Network fault real-time predicting and positioning method based on multi-modal data fusion

Abstract

The invention relates to the technical field of network operation and maintenance, in particular to a network fault real-time predicting and positioning method based on multi-modal data fusion, which comprises the following steps of: acquiring multi-source network data such as performance, flow and logs, and forming a multi-modal data set through space-time alignment and feature fusion; dividing multiple operation scenes of the campus network by using density peak clustering, and training a scene-based normal behavior baseline of each network entity through VAE; then calculating the mahalanobis distance recognition anomaly of the real-time fusion feature and the baseline, and outputting the fault probability and type in combination with the LSTM; then constructing a causal graph by using a PC algorithm, and determining candidate root causes by Bayesian reasoning; and finally, learning a node attention weight by using the GAT, generating an interpretable report in combination with the LLaMA-2, and outputting a positioning result. According to the method, accurate campus network fault prediction and interpretable positioning are effectively realized.

Description

Technical Field

[0001] This invention relates to the field of network operation and maintenance technology, and more specifically, to a method for real-time prediction and location of network faults based on multimodal data fusion. Background Technology

[0002] Real-time prediction and accurate location of network faults are core components of ensuring stable network operation. This is especially true in campus network scenarios, which support diverse services such as teaching, research, office work, and daily life services. The operational status changes dynamically with time periods and business needs (such as significant differences in scenarios like peak class times and exam support), placing higher demands on the real-time and accuracy of fault handling.

[0003] Existing network fault handling methods have significant shortcomings: First, they rely heavily on single-modal data (such as collecting only performance metrics), failing to integrate multi-source data features such as traffic, logs, and user authentication, and neglecting to consider the differences in various scenarios within campus networks. The use of a uniform behavioral baseline results in a large deviation between the baseline and the actual normal state, leading to high false alarm and false negative rates in anomaly identification. Second, root cause reasoning is largely based on human experience or simple correlation analysis, lacking data-driven causal relationship support, making it difficult to accurately locate the source of the fault. Third, fault location results are mostly purely numerical information, lacking natural language explanations, making it difficult for maintenance personnel to quickly understand the fault propagation path and impact range, thus prolonging fault handling time.

[0004] To address this, the present invention proposes a real-time network fault prediction and location method based on multimodal data fusion, specifically solving the accuracy and interpretability issues of existing methods in campus network scenarios. Summary of the Invention

[0005] To address the shortcomings of existing technologies, the present invention aims to provide a method for real-time prediction and localization of network faults based on multimodal data fusion.

[0006] To achieve the above objectives, the present invention provides the following technical solution: A real-time network fault prediction and localization method based on multimodal data fusion includes the following steps: Step 1: Multimodal Data Acquisition and Fusion: Collect multi-source network data and perform spatiotemporal alignment and feature fusion encoding to form a multimodal fusion dataset composed of multimodal feature vectors; Step 2: Construction of multi-scenario behavior baselines: Clustering algorithms are used to divide the network operation scenarios. For each network entity in each scenario, a normal behavior baseline model is trained using an autoencoder. Step 3: Real-time fault prediction based on baseline deviation: Based on the calculated multimodal fusion features and the deviation of the baseline model, the abnormal warning status of network entities is identified, and the fault occurrence probability and fault type are output by combining the time series prediction model. Step 4: Fault Root Cause Inference Based on Causal Discovery: Construct a scenario-based causal graph using a causal discovery algorithm, and determine candidate root causes of network faults through posterior probability inference; Step 5: Fault localization with graph attention and enhanced interpretability: Using the correlation strength between candidate root cause nodes and fault nodes as the supervision signal, the graph attention network is used to learn node attention weights, and combined with the pre-trained large model to generate an interpretable report, outputting the fault localization result package.

