intelligent identification of PON network faults can be realized through multi-dimensional operation and maintenance index fusion and a time sequence convolution auto-encoder model without additional physical equipment.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of optical communication network management, and in particular to a traffic pattern analysis method and system for PON topology anomaly identification. BACKGROUND

[0002] Passive optical network (PON) is a point-to-multipoint access network architecture, which uses a passive optical splitter in an optical distribution network (ODN) to divide one optical fiber into multiple branches to provide fiber to the home (FTTH) services for a large number of homes or enterprises. PON has become an important development direction of broadband access technology due to its high bandwidth, low energy consumption and low operation and maintenance cost. The basic components of a PON system include an optical line terminal (OLT) located at the local end, an optical network unit (ONU) located at the user end, and an optical distribution network that carries the intermediate link. The OLT is responsible for exchanging data with the backbone network and performing uplink / downlink scheduling control, and the ONU converts optical signals and electrical signals to adapt to the cables, Wi-Fi or Ethernet devices on the user side.

[0003] Since PON adopts a tree topology, when a fault occurs in a root optical fiber, all subsequent branch users will be affected, and the fault range may expand from one user to dozens of users. ODNs usually use passive devices and cannot actively report the status like active devices, so fault isolation and positioning rely on measurements and inferences at the central office. The traditional operation and maintenance method injects optical pulses into the optical fiber with the help of an optical time domain reflectometer (OTDR), and judges the attenuation and reflection events of the optical fiber by measuring the intensity and time delay of Rayleigh scattering and Fresnel reflection echoes.

[0004] Although OTDR can provide the insertion loss of the optical fiber link and the accurate position of the reflection event, and help technicians to find problems such as dirty joints, macro-bends, micro-bends, etc. However, OTDR measurement requires setting parameters such as pulse width, averaging time and dead zone; narrow pulse width can improve resolution but reduce measurement distance, and wide pulse width improves dynamic range but reduces resolution, and the parameter selection often depends on experience. Under low signal-to-noise ratio, normal and fault waveforms are difficult to distinguish. In addition, configuring a tunable OTDR for each branch or installing a reflector at the end of the branch in the PON system can improve identification, but the device cost is high, the installation is complex, and the topology needs to be reconfigured after changing. SUMMARY

[0005] The application provides a traffic pattern analysis method and system for PON topology anomaly identification, a storage medium, a computer program product and an electronic device, to at least solve the problem that the fault identification of a PON network in the prior art relies on expensive and complex OTDR measurement means, and it is difficult to timely, low-cost and accurately locate topology anomalies.

[0006] In a first aspect, the embodiments of the application provide a traffic pattern analysis method for PON topology anomaly identification, applied to an optical line terminal, the method comprising: collecting operation and maintenance indexes of each optical network unit managed according to an observation window and recording a time stamp; the operation and maintenance indexes include traffic, optical power and frame error rate; for each sampling time in the observation window, a traffic vector of the sampling time containing the traffic of each optical network unit is constructed, and the global total traffic of the optical line terminal at the sampling time is counted to calculate the traffic proportion of each optical network unit, and a traffic distribution vector of the sampling time containing the traffic proportion of each optical network unit is constructed; the traffic distribution vector of each sampling time is fused with the average value, peak value, fluctuation degree of traffic, optical power and frame error rate in the observation window to form an observation feature sequence, and the observation feature sequence is input into a time series convolution autoencoder model to obtain a reconstruction error; wherein the time series convolution autoencoder model is trained using a normal feature sequence set during historical normal operation to learn normal traffic feature patterns; based on the traffic distribution vector of each sampling time in the observation window and the training period average distribution corresponding to the normal feature sequence set, an information divergence is calculated; an observation traffic correlation matrix between the traffic vectors of each optical network unit in the observation window is calculated, and a traffic correlation matrix difference between the observation traffic correlation matrix and a reference traffic correlation matrix is calculated; the reference correlation matrix is the average value of the traffic correlation matrix corresponding to the historical normal operation period calculated according to the normal feature sequence set; a comprehensive anomaly index is determined according to the calculated reconstruction error, information divergence and traffic correlation matrix difference, and when the comprehensive anomaly index exceeds a threshold value, it is determined that there is a topology anomaly.

[0007] In a second aspect, the embodiments of the present application provide a traffic pattern analysis system for PON topology anomaly identification, which is deployed in an optical line terminal, and comprises: a data collection unit, configured to collect operation and maintenance indexes of each optical network unit managed by the optical line terminal according to an observation window and record a time stamp; the operation and maintenance indexes comprise traffic, optical power and frame error rate; a feature construction unit, configured to, for each sampling moment in the observation window, construct a traffic vector comprising traffic of each optical network unit at the sampling moment, and statistically determine a global total traffic of the optical line terminal at the sampling moment, to calculate a traffic proportion of each optical network unit, and construct a traffic distribution vector comprising traffic proportions of each optical network unit at the sampling moment; a reconstruction error analysis unit, configured to fuse the traffic distribution vector of each sampling moment with a traffic average value, a traffic peak value, a traffic fluctuation degree, optical power and frame error rate in the observation window, to form an observation feature sequence, and input the observation feature sequence into a time series convolution autoencoder model, to obtain a reconstruction error; wherein the time series convolution autoencoder model is trained by using a normal feature sequence set during a historical normal operation period, to learn a normal traffic feature mode; an information divergence analysis unit, configured to calculate an information divergence based on the traffic distribution vector of each sampling moment in the observation window and a training period average distribution corresponding to the normal feature sequence set; a correlation difference analysis unit, configured to calculate an observation traffic correlation matrix between the traffic vectors of each optical network unit in the observation window, and calculate a traffic correlation matrix difference between the observation traffic correlation matrix and a reference traffic correlation matrix; the reference correlation matrix is a mean value of traffic correlation matrices corresponding to the historical normal operation period, which is calculated according to the normal feature sequence set; a topology anomaly identification unit, configured to determine a comprehensive anomaly index according to the calculated reconstruction error, information divergence and traffic correlation matrix difference, and determine that there is a topology anomaly when the comprehensive anomaly index exceeds a threshold value.

[0008] In a third aspect, an electronic device is provided, which comprises at least one processor, and a memory connected with the at least one processor in communication, wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the steps of the traffic pattern analysis method for PON topology anomaly identification according to any of the embodiments of the present application.

[0009] In a fourth aspect, the embodiments of the present application provide a storage medium having a computer program stored thereon, wherein the program, when executed by a processor, implements the steps of the traffic pattern analysis method for PON topology anomaly identification according to any of the embodiments of the present application.

[0010] In a fifth aspect, the embodiments of the present application provide a computer program product, comprising computer programs / instructions, which, when executed by a processor, implement the steps of the traffic pattern analysis method for PON topology anomaly identification according to any of the embodiments of the present application.

[0011] The traffic pattern analysis method and system for PON topology anomaly identification provided by the present application can at least produce the following technical effects:

[0012] (1) By collecting the running indexes of each ONU in the PON system at the OLT end and constructing a time series feature vector based on the traffic proportion, the sensitivity to abnormal behavior under topology changes is effectively enhanced. Unlike traditional detection methods that rely only on physical link parameters, the global total traffic is normalized, and the relative traffic distribution vector of each ONU is constructed, thereby weakening the disturbance of the absolute value of the traffic. As a result, the structural change characteristics are highlighted, so that even in the case of stable total traffic, the relative traffic distribution mutation caused by an abnormal branch can be effectively captured.

