A method and system for automatic network fault handling

Abstract

This invention belongs to the field of network communication and provides a method and system for automatic network fault handling. The method includes: collecting multi-source monitoring signals to construct a spatiotemporal matrix characterizing the network state; training a decision tree model using a reinforcement learning algorithm and constructing a reward function based on root cause localization accuracy and repair effectiveness; after the decision tree model determines the root cause of the fault, calling the software-defined network (SDN) controller interface to generate a corresponding rerouting policy based on the root cause, and distributing the rerouting policy to network devices for path adjustment; applying the rerouting policy in a simulation environment, collecting QoS indicators before and after adjustment to verify the effectiveness of the repair policy; and feeding back the repair verification results to the training process of the decision tree model to update the parameters of the reinforcement learning algorithm. This application can improve the accuracy of automatic network fault handling.

Description

Technical Field

[0001] This invention belongs to the field of network communication, and specifically relates to a method and system for automatic network fault handling. Background Technology

[0002] This invention relates to the field of computer communications, and more particularly to an automatic fault handling technology for complex network operating environments, applicable to, but not limited to, backbone communication networks, data center networks, and cross-layer service-bearing networks. In such networks, with the continuous growth of equipment scale and service traffic, maintenance personnel need to rely on automation technology to monitor and quickly handle network operating status in real time to ensure network stability and service continuity.

[0003] In existing technologies, common fault handling methods mainly rely on static rule matching and manual experience configuration. This involves setting predefined alarm thresholds or logical rules, analyzing collected network operation metrics, and triggering corresponding recovery operations accordingly. For example, in link interruption scenarios, the system typically switches over using routing protocol convergence mechanisms or preset protection paths; in node overload situations, resource allocation is achieved through load threshold-based scheduling strategies. These methods can be effective when the network is small or the business scenario is relatively simple, but their core characteristic is that they rely on fixed rules or limited metrics for judgment, making it difficult to cover complex and ever-changing operational states.

[0004] However, with the increase in network layers and the diversification of service types, traditional methods have gradually revealed several shortcomings. First, their ability to analyze the correlation between signals across layers is insufficient, leading to ambiguity or even bias in fault root cause localization. Second, mechanisms based on static rules cannot adapt to the dynamic evolution of the network, resulting in a significant decrease in processing efficiency when facing sudden or atypical faults. Furthermore, existing methods typically lack the ability to perform closed-loop verification of remediation measures, resulting in a lack of systematic confirmation of the effectiveness and degree of service quality improvement once the recovery strategy is implemented. Summary of the Invention

[0005] To address the problems in the prior art, the present invention provides a method for automatic network fault handling, comprising the following steps:

[0006] During network operation, multi-source monitoring signals from the transport layer, network layer, and application layer are collected, and the multi-source monitoring signals are time-synchronized and topology-mapped to construct a spatiotemporal matrix for characterizing the network state.

[0007] Based on the features extracted from the spatiotemporal matrix, a decision tree model is trained using a reinforcement learning algorithm. The state space of the decision tree model is set as the features of the spatiotemporal matrix, the action space is set as the set of potential root causes of failure, and a reward function is constructed based on the root cause localization accuracy and repair effect.

[0008] Once the decision tree model determines the root cause of the fault, it calls the software-defined network (SDN) controller interface to generate a corresponding rerouting policy based on the root cause of the fault, and then sends the rerouting policy to the network devices for path adjustment.

[0009] The rerouting strategy is applied in a simulation environment to collect QoS indicators of services before and after adjustment, and the QoS indicators are compared with preset thresholds to verify the effectiveness of the repair strategy.

[0010] The repair verification results are fed back into the training process of the decision tree model to update the parameters of the reinforcement learning algorithm.

[0011] Furthermore, the multi-source monitoring signals are aligned using a time protocol during the acquisition process, and a correspondence between the signals and network device ports and routing paths is established through topology mapping.

[0012] Furthermore, during the feature extraction process, the mean, extreme values, and rate of change are calculated using a sliding time window to form a feature vector that can reflect the dynamic evolution of the network's operating state.

[0013] Furthermore, the action space includes link interruption, node overload, forwarding path anomaly, routing oscillation, and application layer performance degradation, and each type of action is associated with an operable network object during the inference process.

[0014] Furthermore, the decision tree model is constructed using a top-down binary hierarchical partitioning method, with the root node corresponding to the global state distribution, internal nodes being segmented into subspaces through feature thresholds, and leaf nodes corresponding to specific root cause categories.

[0015] Furthermore, the reward function is calculated based on the consistency between the root cause localization result and the actual root cause as the first evaluation dimension, and based on the change in service quality indicators before and after the repair as the second evaluation dimension, and the two form a composite reward value.

[0016] Furthermore, the model is trained by combining offline pre-training with online updates. In the offline phase, the basic model is trained using historical spatiotemporal matrix data, and in the online phase, incremental updates are performed using newly collected data.

[0017] Furthermore, during the rerouting policy deployment process, a two-phase commit approach is adopted, namely, firstly, the forwarding table entries for the alternative path are pre-installed in the network device, and then the traffic is gradually switched through transaction commit.

[0018] Furthermore, when verifying the rerouting strategy in the simulation environment, a phased approach of gradual rollout was adopted to increase the proportion of business traffic, and latency, packet loss rate, and throughput metrics were collected at each stage and compared with preset thresholds.

[0019] The present invention also provides a system for automatic network fault handling, comprising:

[0020] The signal acquisition module is used to acquire multi-source monitoring signals from the transport layer, network layer, and application layer during network operation, and to perform time synchronization and topology mapping on the multi-source monitoring signals to construct a spatiotemporal matrix for characterizing the network state.

[0021] The feature processing and model training module is used to train a decision tree model using reinforcement learning algorithms based on the features extracted from the spatiotemporal matrix, set the state space of the decision tree model as the features of the spatiotemporal matrix, set the action space as the set of potential fault root causes, and construct a reward function based on the root cause localization accuracy and repair effect.

[0022] The root cause reasoning and strategy generation module is used to call the software-defined network (SDN) controller interface after the decision tree model determines the root cause of the fault, generate the corresponding rerouting strategy according to the root cause of the fault, and send the rerouting strategy to the network device for path adjustment.

[0023] The simulation verification module is used to apply the rerouting strategy in a simulation environment, collect the service quality (QoS) indicators before and after the adjustment, and compare the QoS indicators with preset thresholds to verify the effectiveness of the repair strategy.

[0024] The feedback update module is used to feed back the repair verification results to the training process of the decision tree model in order to update the parameters of the reinforcement learning algorithm.

[0025] In this invention, by collecting multi-source monitoring signals from the transport layer, network layer, and application layer during network operation, and combining time synchronization and topology mapping to construct a spatiotemporal matrix, the network state can be uniformly represented across multiple dimensions and time scales. This feature ensures that operational data from different layers are comparable and consistent under a unified benchmark, thus providing complete and structured data input for subsequent feature extraction and inference model training. In this way, the global operational state of the network can be captured more accurately and input into the model, avoiding fault location biases caused by insufficient information from a single layer.

[0026] In training the decision tree model based on the spatiotemporal matrix, the state space and action space are respectively defined as a feature set and a potential root cause set. A reward function incorporating localization accuracy and repair effectiveness is introduced through reinforcement learning algorithms. This enables the inference model to not only form a classification structure based on historical samples but also continuously refine its decision path based on the repair results. This feature ensures the model possesses adaptive optimization capabilities during operation, maintaining consistency between the inference of root causes and the generation of repair strategies, and allowing it to continuously evolve into an inference mechanism that matches actual operational conditions.