[0007] Furthermore, the process of dividing the network operation scenarios described in step two specifically includes: S211. Record the network operation scenario for each data sample in the historical multimodal fusion dataset, where each data sample is a multimodal fusion feature vector; S212. Calculate the local density of each sample; S213. Calculate the distance of each sample from the peak value; S214. Draw a decision map for each sample with respect to local density and distance peak, and select cluster center samples from the decision map; S215. Label each sample around the selected cluster center sample, with each label corresponding to a specific network operation scenario.

[0008] Furthermore, the baseline model described in step two is as follows: The baseline model is characterized as a probability distribution model of the normal behavior of network entities. ,in, The mean vector of the latent vectors. The covariance matrix of the latent vectors; the latent vectors are obtained by mapping the multimodal fusion feature vectors through a VAE encoder; The mean vector Given a d-dimensional column vector, its m-th element... , represents the statistical mean of the m-th dimension feature of the latent vector when the network entity is operating normally in the current scenario; The covariance matrix is ​​a d×d symmetric positive definite matrix, whose diagonal elements The off-diagonal elements represent the variance of the m-th feature of the latent vector. Let represent the covariance between the m-th dimension and the l-th dimension of the latent vector.

[0009] Furthermore, the local density described in S212 is calculated as follows: Distance metric selection: Euclidean distance is used to calculate the feature vector distance between sample i and other samples j. The formula is: ; Where n1 is the dimension of the multimodal fusion feature vector; Let i and j be the values ​​of the k-th feature, respectively. Truncating kernel functions to calculate local density: setting a distance threshold Statistical satisfaction The number of samples is used as the local density of sample i. The formula is as follows: ; in, As an indicator function, when x < 0, ,otherwise .

[0010] Furthermore, the distance to the peak value described in S213 The determination method is as follows: For each sample i: if there exists a sample with a local density greater than i, then Let i be the value with the smallest distance from i among these samples; if i is the sample with the largest local density, then... Take the maximum value of the Euclidean distance from all samples to i.

[0011] Furthermore, the selection of cluster center samples from the decision graph described in S214 is as follows: The local density of each sample is used as the horizontal axis and the distance from the peak is used as the vertical axis to draw a decision graph. Samples that satisfy both high local density and large distance from the peak are selected as cluster centers. Specifically, based on the prior knowledge of the campus network scenario, cluster center samples that are significantly more prominent than other points in the decision graph are selected.

[0012] Furthermore, the deviation between the multimodal fusion features described in step three and the baseline model is calculated using the following method: Let the multimodal feature vector in step one be denoted as... via VAE encoder Convert to latent vector Using the formula calculate Compared with baseline model Mahalanobis distance.

[0013] Furthermore, the root cause reasoning based on causal discovery described in step four is as follows: S41. Causal graph construction: For the current scenario, a constraint-based causal discovery algorithm is used to learn causal relationships on a multimodal fusion dataset; S42. Root Cause Inference: When a network entity is detected to have triggered an abnormal warning state or has experienced a fault, the Bayesian inference algorithm is used to locate the root cause. The multimodal feature vectors corresponding to the abnormal warning state or fault are used as observation evidence and substituted into the causal graph. The posterior probability of each node is updated using the Bayesian theorem. Finally, several nodes with the highest posterior probability are selected as candidate root causes and arranged in descending order of probability.

[0014] Furthermore, the specific calculation process for the monitoring signal mentioned in step five is as follows: By using weighted calculations, the fault triggering frequency, propagation delay, and index synchronization are transformed into continuous values ​​in the 0-1 range, which serve as supervision signals for training the graph attention network, denoted as... The calculation formula is as follows: ; in, Indicates the fault trigger frequency; Indicates the propagation delay; Indicates the synchronicity of indicators; This represents the weighting coefficient.

