Network operation and maintenance automatic management method based on deep learning

Abstract

The invention discloses a network operation and maintenance automatic management method based on deep learning, and the method comprises the following steps: collecting operation and maintenance data, and carrying out the preprocessing of the operation and maintenance data, and obtaining a standardized data set; adopting a Mama selective state space network to generate an operation and maintenance state vector; inputting the operation and maintenance state vector into the improved CORAL model to generate an anomaly detection result; generating a root cause analysis result by adopting a causal inference method; generating candidate operation and maintenance actions by adopting a constraint modeling method in combination with a service level agreement rule; obtaining an optimal operation and maintenance action by adopting an action evaluation method and a risk analysis method, issuing and executing the optimal operation and maintenance action, and collecting execution feedback data; and generating an operation and maintenance audit report based on the anomaly detection result, the root cause analysis result and the execution feedback data. Intelligent, automatic and auditing management of the whole operation and maintenance process is realized, and the method can be widely applied to intelligent operation and maintenance scenes of a large-scale complex network.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network management and artificial intelligence, and particularly relates to a network operation and maintenance automation management method based on deep learning. BACKGROUND

[0002] With the continuous growth of network scale and business complexity, the operation and maintenance management demand for network equipment, links and service is increasing. The existing automatic operation and maintenance method mainly relies on threshold alarm of monitoring indicators or abnormal detection model based on shallow machine learning for problem positioning, but there are generally the following problems in actual application:

[0003] The collected topology structure data, link and session performance indicators, equipment operation indicators, logs and alarm events and other multi-source data formats are not unified, the sampling frequencies are inconsistent, there is time deviation across channels, the existing alignment and compensation technology is difficult to realize high-precision multi-source data synchronization and fusion, resulting in insufficient standardization of operation and maintenance data; for high-dimensional time series data, the traditional abnormal detection method mostly uses fixed window or single statistical feature, which is difficult to capture long-time dependence and multi-scale mode change, resulting in poor stability of detection results, high false alarm rate and high false negative rate; in the root cause analysis aspect, the existing method mostly relies on static causal diagram or rule base, which cannot adapt to concept drift and dynamic network environment, and is difficult to output reliable root cause conclusion; in the operation action decision process, the existing system mostly uses preset rules or manual intervention, lacks automatic screening mechanism combining service level agreement rules and risk assessment, is easy to cause misoperation or service interruption, and is difficult to realize efficient and closed-loop operation and maintenance automation management.

[0004] Therefore, how to provide a network operation and maintenance automation management method based on deep learning is a problem to be solved by those skilled in the art. SUMMARY

[0005] One object of the present application is to provide a network operation and maintenance automation management method based on deep learning, which fully utilizes the Mamba selective state space network, the improved CORAL model, the causal inference method and the constraint modeling method, and details the intelligent process from operation and maintenance data collection and preprocessing, abnormal detection, root cause analysis, candidate operation action generation and screening to operation audit report generation, which has the advantages of high abnormal detection accuracy, strong root cause analysis explainability, high operation action decision reliability and whole-process auditability.

[0006] According to the network operation and maintenance automation management method based on deep learning, the method comprises the following steps:

[0007] Collecting operation and maintenance data and preprocessing to obtain a standardized data set;

[0008] generating an operation and maintenance state vector based on a standardized dataset using a Mamba selective state space network;

[0009] inputting the operation and maintenance state vector into an improved CORAL model, the improved CORAL model introducing a multi-window residual trigger mechanism, a causal graph incremental update mechanism and a counterfactual reasoning method to generate an anomaly detection result;

[0010] generating a root cause analysis result based on the anomaly detection result using a causal inference method;

[0011] generating a candidate operation and maintenance action according to the root cause analysis result using a constraint modeling method combined with service level agreement rules;

[0012] screening the candidate operation and maintenance action using an action evaluation method and a risk analysis method to obtain an optimal operation and maintenance action, and issuing and executing the optimal operation and maintenance action to collect execution feedback data;

[0013] generating an operation and maintenance audit report based on the anomaly detection result, the root cause analysis result and the execution feedback data.

[0014] Optionally, the operation and maintenance data collection and preprocessing specifically includes:

[0015] collecting operation and maintenance data, the operation and maintenance data including topology structure data, link and session performance indicators, device operation indicators, log event data, alarm event data, configuration change records and business service indicators;

[0016] performing preprocessing on the operation and maintenance data, the preprocessing including time alignment and clock correction, data format unification and de-coincidence and merging, resampling, missing value filling, outlier processing, denoising processing, numerical standardization, category and text encoding and time window slicing.

[0017] Optionally, the operation and maintenance state vector is generated based on a standardized dataset using a Mamba selective state space network, specifically including:

[0018] the Mamba selective state space network includes a time window slicing unit, a difference encoding unit, a selective gating unit, a state space kernel unit, a sparse attention unit, a residual normalization unit and a multi-scale pooling unit;

[0019] inputting the standardized dataset into the time window slicing unit to perform slicing of a fixed time length and expand using a sliding window method to output serialized input data;

[0020] inputting the serialized input data into the difference encoding unit to perform channel splicing on feature vectors of different sources and calculate difference encoding of adjacent time points to output multi-dimensional input representation;

[0021] The selective gating unit performs a full connection mapping operation and a sigmoid activation operation on the multi-dimensional input representation, generates a gating weight vector, and element-wise multiplies the multi-dimensional input representation, to output a gated sequence feature;

[0022] The gated sequence feature is input into a state space kernel unit, the state space kernel is parameterized, and an implicit convolution calculation is used to extract long sequence dependencies, to output a convolution feature representation;

[0023] The convolution feature representation is input into a sparse attention unit, sparse weighting aggregation is performed on cross-channel features, and an enhanced joint representation is output;

[0024] The enhanced joint representation is input into a residual normalization unit to perform residual connection and layer normalization, to output a stabilized feature representation, a multi-scale pooling unit performs a pooling operation, and an operation state vector is generated through full connection mapping and sigmoid activation.