[0013] (2) By constructing a multi-dimensional observation feature sequence including traffic proportion, optical power, frame error rate, traffic peak value and fluctuation degree at each sampling time within the observation window, and introducing a time series convolution autoencoder model to extract the reconstruction error, the model is unsupervised trained with data sequences in the normal state, learns the typical business behavior patterns of the PON network in normal operation, and can identify the changes in feature patterns caused by network structure anomalies (such as fiber breakage, optical attenuation, etc.) in a timely manner. Through the reconstruction error, the detection process no longer relies on prior knowledge of specific abnormal types, significantly improving the generalization ability and stability of topology anomaly detection.

[0014] (3) A distribution deviation measurement method based on information divergence is introduced to measure the deviation of the traffic distribution vector of the current sampling window compared to the average distribution of the historical normal training period. Such anomalies often lead to local traffic imbalance, and information divergence can quantify the disturbance caused by this imbalance to the overall system behavior structure, and analyze the system running state from the probability distribution level.

[0015] (3) A traffic correlation matrix difference analysis mechanism is constructed to determine whether the traffic behavior coordination between ONUs has changed during the current observation period. By comparing with the reference correlation matrix (generated from historical normal period data), local behavior mismatch or traffic deviation phenomena caused by topology disturbance can be found, and the fault impact range and propagation path can also be further determined.

[0016] (4) By fusing the three dimensions of abnormal index of reconstruction error, information divergence and correlation matrix difference, a multi-element joint comprehensive abnormal index is constructed, and a dynamic threshold is set for abnormal alarm judgment, which significantly improves the accuracy and robustness of abnormal detection.

[0017] Through the technical scheme, by constructing a traffic distribution feature space facing the PON topology structure, and using a time sequence auto-encoder to model and compare the behavior evolution mode, supplemented by statistical correlation and distribution deviation analysis, the efficient identification of PON structural anomalies is realized without relying on physical measurement means. Thus, the traditional idea of relying on optical fiber echo signal analysis is broken through, and a more data-driven and structure-aware method is used to realize intelligent monitoring of the running state of the PON network. BRIEF DESCRIPTION OF DRAWINGS

[0018] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the drawings needed to be used in the embodiments or prior art description will be briefly introduced. Obviously, the drawings in the following description are some embodiments of the present application, and those skilled in the art can also obtain other drawings according to these drawings without creative labor.

[0019] Figure 1 A flow chart of an example of a traffic pattern analysis method for PON topology anomaly identification according to an embodiment of the present application is shown;

[0020] Figure 2 A flow chart of another example of a traffic pattern analysis method for PON topology anomaly identification according to an embodiment of the present application is shown;

[0021] Figure 3 A structural connection diagram of an example of an auto-encoder model according to an embodiment of the present application is shown;

[0022] Figure 4 An F1 score comparison bar chart of an example of different anomaly detection methods is shown;

[0023] Figure 5 An ROC curve comparison chart of an example of different anomaly detection methods is shown;

[0024] Figure 6 A time series heat map of an example of traffic proportion deviation from the mean is shown;

[0025] Figure 7 A structural block diagram of an example of a traffic pattern analysis system for PON topology anomaly identification according to an embodiment of the present application is shown. DETAILED DESCRIPTION

[0026] In order to make the purposes, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are some but not all of the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by a person of ordinary skill in the art without creative work fall within the protection scope of the present application.

[0027] It should be noted that in the prior art, some experts and scholars have proposed some novel directions for PON topology anomaly management. Specifically, OTDR is a typical fiber link monitoring instrument. It injects high-power optical pulses into the fiber and measures the attenuation distribution and reflection event location along the fiber using Rayleigh scattering and Fresnel reflection. This technology can accurately locate events such as connectors, bends, and cracks, helping technicians identify high-loss joints. However, as described earlier, OTDR faces challenges in the PON environment: branch overlap makes reflections indistinguishable, long averaging is needed to improve the signal-to-noise ratio when noise is large, and the device is expensive and relies on experience-based parameter tuning. Therefore, although OTDR is an important tool for operation and maintenance, it cannot solve all problems alone in complex PON scenarios.

[0029] Recently, there have been studies on using machine learning for OTDR data analysis. Abdelli et al. proposed a gated recurrent unit (GRU)-based network-dependent model to identify which branch in the PON is faulty. They built an experimental network with 1:128 branches to collect OTDR data, placed a fixed optical attenuator in a single branch to simulate a fault, and trained a GRU model using noisy OTDR signals. The model outputs the probability of each category (normal or fault in a certain branch), and the average diagnostic accuracy reaches 97.45%. However, this model is trained for a specific topology, and if the number or length of branches changes, it needs to be retrained; in a new topology, the accuracy drops to 93.4%, and it must rely on additional hardware such as reflectors.

[0030] To overcome the network dependence problem, researchers have also proposed a "generalized" model that divides long OTDR data into short sequences containing only one or two reflections and predicts the reflection type and location through a machine learning model, then compares it with a reference waveform to identify the faulty branch. This method does not need to be retrained in different PON topologies, but still relies on the installation of reflectors at the end of the branch to produce clear reflection signals, and requires accurate reference waveforms for comparison.

[0031] In addition to OTDR, some research attempts to directly use traffic flow and transmission characteristics to identify abnormalities. For example, the patent CN109039444B of China Telecom proposes an ONU abnormality detection method, device, OLT and optical network, which can identify abnormal ONUs according to the uplink frame error rate. The method first calculates the uplink frame error rate of each ONU under the OLT port, and classifies the ONUs with frame error rates exceeding the threshold into an abnormal problem group, and then adjusts their uplink time slots in the DBA cycle to the tail of the queue to detect their optical signals without affecting normal user traffic. If an abnormal optical signal (such as light drift causing intensity exceeding the threshold) is detected, the ONU is marked as abnormal and isolated; otherwise, its normal time slot is restored. This scheme is effective for soft faults such as light drift, and can avoid traversing all ONUs, positioning faster and more accurately. However, this method relies on the prior setting of frame error rate and optical power threshold, and may not accurately identify complex topology abnormalities (such as shunt aging and local congestion).

[0032] In summary, the current related technologies mainly focus on fault monitoring at the signal level (such as OTDR) or the bit error rate level, or use traffic anomaly detection algorithms similar to general networks.

[0033] It should be understood that the purpose of the above description of the current related technologies is only to facilitate the public to better understand the spirit and motives of the application, and is not considered as a limitation of the application. In addition, the technical solutions described in the above current related technologies are not prior art, and can also be undisclosed technical solutions, such as solutions under research or in the laboratory stage.

[0034] In the technical solutions of the present application, the collection, storage, use, processing, transmission, provision and disclosure of user personal information, etc. comply with relevant laws and regulations and do not violate public order and good customs.

[0035] It should be noted that as the network scale expands and business diversifies, operators hope to achieve early fault detection, accurate positioning and root cause analysis through intelligent operation and maintenance means, reduce operation and maintenance costs and ensure user experience. Simply relying on OTDR or manual inspection cannot meet the requirements of large-scale and real-time.

[0036] In a PON system, the OLT schedules upstream and downstream time slots for multiple ONUs using a dynamic bandwidth allocation (DBA) mechanism. Under normal circumstances, traffic on each branch exhibits distinct daily cyclical patterns. For example, internet demand during weekday peak hours is higher than at night, and the traffic share of each branch remains relatively stable. However, topological anomalies such as fiber breaks, splitter damage, or ONU light drift can cause sudden changes in traffic on the affected branch. For example, a fiber break can cause traffic on that branch to plummet to zero, or light drift can increase the bit error rate and trigger DBA scheduling adjustments. These anomalies alter the distribution of traffic on each ONU within the total bandwidth, resulting in noticeable anomalies in traffic patterns. Therefore, analyzing the health of the PON topology at the traffic level is feasible. Exploring traffic patterns can not only overcome the limitations of signal-level monitoring tools like OTDRs, but also provide a macroscopic view of service operations beyond the device layer.