[0015] Compared with the prior art, the present invention has the following beneficial effects: 1. Multi-scenario baselines improve the accuracy of anomaly early warning: Density peak clustering is used to divide the campus network into 19 operating scenarios (including peak teaching hours, high bandwidth for scientific research, etc.). For each network entity in different scenarios, a dedicated normal behavior baseline is trained through VAE. The deviation between the fused features and the baseline is calculated in real time by combining Mahalanobis distance, which effectively avoids the problem of poor adaptability of a single baseline, reduces the false alarm and false negative rate of anomaly identification, and provides a reliable basis for early judgment of fault prediction. 2. Improved Operation and Maintenance Efficiency through Causal Reasoning and Explainable Localization: A scenario-based causal graph is constructed using PC algorithms, and Bayesian inference is used to select the candidate root cause with the highest posterior probability. Fault triggering frequency, propagation delay, and indicator synchronization are introduced as supervisory signals. GAT is used to learn node attention weights, and the LLaMA-2 large model is combined to generate a natural language report containing fault location and propagation path. This not only achieves accurate root cause localization but also enables operation and maintenance personnel to quickly understand the fault logic, shortening the handling cycle. Attached Figure Description

[0016] Figure 1 The flowchart shows a method for real-time prediction and localization of network faults based on multimodal data fusion. Figure 2 This is a flowchart of the scene division in step two of the present invention; Figure 3 This is a flowchart illustrating the fault location method for enhancing attention and interpretability in this invention. Detailed Implementation

[0017] Example, refer to Figure 1 The real-time network fault prediction and localization method based on multimodal data fusion in this embodiment specifically includes the following steps: Step 1: Multimodal data acquisition and fusion.

[0018] S11. Collect multi-source data: Performance metrics data: Collect metrics such as CPU utilization, memory utilization, port traffic, packet loss rate, and latency of network devices (switches, APs, servers) via Simple Network Management Protocol (SNMP). The collection frequency is set to 10-30 seconds / time (performance metrics change rapidly, and high-frequency capture of fluctuations is required to support fault prediction). Traffic data: Collect information such as source IP address, destination IP address, protocol type, traffic size, number of packets, and session duration of traffic using NetFlow or sFlow technology. The collection frequency is set to 1-5 minutes / time (the total amount of traffic data is large, and minute-level trends can meet the analysis needs, balancing storage and computing costs). System log data: Operation logs (including device startup, configuration changes, error codes, alarm levels, etc.) are collected from network devices and business servers via the Syslog protocol. The collection frequency is set to real-time reception (system logs are event-based data, and real-time reception can avoid missing early signs of failure). User authentication data: Collect information such as user authentication request time, authentication result (success or failure), access device MAC address, and access VLAN from RADIUS or LDAP authentication server. The collection frequency is set to real-time reception (user authentication anomalies are a direct manifestation of network failures and the related root causes need to be captured in real time). Business interaction data: Access logs are collected from business systems such as teaching platforms, scientific research systems, and office systems, including access time, request interfaces, response time, error status codes, etc. The collection frequency is set to 1-3 seconds / time (business interaction performance is related to user experience, and second-level collection can promptly detect the impact of network failures). S12. Spatiotemporal alignment and fusion processing: Time dimension alignment: Time synchronization of each data source is performed with uniform timestamp precision (millisecond level), missing data is filled with linear interpolation, and outliers (such as indicators that exceed the physical threshold of the device) are filtered using the 3σ rule. Spatial dimension association: Based on the network topology configuration file, including the physical connection relationship of devices, VLAN and IP segment mapping, business system deployment address, user access location and device correspondence, a unique association mapping between each data source and network entity is established. Network entities include device ports, links, business instances, and user groups. Feature fusion encoding: Numerical data (such as CPU utilization and latency) is processed using Min-Max normalization and converted into values ​​in the range [0,1]; textual data (such as log content and error code descriptions) is embedded using Word2Vec or BERT models to generate 128-dimensional text feature vectors; structured data (such as authentication results and business response status) is processed using one-hot encoding or label encoding; finally, all features are concatenated into a multimodal fusion feature vector of a unified dimension to form a multimodal fusion dataset.

[0019] Step 2: Constructing multi-scenario behavior baselines.