[0025] Optionally, the improved CORAL model specifically includes:

[0026] The improved CORAL model includes a multi-window residual trigger module, a causal graph construction module, a causal relationship incremental update module, and a counterfactual reasoning module;

[0027] The operation state vector is input into the multi-window residual trigger module, the operation state vector is sliced according to different time scales, the residual sequence of each time window is calculated based on a long short-term memory network, and the residual sequence is determined using a quantile threshold method. The determination results of the multiple time windows are fused, and an abnormal candidate variable is output;

[0028] The abnormal candidate variable is input into the causal graph construction module, mutual information calculation is performed on the correlation between the abnormal candidate variable and the non-abnormal candidate variable in the operation state vector, full connection mapping operation and sigmoid activation function are used to calculate the causal edge weight, edge sparsity constraint is introduced in the causal graph construction process to delete low-weight causal edges, and ring detection constraint is introduced to ensure the directed acyclic nature of the causal graph structure, and an initial causal relationship graph is output;

[0029] The initial causal relationship graph is input into the causal relationship incremental update module, concept drift detection is performed on the new data, distribution changes are determined, and adaptive forgetting factors are used to update the historical causal edges, new edges are added incrementally, and causal edges that are no longer significant are deleted, to output an updated causal relationship graph;

[0030] The abnormal candidate variable and the updated causal relationship diagram are input into the counterfactual reasoning module, intervention simulation is performed on each candidate root cause, the change range of the system index under the intervention condition is calculated, an intervention score is obtained, and the importance of different candidate root causes is weighted and fused by combining an attention weighting method, and a root cause ranking result is output.

[0031] The root cause ranking result is taken as a final result to generate an abnormality detection result, and the abnormality detection result includes an abnormality category, a propagation path, a root cause node or a root cause configuration item, and a corresponding confidence score.

[0032] Optionally, a root cause analysis result is generated based on the abnormality detection result by using a causal inference method, and specifically includes:

[0033] A candidate root cause set is extracted from the abnormality category, the propagation path, the root cause node or the root cause configuration item in the abnormality detection result;

[0034] Causal inference is performed on the candidate root cause set, a conditional independence test method and a Bayesian causal reasoning method are used to calculate the causal strength between the candidate root cause and the abnormality category, and a causal strength matrix is generated;

[0035] Path search is performed on the causal strength matrix, a depth-first search method or a breadth-first search method is used to enumerate the causal path from the candidate root cause to the abnormality category, and a path weight value is calculated, and a candidate path set is output;

[0036] Scoring and ranking are performed on the candidate path set, an edge weight accumulation and path length normalization method is used to determine a path confidence, and the candidate paths are ranked from high to low according to the confidence, and effective paths with a confidence greater than a preset threshold are screened;

[0037] The root cause node, the root cause link or the root cause configuration item corresponding to the effective path is determined as an effective root cause object, and a root cause analysis result is output.

[0038] Optionally, candidate operation and maintenance actions are generated based on the root cause analysis result by using a constraint modeling method combined with a service level agreement rule, and specifically include:

[0039] The root cause analysis result is taken as an input, and an effective root cause object is extracted from the root cause analysis result, including a root cause node, a root cause link or a root cause configuration item;

[0040] An action set is constructed for the effective root cause object, a device restart, resource expansion or configuration adjustment action is generated according to the root cause node, a traffic rerouting or bandwidth scheduling action is generated according to the root cause link, and a parameter rollback or policy recovery action is generated according to the root cause configuration item, and an initial action set is output;

[0041] The constraint modeling is performed on the initial action set, a constraint model containing service level agreement constraints, network security constraints and resource capacity constraints is established, and the initial action set is input into the constraint model for feasibility checking, actions not satisfying the constraint conditions are removed, and a post-constraint action set is output;

[0042] The rule verification is performed on the post-constraint action set, the delay, throughput, reliability and security of the action are judged item by item by using the service level agreement rules, and the actions satisfying the agreement requirements are reserved in combination with the rule results, and an action set after rule verification is output;

[0043] The action set after rule verification is mapped with the root cause analysis result to form a candidate operation and maintenance action, and the candidate operation and maintenance action corresponds to the root cause object one by one.