[0037] From a broader cybersecurity perspective, much research has focused on the application of unsupervised learning in network traffic anomaly detection. Traffic-based anomaly detection often utilizes network flows (NetFlow) rather than packet-by-packet analysis to reduce data volume and adapt to the high-traffic scenarios of the 5G era. Autoencoders, Adversarially Learned Anomaly Detection (ALAD), and Self-Organizing Maps (SOM) are all examples of unsupervised algorithms. However, these methods primarily target IP network attacks and lack in-depth consideration of PON architecture characteristics and traffic patterns.

[0038] Figure 1 A flowchart of an example of a traffic pattern analysis method for identifying PON topology anomalies according to an embodiment of the present application is shown.

[0039] The execution entity of the method of the embodiment of the present application can be any controller or processor with computing or processing capabilities, such as a controller integrated into the OLT. Based on the traffic distribution characteristics of the PON topology, a more refined traffic model is established by combining unsupervised learning to analyze PON topology anomalies at the traffic level.

[0040] In some examples, it may be integrated and configured in an electronic device or terminal through software, hardware, or a combination of software and hardware, and the types of terminals or electronic devices may be diverse, such as various types of optical line terminals, etc.

[0041] like Figure 1 As shown, in step S110, the operation and maintenance indicators of each managed optical network unit are collected according to the observation window and the timestamp is recorded.

[0042] Here, with the observation window as the basic unit, all the managed optical network units are periodically collected for full-quantity operation and maintenance data. The operation and maintenance indicators not only include the most intuitive uplink and downlink traffic, but also cover the core indicators such as optical power and frame error rate reflecting the physical health status of the link and the reliability of data transmission. Each collection is accompanied by an accurate timestamp to achieve consistency of multi-source data in the time sequence dimension.

[0043] Specifically, as the control center of the PON system, the OLT periodically collects key operating status indicators from each ONU it manages at a fixed sampling period (for example, every 5 seconds or 10 seconds). The downlink / uplink traffic represents the data size transmitted by the ONU at the current time; the received optical power is used to reflect the optical signal strength of the optical fiber link, which is an important indicator for identifying physical problems such as optical loss, cable bending, and loose connection; the frame error rate represents the ratio of transmission frame errors in a unit of time, which can reflect the link quality and data stability. All data need to be recorded with accurate timestamps and labeled according to the ONU number to build a clear multi-dimensional time sequence structure.

[0044] In step S120, for each sampling time in the observation window, a traffic vector of the sampling time containing the traffic of each optical network unit is constructed, and the global total traffic of the optical line terminal at the sampling time is counted to calculate the traffic proportion of each optical network unit and construct a traffic distribution vector of the sampling time containing the traffic proportion of each optical network unit.

[0045] Here, for each sampling time in the observation window, the traffic indicators of all ONUs are integrated into a traffic vector in turn. Further, the global total traffic at the sampling time is counted, and based on this, the traffic of each ONU is normalized to calculate the traffic proportion of each ONU at that time. The traffic proportion vector (i.e., the traffic distribution vector) can directly reflect the contribution relationship of each ONU in the global traffic, eliminate the impact of business volume fluctuations, and focus on structural changes within the network.

[0046] In some embodiments, at each sampling time, an ONU traffic vector including each optical network unit is constructed , the global total traffic and the traffic proportion of each optical network unit are calculated to form a traffic distribution vector , and the traffic distribution vector is fused with the average traffic, peak traffic, fluctuation degree, optical power, and frame error rate in the observation window to form an observation feature sequence; represents the traffic value of the th optical network unit at the sampling time , and represents the traffic vector of all optical network units at time denotes the global total traffic at the sampling time denotes the traffic proportion of the th optical network unit at the sampling time denotes the traffic distribution vector at the sampling time

[0047] It should be noted that traditional anomaly identification often focuses on fluctuations in absolute traffic values, but in PONs, the absolute values of traffic are often affected by business time periods (such as morning and evening peak hours), and fluctuations are large and have no abnormal meaning. By introducing the traffic proportion, the perception ability of the relative behavior structure is strengthened. For example, when a branch is disconnected due to a broken fiber, its original traffic proportion will drop sharply, and the traffic proportions of other ONUs will relatively increase, thereby forming a significant traffic distribution variation. Thus, by analyzing the traffic distribution vector, the system pays more attention to structural deviation rather than absolute traffic fluctuations, thereby enhancing the sensitivity and robustness to topology anomalies.

[0048] In step S130, the traffic distribution vector of each sampling time is fused with the average traffic, peak traffic, traffic fluctuation, optical power and frame error rate in the observation window to form an observation feature sequence, and the observation feature sequence is input into a time series convolutional autoencoder model to obtain a reconstruction error.

[0049] Here, the time series convolutional autoencoder model is trained using a normal feature sequence set during the historical normal operation to learn the normal traffic feature mode, and can automatically capture the time series rules, local features and periodic changes in the normal traffic mode, and generate a higher reconstruction error for abnormal patterns.

[0050] In some embodiments, the traffic distribution vector is horizontally fused with the traffic statistical features (such as average value, peak value, fluctuation), optical power and frame error rate in the observation window, for example, the above features are spliced to form a joint multi-dimensional feature vector sequence, and an observation feature sequence of an observation window is formed according to time sequence. Subsequently, the trained time series convolutional autoencoder model is input for modeling and reconstruction, and the reconstructed feature sequence is output, which is compared with the original input observation feature sequence to obtain a reconstruction error value.

[0051] In step S140, based on the traffic distribution vector of each sampling time in the observation window and the average distribution corresponding to the training period of the normal feature sequence set, the information divergence is calculated.

[0052] ​​​It should be understood that the form of the information divergence can be diversified, such as KL divergence, JS divergence, etc., to compare the degree of deviation between the traffic distribution vector of each time in the current observation window and the average distribution between the historical normal characteristic sequence. Thus, by depicting the deviation between the probability distributions, the small abnormal fluctuations and potential branch abnormalities of the traffic proportion are captured.

[0053] It should be noted that during normal operation, the traffic proportion of each ONU of the PON system usually has stability or periodicity. When a branch is interrupted or the link quality is reduced, the distribution weight of the branch will change. Through the divergence calculation, the structural change can be accurately captured from the probability space level, which is independent of the model prediction, and is used as an independent discriminant to supplement the time series modeling ability of the reconstruction error, thereby improving the accuracy and interpretability of the overall detection.

[0054] In step S150, an observed traffic correlation matrix between the traffic vectors of each optical network unit in the observation window is calculated, and a traffic correlation matrix difference between the observed traffic correlation matrix and a reference traffic correlation matrix is calculated.

[0055] Here, the reference correlation matrix is the average of the traffic correlation matrix corresponding to the historical normal operation period calculated according to the normal characteristic sequence set. The correlation analysis is performed on all ONU traffic vectors in the observation window to obtain the current observed correlation matrix; then the reference correlation matrix average calculated based on the normal characteristic sequence is compared to quantify the difference between the two, which reflects the overall deviation of the cooperative relationship between the traffic of each node in the network, and effectively reveals the imbalance or interruption of the traffic transmission mechanism under the abnormal topology.