[0020] S21. Scene Division: Density Peak Clustering (DPC) is used to perform unsupervised clustering on historical multimodal fusion datasets, automatically classifying network operation scenarios based on data distribution characteristics, such as... Figure 2 As shown, the specific process is as follows: S211. Data preparation: The input is a historical multimodal fusion dataset, where each data sample is a multimodal fusion feature vector, recording the network operation scenario of each data sample, and the dataset must contain at least one year of continuous operation data to cover various operation states within the typical cycle of the campus network; S212, Calculate local density For each sample i in the dataset (corresponding to a multimodal fusion feature vector at a certain time): Distance metric selection: Euclidean distance is used to calculate the feature vector distance between sample i and other samples j. The formula is: ; Where n1 is the dimension of the multimodal fusion feature vector; Let i and j be the values ​​of the k-th feature, respectively. Truncating kernel functions to calculate local density: setting a distance threshold (The value is taken as the top 2% quantile of the Euclidean distance for all samples, ensuring that each sample has a sufficient number of neighbors to reflect local density), statistically satisfying The number of samples is used as the local density of sample i. The formula is as follows: ; in, As an indicator function, when x < 0, ,otherwise ; S213, Calculate the distance from the peak value. For each sample i: if there exists a sample with a local density greater than i, then Let i be the value with the smallest distance from i among these samples; if i is the sample with the largest local density, then... Take the maximum Euclidean distance from all samples to i; S214. Constructing a decision graph and selecting cluster centers: Plot the horizontal axis of each sample... and vertical axis Plotted in the decision graph. Cluster centers must satisfy local density. Higher and the distance from the peak Given the relatively large number of cluster centers, and combining prior knowledge of the campus network scenario, we select K cluster center samples that are significantly more prominent than other points in the decision graph (using the built-in automatic cluster center selection algorithm of the Python library density-peak-clustering). In this embodiment, K=19, and the cluster center samples correspond to various operating scenarios of the campus network: core teaching scenarios (peak class times, exam support scenarios, online teaching scenarios, evening self-study time scenarios), research-specific scenarios (high bandwidth research laboratory scenarios, academic conference live streaming scenarios), office and management scenarios (faculty and staff office scenarios, peak administrative system scenarios, logistics support scenarios), life service scenarios (dormitory nighttime use scenarios, library intensive use scenarios, canteen dining scenarios), special time period scenarios (new student enrollment certification scenarios, graduation season business scenarios, low load scenarios during winter and summer vacations, statutory holidays on campus scenarios), and activities and maintenance scenarios (large-scale cultural and sports activities scenarios, network maintenance window scenarios, equipment upgrade transition scenarios). S215. Assign cluster labels: For each cluster center c, assign the corresponding cluster label to the cluster center sample based on the network operation scenario recorded in the cluster center sample data; for each non-cluster center sample i, find... Among all samples, the sample c that is closest to i is assigned the cluster label to sample i; finally, all samples are divided into K clusters, each cluster corresponding to a campus network operation scenario label.