[0044] Optionally, the candidate operation and maintenance action is screened by using an action evaluation method and a risk analysis method to obtain an optimal operation and maintenance action, and the optimal operation and maintenance action is issued for execution, and execution feedback data is collected, specifically including:

[0045] The candidate operation and maintenance action is taken as an input, performance evaluation is performed on each candidate action, an action evaluation vector is constructed by using four types of indexes of delay, throughput, reliability and security, and normalization processing is performed on each index, and an action evaluation matrix is output;

[0046] The risk analysis is performed on the action evaluation matrix, the performance degradation degree and secondary abnormal probability possibly caused after the action is executed are calculated by using a risk scoring method, and a risk score is assigned to each candidate action, and an action set with a risk score is output;

[0047] The comprehensive score is executed on the action set with the risk score, the index scores in the action evaluation matrix and the risk score are fused by using a weighted summation method, a comprehensive score vector is generated, and the candidate actions are sorted according to the comprehensive scores from high to low;

[0048] The sorted candidate action set is screened, the candidate actions with a comprehensive score greater than a preset threshold are reserved, and the highest ranked action is selected as the optimal operation and maintenance action, and an optimal operation and maintenance action identifier is output;

[0049] The optimal operation and maintenance action is issued to the corresponding network device, a configuration update instruction or a scheduling control instruction is used to drive the device to execute the action, and execution feedback data is collected.

[0050] Optionally, the operation and maintenance audit report is generated based on the abnormality detection result, the root cause analysis result and the execution feedback data, specifically including:

[0051] The abnormality category, propagation path, root cause node or root cause configuration item and corresponding confidence score are extracted from the abnormality detection result, and an abnormality detection field set is output;

[0052] Extract the optimal propagation path, root cause object identifier and confidence score from the root cause analysis result, establish a corresponding relationship with the abnormal detection field set, and output the root cause analysis field set;

[0053] Extract the execution state, performance index change and abnormal recovery from the execution feedback data, and perform difference calculation on the performance index change to generate a feedback field set;

[0054] Perform field mapping and unified coding on the abnormal detection field set, root cause analysis field set and feedback field set, establish a field index table using a key-value mapping method, and perform integrity check on the contents of each field, and output the integrated field data;

[0055] Perform log processing on the integrated field data, generate a time-sequenced log sequence using a timestamp order sorting and multi-source data merging method, and input the log sequence into a format engine to generate an operation and maintenance audit report.

[0056] The beneficial effects of the present application are:

[0057] (1) The present application collects multi-source operation and maintenance data such as topology structure data, performance indicators, logs and alarms, and combines time alignment, standardization and coding preprocessing steps, generates operation and maintenance state vectors using Mamba selective state space network, effectively solves the problem of multi-source data asynchronization, feature representation deficiency in the prior art, realizes accurate modeling of complex time sequence dependence and multi-scale mode, and improves the stability and accuracy of abnormal detection.

[0058] (2) The present application introduces a multi-window residual trigger mechanism, an incremental update mechanism of a causal graph and a counterfactual reasoning method in the improved CORAL model, deeply models abnormal detection and root cause analysis, dynamically adapts to concept drift and environmental changes, generates root cause analysis results with propagation path and confidence score, overcomes the problem that existing static causal models and rule bases cannot explain abnormal reasons, and improves the explainability and reliability of root cause analysis.

[0059] (3) The present application adopts a constraint modeling method combined with service level agreement rules in the operation and maintenance action decision process, and selects the optimal operation and maintenance action through action evaluation method and risk analysis method, further combines execution feedback data to form an audit closed loop, solves the defects of lack of constraints and risk assessment of operation and maintenance action in the existing method, and realizes the automation, safety and whole process traceability management of operation and maintenance action. BRIEF DESCRIPTION OF DRAWINGS

[0060] The accompanying drawings, which are included to provide a further understanding of the application and are incorporated in and constitute a part of this specification, illustrate embodiments of the application and together with the description serve to explain the application. In the drawings:

[0061] Figure 1 A flow chart of a network operation and maintenance automatic management method based on deep learning proposed in the present application;

[0062] Figure 2 A schematic diagram of a network operation and maintenance automatic management method based on deep learning proposed in the present application;

[0063] Figure 3 A framework diagram of an improved CORAL model in a network operation and maintenance automatic management method based on deep learning proposed in the present application. DETAILED DESCRIPTION

[0064] The application will now be described in further detail with reference to the drawings. These drawings show only the essential features of the application and are therefore to be regarded only as a schematic illustration. In the drawings:

[0065] REFERENCE Figures 1-3 A network operation and maintenance automatic management method based on deep learning, comprising the following steps:

[0066] Collecting operation and maintenance data and performing preprocessing to obtain a standardized data set;

[0067] Generating an operation and maintenance state vector based on the standardized data set using a Mamba selective state space network;

[0068] Inputting the operation and maintenance state vector into an improved CORAL model, the improved CORAL model introducing a multi-window residual trigger mechanism, a causal graph incremental update mechanism and a counterfactual reasoning method to generate an anomaly detection result;

[0069] Generating a root cause analysis result based on the anomaly detection result using a causal inference method;

[0070] Generating a candidate operation and maintenance action based on the root cause analysis result using a constraint modeling method combined with a service level agreement rule;

[0071] Screening the candidate operation and maintenance action using an action evaluation method and a risk analysis method to obtain an optimal operation and maintenance action, and issuing and executing the optimal operation and maintenance action to collect execution feedback data;

[0072] Generating an operation and maintenance audit report based on the anomaly detection result, the root cause analysis result and the execution feedback data.