[0027] In the process of generating and distributing rerouting policies, this invention directly maps the root causes of faults determined by the decision tree model to corresponding executable policies by calling the software-defined network controller interface. The policies are then validated in a simulation environment through gray-scale testing, and their effectiveness is confirmed by comparing service quality indicators before and after the fix. This feature creates a closed loop between policy generation and validation, ensuring that each path adjustment is based on real improvements in service quality. This methodologically guarantees the controllability and verifiability of the repair process and provides reliable feedback for continuous optimization of model parameters. Attached Figure Description

[0028] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0029] Figure 1 This is a schematic diagram of the main process of the present invention. Detailed Implementation

[0030] To make the objectives, technical solutions, and beneficial effects of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the described embodiments are only for explaining the invention and are not intended to limit the scope of protection of the invention.

[0031] like Figure 1 As shown, this embodiment provides a method for automatic network fault handling, which addresses the technical problems of ambiguous root cause localization and lack of verification of repair measures in existing network faults. The method includes the following steps:

[0032] In existing network operating environments, with the increasing complexity of services and the continuous layering of network layers, traditional single-layer signal monitoring methods can no longer meet the needs for accurate network fault location. Relying solely on link alarms at the transport layer or routing information at the network layer often fails to reveal cross-layer fault correlations, leading to ambiguous root cause identification and difficulty in taking timely and effective remedial measures. Meanwhile, the service quality at the service layer directly affects user experience, but signals at this layer are often ignored in existing monitoring systems, causing information fragmentation between the network and service layers and further increasing the uncertainty of fault handling. Therefore, it is necessary to introduce a multi-source signal fusion mechanism to unify the processing of data from the transport, network, and application layers, comprehensively reflecting the network operating status within the same framework. By synchronizing multi-source monitoring signals in the time dimension and mapping them in the topology dimension, a spatiotemporal matrix that includes both temporal evolution characteristics and reflects spatial correlation characteristics can be effectively constructed, providing a solid data foundation for subsequent fault reasoning and automatic processing. Therefore, during network operation, multi-source monitoring signals from the transport layer, network layer, and application layer are collected, and the multi-source monitoring signals are time-synchronized and topology-mapped to construct a spatiotemporal matrix for characterizing the network state.

[0033] In this technical solution, multi-source monitoring signals refer to different types of operational data collected from the transport layer, network layer, and application layer during network operation. In this method, these signals are used to comprehensively reflect the state characteristics of the network at different levels, thereby providing input for subsequent fault reasoning.

[0034] Time synchronization refers to aligning monitoring signals from different sources according to a unified time reference, so that various signals are comparable and consistent on the same time axis, thereby ensuring the accuracy and reliability of the spatiotemporal matrix construction results.

[0035] Topology mapping refers to associating time-synchronized multi-source monitoring signals with specific node or link locations according to the network topology, thereby forming a data representation with spatial distribution characteristics. This process is used to reveal the correspondence between signals and network structure.

[0036] A spatiotemporal matrix is ​​a two-dimensional data structure formed through time synchronization and topology mapping. The row dimension corresponds to the time series, and the column dimension corresponds to the network nodes or links. The matrix unit is used to record the multi-source signal characteristics at a specific time and location. In this method, the matrix is ​​used to characterize the dynamic evolution of the network state.

[0037] In the specific implementation process, the first step is to unify the timing of monitoring signals from different layers to ensure the accuracy and consistency of subsequent processing. Since monitoring devices at the transport, network, and application layers are typically located in different places and have independent acquisition cycles, the original signals often lack comparability in terms of timestamps. Direct analysis would lead to timing alignment errors and misjudgments of causal relationships. Therefore, a unified time reference needs to be introduced to map the acquisition times of various signals onto a network-wide reference timeline. This time reference can be provided through a network synchronization protocol or generated by a high-precision time synchronization device. During synchronization, the timestamps of different signals are estimated and corrected for drift, eliminating deviations caused by differences in acquisition links, ensuring that all signals have a consistent reference at the same point in time.

[0038] After time synchronization is completed, the mapping between signals and network structure needs to be addressed. Since each type of signal represents only the local state of a specific acquisition point, without mapping, the spatial relationships of the overall network cannot be reflected. Topology mapping involves binding the processed signals to network nodes, links, and other structural elements, ensuring that each monitored value is clearly associated with its actual network location. This process requires establishing mapping relationships based on network topology description files, device port identifiers, and routing tables, ultimately achieving a one-to-one correspondence between cross-level signals and physical structures. In this way, the spatial dependencies between lower-level events such as link interruptions and node failures and upper-level service indicators can be revealed.

[0039] To ensure the fusion of signals from different sources within the same framework, the synchronized and mapped data needs to be standardized and robustned. Signals at different levels differ significantly in their value ranges, dimensions, and sampling frequencies; direct use of these differences can lead to fusion distortion. Interval scaling or statistical standardization methods can normalize various signals to a unified numerical range. Furthermore, considering potential data gaps and abnormal fluctuations during acquisition, data completion and anomaly detection mechanisms need to be designed. These mechanisms interpolate missing data points and smooth sudden spikes, thereby ensuring data continuity and stability.

[0040] After the above processing, the multi-source signals are finally organized according to time series and network topology location, forming a matrix-based data structure. In this matrix, the rows reflect the continuous evolution of the signals over time, the columns reflect the spatial distribution of nodes or links in the network, and each cell in the matrix represents the multi-source integrated characteristics of a certain network location at a certain moment. This matrix can simultaneously display the temporal variation pattern of the network state and the spatial topological relationship, realizing the unified carrying of cross-layer information. In this form, complete, deterministic, and computable data input can be provided for subsequent root cause reasoning and automatic processing.

[0041] By synchronously processing multi-source monitoring signals from the transport, network, and application layers under the same time reference and combining this with spatial mapping based on the network topology, a unified spatiotemporal matrix representation can be formed, enabling a dynamic and global characterization of the network's operational status. This spatiotemporal matrix not only correlates signals from different layers within the same framework, avoiding information gaps caused by single-layer monitoring, but also reflects the chronological order of fault occurrence and propagation in the temporal dimension and reveals the dependencies between nodes and links in the spatial dimension, thereby improving the accuracy and comprehensiveness of root cause localization. Since the integrity and consistency of the input data are guaranteed, subsequent root cause inference models can learn and judge based on more reliable features, thus improving the effectiveness of fault identification and repair strategy generation. It also provides quantifiable benchmark data for the closed-loop verification mechanism, thereby enhancing the overall stability and controllability of automated network fault handling.

[0042] As one possible implementation, when collecting multi-source monitoring signals, the sampling period for transport layer link status can be set to 100 milliseconds, the sampling period for network layer routing information to 500 milliseconds, and the sampling period for application layer QoS indicators to 1 second. These are aligned using a unified high-precision time protocol. Simultaneously, during topology mapping, signals are precisely associated with the physical port identifiers of nodes and links, ensuring consistency in both time and space dimensions. This implementation can maintain the differences in the characteristics of monitoring signals at different levels while avoiding feature loss or mismatch due to inconsistent sampling frequencies. The constructed spatiotemporal matrix possesses both high timeliness and strong spatial resolution, enabling faster and more accurate capture of fault occurrence and propagation processes in complex network environments. This improves the accuracy of root cause inference and shortens fault handling latency.