[0021] S22, Baseline Model Training: For each network entity (such as a port on a core switch or an AP group in a teaching building), a behavioral baseline model is trained using a variational autoencoder (VAE) under each scenario label: VAE model structure: The input layer is a multimodal fusion feature vector. The encoder compresses the input into a low-dimensional latent vector through a 2-layer fully connected network (in this embodiment, a 64-dimensional latent vector is selected based on the input dimension), and learns the mean and variance parameters of the latent vector. The decoder restores the latent vector into a reconstructed vector with the same dimension as the input through a 2-layer fully connected network. Training objective: The loss function is to minimize the reconstruction error and KL divergence (constraining the latent vector distribution to approximate a standard normal distribution). In this embodiment, the mean squared error (MSE) is used to minimize the reconstruction error. Iterative training is performed using the Adam optimizer until the loss function converges. In this embodiment, the convergence condition is that the change in loss over 20 consecutive iterations is less than 1%. ; Baseline Output: After training, the baseline behavior of each network entity in the corresponding scenario is denoted as the normal behavior probability distribution model, which is the normal distribution parameters that the latent vectors follow, as follows: The normal behavior of network entities is represented by low-dimensional latent vectors obtained by mapping their multimodal fusion feature vectors through a VAE encoder. Characterized by the probability distribution: ; in, Represents a multivariate normal distribution. The mean vector of the latent vectors. The covariance matrix of the latent vectors; latent vectors The dimension is determined by the VAE model structure. In this embodiment, it is set to 64 dimensions, denoted as d=64. Therefore, the distribution is a d-dimensional multivariate normal distribution. Mean vector Specific definition: mean vector Given a d-dimensional column vector, its m-th element... , This indicates that, in the current scenario, when network entities are operating normally, the latent vectors... The statistical mean of the m-th feature; covariance matrix Specific definition: covariance matrix It is a d×d order symmetric positive definite matrix, whose elements are divided into two categories: diagonal elements Representing implicit vectors The variance of the m-th dimension feature reflects the range of fluctuation of that dimension feature during normal operation; off-diagonal elements Representing implicit vectors The covariance between the m-th and l-th features, i.e. This reflects the degree of linear correlation between these two dimensions during normal operation, with positive correlation indicating positive, negative correlation indicating negative, and no correlation indicating 0; among them, The covariance is calculated using the following formula: ; Where 'a' represents the sample number; This represents the total number of normal samples; This represents the m-th feature of the a-th sample; This represents the l-th feature of the a-th sample; and Representing implicit vectors respectively The statistical mean of the m-th and l-th dimensions of the feature; S23, Baseline Dynamic Update: Regular updates: Set a fixed time window and use incremental training to add newly collected multimodal fusion data to the training set to update the parameters of the baseline model and avoid baseline deviation caused by outdated historical data; Triggered Updates: Deploy a scenario change detection module to monitor network topology changes (such as new device access, link adjustment), business system iterations (such as business version updates, new business launches), user scale changes (such as a surge in user volume during the new student enrollment season), and other events in real time. When a change event is detected, the scenario is automatically re-divided and the corresponding baseline model is retrained.

[0022] Step 3: Real-time fault prediction based on baseline deviation.

[0023] S31. Real-time data input and deviation calculation: Real-time data processing: The multimodal feature vectors acquired and fused in real time in step one are denoted as... t is a timestamp, and the input is the baseline model of the behavior of the corresponding network entity in the current scenario; Deviation calculation: via VAE encoder Convert to latent vector ,calculate Compared with baseline model The Mahalanobis distance is calculated using the following formula: ; Mahalanobis distance reflects the degree of deviation of current behavior from the normal baseline; the greater the distance, the higher the risk of abnormality. S32. Deviance from Threshold Detection and Fault Prediction: Threshold setting: Based on historical fault data, the fault warning threshold of Mahalanobis distance is determined using ROC curve analysis, denoted as . It is usually set to The corresponding distance values ​​ensure that the deviation of normal behavioral data is mostly below [a certain value]. ; Real-time prediction trigger: If the deviation of 3 consecutive timestamps All greater than The network entity is determined to be in an abnormal warning state, triggering the fault prediction process; Predictive model inference: The multimodal feature vector sequence of the network entity over the past 10 time steps (with a time step interval of 1 minute, i.e., covering a duration of nearly 10 minutes). Input time series prediction model; LSTM model structure: Input is shape The tensor of, where, This represents the batch size during the training phase; in this embodiment, it is set to 64. The dimension of the multimodal fusion feature vector is given; the model contains one LSTM unit with a hidden state dimension of 128; the LSTM layer is followed by two fully connected layers. The first fully connected layer has an output dimension of 64, and the second layer has two branches: Fault probability branch: Through the sigmoid activation function, a 1-dimensional vector is output, representing the probability of fault occurrence, with a value range of [0,1]. Fault type branch: Output through the softmax activation function. dimensional vector, Given the number of known fault types, such as port congestion, link interruption, service anomaly, and no fault, a 4-dimensional probability distribution vector is output. Predictive model training: The LSTM model is trained in a supervised manner using historical data on the correlation between "abnormal warning state and failure occurrence" (including labels such as failure type, actual occurrence time, and scope of impact). The loss function is a joint loss function of binary cross-entropy (for the failure occurrence probability branch) and classification cross-entropy (for the failure type branch). After training, the model outputs the probability distribution vectors of failure occurrence probability and failure type. The associated data is selected from the historical records of the campus network operation, showing pairs of data that first showed an abnormal warning state and subsequently actually experienced a failure. Prediction output: If the model outputs a failure occurrence probability ≥ Then, the category with the highest probability value in the fault type probability distribution vector is selected as the predicted fault type, and a fault prediction report is generated—including the network entity of the predicted fault, the predicted occurrence time (prediction interval: the next 10-30 minutes), the fault type, and the confidence level. The threshold representing the probability of a fault occurring, in this embodiment The predicted time interval is obtained by analyzing the training data of the time prediction model. First, the time difference between the abnormal warning trigger time and the actual fault occurrence time is calculated. Then, the label is statistically analyzed to determine the typical time range for a fault to develop from a warning state to an actual fault in a campus network scenario. Step 4: Root cause reasoning based on causal discovery.