[0073] In the present embodiment, the collecting operation and maintenance data and performing preprocessing specifically comprises:

[0074] Collecting operation and maintenance data, including topology data, link and session performance indicators, device operation indicators, log event data, alarm event data, configuration change records, and service indicators;

[0075] Performing preprocessing on the operation and maintenance data, including time alignment and clock correction, data format unification and de-duplication, resampling, missing value filling, outlier processing, noise reduction, numerical standardization, category and text encoding, and time window slicing.

[0076] The embodiment significantly improves the completeness and consistency of operation and maintenance data by performing time alignment, data format unification, de-duplication, resampling, missing value filling, outlier and noise processing, numerical standardization, category and text encoding, and time window slicing, reduces redundancy and bias, and provides a high-quality standardized data basis for the input of subsequent deep learning models, thereby improving the reliability and accuracy of anomaly detection and root cause analysis.

[0077] In the embodiment, the standardized data set is used to generate an operation and maintenance state vector based on a Mamba selective state space network, specifically including:

[0078] The Mamba selective state space network includes a time window slicing unit, a difference encoding unit, a selective gating unit, a state space kernel unit, a sparse attention unit, a residual normalization unit, and a multi-scale pooling unit.

[0079] The standardized data set is input into the time window slicing unit, which performs slicing of a fixed time length and expands it using a sliding window method, outputting serialized input data.

[0080] The serialized input data is input into the difference encoding unit, which performs channel concatenation on feature vectors of different sources and calculates difference encoding of adjacent time points, outputting multi-dimensional input representation.

[0081] The selective gating unit performs full connection mapping operation and Sigmoid activation operation on the multi-dimensional input representation, generates a gating weight vector, and element-wise multiplies the multi-dimensional input representation, outputting the gated sequence feature.

[0082] The gated sequence feature is input into the state space kernel unit, which performs parameterization processing on the state space kernel and extracts long sequence dependencies using implicit convolution calculation, outputting convolution feature representation.

[0083] The convolution feature representation is input into the sparse attention unit, which performs sparse weighting aggregation on cross-channel features, outputting enhanced joint representation.

[0084] The enhanced joint representation is input into a residual normalization unit to perform residual connection and layer normalization, output a stabilized feature representation, perform a pooling operation by a multi-scale pooling unit, and generate an operation and maintenance state vector through full connection mapping and Sigmoid activation.

[0085] The embodiment effectively captures the long-time sequence dependence and multi-scale pattern features of operation and maintenance data by sequentially performing time window slicing, differential encoding, selective gating, state space kernel calculation, sparse attention aggregation, residual normalization and multi-scale pooling operations in the Mamba selective state space network, generates a stable and high-dimensional expressed operation and maintenance state vector, thereby enhancing the representation ability of the complex network operation state, reducing the feature loss and information redundancy problem, and providing a more accurate input basis for subsequent anomaly detection and root cause analysis.

[0086] In the embodiment, the improved CORAL model specifically includes:

[0087] The improved CORAL model includes a multi-window residual trigger module, a causal graph construction module, a causal relationship incremental update module, and a counterfactual reasoning module.

[0088] The operation and maintenance state vector is input into the multi-window residual trigger module, the operation and maintenance state vector is sliced according to different time scales, the residual sequence of each time window is calculated based on a long short-term memory network, and the residual sequence is determined by using a quantile threshold method. The determination results of the multiple time windows are fused, and an abnormal candidate variable is output.

[0089] The abnormal candidate variable is input into the causal graph construction module, mutual information calculation is performed on the correlation between the abnormal candidate variable and the non-abnormal candidate variable in the operation and maintenance state vector, the causal edge weight is calculated by using full connection mapping operation and Sigmoid activation function, and the edge sparsity constraint is introduced in the causal graph construction process to delete low-weight causal edges. The ring detection constraint is introduced to ensure the directed acyclic nature of the causal graph structure, and an initial causal relationship graph is output.

[0090] The initial causal relationship graph is input into the causal relationship incremental update module, concept drift detection is performed on the new data, distribution changes are determined, and the historical causal edges are updated by using an adaptive forgetting factor. The new edges are incrementally added, and the causal edges that are no longer significant are deleted, and an updated causal relationship graph is output.

[0091] The abnormal candidate variable and the updated causal relationship graph are input into the counterfactual reasoning module, the candidate root causes are simulated one by one, the change amplitude of the system index under the intervention condition is calculated, the intervention score is obtained, and the importance of different candidate root causes is weighted and fused by using an attention weighting method, and a root cause ranking result is output.

[0092] The root cause ranking result is taken as a final result to generate an anomaly detection result, which includes an anomaly category, a propagation path, a root cause node or a root cause configuration item, and a corresponding confidence score.

[0093] The embodiment introduces a multi-window residual trigger mechanism, a causal graph construction and incremental update mechanism, and a counterfactual reasoning method in the improved CORAL model, and significantly improves the anomaly detection and root cause analysis. Specifically, the multi-window residual trigger mechanism can perform residual analysis on the operation and maintenance state vector at different time scales, avoiding the misjudgment problem caused by a single window, thereby reducing the false positive rate and the false negative rate; the causal graph construction and incremental update mechanism establishes a causal relationship between abnormal candidate variables and non-abnormal variables, and maintains the dynamic update of the causal graph structure through adaptive forgetting and incremental addition, solving the problem that existing methods are difficult to adapt to network environment changes and concept drift; the counterfactual reasoning method simulates the intervention of the candidate root cause, quantifies its impact on the system index, outputs the ranking result, and enhances the explainability and confidence of root cause analysis. Through the above technical combination, the embodiment realizes the dual improvement of the accuracy of anomaly detection results and the reliability of root cause positioning, and provides a solid foundation for subsequent action decision-making.