[0043] In a specific example, a fiber optic cable outage occurs during backbone network operation. The transport layer monitoring module detects a sudden drop in link optical power and generates an alarm signal within a 100-millisecond sampling period. The network layer records the convergence delay of related routes and forwarding table anomalies within a 500-millisecond sampling period. The application layer observes that the end-to-end latency of video services increases from 180 milliseconds to 320 milliseconds, and the packet loss rate increases from 0.2% to 0.8% within a 1-second sampling period. These multi-source signals are aligned using a unified high-precision time protocol and mapped to the topology through port identifiers to construct a spatiotemporal matrix that simultaneously reflects temporal changes and spatial distribution.

[0044] Traditional rule-based or static threshold-based methods often rely on single indicators for judgment, lacking the ability to analyze cross-layer signals holistically. This makes it difficult to accurately infer the root cause of faults in complex network environments, and fails to provide dynamic feedback on the effectiveness of subsequent remediation measures. With the expansion of network scale and the diversification of service types, relying solely on fixed logic trees or human experience for reasoning can no longer meet the requirements of real-time performance and accuracy, easily leading to misjudgments or omissions, thus affecting fault handling efficiency and business continuity. To address these issues, it is necessary to introduce a reasoning mechanism capable of autonomously learning and optimizing in the face of state changes. This would allow root cause localization to not only rely on static features but also combine remediation results to form feedback, thereby improving the adaptability and reliability of reasoning. Therefore, based on the features extracted from the spatiotemporal matrix, a reinforcement learning algorithm is used to train a decision tree model. The state space of the decision tree model is set to the features of the spatiotemporal matrix, the action space is set to the set of potential fault root causes, and a reward function is constructed based on the root cause localization accuracy and remediation effect.

[0045] In this technical solution, the state space refers to the set of feature vectors extracted from the spatiotemporal matrix. This space is used to characterize the operating state of the network at different times and topological locations, and serves as the input condition for the decision tree model to perform root cause reasoning.

[0046] The action space refers to the set corresponding to potential root causes of failures. This set is used to limit the range of outputs that the decision tree model can choose during the inference process, thereby ensuring that the inference results can correspond to the actual locatable fault objects.

[0047] The reward function is a mathematical function used in reinforcement learning to evaluate the quality of inference results. This function determines the reward value based on the accuracy of root cause localization and the effectiveness of remedial measures, and uses this as the basis for updating model parameters to achieve continuous optimization of inference ability.

[0048] In the specific implementation process, the features in the spatiotemporal matrix first need to be preprocessed to ensure the integrity and computability of the input data. Since signals from different levels differ in sampling frequency, dimensions, and noise levels, a series of data normalization steps are required to unify them. Specifically, missing values ​​in the matrix are first filled in using interpolation with a limited time window or forward hold method to avoid matrix sparsity caused by short-term missing measurements. Then, standardization operations are performed on signals from different sources, mapping them to a unified numerical range, thereby ensuring the comparability of different indicators in the feature space. Based on this, dynamic features are extracted through sliding window or aggregation operations, such as calculating the average, extreme values, or rate of change within a specified time interval, so that the input vector can better reflect the evolution trend of the network state.

[0049] After feature construction is completed, these features need to be organized into a state space. The state space consists of a series of feature vectors, each corresponding to the overall operating state of the network at a certain point in time, covering multi-dimensional parameters such as node traffic, link utilization, end-to-end latency, and packet loss rate. To avoid increased training complexity due to excessive dimensionality, a feature selection mechanism can be introduced during the state space construction process. For example, redundant features can be removed based on a relevance threshold, or the most critical indicators for fault detection can be selected based on information gain. Through this process, a set of states that can both fully represent the network state and efficiently participate in model training is formed.

[0050] When constructing the action space, potential root causes of failures need to be categorized into a finite number of classes to correspond to the branching structure of the decision tree. The action space includes typical categories such as link interruption, node overload, abnormal forwarding paths, routing oscillations, and application layer performance degradation. Each action class corresponds to a possible root cause judgment. During inference, the model selects the output from the action space based on the input state. When the root cause output by the model matches the actual verification result, it is considered correct inference; otherwise, it is considered incorrect inference. This discretized action space construction method ensures that the model has a clear range of choices during inference, avoiding problems such as ambiguous or inoperable outputs.

[0051] To ensure the interpretability and executableness of the root cause reasoning process when constructing the decision tree, the model adopts a top-down binary hierarchical structure. The root corresponds to the global state distribution, internal nodes correspond to subspaces segmented by feature thresholds, and leaf nodes correspond one-to-one with root cause decision units in the action space, along with their confidence scores and execution-related information. The node growth stage uses single-feature threshold segmentation as the basic operation. The segmentation criterion comprehensively considers information gain and structural complexity constraints. Internally, a unified objective function evaluates candidate features and thresholds. This objective function can be written as follows: ,in Characterizes the increase in class purity after segmentation. Characterize the structural complexity introduced by the partitioning (including the increment of the current depth and the number of leaf nodes). The penalty coefficient is non-negative and remains consistent across the entire tree to ensure uniform selection criteria across different nodes. To accommodate differences in numerical scales across layers, continuous features undergo robust binning and monotonicity constraint calibration before segmentation, ensuring that indicators with the same business meaning have consistent decision directions in different topological locations, thereby reducing the probability of incorrect segmentation at its source.

[0052] In the leaf node output design, in addition to providing the root cause category, the model also simultaneously generates additional quantities for control plane linkage, including the policy template reference bound to the root cause, the expected QoS recovery interval, and the execution credibility score. The credibility score is jointly calculated using the posterior distribution of leaf node samples and path stability metrics. The path stability metrics are obtained by combining the sample coverage reaching the leaf node, the error trajectory within the near-time window, and the node entropy reduction magnitude. When the credibility is lower than the operating threshold, the system triggers a backup leaf node rollback or requests priority verification in the simulation environment, thus maintaining a controllable execution strategy even in scenarios with model uncertainty. To avoid generalization degradation caused by excessive tree growth, cost-sensitive pruning is implemented in the later stages of training. The pruning criterion aims to minimize the comprehensive cost on the validation set. The comprehensive cost incorporates the misjudgment cost and the policy failure cost into the same metric system, ensuring that structural contraction and minimizing operational risk are kept consistent.

[0053] In terms of training and update mechanisms, the model obtains its initial tree structure through offline batch training, and then undergoes incremental fine-tuning and local retraining after deployment. Incremental updates only apply to branch subtrees triggered during runtime, and the update triggering conditions are directly linked to the feedback from the repair verification: when the action corresponding to a leaf node fails to reach a threshold in grayscale or simulation verification, or when the cumulative error of the same path exceeds the limit, the system re-executes feature re-screening and threshold re-estimation for that subtree, and, if necessary, reverts a split to merge two sub-leaves into a parent leaf to restore stability. To improve sensitivity to class imbalance faults, sample reweighting is enabled simultaneously during node growth and retraining phases. The weights are related to the historical false alarm rate and the level of business impact, giving rare and costly fault modes greater weight in the training objective. The model output and action space maintain hierarchical consistency: the root layer first makes a coarse judgment among the main causes such as link interruption, node overload, routing oscillation, and application degradation, and the sub-layer refines it to operable objects such as physical port failure, abnormal optical power, CPU resource shortage, and imbalance of equivalent multipaths; the policy template references and threshold calibers carried by the leaf nodes correspond one-to-one with the compilation and grayscale scripts on the controller side, ensuring that the inference results can be seamlessly transformed into executable rerouting and verification processes.