[0056] Exemplarily, the Pearson correlation coefficient can be used to measure the correlation between the traffic of each pair of ONUs. In addition, the quantification method of the structural difference can be diversified, such as matrix norm, eigenvalue distance.

[0057] It should be noted that under the normal topology, the traffic correlation between some ONUs often has statistical consistency due to the proximity of the region and the synchronization of the service; if the topology structure is disturbed (such as some branch chain is interrupted or exchanged), the correlation structure will change. Through the correlation matrix difference analysis, not only the fault can be identified, but also the abnormal influence range and the change of the behavior linkage between nodes can be reflected.

[0058] In step S160, a comprehensive abnormality index is determined according to the calculated reconstruction error, information divergence and traffic correlation matrix difference, and it is determined that there is a topology anomaly when the comprehensive abnormality index exceeds a threshold value.

[0059] Here, the three abnormality indicators of reconstruction error, information divergence and correlation matrix difference calculated by the observation window are fused, for example, normalized and aggregated by weighted combination, rule set or shallow neural network, to output a comprehensive abnormality index in the interval of 0~1, which not only reflects the intensity of the abnormality, but also takes into account the sensitivity of different abnormality types. In addition, by comparing with a dynamic or static threshold, once the abnormality index exceeds the threshold, it is determined that there is a topological structure abnormality in the current observation window, realizing real-time and automatic discrimination and alarm of the topological abnormality, which facilitates the subsequent operation and maintenance personnel to quickly intervene.

[0060] Thus, the accuracy and response speed of abnormality detection are significantly improved, the burden of manual inspection and the user influence range caused by fault propagation are greatly reduced, and the efficient and automated transformation of the PON network intelligent operation and maintenance system is enabled.

[0061] In some examples of the embodiments of the present application, the early warning threshold can adopt a dynamic adaptive threshold.

[0062] More specifically, the sequence of comprehensive abnormality indexes of the last observation windows is dynamically recorded, and the threshold is adaptively updated by using a quantile method.

[0063] , formula (1)

[0064] In the formula, represents the adaptive threshold corresponding to the observation window, represents the initial reference threshold, is a quantile function, which represents the quantile of the input data set; represents the set of comprehensive abnormality indexes from the observation window to the observation window, represents the comprehensive abnormality index of the observation window.

[0065] Regarding formula (1), It is initialized by the system to provide minimum safety guarantee; if the recent window score distribution is lower than , the threshold will not be lowered too much, avoiding misjudgment of abnormality in the low load stage. The quantile parameter in the quantile function can be selected as 0.95~0.99, which can tolerate occasional fluctuations and efficiently detect persistent abnormalities. The sequence data structure adopts a circular queue or a double-ended queue, and each batch of observation data is automatically added to the sequence with the latest window score. If the total number exceeds , the oldest data is removed to realize sliding update.

[0066] Through the embodiments of the present application, the sliding window quantile adaptive threshold mechanism can dynamically extract high quantiles as the current alarm threshold based on the abnormal exponential distribution in the recent history window, effectively reflecting the latest running state and normal fluctuation range of the system. At the same time, by combining the initial safety baseline threshold, it is ensured that the threshold will not be abnormally reduced due to short-term business fluctuations, thereby realizing real-time self-adaptation to different network states and load environments.

[0067] Figure 2 A flowchart showing another example of a traffic pattern analysis method for PON topology anomaly identification according to an embodiment of the present application is shown.

[0068] In step S210, it is determined that there is a PON topology anomaly.

[0069] Regarding the operation of step S210, reference can be made to the above description of the operation in combination with steps S110-S160 of the method shown in FIG. 1, which will not be repeated here. Figure 1

[0070] In step S220, the contribution of each optical network unit to the information entropy divergence in the observation window is calculated, and the abnormal optical network unit is located from each optical network unit according to the calculated contribution.

[0071] It should be noted that in the case where the PON topology anomaly has been determined to exist, the network management system needs to further accurately locate the abnormal branch or abnormal ONU from the global anomaly. To this end, the group distribution anomaly is decomposed into the individual contribution of each ONU to highlight the physical location and traffic characteristics of the abnormal source.

[0072] Specifically, taking the information entropy divergence (such as JS divergence) as the abnormality measurement tool, the traffic distribution of each optical network unit in the observation window is compared with its historical normal distribution to quantitatively depict the degree of deviation of the current behavior of each unit from the normal mode. For each ONU, the component contribution of each sampling time in the observation window is calculated according to the JS divergence decomposition method, and then the component contribution of all sampling times is averaged or weighted aggregated to form a window-level contribution index, expressing the overall abnormal trend of the ONU in the current observation window.

[0073] In some examples of the embodiments of the present application, through the component decomposition method of information entropy divergence, the JS divergence contribution of each ONU is real-time and fine-grained depicted based on the comparison of traffic distribution and normal distribution at each sampling, and through the observation window-level aggregation, an interpretable index reflecting the abnormal trend of each ONU in the entire window is output.

[0074] Specifically, for each sampling time in the observation window, the component contribution of each optical network unit to the JS divergence at the sampling time is calculated.

[0075] ​First, the original traffic data is normalized to calculate the traffic proportion of each ONU for each sampling time in each observation window , ensuring that the sum of each component is 1. In addition, based on the normal traffic sequence set during the historical training period, the reference traffic proportion of each ONU is counted as a normal distribution reference.

[0076] For each sampling time within the observation window , the influence of JS divergence is decomposed using the KL divergence component, and the component contribution of each ONU is calculated respectively.

[0077] , formula (2)

[0078] , formula (3)

[0079] In the formula, represents the component contribution of the th optical network unit to the JS divergence at the sampling time , and represents the traffic proportion of the th optical network unit at the sampling time , and represents the average traffic proportion of the th optical network unit during the training period determined according to the normal characteristic sequence set, represents the mean component of the current distribution and the normal distribution of the th optical network unit at the sampling time .

[0080] The component contribution measures the influence of the actual distribution of a single ONU at that time on the JS divergence, and the larger the value indicates the higher degree of deviation from the normal.

[0081] According to the component contribution of each sampling time, the window-level contribution of information theory divergence is calculated.

[0082] , formula (4)

[0083] In the formula, represents the window-level average contribution of the th optical network unit to the information theory divergence within the observation window, represents the total number of sampling times within the observation window, represents the component contribution of the th sampling time within the window.

[0084] To achieve more robust anomaly detection results, the component contributions at all sampling moments within the observation window are averaged and aggregated. This significantly reduces the impact of transient noise and random fluctuations on single-point metrics and improves the statistical stability of anomaly location. Consequently, the application of window-level JS divergence component contributions significantly improves the accuracy and anti-interference capabilities of anomaly location, enabling the system to more accurately identify ONUs that consistently deviate from normal traffic patterns over a period of time.

[0085] Through the embodiments of the present application, a component contribution method based on information theoretic divergence decomposition is adopted, which can refine the overall abnormality within the observation window to each optical network unit, realize the interpretable distribution of abnormality scores, and enable network management personnel to quickly and intuitively lock the ONU branch with significantly abnormal traffic behavior after a global abnormality alarm, thereby reducing the scope and time of manual investigation.

[0086] Figure 3 A structural connection diagram of an example of an autoencoder model according to an embodiment of the present application is shown.