[0094] In the embodiment, the root cause analysis result is generated based on the anomaly detection result by using a causal inference method, specifically including:

[0095] A candidate root cause set is extracted from the anomaly category, the propagation path, the root cause node or the root cause configuration item in the anomaly detection result;

[0096] Causal inference is performed on the candidate root cause set, a conditional independence test method and a Bayesian causal reasoning method are used to calculate the causal strength between the candidate root cause and the anomaly category, and a causal strength matrix is generated;

[0097] Path search is performed on the causal strength matrix, a depth-first search method or a breadth-first search method is used to enumerate the causal path from the candidate root cause to the anomaly category, and a path weight value is calculated, and a candidate path set is output;

[0098] Scoring and ranking are performed on the candidate path set, an edge weight accumulation and path length normalization method is used to determine the path confidence, and the candidate paths are arranged from high to low according to the confidence, and the effective paths with a confidence greater than a preset threshold are screened;

[0099] The root cause node, the root cause link or the root cause configuration item corresponding to the effective path is determined as an effective root cause object, and a root cause analysis result is output.

[0100] The embodiment performs conditional independence test and Bayesian causal inference on the abnormal category, propagation path and root cause object in the abnormal detection result, generates a causal strength matrix, and screens out an effective path by combining path search and scoring sorting, so as to accurately locate the most critical root cause object in a complex network environment, effectively reduce the interference of false links or configuration items, improve the accuracy and reliability of root cause analysis, and provide a reliable basis for subsequent operation and maintenance action generation.

[0101] In the embodiment, the candidate operation and maintenance action is generated by using a constraint modeling method in combination with a service level agreement rule according to the root cause analysis result, and specifically includes the following steps.

[0102] The root cause analysis result is taken as input, and effective root cause objects are extracted from the root cause analysis result, including root cause nodes, root cause links or root cause configuration items.

[0103] Action set construction is performed on the effective root cause objects, device restart, resource expansion or configuration adjustment actions are generated according to the root cause nodes, traffic rerouting or bandwidth scheduling actions are generated according to the root cause links, and parameter rollback or policy recovery actions are generated according to the root cause configuration items, and an initial action set is output.

[0104] Constraint modeling is performed on the initial action set, a constraint model containing service level agreement constraints, network security constraints and resource capacity constraints is established, and the initial action set is input into the constraint model for feasibility test, actions that do not satisfy the constraint conditions are eliminated, and a constraint action set is output.

[0105] Rule verification is performed on the constraint action set, service level agreement rules are used to determine the delay, throughput, reliability and security of the actions one by one, and actions that satisfy the agreement requirements are screened and retained in combination with the rule results, and an action set after rule verification is output.

[0106] The action set after rule verification is mapped with the root cause analysis result to form a candidate operation and maintenance action, and the candidate operation and maintenance action corresponds to the root cause object one by one.

[0107] The embodiment extracts effective root cause objects based on the root cause analysis result, constructs a corresponding initial action set, performs feasibility test in combination with service level agreement constraints, network security constraints and resource capacity constraints, and performs protocol rule verification on the action set, and finally forms a candidate operation and maintenance action, realizes automation and compliance of the action generation process, effectively avoids the risk of executing unreasonable actions, and ensures that the selected operation and maintenance action meets the operation and maintenance requirements in terms of performance, reliability and security.

[0108] In the embodiment, the candidate operation and maintenance actions are screened by the action evaluation method and the risk analysis method to obtain optimal operation and maintenance actions, and the optimal operation and maintenance actions are issued for execution, and feedback data is collected, specifically including:

[0109] The candidate operation and maintenance actions are taken as inputs, performance evaluation is performed on each candidate action, an action evaluation vector is constructed using four indexes of delay, throughput, reliability and security, and normalization processing is performed on each index, and an action evaluation matrix is output;

[0110] The action evaluation matrix is subjected to risk analysis, the risk scoring method is used to calculate the performance degradation degree and secondary abnormal probability that may be caused after the action is executed, and a risk score is assigned to each candidate action, and an action set with a risk score is output;

[0111] The action set with the risk score is subjected to comprehensive scoring, the index scores in the action evaluation matrix and the risk scores are fused by using the weighted summation method to generate a comprehensive score vector, and the candidate actions are sorted in descending order of the comprehensive scores;

[0112] The sorted candidate action set is screened, and the candidate actions with a comprehensive score greater than a preset threshold are retained, and the highest ranked action is selected as the optimal operation and maintenance action, and an optimal operation and maintenance action identifier is output;

[0113] The optimal operation and maintenance action is issued to the corresponding network device, a configuration update instruction or a scheduling control instruction is used to drive the device to execute the action, and execution feedback data is collected.

[0114] The embodiment quantitatively evaluates and sorts the effectiveness and potential risks of the actions by constructing a performance evaluation vector for the candidate operation and maintenance actions and performing risk analysis, selects the optimal operation and maintenance action with the highest comprehensive score from the sorted actions, and automatically issues the action for execution and collects feedback data for closed-loop verification, thereby realizing automation and precision of action screening and execution, effectively reducing the probability of misoperation, and improving the reliability of operation and maintenance actions and network recovery efficiency.