[0054] Regarding the coupling with reinforcement learning feedback, the tree structure maintains determinism and interpretability while the parameters of node selection and leaf output are continuously corrected through reward-driven reweighting. The reward signal consists of a localization consistency score and a repair effectiveness score, corresponding to whether the inference is consistent with the actual root cause and whether the QoS after repair meets the threshold, respectively. At the node level, the splitting preference is updated with reward-weighted sample statistics, while at the leaf level, the posterior distribution and credibility threshold are adjusted with rewards. Furthermore, a priority experience replay mechanism amplifies the corrective effect of failed and marginally compliant samples on the local structure. Thus, while maintaining clear rules and traceable paths, the decision tree gains the ability to adaptively optimize as the network state evolves, ensuring that root cause localization and policy linkage continuously align with the actual repair effect during long-term operation.

[0055] When designing the reward function, both the accuracy of root cause localization and the actual effectiveness of the remedial measures need to be considered. The accuracy of root cause localization is determined by comparing the consistency between the model's inference results and the actual root cause; a positive reward is given when they are consistent, and a negative penalty is imposed when they are inconsistent. The remedial effect is evaluated by comparing service quality indicators before and after the remediation. For example, in video service scenarios, if the backend-to-end latency is restored to within 200 milliseconds, the packet loss rate drops below 0.5%, and the video stuttering rate no longer exceeds 1%, then the remediation is considered effective, and additional rewards can be added. The value of the reward function is limited to a finite range to avoid unstable convergence during training due to excessively large or small rewards. Through this dual evaluation mechanism, the model can not only learn to accurately determine the root cause of the fault but also adjust its inference strategy based on the remediation effectiveness, ensuring that the training process remains consistent with the actual operational goals.

[0056] Furthermore, during reinforcement learning training, appropriate parameters need to be configured to ensure both rapid model convergence and stability. The number of training iterations should cover a sufficient number of failure scenarios to ensure the model can make reasonable inferences when encountering new network states. Exploration strategies typically employ selection methods with random perturbations, such as randomly selecting actions in a certain proportion of rounds, to avoid the model getting trapped in local optima. The learning rate should be chosen between 0.01 and 0.1; too high a rate will cause parameter updates to oscillate, while too low a rate will slow down model convergence. To further improve usability, training can employ an offline pre-training + online update approach: a basic model is trained offline using historical data, and the model parameters are continuously updated during actual operation using newly collected spatiotemporal matrix data. This ensures the model has basic inference capabilities in the initial deployment phase and can adapt to constantly changing network operating characteristics through continuous learning.

[0057] By using features from the spatiotemporal matrix as input to the state space and potential root causes of faults as output to the action space, and combining this with a reward function that simultaneously considers localization accuracy and repair effectiveness, the decision tree model can gradually form a stable mapping relationship from network states to root causes of faults during training, thereby significantly improving the accuracy and reliability of root cause inference. Since the reward function introduces feedback on repair effectiveness, the model can ensure both localization accuracy and the effectiveness of repair measures. This ensures that the inference results not only conform to the characteristics of the fault itself but also guarantee the feasibility and effectiveness of subsequent repair strategies at the business level, thus achieving closed-loop optimization of localization and repair. Furthermore, by continuously updating model parameters, this mechanism can continuously improve inference capabilities as the network environment changes, thereby maintaining high adaptability and stability in dynamic and complex scenarios.

[0058] As one possible implementation, the selection of split nodes at each layer during the training of the decision tree model can be achieved by setting a composite decision function. This function consists of an information gain term and a penalty term. The information gain measures the degree to which the data purity is improved after selecting a certain feature, while the penalty term is proportional to the current tree depth and the number of leaf nodes after the split, thus limiting the model complexity. For example, when the tree depth exceeds 10 layers or the number of leaf nodes exceeds 500, the influence of the penalty term is significantly enhanced, suppressing the benefits of further splits and forcing the model to find the optimal split path within a finite depth. This implementation not only ensures that the most discriminative features are used preferentially during training but also prevents excessive branching due to sample anomalies, improving the model's stability with unknown data during inference. In this way, the decision tree model can maintain interpretability when facing large-scale network monitoring data and ensure that the generated inference paths are clear and traceable.

[0059] As a possible implementation, an offline pre-training + online fine-tuning update mechanism is adopted in the training and deployment phases. The specific process is as follows: In the offline training phase, initial model training is completed using historical network operation data from the past three months (no less than ten million monitoring samples). A parameter combination with a learning rate of 0.05 and an exploration rate of 0.1 is selected through cross-validation to obtain a convergent and stable base model. In the online operation phase, the system collects state-action-result triples generated from grayscale validation results in real time. This data is written into an experience replay pool with a capacity of 100,000 records, and misclassification rate is used as a priority indicator, allocating higher resampling probabilities to misclassified samples. During online fine-tuning, parameters are updated only for the decision subtree corresponding to the triggered path, avoiding full retraining of the entire tree, thereby significantly reducing computational overhead. Through this mechanism, the model can quickly absorb newly emerging fault modes during actual operation and achieve adaptive parameter updates without affecting overall operational stability, maintaining the long-term reliability of inference results.

[0060] One possible implementation is to introduce a hierarchical structure of primary and secondary causes in the action space, and to pre-set SDN policy templates and canary verification scripts for each type of fault at the secondary cause layer. Specifically, when the model determines that a link is interrupted at the primary cause layer, the secondary cause layer will further identify two scenarios: fiber breakage or port failure. In the case of fiber breakage, the rerouting + rate limiting policy template will be automatically invoked, and in the case of port failure, the link switching template will be invoked. Each template is bound to canary verification parameters. For example, in the rerouting template, canary verification can be set to an initial traffic import ratio of 10% and a verification duration of 30 seconds. If the end-to-end latency is stable within 200 milliseconds and the packet loss rate is less than 0.5%, the import ratio will be gradually increased until 100%. If the indicators exceed the threshold during the verification process, an automatic switchback to the original path will be triggered and the result will be recorded to correct the reward function. This implementation ensures that the mapping relationship between inference output and execution action is deterministic and operable. It also avoids the risks of direct switching of full traffic through the gray-scale verification process, and can complete fault repair without interrupting business or with minimal impact, thereby improving the success rate of policy issuance and the repeatability of the verification process.

[0061] In a specific example, a fiber optic cable outage occurs during the operation of a backbone network. The transport layer monitoring module detects a sudden drop in link optical power and triggers an alarm at a sampling period of 100 milliseconds. The network layer records routing oscillations and convergence delays of the relevant path at a sampling period of 500 milliseconds. The application layer observes that the end-to-end latency of video services increases from 180 milliseconds to 310 milliseconds and the packet loss rate increases from 0.2% to 0.7% at a sampling period of 1 second. These monitoring signals are synchronized using a unified high-precision time protocol, combined with the topology mapping of links and nodes to generate a spatiotemporal matrix, and after normalization, form feature vectors that are input into a trained decision tree model.

[0062] During the inference process, the decision tree model first determines the link interruption at the main cause layer based on the input features, and then further refines it to physical port failure at the sub-cause layer, outputting corresponding actions. The system then calls the SDN controller interface to load the rerouting policy template bound to this sub-cause and executes the canary verification process. In the canary phase, initially only 10% of the service traffic is diverted to the backup path. After verifying that the backend-to-end latency recovers to 195 milliseconds and the packet loss rate decreases to 0.3% after 30 seconds, meeting the threshold conditions, the system gradually increases the diversion ratio to 100%, ultimately completing the path switchover.

[0063] After the strategy is executed, the system feeds back the verification result of the repair to the reward function module, adjusts the weight of the repair effect part in the reward, and thus improves the inference accuracy in similar scenarios in subsequent training.