[0087] like Figure 3 As shown, the temporal convolutional autoencoder model 300 includes an encoder 310, an attention module 320, and a decoder 330. In the PON network traffic pattern analysis and anomaly detection scenario, relying solely on static features makes it difficult to fully capture the temporal evolution and multi-scale anomalies of ONU traffic. Therefore, an autoencoder structure based on multi-layer dilated convolution is used to perform multi-scale temporal modeling on the original observation feature sequence, and a self-attention mechanism is introduced to capture the dynamic correlation between different time slices, achieving accurate modeling of complex abnormal behaviors within the observation window and quantification of reconstruction errors. Through end-to-end deep model learning and temporal reconstruction loss feedback, the model can automatically adapt to different types of anomaly patterns, improving the system's adaptive detection capabilities for fine-grained network anomalies.

[0088] Specifically, the encoder 310 is used to extract the observation feature sequence using multiple one-dimensional convolution layers with increasing dilation rates. Multi-scale temporal characteristics.

[0089] , formula (5)

[0090] Where, Indicates that the convolution kernel size is , expansion rate is the one-dimensional convolution operation; and Respectively represent Layer and The hidden features of the layer output, represents the observation feature sequence, and Respectively represent the first the first and the feature values of the sampling time points.

[0091] Here, the encoder 310 extracts features from the input sequence through multiple layers of one-dimensional convolution layers with increasing dilation rates, and the output of each layer is used as the input of the next layer, so that the network can extract time-dependent dependencies and global / local features of different time scales. The use of dilated convolution increases the receptive field range and enables long-distance modeling of abnormal evolution processes.

[0092] The attention module 320 is used to calculate the attention weight between the encoding sequence features of the last layer of the encoder as input.

[0093] , formula (6)

[0094] In the formula, denotes the attention weight of the first sampling time point to the first sampling time point in the self-attention mechanism, and denote the hidden feature vectors of the first sampling time point and the first sampling time point in the encoding sequence feature, denotes the total number of layers of the encoder; denotes the vector transposition operation, and denote the query and key learnable weight matrices, respectively.

[0095] The encoding sequence features are weighted and fused according to the time-dependent self-attention weights of each sampling time point to obtain the attention output features:

[0096] , formula (7)

[0097] In the formula, is a learnable weight matrix, is the self-attention comprehensive feature of the first sampling time point.

[0098] Here, the hidden features output by the last layer of the encoder are used as the input of the attention module, and the self-attention mechanism is used to calculate the correlation between the hidden feature vectors of different time points using learnable weights such as queries and keys, and the attention weights between the time points are obtained through softmax normalization. The hidden features are weighted and summed according to the attention weights to obtain the self-attention comprehensive features of each sampling time point , which enhances the sensitivity of the model to abnormal mutations or key time points and realizes adaptive aggregation of cross-time slice features.

[0099] The decoder 330 is used to generate a feature sequence based on the output of the attention module. Reconstruction is performed to obtain reconstructed time series characteristics.

[0100] , formula (8)

[0101] Where, Indicates the The reconstructed features of the sampling moments, For the The comprehensive self-attention features at each sampling moment, Represents a decoder function.

[0102] Calculate the reconstruction error for the observation window:

[0103] , formula (9)

[0104] Where, represents the reconstruction error, Indicates the first The characteristic value at each sampling moment, is the Euclidean norm.

[0105] In equations (8) and (9), the decoder 330 takes the attention output feature sequence as input and inverts and restores the feature vector at each sampling moment through the deep neural network structure. The Euclidean distance reconstruction error of all sampling points in the observation window is averaged to obtain the window-level reconstruction error The reconstruction error is expressed as an anomaly score.

[0106] Specifically, the attention mechanism is used to dynamically capture the complex correlation between traffic features and different ONU units at different time steps, and its output This reflects the joint attention of the model to different time slices and ONU spaces. Subsequently, the decoder uses deconvolution or upsampling structure to Perform feature reconstruction.

[0107] The training goal of the temporal convolutional autoencoder model is to minimize the reconstruction error of the full temporal window:

[0108] , formula (10)

[0109] Where, represents the reconstruction loss function, For the The real observed characteristics of the moment, For the Reconstructed features of the moment model output. By combining temporal and spatial modeling, the system can learn the spatiotemporal coupling of traffic characteristics under normal operating conditions of the PON network.

[0110] The embodiments of this application utilize an autoencoder model based on multi-layer dilated convolution and temporal self-attention mechanisms, which can simultaneously extract long- and short-term traffic evolution patterns and adaptively aggregate important features at different sampling moments, enabling accurate modeling and detection of complex anomaly patterns. Furthermore, through end-to-end reconstruction and error feedback of multi-moment features within the observation window, sporadic noise is effectively smoothed, improving the stability and sensitivity of anomaly detection.

[0111] In some examples of the present application, the information theory divergence uses the JS divergence. Compared with the KL divergence, the JS divergence is symmetric and bounded, and can fairly measure the overall difference between two probability distributions without causing infinite or unstable results due to zero probability in one distribution.

[0112] Specifically, in the calculation of JS divergence, the average vector of the traffic distribution during the training period corresponding to the normal feature sequence set is obtained.

[0113] , formula (11)

[0114] Where, is the average vector of traffic distribution during training period, is the total number of sampling moments during the training period during historical normal operation, For the The traffic distribution vector at the sampling moment of the training period.

[0115] Based on the traffic distribution vector at each sampling moment and the average traffic distribution vector during the training period, the JS divergence at the corresponding sampling moment is calculated.

[0116] , formula (12)

[0117] , formula (13)

[0118] Where, Indicates the The traffic distribution vector at each sampling moment, for and The mean distribution of Indicates the JS divergence at sampling moments, used to measure the distribution and The dissimilarity measure between Indicates the The KL divergence at the sampling moment is used to measure the distribution and distribution Information loss between them.

[0119] Aggregate the JS divergence at each sampling moment to obtain the corresponding window-level JS divergence.

[0120] , formula (14)

[0121] Where, Indicates window-level JS divergence, Indicates the The traffic distribution vector at each sampling moment.

[0122] It should be noted that the normal and abnormal states of a PON network are often reflected in the overall changes in traffic distribution across each ONU. Abnormal distributions at a single moment are easily affected by occasional traffic disturbances and cannot reliably reflect actual topological changes. Therefore, the JS divergence, with its symmetry and finite value, is suitable for measuring the overall changes in probability distributions. Using the JS divergence as a measure of the global dissimilarity between multi-moment traffic distributions and the historical normal average distribution, and aggregating it at the window level, can effectively smooth noise and improve the stability and sensitivity of anomaly detection.

[0123] Regarding the differences in the traffic correlation matrix, the traffic correlation matrix is ​​calculated to identify topology anomalies by measuring the traffic changes between each ONU in the PON network.

[0124] Specifically, for the observation window At each sampling moment, the traffic time series data of each optical network unit is obtained, and the correlation matrix between the traffic of each optical network unit is calculated.

[0125] , formula (15)

[0126] Where, Indicates the Optical Network Unit at time The flow observation value, Indicates the observation window Neidi The average traffic volume of each optical network unit; is the correlation matrix Middle Rank The elements of the column represent the elements in the observation window Neidi The first and Pearson correlation coefficient between the traffic sequences of the optical network units; It's time The observed traffic correlation matrix.

[0127] In formula (15), for each sampling time , by calculating the traffic time series data of each ONU, the Pearson correlation coefficient between each pair of ONUs is obtained, which captures the time correlation between each node in the network, and helps to identify the ONU with abnormal traffic change.

[0128] The mean of the traffic correlation matrix during the historical normal operation period is obtained as a reference traffic correlation matrix :

[0129] , formula (16)

[0130] In the formula, , the correlation matrix at the th training period sampling time.