[0024] S41. Cause-effect graph construction: For the current scenario, a constraint-based causal discovery algorithm (such as PC algorithm) is used to learn causal relationships on a multimodal fusion dataset: Input data: Select multimodal feature vectors of other network entities (such as upstream and downstream devices, dependent services, and access users) that are associated with the network entity in the abnormal warning state; Causal relationship learning: The PC algorithm is used to identify the conditional independence between variables, eliminate spurious associations, and output a scenario-based causal graph. In the graph, nodes are network entities, directed edges represent the causal relationship from cause to effect, and edge weights represent the influence strength (0-1 range). The calculation process for the intensity of the influence is as follows: Vector-level conditional independence test: For any two multimodal eigenvectors, given a conditional vector set Z, Hotelling's T² test is used; First, calculate the vector-level correlation statistic of the two multimodal vectors under condition Z ( value), The larger the value, the stronger the conditional dependence between the two vectors (unconditional independence). Secondly, if If the p-value corresponding to the value is ≤0.05 (significance level), it is determined that there is a causal relationship between X and Y, and the causal edge is retained; if the p-value is >0.05, the condition is determined to be independent, and the edge is removed; the p-value is the core indicator used to determine whether the observation result is caused by random factors. This embodiment adopts the industry-standard judgment standard p=0.05. Statistical standardization and weight mapping: For the retained causal edges, collect all edge values. The value is normalized using Min-Max. The values ​​are mapped to the 0-1 range; the normalized values ​​are the edge weights, and the closer the value is to 1, the stronger the causal influence of the cause vector on the result vector. S42. Root Cause Reasoning: When a network entity is detected to have triggered an abnormal warning state or has experienced a failure, a Bayesian inference algorithm is used for root cause localization. Evidence input: The multimodal feature vectors corresponding to abnormal warning states or faults are used as observation evidence and substituted into the causal graph; Probability Update: The posterior probability of each node is updated using Bayes' theorem, which represents the likelihood that the node is the root cause of the failure. The specific formula is as follows: ; Where R is the root cause node; E is the observed evidence; P(R) is the prior probability of the root cause node, which is set based on the historical failure frequency, specifically the proportion of the number of times a certain type of failure occurs in the historical failure data to the total number of failures; P(E|R) is the conditional probability that the root cause node leads to the occurrence of the evidence. Root cause output: Select the top 3 nodes with the highest posterior probability as candidate root causes, and sort them in descending order of probability.