[0064] In existing network fault handling, even after root cause identification, manual intervention is often still required to configure routing policies. This results in slow response times, complex operations, and a high risk of secondary failures due to human error, especially in time-sensitive scenarios such as backbone networks, where it is difficult to meet business continuity requirements. While traditional static backup path mechanisms can achieve automatic switching to some extent, they lack specificity for the root cause of the fault, easily leading to low resource utilization or poor switching performance, failing to guarantee the quality of service for critical businesses. Therefore, a mechanism is needed that can automatically trigger path adjustment after root cause inference, quickly transforming the inference results into executable routing policies through direct interaction with the control plane, and ensuring that the policies are promptly distributed to network devices to complete the switchover. To this end, after the decision tree model determines the root cause of the fault, it calls the software-defined network (SDN) controller interface to generate a corresponding rerouting policy based on the root cause, and then distributes the rerouting policy to network devices for path adjustment.

[0065] In this technical solution, the rerouting policy refers to the new path selection rules generated and issued by the control plane after the root cause of the network failure is determined. This policy is used to redirect service traffic that originally passed through the faulty node or link to an available alternative path in order to restore network connectivity and ensure service quality.

[0066] The SDN controller interface refers to the interactive channel established between the control plane and forwarding devices in a software-defined network architecture. In this technology, the interface is used to receive root cause inference results and pass the corresponding rerouting policies to the underlying network devices, thereby realizing automated path adjustment and policy execution.

[0067] In the execution phase following root cause reasoning, the system first maps the root causes of failures output by the decision tree model to remediation intentions. It then establishes a binding relationship with the SDN controller interface in the control plane, structuring the remediation intentions into a policy description object containing affected service identifiers, bandwidth requirements, latency and packet loss limits, a set of failure elements to be avoided, and the policy's effective domain. This object enters the controller's policy synthesis pipeline, where it undergoes consistency verification with real-time information in the topology and link state database. If the verification is successful, the path calculation module is triggered to generate a set of candidate paths that meet the constraints, and the remediation intentions are applied to these paths. Figure 1 The hard exclusion condition ensures that the path semantically bypasses the determined failed node or link.

[0068] In the path calculation phase, the controller evaluates and selects the best path based on the multi-constraint shortest path concept. The cost function weights latency, packet loss, available bandwidth, and shared risk, and penalizes insufficient bandwidth to prevent pseudo-feasible paths from entering the execution queue. The cost function can be expressed as follows:

[0069]

[0070] in, Indicate candidate paths;

[0071] Represents the end-to-end delay statistics of the path;

[0072] A statistic representing the packet loss rate of a path;

[0073] Indicates the minimum available bandwidth of the path;

[0074] This indicates the bandwidth requirements of the affected services;

[0075] Indicates the cost of the shared risk link group traversed by the path;

[0076] These are non-negative weights, used to reflect the business scenario's preference for each indicator. Non-negative weights can be the mean.

[0077] By calculating the cost of all feasible paths and selecting the path with the minimum cost as the target path, the repair intention can be transformed into a specific routing decision while satisfying the constraints.

[0078] The controller generates forwarding rules that match the characteristics of the service flow based on the target path, and encapsulates intermediate segments of the path with forwarding semantics that network devices can understand. When the network adopts a label-based or segment-based forwarding system, it generates a label stack or segment list with priority and effective domain information, and performs consistency checks and priority scheduling with the existing forwarding table to avoid overlap or preemption with existing policies. To ensure the policy's feasibility in high-load scenarios, the controller compresses and aggregates the rules during the compilation phase, and inserts rate-limiting or shaping instructions when necessary to guarantee the bandwidth and latency targets of critical services.

[0079] The controller pushes rules to relevant switching and routing devices in stages via OpenFlow, NETCONF / gNMI, or equivalent southbound protocols. First, it pre-installs backup paths and performs adjacency health checks. Then, it switches traffic direction in a transactional manner. Finally, it reclaims old rules on failed paths to eliminate dangling states. To reduce the risk of transient loops or black holes, a protection timer is set during the switching process. satisfy

[0080]

[0081] in, This represents the maximum round-trip time measured between the controlled device and the controller;

[0082] This indicates the maximum processing jitter for controlling message propagation and device application rules.

[0083] By introducing sufficient protection intervals between the two-phase commits and performing health checks and black hole detections before committing, business continuity can be maintained during path switching.

[0084] By directly calling the SDN controller interface after root cause inference, the inference results are transformed into a rerouting policy that includes bandwidth requirements, latency constraints, and fault avoidance conditions. Path calculation, policy compilation, and rule distribution are completed within the controller, enabling rapid migration of service traffic without interrupting manual intervention. This shortens fault handling response time and avoids secondary interruptions caused by manual configuration delays. This technology establishes a tight linkage between the inference layer and the control layer, allowing path adjustment to dynamically generate optimal policies based on actual root causes, rather than relying on preset static backups. This maintains service QoS stability while ensuring connectivity, and further reduces loop risks and resource waste during handover, thus forming an automatically executable and instantly verifiable closed-loop control effect in complex network environments.

[0085] As one possible implementation, when generating rerouting policies by calling the SDN controller interface, the control plane employs a multi-constraint shortest path algorithm with parallel solutions of hard constraints and soft costs to construct a candidate path set. The hard constraint requires that the end-to-end delay does not exceed a set upper limit. The minimum available bandwidth shall not be less than the service requirements. Packet loss rate not higher than the threshold Furthermore, it is necessary to avoid the set of failure elements obtained from root cause reasoning; soft costs simultaneously penalize the average delay, packet loss statistics, and the number of traversals of shared risk link groups in a weighted manner, and under optional conditions, apply congestion surcharges to links that conflict with the existing network's large flow to suppress instantaneous congestion. After path selection is completed, the policy compiler generates entries that match the device semantics (such as OpenFlow match / action, SR-MPLS segment list, or routing intent based on NETCONF / gNMI), and attaches priority, aging time, and effective domain information to ensure deterministic superposition with existing rules; policy issuance adopts a two-phase commit mechanism. First, in a pre-installation manner, low-priority protection entries are written to each hop of the backup path and adjacent health probes are started. After the probes stabilize and the round-trip delay of the control channel is measured to be no greater than the protection timer, the policy is issued. Constraints ( When the transaction commit is complete, the priority of the new path entry is increased atomically and the old path is simultaneously downgraded. During this process, ECMP hash fixing and lossless flushing are enabled on the ingress device. If necessary, Meter / Policer is added for critical services to ensure minimum bandwidth within the switching window. After the changeover takes effect, a gradual increase in capacity is implemented, using traffic mirroring or policy-based traffic distribution to progressively increase capacity within a quota sequence of 10%–30%–100%, and verification is performed in each observation window. and The system ensures compliance with standards. If any indicator exceeds the limit, a back-switch is automatically triggered and pre-installed rules are reclaimed. At the same time, the execution trajectory and indicator changes are written to the event log to update the controller's path cost model and experience replay pool. This implementation ensures the service adaptability of path selection with verifiable constraint solutions, ensures the consistency of policy effectiveness and the absence of loops and black holes with two-phase commit and protection timer constraints, and reduces switching risks and shortens recovery time with gray-scale scaling and fast back-switch mechanisms. It can achieve safe, controllable and reproducible closed-loop processing from root cause reasoning to rerouting in complex backbone networks.

[0086] In a specific example, a backbone network experiences a fiber optic cable outage during peak hours. The transport layer monitoring module detects a sudden drop in link optical power and generates continuous alarms within a 100-millisecond sampling period. The network layer observes that the affected link experiences more than 5 routing oscillations and the convergence time extends to 3 seconds within a 500-millisecond sampling period. The application layer records that the end-to-end latency of video services increases from 180 milliseconds to 320 milliseconds within a 1-second sampling period, and the packet loss rate increases from 0.2% to 0.9%. After these signals are synchronized with a unified time base, a spatiotemporal matrix is ​​formed through topology mapping and input into a decision tree model trained by reinforcement learning for root cause inference. The model outputs the root cause as the failure of the target link's physical port.