[0115] In the embodiment, the operation and maintenance audit report is generated based on the abnormality detection result, the root cause analysis result and the execution feedback data, specifically including:

[0116] The abnormality categories, propagation paths, root cause nodes or root cause configuration items and corresponding confidence scores are extracted from the abnormality detection result, and an abnormality detection field set is output;

[0117] The optimal propagation path, root cause object identifier and confidence score are extracted from the root cause analysis result, a corresponding relationship with the abnormality detection field set is established, and a root cause analysis field set is output;

[0118] extracting an execution state, a performance index change and an abnormal recovery condition from the execution feedback data, performing a difference calculation on the performance index change, and generating a feedback field set;

[0119] performing field mapping and unified coding on the abnormal detection field set, the root cause analysis field set and the feedback field set, establishing a field index table using a key-value mapping method, performing integrity checking on the contents of each field, and outputting integrated field data;

[0120] performing log processing on the integrated field data, generating a time-sequenced log sequence using a timestamp sequential ordering and multi-source data merging method, and inputting the log sequence into a format engine to generate an operation and maintenance audit report.

[0121] The embodiment extracts, maps and unifies the abnormal detection result, the root cause analysis result and the execution feedback data, and generates an operation and maintenance audit report through log processing and time sequencing, realizes traceable and structured recording of the whole process of abnormal discovery, root cause positioning and action execution, effectively improves the transparency and compliance of operation and maintenance results, and provides reliable data support for subsequent decision optimization and audit supervision.

[0122] Example 1:

[0123] In order to verify the feasibility of the application in implementation, the application is applied to the comprehensive operation and maintenance scene of the core network and metropolitan area network of a large operator. The network covers more than 1.2 million active users, contains about 320 core switches, about 480 service routers, more than 2000 access devices, generates more than 5TB of log and alarm data per day, and involves multi-source heterogeneous data such as link and session performance indexes, device running indexes and service indexes. The traditional operation and maintenance method mainly relies on manual duty and rule alarm, which not only causes alarm flooding and high false alarm rate, but also consumes time in root cause positioning, often leading to an average repair time (MTTR) of more than 2 hours, seriously affecting user experience.

[0124] In this scene, the application first performs unified preprocessing on the collected multi-source operation and maintenance data. Through time alignment and clock correction, the synchronicity of different source data is ensured; the log and alarm are de-duplicated and combined and the abnormal value is processed, so that the data redundancy rate is reduced by about 35%; after numerical standardization and text coding, a standardized data set that can be directly input into a deep learning model is formed. After preprocessing, a training and reasoning data set containing about 120 million valid records is finally obtained.

[0125] Next, the normalized dataset is input into the Mamba selective state space network. The network can capture the trend changes of key performance indicators within a time window of up to 48 hours, and identify sudden abnormalities through differential coding and sparse attention mechanisms. In the experiment, in the link latency anomaly detection task, the Mamba network improves the detection accuracy by about 7.6% and reduces the false alarm rate by about 11% compared with the traditional GRU method. The generated operation and maintenance state vector can stably reflect the running state of different devices and links in the time dimension.

[0126] Subsequently, the operation and maintenance state vector is input into the improved CORAL model. The model introduces a multi-window residual trigger mechanism, which can monitor residual changes at three window scales of 15 minutes, 1 hour and 6 hours simultaneously, and only determines an anomaly when multiple windows are triggered at the same time, significantly reducing false alarms caused by short-term fluctuations. In actual testing, the false alarm rate of anomaly detection is reduced from 18% of the original system to 7.5%. Through the incremental update mechanism of the causal graph, the model can dynamically adjust the causal edge weight and model the recent addition of link configuration changes in a timely manner. In a large-scale link congestion event, the model accurately identifies the root cause as "core router port policy configuration error", and verifies through counterfactual reasoning that the anomaly disappears if the policy is revoked, with a root cause analysis confidence score of 0.93.

[0127] Based on the root cause analysis results, the system generates candidate operation and maintenance actions using a constraint modeling method combined with service level agreement rules. For example, when a link configuration error is detected as the root cause, candidate actions include "rollback configuration", "reallocate bandwidth" and "traffic rerouting". After SLA rule verification, the action set that meets the delay of less than 30ms and the reliability of more than 99.9% is retained. The candidate action is further evaluated and risk analyzed, and the "rollback configuration" action has the highest comprehensive score. The system automatically issues the action and collects feedback data. Table 1 compares the key indicators of the method of the present application and the traditional operation and maintenance method during the three-month test period:

[0128] Table 1 Comparison of operation and maintenance effect data during three-month test period

[0129] Indicator category Conventional operation and maintenance method average value Invention method average value Promotion amplitude Average number of alarms per day 1260 830 -34％ Alarm false alarm rate 18.00％ 7.50％ -58％ Abnormal detection accuracy 82.30％ 89.90％ 9.20％ Root cause positioning time consumption (min) 78 21 -73％ Root cause analysis confidence 0.68 0.91 33％ Average repair time (h) 2.1 0.6 -71％ SLA violation times / month 11 3 -73％ Number of user complaints / month 245 92 -62％

[0130] As can be seen from Table 1, the present application has achieved significant improvement in alarm quantity control, anomaly detection accuracy, root cause positioning speed, repair time shortening, etc. For example, the average repair time is shortened from 2.1 hours to 0.6 hours, meeting the operator's SLA requirement of "key fault recovery within 2 hours"; the alarm false alarm rate is greatly reduced, reducing the unnecessary troubleshooting workload of operation and maintenance personnel; the root cause analysis confidence is significantly improved, ensuring the reliability of automatic action execution.