[0025] Step 5: Fault localization with graph attention and enhanced interpretability.

[0026] The process of fault localization with enhanced attention and interpretability, such as... Figure 3 As shown, the specific steps are as follows: S51, Graph Attention Network Processing: The causal graph is converted into graph-structured data—node features are multimodal fusion feature vectors of the corresponding network entities, and edge features are the causal influence strength; this graph-structured data is then input into a graph attention network (GAT): GAT Model Training: Using the correlation strength between candidate root cause nodes and faulty nodes as the supervision signal, the GAT model is trained to learn the attention weights between nodes. The attention weight reflects the contribution of a node to fault propagation; the higher the weight, the more critical the node's role in the fault propagation chain. The calculation method of the supervision signal is as follows: By using weighted calculations, the fault triggering frequency, propagation delay, and index synchronization are transformed into continuous values ​​in the 0-1 range, which serve as supervision signals for training the GAT model, denoted as... The calculation formula is as follows: ; in, This represents the fault trigger frequency, which is the number of times the paired Q has triggered a fault in historical cases divided by the total number of faults at the fault node. Indicates the propagation delay. The maximum propagation delay threshold is determined by extracting propagation delay data of root cause nodes and fault nodes from the historical fault case database, grouping them into 19 types of campus network scenarios, and initially setting the threshold using the 95th percentile. It is then verified by operation and maintenance and dynamically updated in conjunction with events such as network topology changes. It indicates the synchronicity of indicators, and its value is the Pearson correlation coefficient between the core abnormal indicators of the root cause node and the fault node; The weight coefficients are determined by the analytic hierarchy process (AHP), as shown in this embodiment. ; Weight output: The model outputs a sequence of attention weights from each candidate root cause node to the faulty node; S52, Interpretable Generation: The attention weight sequence from the GAT output is extracted, combined with key metrics from multimodal fusion data, and concatenated into a pre-trained large model for text input to generate an interpretable report in natural language. The report includes the specific location of the root cause node, the failure propagation path, the types and scope of affected services, and a comparison of key anomaly indicators. The pre-trained large model adopts Meta's LLaMA-2 7B parameter model, with a model architecture of 32 Transformer layers, 12 attention heads, 4096 hidden layer dimensions, and a vocabulary size of 32000. S53. Positioning result output: By integrating the numerical attention weights of GAT, the natural language interpretation reports of large models, and the raw metrics from multimodal data, a fault localization result package is formed, which includes: Numerical layer: posterior probability of candidate root cause nodes, attention weights, and outliers of key indicators; Text layer: Natural language interpretable reports; Graphical layer: A network topology diagram annotating fault propagation paths; The results package is pushed to the operation and maintenance management platform, enabling operation and maintenance personnel to view and quickly handle them visually.

[0027] Through the detailed description of the above embodiments, the network fault real-time prediction and localization method based on multimodal data fusion of the present invention provides a rich and comprehensive feature foundation for fault analysis by comprehensively collecting multi-source network data and completing spatiotemporal alignment and feature fusion. Then, relying on density peak clustering and VAE, a network entity behavior baseline adapted to multiple scenarios of the campus network is constructed to ensure the scenario adaptability of anomaly identification. Subsequently, Mahalanobis distance and LSTM models are combined to achieve early prediction of fault occurrence probability and type. Candidate root causes are identified through PC algorithms and Bayesian inference, and finally, interpretable localization is achieved with the help of GAT and a pre-trained large model. This method is fully adaptable to the multi-service and multi-scenario characteristics of campus networks, effectively improving the accuracy of fault prediction and the clarity of fault localization, and providing strong technical support for efficient operation and maintenance of campus networks.

[0028] The above formulas are all dimensionless calculations, and the preset parameters in the formulas should be set by those skilled in the art according to the actual situation.

[0029] The above embodiments can be implemented, in whole or in part, by software, hardware, firmware, or any other combination thereof. When implemented using software, the above embodiments can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more sets of available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium. A semiconductor medium can be a solid-state drive.