[0087] Upon receiving this determination, the system immediately invokes the SDN controller interface to convert the repair intent into a rerouting policy generation request. The controller sets hard constraints in its path calculation module: end-to-end latency not exceeding 200 milliseconds, minimum available bandwidth not less than 50 Mbps, packet loss rate not exceeding 0.5%, and must avoid faulty links. Simultaneously, a weighted penalty is introduced into the cost function for the average latency, packet loss rate, and shared risky link groups. This algorithm generates three candidate paths, and the path with the lowest cost function value is selected as the target path. The controller then generates OpenFlow matching and action rules in its compilation module and pre-installs backup path entries in the relevant switches using a two-phase commit mechanism. After confirming stable link detection, the new path is prioritized and activated, while the old path rules are gradually withdrawn.

[0088] During the policy activation phase, the controller allocates traffic in a phased, gradual manner, initially importing 10% of video services for verification. If the end-to-end latency stabilizes at 190 milliseconds and the packet loss rate decreases to 0.3% within 30 seconds, and the threshold conditions are met, the traffic import ratio is gradually increased to 100%. After the final switchover is complete, the system feeds back the QoS metrics comparison before and after the repair to the model training module, adjusting the weights of the repair effect in the reward function for subsequent iterative optimization.

[0089] In existing network fault handling mechanisms, once a repair strategy is directly applied to the production network, configuration deviations or path calculation errors can easily lead to a decline in service performance or even trigger new cascading failures. The lack of an effective pre-verification step is a prominent issue restricting the reliability of automated fault handling. Especially in backbone network scenarios carrying critical services, service quality indicators such as latency, packet loss rate, and throughput are subject to strict constraints. Relying solely on the strategy logic itself is insufficient to ensure the effectiveness of repair measures in actual operation. Therefore, it is urgent to introduce a secure and controllable verification mechanism before strategy deployment. By pre-executing the repair strategy in a simulation environment, the trend of changes in service quality can be observed in advance without affecting production traffic. This allows for the determination of whether the strategy meets predetermined threshold requirements and, based on this, whether to apply it to actual network operation. To this end, the rerouting strategy is applied in a simulation environment, service quality (QoS) indicators before and after adjustment are collected, and these QoS indicators are compared with preset thresholds to verify the effectiveness of the repair strategy.

[0090] In this technical solution, the simulation environment refers to a virtualized operating environment that has the same logical structure as the production network but does not directly carry real business traffic. In this method, this environment is used to perform a security re-routing strategy to verify its feasibility and effectiveness on the business side.

[0091] Quality of Service (QoS) metrics refer to a set of parameters that can quantify the performance status of a service, including key indicators such as end-to-end latency, packet loss rate, and bandwidth utilization. In this method, these metrics are used to compare the differences in service status before and after the repair and serve as the basis for determining the effectiveness of the repair.

[0092] The preset threshold refers to the performance critical value range set in advance based on business needs and network design goals. In this method, the threshold is used as the judgment benchmark for verifying the repair effect and to determine whether the rerouting strategy meets the business continuity requirements.

[0093] In the simulation verification phase, a simulation environment consistent with the production network logic was first established, and a one-to-one mapping configuration was performed using topology description, link parameters, and device forwarding semantics as constraints. To ensure comparability, the basic latency, bandwidth, and packet loss probability of the simulation link were set to the same order of magnitude according to the production side's near-time statistics. The forwarding table size and priority rules of the virtual devices were kept consistent, and the clock was driven by a unified time base to avoid sampling alignment deviations. Baseline traffic was formed by replaying real packet captures within the near-time window or by generating synthetic streams based on service profiles. The service profiles inherited the production side's statistical characteristics in terms of traffic share, packet length distribution, and session duration, enabling the simulation environment to stably reproduce the performance under the unrepaired state.

[0094] After the baseline is established, the rerouting policy generated by the control plane is pre-installed and switched in the simulation equipment, enabling the service traffic to complete the full-path simulation of the policy activation process without affecting the production network. The policy injection follows the same two-phase commit and health probe sequence as production, ensuring that there are no transient loops or black holes in the simulation topology. To improve observability, fine-grained counting and queue monitoring are enabled for key forwarding nodes, and probes are deployed at both the inlet and outlet to ensure closed-loop measurement of end-to-end metrics.

[0095] In terms of metric acquisition, the simulation environment continuously records end-to-end latency. Packet loss rate Throughput With latency jitter The time series data were collected, and statistics were calculated within the same observation window as the baseline to obtain comparable results before and after the repair; the calculation caliber of the four metrics was consistent with the operational dimensionality of the production side. To avoid misleading judgments due to short-term fluctuations, a robust aggregation window and fixed sampling granularity were used for sudden spikes during the acquisition process to ensure that the statistical caliber remained reproducible across different rounds.

[0096] In the judgment and comparison phase, a hard compliance check based on a threshold is first performed, i.e., verification. , , , Do they satisfy simultaneously, among which , , , These are the pre-set upper limits for latency, packet loss, throughput, and jitter, based on the service level. To balance the trade-offs among these multiple metrics, a comprehensive evaluation metric is further calculated.

[0097]

[0098] in , , , The weights are non-negative and satisfy the following conditions: This is used to reflect the relative preference of the business scenario for latency, packet loss, jitter, and throughput; when all hard thresholds are met and The determination strategy is effective in the simulation environment. The above parameters and weights are calibrated according to the business SLA and historical operating data before deployment and remain unchanged within the verification batch to ensure comparability.

[0099] In the results archiving and feedback phase, the system writes the pre- / post-fix metrics, pass / fail determinations, and key intermediate evidence (such as path cost decomposition, queue occupancy trajectories, and health detection results) into a verification report, and feeds this structured record back into the experience base of the control plane. If the determination passes, a production-ready signature is generated, and the same strategy identifier is bound to the threshold version number to ensure consistency in subsequent production-side canary deployments. If the determination fails, the failure trajectory is retained, and the strategy rollback and parameter reconfiguration process is automatically triggered, providing a basis for subsequent adjustments to path cost weights or avoidance sets. Through the above process, the rerouting strategy completes controllable and reproducible effectiveness verification before being deployed to production. The verification results correspond one-to-one with key technical features (threshold comparison and comprehensive score), thus providing reliable input for subsequent canary deployments and online closed-loop optimization.

[0100] By pre-applying rerouting policies in a simulation environment and comparing the service quality indicators (SMIs) before and after the repair with preset thresholds, it is possible to verify whether the policies meet service continuity requirements without affecting the production network. This effectively avoids potential performance degradation or cascading failures that might occur when the policies directly affect real traffic. This technology transforms the determination of repair effectiveness from a purely logical configuration-based process to a verification process based on quantitative indicators. It not only ensures the reliability of policy distribution but also provides verifiable data support for subsequent policy optimization and model training through result feedback, thereby further improving the security and stability of automated fault handling.

[0101] As one possible implementation, when verifying the rerouting policy in a simulation environment, a gray-scale approach to traffic tiered import can be combined with multi-indicator linkage judgment. That is, after the policy is initially loaded, only 10% of the business traffic is introduced to run a 30-second observation window. If the end-to-end latency remains within 200 milliseconds and the packet loss rate does not exceed 0.5%, the traffic ratio is gradually increased to 30% and 100%. At the same time, indicators such as latency, packet loss rate, and jitter are collected at each stage and compared with preset thresholds. This implementation can dynamically observe the changing trend of business performance during the policy verification process, which can reduce the risk of a single full switch. By verifying in stages, the controllability and reproducibility of the policy's effectiveness are enhanced, thereby ensuring that the policy finally put into production performs stably and reliably on the business side.