[0131] Through analysis of the feedback data, it is found that after performing the "rollback configuration" type action, the link delay is restored to the normal range within 5 minutes, the packet loss rate is reduced to below 0.1%, and the user experience is obviously improved. The operation and maintenance audit report generated by the system not only records the action execution details, but also gives quantitative analysis on the performance recovery, providing a reliable basis for subsequent audit and decision-making.

[0132] In summary, the present application can significantly improve the automation and intelligence level of operation and maintenance in large complex network scenarios, effectively reduce the alarm false alarm rate and root cause positioning time, shorten the average repair time, and realize precise, safe and traceable management of operation and maintenance actions.

[0133] The above is only a preferred specific embodiment of the present application, but the protection scope of the present application is not limited thereto, any person skilled in the art can make equivalent replacement or change according to the technical solution and inventive concept of the present application within the technical range disclosed by the present application, which should be covered within the protection scope of the present application.

Claims

1. A deep learning-based automated network operation and maintenance management method, characterized in that, Includes the following steps: Collect and preprocess operation and maintenance data to obtain a standardized dataset; Based on a standardized dataset, an operational state vector is generated using the Mamba selective state space network. The operation and maintenance status vector is input into the improved CORAL model, which introduces a multi-window residual triggering mechanism, a causal graph incremental update mechanism, and a counterfactual reasoning method to generate anomaly detection results. Root cause analysis results are generated using a causal inference method based on anomaly detection results; Based on the root cause analysis results, a constraint modeling method is used in conjunction with service level agreement rules to generate candidate maintenance actions. Candidate maintenance actions are screened using action evaluation and risk analysis methods to obtain the optimal maintenance action, which is then issued for execution, and execution feedback data is collected. An operation and maintenance audit report is generated based on anomaly detection results, root cause analysis results, and execution feedback data.

2. The network operation and maintenance automation management method based on deep learning according to claim 1, characterized in that, The collection and preprocessing of operation and maintenance data specifically includes: Collect operation and maintenance data, which includes topology data, link and session performance indicators, device operation indicators, log event data, alarm event data, configuration change records, and service indicators; Preprocessing is performed on the operation and maintenance data, including time alignment and clock correction, data format unification and deduplication merging, resampling, missing value imputation, outlier handling, noise reduction, numerical standardization, category and text encoding, and time window slicing.

3. The network operation and maintenance automation management method based on deep learning according to claim 1, characterized in that, The generation of operational state vectors based on standardized datasets using the Mamba Selective State Space Network specifically includes: The Mamba selective state space network includes time window slicing units, differential coding units, selective gating units, state space kernel units, sparse attention units, residual normalization units, and multi-scale pooling units. The standardized dataset is input into the time window slicing unit, slices of fixed time length are executed, and the data is expanded using a sliding window method to output serialized input data. The serialized input data is input into the differential coding unit, which performs channel concatenation on feature vectors from different sources, calculates the difference encoding between adjacent time points, and outputs a multidimensional input representation. The selective gating unit performs fully connected mapping and sigmoid activation operations on the multidimensional input representation to generate a gating weight vector, which is then multiplied element-wise with the multidimensional input representation to output the gated sequence features. The gated sequence features are input into the state space kernel unit, the state space kernel is parameterized, and implicit convolution is used to extract long sequence dependencies, outputting convolutional feature representations. The convolutional feature representation is input into the sparse attention unit, and the cross-channel features are sparsely weighted and aggregated to output an enhanced joint representation. The enhanced joint representation is input into the residual normalization unit to perform residual connection and layer normalization processing, outputting a stable feature representation. A multi-scale pooling unit is then used to perform pooling operations, and an operation and maintenance state vector is generated through fully connected mapping and Sigmoid activation.

4. The network operation and maintenance automation management method based on deep learning according to claim 1, characterized in that, The improved CORAL model specifically includes: The improved CORAL model includes a multi-window residual triggering module, a causal graph construction module, a causal relationship incremental update module, and a counterfactual reasoning module; The operation and maintenance status vector is input into the multi-window residual triggering module. The operation and maintenance status vector is sliced ​​according to different time scales. The residual sequence of each time window is calculated based on the long short-term memory network. The residual sequence is judged by the quantile threshold method. The judgment results of multiple time windows are fused and the abnormal candidate variables are output. The abnormal candidate variables are input into the causal graph construction module. Mutual information calculation is performed on the correlation between the abnormal candidate variables and the non-abnormal candidate variables in the operation and maintenance state vector. The weight of the causal edge is calculated by using fully connected mapping operation and Sigmoid activation function. During the construction of the causal graph, edge sparsity constraint is introduced to delete low-weight causal edges. Cycle detection constraint is introduced to ensure the directed acyclicity of the causal graph structure. The initial causal relationship graph is output. The initial causal relationship graph is input into the causal relationship incremental update module. Concept drift detection is performed on the newly added data. After the distribution changes are determined, an adaptive forgetting factor is used to decay and update the historical causal edges. New edges are added incrementally, and causal edges that are no longer significant are deleted. The updated causal relationship graph is then output. The abnormal candidate variables and the updated causal relationship diagram are input into the counterfactual reasoning module. Intervention simulations are performed on each candidate root cause, the change range of system indicators under intervention conditions is calculated, the intervention score is obtained, and the importance of different candidate root causes is weighted and fused using the attention weighting method to output the root cause ranking results. The root cause ranking results are used as the final result to generate anomaly detection results, which include anomaly category, propagation path, root cause node or root cause configuration item and corresponding confidence score.