[0131] The difference between the observed traffic correlation matrix and the reference traffic correlation matrix is calculated:

[0132] , formula (17)

[0133] In the formula, , the traffic correlation matrix difference degree corresponding to the observation window, , the Frobenius norm.

[0134] As shown in formula (16), by averaging the traffic correlation matrix during the historical normal operation period, a reference traffic correlation matrix is calculated, which is used to compare with the currently observed traffic correlation matrix to calculate the difference degree between the two, which is realized by the Frobenius norm as shown in formula 17. The Frobenius norm provides a standard for measuring the difference between matrices, which can objectively reflect the overall deviation degree of two matrices in the global, and the calculation process treats each element of the matrix equally, so that we can quantify the difference between the current traffic correlation matrix and the historical normal operation period traffic correlation matrix, so as to judge whether there is an abnormality.

[0135] Through the embodiments of the present application, the traffic correlation matrix is calculated for the traffic time series data of each optical network unit in the observation window, and further the difference is measured with the historical normal reference correlation matrix, the collaborative change rule between each unit is described based on the Pearson correlation coefficient, and the global measurement is combined with the Frobenius norm, which can effectively capture the abnormal change of the network structural correlation. Therefore, the system can not only find the sudden traffic anomaly of individual nodes, but also accurately identify the overall correlation structure deviation caused by topology change, link failure or group behavior change.

[0136] In some examples of the embodiments of the present application, the comprehensive anomaly index can be calculated in the following manner:

[0137] , formula (18)

[0138] In the formula, represents the comprehensive anomaly index corresponding to the observation window, , and represents the anomaly term weighting coefficient, , and respectively represent the reconstruction error standard deviation, JS divergence standard deviation and correlation matrix difference standard deviation of the training period window level determined according to the normal feature sequence set.

[0139] As shown in formula (18), a weighted and normalized multi-index fusion method is used to calculate the comprehensive anomaly index. By normalizing the reconstruction error , JS divergence and flow correlation matrix difference calculated by the observation window with the standard deviation , , of the training period window level respectively, and then weighting and synthesizing the unified anomaly measure.

[0140] Here, the time series convolution autoencoder is used to reconstruct the flow multi-dimensional time series features, and the reconstruction error of the observation window is calculated to measure the overall flow pattern change; secondly, the JS divergence is used to depict the overall difference between the flow distribution and the historical normal distribution, and to capture the subtle shift of the group flow structure; thirdly, the flow correlation matrix difference focuses on capturing the mutation of the cooperative relationship between each node in the network, and reflects the structural change of the topology level. Finally, the weighting coefficient can be adjusted according to the actual application scene and the anomaly risk sensitivity to balance the influence of the three types of anomaly signals on the comprehensive index, which can significantly improve the comprehensiveness and robustness of PON network anomaly detection.

[0141] To verify the effectiveness of the proposed method, we construct a simulated data set containing 8 ONUs, with a duration of two days (5-minute sampling interval). Under normal circumstances, the flow of each ONU presents a typical daily periodicity, and random noise is added to simulate network fluctuations. In the abnormal scenario, we designed two kinds of topology anomalies: one is branch fiber break, which reduces the flow to zero at the 200-220 time slices of the 3rd ONU; the other is branch misconnection / sudden congestion, which makes the flow surge to twice the original at the 100-110 time slices of the 6th ONU. The rest of the time maintains the normal mode. We define the abnormal label as the state within the above time period.

[0142] To demonstrate the advantages of the proposed algorithm, we selected the following methods for comparison experiments:

[0143] Z-Score threshold method: Calculate the overall mean and standard deviation for each ONU traffic. If the standardized score of any ONU exceeds the threshold (set to 3) at a certain time, it is judged as abnormal. This is a simple but common statistical detection method.

[0144] Principal Component Analysis (PCA) autoencoder: Train a PCA model using normal data, reconstruct the observed traffic and calculate the reconstruction error. Use the 95th percentile as the threshold, which refers to low-dimensional space anomaly detection.

[0145] Proposed SA-TCAE+JS-divergence method: Use the comprehensive anomaly index described in this paper, where the weight α=β=γ=1 / 3.

[0146] We mainly evaluate the precision, recall and F1 value; and draw the Receiver Operating Characteristic (ROC) curve to measure the detection performance under different thresholds. The experimental results are shown in the following table (the precision is three decimal places).

[0147] Table 1. Performance indicators of different anomaly detection methods in comparison experiments

[0148] Method Precision Recall F1 Score Z-Score 0.000 0.000 0.000 PCA 0.595 0.733 0.657 Proposed 0.460 0.767 0.575

[0149] As shown in Table 1, the Z-Score method failed to identify any anomalies due to the high threshold; the PCA method could detect some anomalies with an F1 value of 0.657; the proposed method had the highest recall rate (0.767), although the precision was slightly lower, but overall it was better than PCA in the ROC curve, with a higher AUC (0.904 vs 0.870). This shows that considering traffic patterns, distribution divergence and related structures can help achieve high detection rates with low false positive rates.

[0150] Figure 4 The F1 score comparison bar chart of an example of different anomaly detection methods is shown.

[0151] As Figure 4 shown, the Z-Score method has the lowest detection accuracy because it only relies on statistical thresholds; the PCA method can improve certain detection performance through low-dimensional reconstruction; while the proposed method has obvious advantages in overall detection accuracy after utilizing multiple features and JS divergence, indicating its strong recognition and detection ability for PON topology anomalies.

[0152] Figure 5 An ROC curve comparison chart of an example of different anomaly detection methods is shown.

[0153] As shown in Figure 5 , the horizontal axis of the coordinate system is the false positive rate (FPR), the vertical axis of the coordinate system is the true positive rate (TPR), the orange curve corresponds to the SA-TCAE+JS-divergence method proposed in this paper, and the blue curve corresponds to the PCA method. It is not difficult to see that the method proposed in this paper shows higher true positive rate at most thresholds, and the overall envelope is better than the PCA auto-encoding method, and the AUC (area under the curve) reaches 0.904, which is significantly higher than the 0.870 of the PCA method, indicating that the method in this paper has achieved a better balance between sensitivity and specificity, and can more stably and accurately detect the topology anomaly of the PON network.

[0154] Figure 6 A time series heat map of an example of traffic proportion deviation from the mean is shown.

[0155] As shown in Figure 6 , the horizontal axis is the time step index, the vertical axis is the ONU number, and the color bar represents the numerical value of the proportion deviation. The closer the color is to dark purple represents negative deviation, and the closer the color is to yellow represents positive deviation. It can be seen that the third ONU has a significant negative deviation (dark purple) during about 200-220 time steps, reflecting the traffic drop caused by fiber breakage or link failure; the sixth ONU has a short positive deviation (yellow) during about 100-110 time steps, corresponding to a sudden traffic congestion. Through the heat map, the dynamic changes of the traffic distribution of each ONU can be intuitively reflected, which is convenient for operation and maintenance personnel to quickly locate the abnormal ONU branch and verify the actual positioning ability of the anomaly detection algorithm.