[0102] As one possible implementation, when executing rerouting policies in a simulation environment, differentiated sets of verification thresholds can be predefined for various services. For example, the latency threshold for video services can be set to 200 milliseconds, the packet loss rate to 0.5%, and the jitter to 30 milliseconds, while the latency threshold for file transfer services can be relaxed to 400 milliseconds, but the bandwidth utilization rate must not be lower than 80%. During the verification process, the QoS performance of multiple services can be monitored simultaneously using a unified acquisition probe. Then, the control module compares the threshold sets corresponding to each service to comprehensively determine whether the repair strategy meets the standards. This implementation can simultaneously cover the performance requirements of different service scenarios during the same simulation execution process, avoiding the deviation of meeting the standard for a single indicator but damaging other services. This ensures that the strategy can meet the comprehensive performance target under the concurrent operation of multiple services after being promoted to the production network.

[0103] In existing automatic network fault handling methods, the generation and execution of repair strategies are typically based on one-time judgments, lacking dynamic feedback based on actual repair effects. This prevents the model from accumulating experience and adaptively optimizing over long-term operation. When network environments and business requirements change, if the decision model cannot iteratively update based on repair results, it is highly susceptible to positioning errors and strategy failures, thereby reducing the overall accuracy and robustness of the processing. To ensure the model remains effective under constantly evolving network conditions, a feedback mechanism needs to be introduced, directly using the results of repair verification as the basis for updating model parameters. This creates a closed-loop relationship between the inference process and actual results, continuously adjusting the convergence direction of reinforcement learning to improve the accuracy of root cause inference and repair strategy generation. Therefore, the repair verification results are fed back into the training process of the decision tree model to update the parameters of the reinforcement learning algorithm.

[0104] In this technical solution, the repair verification result refers to the judgment information formed by comparing the service quality indicators collected in the simulation environment or the actual gray-scale verification process with the preset threshold. This result is used to measure the effectiveness of the rerouting strategy in restoring network performance and serves as the input basis for model updates.

[0105] The parameters of a reinforcement learning algorithm refer to the set of key variables that determine state transitions and reward allocation during the training process of a decision tree model, including the learning rate, discount factor, and reward weight. In this method, these parameters are dynamically adjusted by combining the repair verification results, thereby continuously optimizing the model's accuracy in fault root cause localization and policy generation.

[0106] During the feedback and update phase, the system first compares the service quality indicators collected in the simulation environment or during gray-scale verification with preset thresholds, generating quantitative verification results. These results include not only Boolean judgments of repair success but also numerical differences in performance indicators such as end-to-end latency, packet loss rate, throughput, and latency jitter. To enable direct application of these results during training, the system maps these indicators to input variables of the reward signal and performs unified normalization to eliminate interference from different units of measurement on the learning process.

[0107] During the reward signal construction process, the system generates a repair effectiveness score based on the verification results and combines it with the root cause localization accuracy score to form a composite reward function. The reward function can be expressed as follows:

[0108]

[0109] in, Indicates the composite reward value; This indicates the accuracy score for root cause localization; This indicates the validity score of the repair verification.

[0110] and This is a weighting coefficient used to balance the contribution of positioning accuracy and repair effect. It is dynamically adjusted. and The value range (e.g., between 0.4 and 0.6) allows the system to flexibly change the optimization focus at different stages of operation to adapt to the dual needs of sudden failures and stability maintenance.

[0111] During parameter updates, the reinforcement learning algorithm uses a pre-constructed composite reward function to correct the state-action value estimate of the decision tree model. The system updates the action value function by replaying recent state-action-outcome triplets using a temporal difference method, making it more inclined to select actions with proven repair effectiveness in similar scenarios. The learning rate parameter is adjusted between 0.01 and 0.1 to ensure convergence speed while avoiding oscillations, and the discount factor is maintained between 0.8 and 0.95 to balance the relationship between short-term repair effectiveness and long-term network stability.

[0112] During long-term operation, the system periodically retrains the model, incorporating accumulated repair and verification results into the training samples to improve the model's generalization ability in complex topologies and multi-service scenarios. In this way, after actual deployment, the model can continuously absorb feedback information from network operation and continuously optimize the accuracy of its root cause reasoning and policy generation, thereby forming an adaptive and evolving automated fault handling mechanism.

[0113] By feeding back the repair verification results to the training process of the decision tree model and dynamically updating the parameters of the reinforcement learning algorithm accordingly, the model can not only rely on the static experience of historical samples during inference but also continuously absorb dynamic information from the actual repair effects. This ensures that root cause localization and policy generation remain consistent with the network's operating state. This technique, by introducing a repair effectiveness score into the reward function, enables the model to automatically reinforce successful actions and suppress invalid or misjudged actions, thereby improving the accuracy of subsequent inference and the practicality of the repair strategy. Simultaneously, because the parameter update process continuously incorporates real-time feedback, the model gradually acquires the ability to adapt to new fault modes over long-term operation. It can maintain high stability and convergence speed in dynamic and complex network environments, thus improving the reliability and evolutionary capability of the entire automated fault handling closed loop.

[0114] As a possible implementation, a priority-based experience replay mechanism can be used during the model training process to feed the repair verification results back to the model. This mechanism assigns higher sampling probabilities to repair samples that fail verification or are on the verge of meeting the criteria. Furthermore, a hierarchical learning rate strategy can be adopted during parameter updates. This involves setting different learning rate ranges for the reward weights and the action value function. The learning rate for the reward weights is controlled between 0.01 and 0.05 to maintain stability, while the learning rate for the action value function is set between 0.05 and 0.1 to accelerate convergence. This implementation can highlight the key role of the repair effect while ensuring training stability. It enables the model to correct erroneous decision paths more quickly during iteration and enhances its adaptability to unstable scenarios, thereby improving the accuracy and robustness of root cause inference and repair strategy generation.

[0115] As one possible implementation, during the update of reinforcement learning algorithm parameters, a combination of sliding time windows and dynamic weights can be used to weight the repair verification results. Specifically, a weight function that decays over time is set in the most recent N verification rounds, assigning higher weights to the latest results and gradually reducing the influence of earlier results. At the same time, the balance coefficient between root cause localization accuracy and repair effectiveness is dynamically adjusted in the reward function. This strengthens the weight of repair effectiveness when the network enters a frequent failure phase, while increasing the weight of localization accuracy during a stable operation phase. This implementation can adaptively guide the model update direction according to changes in the network's operating state, enhancing the model's sensitivity to sudden failures while maintaining overall convergence, thereby continuously ensuring the effectiveness and practicality of inference and repair strategies in dynamic environments.

[0116] In a specific example, a provincial backbone network experienced a link outage during peak service hours. The transport layer monitoring module detected a sudden increase in packet loss rate to 1.2% within a 100-millisecond sampling period. The network layer recorded path oscillations accompanied by a routing convergence delay exceeding 2 seconds within a 500-millisecond sampling period. The application layer observed an increase in end-to-end latency for video services from 190 milliseconds to 320 milliseconds within a 1-second sampling period. After time synchronization and topology mapping to generate a spatiotemporal matrix, the matrix was input into a decision tree model for inference. The model determined that the root cause of the fault was the failure of the physical port of the backbone link and triggered the SDN controller to generate a rerouting policy that meets the requirements of latency not exceeding 200 milliseconds, packet loss rate less than 0.5%, and bandwidth greater than 50 Mbps.