5. The network operation and maintenance automation management method based on deep learning according to claim 1, characterized in that, The generation of root cause analysis results based on causal inference methods using anomaly detection results specifically includes: Extract a set of candidate root causes from the anomaly category, propagation path, root cause node, or root cause configuration item in the anomaly detection results; Causal inference is performed on the candidate root cause set. The conditional independence test method and Bayesian causal inference method are used to calculate the causal strength between the candidate root cause and the abnormal category, and a causal strength matrix is ​​generated. Perform path search on the causal strength matrix, enumerate the causal paths from candidate root causes to anomalous categories using either depth-first search or breadth-first search, calculate the path weight values, and output the candidate path set. The candidate path set is scored and sorted. The path confidence is determined by the edge weight accumulation and path length normalization method. The candidate paths are arranged from high to low confidence and the effective paths with confidence greater than the preset threshold are selected. The root cause nodes, root cause links, or root cause configuration items corresponding to the valid paths are identified as valid root cause objects, and the root cause analysis results are output.

6. The network operation and maintenance automation management method based on deep learning according to claim 1, characterized in that, The process of generating candidate maintenance actions based on root cause analysis results using constraint modeling methods combined with service level agreement rules specifically includes: Use the root cause analysis results as input to extract valid root cause objects, including root cause nodes, root cause links, or root cause configuration items. Construct an action set for valid root cause objects, generate device restart, resource expansion or configuration adjustment actions based on root cause nodes, generate traffic rerouting or bandwidth scheduling actions based on root cause links, generate parameter rollback or policy recovery actions based on root cause configuration items, and output the initial action set. Constraint modeling is performed on the initial action set. A constraint model is established that includes service level agreement constraints, network security constraints, and resource capacity constraints. The initial action set is then input into the constraint model for feasibility testing. Actions that do not meet the constraints are removed, and the constrained action set is output. Perform rule validation on the constrained action set, use service level agreement rules to evaluate the latency, throughput, reliability and security of each action, and combine the rule results to filter and retain actions that meet the protocol requirements, and output the action set after rule validation; The action set after rule verification is mapped to the root cause analysis results to form candidate operation and maintenance actions, and the candidate operation and maintenance actions correspond one-to-one with the root cause objects.

7. The network operation and maintenance automation management method based on deep learning according to claim 1, characterized in that, The process of screening candidate maintenance actions using action evaluation and risk analysis methods to obtain the optimal maintenance action, and then issuing and executing the optimal maintenance action, along with collecting execution feedback data, specifically includes: The candidate operation and maintenance actions are taken as input, and a performance evaluation is performed on each candidate action. Four types of indicators, namely latency, throughput, reliability and security, are used to construct an action evaluation vector. The indicators are then normalized, and the action evaluation matrix is ​​output. Perform risk analysis on the action evaluation matrix, use the risk scoring method to calculate the degree of performance degradation and the probability of secondary anomalies that may be caused after the action is executed, assign risk scores to each candidate action, and output the action set with risk scores. A comprehensive score is performed on the action set with risk scores. The index scores in the action evaluation matrix are merged with the risk scores using a weighted summation method to generate a comprehensive score vector. Candidate actions are then sorted from high to low according to the comprehensive scores. Filter the sorted set of candidate actions, retain the candidate actions with a comprehensive score greater than a preset threshold, select the highest-ranked action as the optimal operation and maintenance action, and output the optimal operation and maintenance action identifier. The optimal operation and maintenance actions are issued to the corresponding network devices, and the devices are driven to execute the actions using configuration update commands or scheduling control commands, and execution feedback data is collected.

8. The network operation and maintenance automation management method based on deep learning according to claim 1, characterized in that, The process of generating an operation and maintenance audit report based on anomaly detection results, root cause analysis results, and execution feedback data specifically includes: Extract the anomaly category, propagation path, root cause node or root cause configuration item and corresponding confidence score from the anomaly detection results, and output the anomaly detection field set. Extract the optimal propagation path, root cause object identifier, and confidence score from the root cause analysis results, establish the correspondence with the anomaly detection field set, and output the root cause analysis field set; Extract execution status, performance metric changes, and anomaly recovery from the execution feedback data, and perform differential calculations on the performance metric changes to generate a set of feedback fields; Field mapping and unified coding are performed on the anomaly detection field set, root cause analysis field set, and feedback field set. A field index table is established using the key-value mapping method, and the integrity of each field content is checked. The integrated field data is then output. The integrated field data is logged, and a time-series log sequence is generated by sorting by timestamp order and merging data from multiple sources. The log sequence is then input into a formatting engine to generate an operation and maintenance audit report.

Images