[0156] It should be noted that although the F1 score of the SA-TCAE+JS-divergence method proposed in this paper is slightly lower than that of the PCA auto-encoding method (as shown in Figure 4 , the ROC curve in Figure 5 shows that the method in this paper has a higher true positive rate in most false positive rate ranges, with an AUC value of about 0.904, which is more excellent than the 0.870 of PCA, indicating that the method in this paper is better than the baseline method at different thresholds. In addition, Figure 6The heat map in Figure 1 effectively demonstrates the advantages of this method in abnormal traffic detection and branch location, helping operations personnel to intuitively identify anomalies in the network, such as sudden drops in traffic or congestion. Therefore, although the F1 score is slightly lower than that of the PCA method, it is significantly effective in accurately locating abnormal events and improving recall rates, helping to reduce missed anomalies and improve the timeliness and accuracy of fault response. By accurately locating abnormal branches, the method proposed in this paper is of great significance in improving system stability and reducing service interruption time, especially in high-load or complex network environments. It can ensure that problems are discovered and fixed in a timely manner, maximizing network uptime.

[0157] Through the embodiments of the present application, a topological anomaly identification method for traffic patterns is proposed by deeply mining the structural information of traffic patterns in PON scenarios; without relying on additional hardware, by collecting ONU traffic and optical power data, traffic distribution features are constructed and combined with self-attention temporal convolution autoencoders, information theory divergence and correlation analysis to achieve anomaly detection and positioning. Comparative experiments show that the traditional Z-Score method cannot effectively detect topological anomalies, and the PCA autoencoder can detect anomalies to a certain extent, but cannot utilize the details of traffic distribution; the solution proposed in this article is significantly better in recall rate and comprehensive indicators, and the ROC curve area is larger. The heat map further verifies the algorithm's ability to locate abnormal branches.

[0158] It should be noted that, for the aforementioned method embodiments, for the sake of simplicity of description, they are all expressed as a series of combined actions, but those skilled in the art should be aware that this application is not limited by the order of the actions described, because according to this application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by this application. In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0159] Figure 7 The structure block diagram of an example of a traffic pattern analysis system for identifying anomalies in a PON topology according to an embodiment of the present application is shown. The traffic pattern analysis system for identifying anomalies in a PON topology is deployed in an optical line terminal.

[0160] like Figure 7 As shown, the traffic pattern analysis system 700 for identifying PON topology anomalies includes a data acquisition unit 710 , a feature construction unit 720 , a reconstruction error analysis unit 730 , an information theory divergence analysis unit 740 , a correlation difference analysis unit 750 and a topology anomaly identification unit 760 .

[0161] The data collection unit 710 is configured to collect operation and maintenance indexes of each optical network unit managed by the system according to an observation window and record a time stamp; the operation and maintenance indexes include traffic, optical power and frame error rate.

[0162] The feature construction unit 720 is configured to, for each sampling time in the observation window, construct a traffic vector containing traffic of each optical network unit at the sampling time, and count a global total traffic of the optical line terminal at the sampling time, to calculate a traffic proportion of each optical network unit, and construct a traffic distribution vector containing traffic proportions of each optical network unit at the sampling time.

[0163] The reconstruction error analysis unit 730 is configured to fuse the traffic distribution vector of each sampling time with a traffic average value, a traffic peak value, a traffic fluctuation degree, optical power and frame error rate in the observation window, to form an observation feature sequence, and input the observation feature sequence into a time series convolutional autoencoder model to obtain a reconstruction error; the time series convolutional autoencoder model is trained by using a normal feature sequence set in a historical normal operation period, to learn a normal traffic feature mode.

[0164] The information divergence analysis unit 740 is configured to calculate an information divergence based on the traffic distribution vector of each sampling time in the observation window and a training period average distribution corresponding to the normal feature sequence set.

[0165] The correlation difference analysis unit 750 is configured to calculate an observation traffic correlation matrix between the traffic vectors of each optical network unit in the observation window, and calculate a traffic correlation matrix difference between the observation traffic correlation matrix and a reference traffic correlation matrix; the reference correlation matrix is a mean value of traffic correlation matrices corresponding to the historical normal operation period calculated according to the normal feature sequence set.

[0166] The topology anomaly identification unit 760 is configured to determine a comprehensive anomaly index according to the calculated reconstruction error, information divergence and traffic correlation matrix difference, and determine that a topology anomaly exists when the comprehensive anomaly index exceeds a threshold.

[0167] In some embodiments, the present application provides a non-volatile computer readable storage medium, wherein the storage medium stores one or more programs including execution instructions, the execution instructions can be read and executed by an electronic device (including but not limited to a computer, a server, or a network device, etc.) to perform the steps of the traffic mode analysis method for identifying a PON topology anomaly according to any one of the above embodiments of the present application.

[0168] In some embodiments, the embodiments of the present application further provide a computer program product, comprising a computer program stored on a non-volatile computer readable storage medium, the computer program comprising program instructions which, when executed by a computer, cause the computer to perform the steps of any of the above-mentioned PON topology anomaly identification traffic pattern analysis methods.

[0169] In some embodiments, the embodiments of the present application further provide an electronic device, comprising: at least one processor, and a memory connected to the at least one processor in communication, wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the steps of the PON topology anomaly identification traffic pattern analysis method.

[0170] The above product can execute the method provided by the embodiments of the present application, and has the corresponding function modules and beneficial effects of executing the method. Technical details not described in detail in the embodiments can be referred to the method provided by the embodiments of the present application.

[0171] The electronic device of the embodiments of the present application exists in various forms, including but not limited to: a mobile communication device, an ultra-mobile personal computer device, a portable entertainment device, or other onboard electronic devices with data interaction functions.

[0172] The device embodiments described above are only schematic, and the units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, i.e. they may be located in one place, or distributed on multiple network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of the embodiments.

[0173] From the above description of the embodiments, those skilled in the art can clearly understand that the embodiments can be implemented by means of software plus a general hardware platform, and of course can also be implemented by hardware. Based on such understanding, the above technical solutions or the part that contributes to the related art can be embodied in the form of a software product, which can be stored in a computer readable storage medium, such as a ROM / RAM, a magnetic disk, an optical disk, etc., and includes a number of instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) execute the methods described in the various embodiments or some parts of the embodiments.

[0174] Finally, it should be noted that the above examples are only used to illustrate the technical solutions of the present application, and are not intended to limit the same; although the present application has been described in detail with reference to the foregoing examples, those of ordinary skill in the art should understand that they can still modify the technical solutions recorded in the foregoing examples, or make equivalent replacements for some of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A traffic pattern analysis method for identifying PON topology anomalies, applied to optical line terminals, characterized in that: The method comprises: Collecting operation and maintenance indicators of each managed optical network unit according to the observation window and recording the timestamp; the operation and maintenance indicators include traffic, optical power and frame error rate; For each sampling moment in the observation window, constructing a flow vector including the flow of each optical network unit at the sampling moment, and counting the global total flow of the optical line terminal at the sampling moment to calculate the flow proportion of each optical network unit, and constructing a flow distribution vector including the flow proportion of each optical network unit at the sampling moment; The flow distribution vector at each sampling moment is fused with the flow average, flow peak, flow fluctuation, optical power, and frame error rate within the observation window to form an observation feature sequence, and the observation feature sequence is input into a time series convolutional autoencoder model to obtain a reconstruction error; wherein the time series convolutional autoencoder model is trained using a normal feature sequence set during historical normal operation to learn normal flow feature patterns; Calculating information theoretic divergence based on the traffic distribution vector at each sampling moment in the observation window and the average distribution of the training period corresponding to the normal feature sequence set; Calculating an observed traffic correlation matrix between traffic vectors of each optical network unit within the observation window, and calculating a traffic correlation matrix difference between the observed traffic correlation matrix and a reference traffic correlation matrix; the reference correlation matrix is ​​a mean value of a traffic correlation matrix corresponding to a historical normal operation period calculated based on the normal feature sequence set; A comprehensive anomaly index is determined according to the calculated reconstruction error, information theory divergence, and traffic correlation matrix difference, and when the comprehensive anomaly index exceeds a threshold, it is determined that a topological anomaly exists.