[0117] Before the strategy is deployed, the system pre-executes the strategy in a simulation environment, setting the gray-scale import ratio to three stages: 10%, 30%, and 100%, each lasting 30 seconds. Indicators such as latency, packet loss rate, and throughput are collected and thresholds are verified. Simulation results show that when the import ratio reaches 30%, the end-to-end latency stabilizes at 195 milliseconds, the packet loss rate is controlled at 0.3%, and the throughput remains at 52 Mbps, all meeting the preset threshold requirements. Based on this, the system determines the strategy is feasible and feeds the results back to the training module, using the repair effectiveness as input to the reward function.

[0118] In the feedback update phase, the training module uses the validation results to increase the weight of the repair effectiveness in the reward function, and prioritizes sampling the state-action-outcome triplet formed by the event through an experience replay mechanism. Combined with dynamic adjustments to the learning rate and discount factor, the decision tree model's parameters are updated. After iterative optimization, the model can converge to the correct decision path more quickly when encountering similar link failure scenarios, improving inference accuracy by approximately 15% compared to the initial model. Simultaneously, the validation pass rate of the repair strategy in the simulation environment also increases.

[0119] In another embodiment, the present invention also provides a system for automatic network fault handling, including...

[0120] The signal acquisition module is used to acquire multi-source monitoring signals from the transport layer, network layer, and application layer during network operation, and to perform time synchronization and topology mapping on the multi-source monitoring signals to construct a spatiotemporal matrix for characterizing the network state.

[0121] The feature processing and model training module is used to train a decision tree model using reinforcement learning algorithms based on the features extracted from the spatiotemporal matrix, set the state space of the decision tree model as the features of the spatiotemporal matrix, set the action space as the set of potential fault root causes, and construct a reward function based on the root cause localization accuracy and repair effect.

[0122] The root cause reasoning and strategy generation module is used to call the software-defined network (SDN) controller interface after the decision tree model determines the root cause of the fault, generate the corresponding rerouting strategy according to the root cause of the fault, and send the rerouting strategy to the network device for path adjustment.

[0123] The simulation verification module is used to apply the rerouting strategy in a simulation environment, collect the service quality (QoS) indicators before and after the adjustment, and compare the QoS indicators with preset thresholds to verify the effectiveness of the repair strategy.

[0124] The feedback update module is used to feed back the repair verification results to the training process of the decision tree model in order to update the parameters of the reinforcement learning algorithm.

[0125] It should be noted that the explanation of the aforementioned method embodiment for automatic network fault handling also applies to the apparatus of the embodiments of this application, and will not be repeated here.

[0126] Those skilled in the art will recognize that the units and algorithm steps described in the embodiments disclosed herein can be implemented using electronic hardware, computer software, or a combination of electronic hardware and software. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0127] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0128] In the several embodiments provided in this application, any function, if implemented as a software functional unit and sold or used as an independent product, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0129] The above description is merely a specific embodiment of this application. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the protection scope of this application. For some module structures not specifically defined in this invention, the content described in the prior art shall prevail. The prior art mentioned in the foregoing background and specific embodiments sections can be considered as part of this invention and used to understand the meaning of some technical features or parameters.

Claims

1. A method for automatic handling of network failures, characterized by, Comprise the following steps: During network operation, multi-source monitoring signals of the transport layer, network layer and application layer are collected, time synchronization and topology mapping are performed on the multi-source monitoring signals, and a space-time matrix for representing network state is constructed; Based on the features extracted from the space-time matrix, a decision tree model is trained using a reinforcement learning algorithm, the state space of the decision tree model is set as the space-time matrix features, the action space is set as a set of potential fault root causes, and a reward function is constructed according to root cause positioning accuracy and repair effect; When the decision tree model determines the fault root cause, a software-defined network (SDN) controller interface is called, a corresponding rerouting strategy is generated according to the fault root cause, and the rerouting strategy is sent to network equipment for path adjustment; the decision tree model is constructed in a top-down binary hierarchical division manner, the root node corresponds to a global state distribution, internal nodes are divided into subspaces by feature threshold, and leaf nodes correspond to specific root cause categories; In a simulation environment, the rerouting strategy is applied, QoS indicators before and after adjustment are collected, and the QoS indicators are compared with preset thresholds to verify the effectiveness of the repair strategy; during the rerouting strategy sending process, a two-phase commit method is used, that is, the forwarding table items of the backup path are pre-installed in the network equipment, and then the traffic is gradually switched through transaction commit method; The repair verification result is fed back to the training process of the decision tree model, and the parameters of the reinforcement learning algorithm are updated.

2. The method of automatic handling of network faults according to claim 1, characterized in that, The multi-source monitoring signals are aligned through time protocol during the collection process, and the corresponding relationship between the signals and the network equipment ports and routing paths is established through topology mapping.

3. The method of automatic handling of network faults according to claim 1, characterized in that, In the feature extraction process, the mean, extreme value and change rate are calculated through the sliding time window to form a feature vector that can reflect the dynamic evolution of the network operation state.

4. The method for automatic handling of network faults according to claim 1, characterized in that, The action space includes link interruption, node overload, forwarding path anomaly, routing oscillation and application layer performance degradation, and each type of action is corresponded to an operable network object during inference.

5. The method for automatic handling of network faults according to claim 1, characterized in that, The calculation of the reward function is based on the consistency of the root cause positioning result and the actual root cause as the first evaluation dimension, and based on the service quality indicator change before and after repair as the second evaluation dimension, and the two form a composite reward value.

6. The method for automatic handling of network faults according to claim 1, characterized in that, The training of the model adopts a combination of offline pre-training and online updating, the historical space-time matrix data is used to train the basic model in the offline stage, and the newly collected data is used for incremental update in the online stage.

7. The method for automatic handling of network faults according to claim 1, characterized in that, When verifying the rerouting strategy in the simulation environment, the gray import method is used to gradually increase the proportion of business traffic in stages, and the delay, packet loss rate and throughput indicators are collected in each stage and compared with the preset thresholds.

8. A system for automatic handling of network failures, characterized in that The system comprises the following modules: A signal collection module for collecting multi-source monitoring signals of the transport layer, network layer and application layer during network operation, and performing time synchronization and topology mapping on the multi-source monitoring signals to construct a space-time matrix for representing network state; The feature processing and model training module is configured to train a decision tree model by using a reinforcement learning algorithm based on the extracted features of the spatiotemporal matrix, set a state space of the decision tree model as the features of the spatiotemporal matrix, set an action space as a set of potential fault root causes, and construct a reward function according to a root cause positioning accuracy and a repair effect; The root cause reasoning and strategy generation module is configured to, after the decision tree model determines a fault root cause, call a software-defined network (SDN) controller interface, generate a corresponding rerouting strategy according to the fault root cause, and issue the rerouting strategy to a network device for path adjustment. The decision tree model is constructed by using a top-down binary hierarchical division manner, a root node corresponds to a global state distribution, internal nodes are divided into subspaces by feature threshold values, and leaf nodes correspond to specific root cause categories. The simulation verification module is configured to apply the rerouting strategy in a simulation environment, collect service quality (QoS) indicators before and after adjustment, and compare the QoS indicators with a preset threshold to verify the effectiveness of the repair strategy. During the issuance of the rerouting strategy, a two-stage commit manner is adopted, that is, first, forwarding table entries of a backup path are preinstalled in the network device, and then traffic is gradually switched by using a transaction commit manner. The feedback updating module is configured to feed back a repair verification result to a training process of the decision tree model to update parameters of the reinforcement learning algorithm.

Images