2. The method according to claim 1, characterized in that The method further comprises: Dynamic record recent The comprehensive anomaly index sequence of observation windows is calculated, and the threshold is adaptively updated by using the quantile method: ， Where, Indicates the The adaptive threshold corresponding to the observation window is represents the initial reference threshold, is the quantile function, which represents the first Quantile; Indicates that from To The comprehensive anomaly index set of observation windows, Indicates the The comprehensive anomaly index of an observation window.

3. The method according to claim 1, characterized in that After determining that a topological anomaly exists, the method further includes: Contributions of each optical network unit in the observation window to the information theoretic divergence are calculated, and abnormal optical network units are located from among the optical network units according to the calculated contributions.

4. The method according to claim 3, characterized in that Calculating the contribution of each optical network unit to the information theoretic divergence within the observation window includes: For each sampling moment in the observation window, the component contribution of each optical network unit to the JS divergence at the sampling moment is calculated respectively: ， ， Where, Indicates that at the sampling time Middle The component contribution of each optical network unit to the JS divergence, Indicates that at the sampling time Middle The traffic proportion of each optical network unit, Indicates the first The average traffic proportion of each optical network unit during the training period, Indicates the The optical network unit at the sampling time The mean component of the current distribution and the normal distribution of ; According to the component contribution at each sampling moment, the window-level contribution of the information theory divergence is calculated: ， Where, Indicates the number of The window-level average contribution of each optical network unit to the information-theoretic divergence, represents the total number of sampling moments in the observation window, Indicates the first The component contribution at each sampling moment.

5. The method according to any one of claims 1 to 4, characterized in that The temporal convolutional autoencoder model includes an encoder, an attention module and a decoder; The encoder is used to extract the observation feature sequence using multiple layers of one-dimensional convolutional layers with increasing dilation rates Multi-scale temporal characteristics of ， Where, Indicates that the convolution kernel size is , expansion rate is the one-dimensional convolution operation; and Respectively represent Layer and The hidden features of the layer output, represents the observation feature sequence, and Respectively represent the first and The characteristic value of each sampling moment; The attention module is used to encode sequence features output by the last layer of the encoder As input, calculate the temporal self-attention weights: ， Where, Represents the first The sampling moment The attention weight at each sampling moment, and Respectively represent the coding sequence features The sampling moment and The hidden feature vector at the sampling moment, Indicates the total number of encoder layers; represents the vector transpose operation, and The learnable weight matrices representing queries and keys respectively; The encoding sequence features are weighted and fused according to the temporal self-attention weights at each sampling moment to obtain the attention output features: ， Where, A learnable weight matrix with values ​​of , For the Comprehensive self-attention features at each sampling moment; The decoder is used to generate feature sequences based on the output of the attention module. Reconstruct to obtain the reconstructed timing characteristics: ， Where, Indicates the The reconstructed features of the sampling moments, For the The comprehensive self-attention features at each sampling moment, represents the decoder function; Calculate the reconstruction error for the observation window: ， Where, represents the reconstruction error, Indicates the first The characteristic value at each sampling moment, is the Euclidean norm.

6. The method according to claim 5, characterized in that The information theory divergence adopts JS divergence, wherein the calculation of the information theory divergence includes: Get the average vector of the training period traffic distribution corresponding to the normal feature sequence set: ， Where, is the average vector of traffic distribution during training period, is the total number of sampling moments during the training period during historical normal operation, For the Traffic distribution vector at the sampling moment of each training period; Based on the traffic distribution vector at each sampling moment and the average traffic distribution vector during the training period, the JS divergence at the corresponding sampling moment is calculated: ， ， Where, Indicates the The traffic distribution vector at each sampling moment, for and The mean distribution of Indicates the JS divergence at sampling moments, used to measure the distribution and The dissimilarity measure between Indicates the The KL divergence at the sampling moment is used to measure the distribution and distribution Information loss between Aggregate the JS divergence at each sampling moment to obtain the corresponding window-level JS divergence: ， Where, Indicates window-level JS divergence, Indicates the The traffic distribution vector at each sampling moment.

7. The method according to claim 6, characterized in that The calculating the observed traffic correlation matrix between the traffic vectors of each optical network unit within the observation window, and calculating the traffic correlation matrix difference between the observed traffic correlation matrix and a reference traffic correlation matrix, includes: For observation window At each sampling moment, the traffic time series data of each optical network unit is obtained, and the correlation matrix between the traffic of each optical network unit is calculated: ， Where, Indicates the Optical Network Unit at time The flow observation value, Indicates the observation window Neidi The average traffic volume of each optical network unit; is the correlation matrix Middle Rank The elements of the column represent the elements in the observation window Neidi The first and Pearson correlation coefficient between the traffic sequences of the optical network units; It's time The observed flow correlation matrix; Get the mean of the traffic correlation matrix during historical normal operation as the reference traffic correlation matrix : ， Where, Indicates the The correlation matrix of the sampling moments of the training period; Calculate the difference between the observed flow correlation matrix and the reference flow correlation matrix: ， Where, Indicates the difference of the traffic correlation matrix corresponding to the observation window, represents the Frobenius norm.

8. The method according to claim 7, characterized in that The comprehensive anomaly index is determined based on the reconstruction error, information theory divergence, and traffic correlation matrix difference calculated at each sampling moment, including: ， Where, represents the comprehensive anomaly index corresponding to the observation window, 、 and represents the weighted coefficient of abnormal items, 、 and They respectively represent the reconstruction error standard deviation, JS divergence standard deviation and correlation matrix difference standard deviation of the training period window level determined according to the normal feature sequence set.

9. A traffic pattern analysis system for identifying PON topology anomalies, characterized in that: Deployed in an optical line terminal, the system includes: A data collection unit, configured to collect operation and maintenance indicators of each managed optical network unit according to an observation window and record a timestamp; the operation and maintenance indicators include flow, optical power, and frame error rate; A feature construction unit is configured to construct, for each sampling moment in the observation window, a flow vector including the flow of each optical network unit at the sampling moment, and to count the global total flow of the optical line terminal at the sampling moment to calculate the flow proportion of each optical network unit, and to construct a flow distribution vector including the flow proportion of each optical network unit at the sampling moment; a reconstruction error analysis unit, configured to fuse the flow distribution vector at each sampling moment with the flow average, flow peak, flow fluctuation, optical power, and frame error rate within the observation window to form an observation feature sequence, and input the observation feature sequence into a time series convolutional autoencoder model to obtain a reconstruction error; wherein the time series convolutional autoencoder model is trained using a normal feature sequence set during historical normal operation to learn normal flow feature patterns; An information theory divergence analysis unit, configured to calculate information theory divergence based on the flow distribution vector at each sampling moment in the observation window and the average distribution of the training period corresponding to the normal feature sequence set; a correlation difference analysis unit, configured to calculate an observed traffic correlation matrix between traffic vectors of each optical network unit within the observation window, and calculate a traffic correlation matrix difference between the observed traffic correlation matrix and a reference traffic correlation matrix; the reference correlation matrix being a mean value of traffic correlation matrices corresponding to historical normal operation periods calculated based on the normal feature sequence set; The topology anomaly identification unit is used to determine a comprehensive anomaly index based on the calculated reconstruction error, information theory divergence and traffic correlation matrix difference, and determine that a topology anomaly exists when the comprehensive anomaly index exceeds a threshold.

Images