[0030] It should be understood that in the various embodiments of this application, the order of the above-mentioned processes does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0031] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0032] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0033] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0034] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0035] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for real-time prediction and localization of network faults based on multimodal data fusion, characterized in that, The method flow is as follows: Step 1: Multimodal Data Acquisition and Fusion: Collect multi-source network data and perform spatiotemporal alignment and feature fusion encoding to form a multimodal fusion dataset composed of multimodal fusion feature vectors; Step 2: Construction of multi-scenario behavior baselines: Clustering algorithms are used to divide the network operation scenarios. For each network entity in each scenario, a normal behavior baseline model is trained using an autoencoder. Step 3: Real-time fault prediction based on baseline deviation: Based on the calculated multimodal fusion features and the deviation of the baseline model, the abnormal warning status of network entities is identified, and the fault occurrence probability and fault type are output by combining the time series prediction model. Step 4: Fault Root Cause Inference Based on Causal Discovery: Construct a scenario-based causal graph using a causal discovery algorithm, and determine candidate root causes of network faults through posterior probability inference; Step 5: Fault localization with graph attention and enhanced interpretability: Using the correlation strength between candidate root cause nodes and fault nodes as the supervision signal, the graph attention network is used to learn node attention weights, and combined with the pre-trained large model to generate an interpretable report, outputting the fault localization result package.

2. The method for real-time prediction and localization of network faults based on multimodal data fusion according to claim 1, characterized in that, Step two, which describes the division of network operation scenarios, specifically includes the following process: S211. Record the network operation scenario for each data sample in the historical multimodal fusion dataset, where each data sample is a multimodal fusion feature vector; S212. Calculate the local density of each sample; S213. Calculate the distance of each sample from the peak value; S214. Draw a decision map for each sample with respect to local density and distance peak, and select cluster center samples from the decision map; S215. Label each sample around the selected cluster center sample, with each label corresponding to a specific network operation scenario.

3. The method for real-time prediction and localization of network faults based on multimodal data fusion according to claim 1, characterized in that, The baseline model described in step two is as follows: The baseline model is characterized as a probability distribution model of the normal behavior of network entities. ,in, The mean vector of the latent vectors. The covariance matrix of the latent vectors; the latent vectors are obtained by mapping the multimodal fusion feature vectors through a VAE encoder; The mean vector Given a d-dimensional column vector, its m-th element... , represents the statistical mean of the m-th dimension feature of the latent vector when the network entity is operating normally in the current scenario; The covariance matrix is ​​a d×d symmetric positive definite matrix, whose diagonal elements The off-diagonal elements represent the variance of the m-th feature of the latent vector. Let represent the covariance between the m-th dimension and the l-th dimension of the latent vector.

4. The method for real-time prediction and localization of network faults based on multimodal data fusion according to claim 2, characterized in that, The local density mentioned in S212 is calculated as follows: Distance metric selection: Euclidean distance is used to calculate the feature vector distance between sample i and other samples j. The formula is: ； Where n1 is the dimension of the multimodal fusion feature vector; Let i and j be the values ​​of the k-th feature, respectively. Truncating kernel functions to calculate local density: setting a distance threshold Statistical satisfaction The number of samples is used as the local density of sample i. The formula is as follows: ； in, As an indicator function, when x < 0, ,otherwise .

5. The method for real-time prediction and localization of network faults based on multimodal data fusion according to claim 2, characterized in that, The distance to the peak distance described in S213 The determination method is as follows: For each sample i: if there exists a sample with a local density greater than i, then Let i be the value with the smallest distance from i among these samples; if i is the sample with the largest local density, then... Take the maximum value of the Euclidean distance from all samples to i.

6. The method for real-time prediction and localization of network faults based on multimodal data fusion according to claim 2, characterized in that, The selection of cluster center samples from the decision graph as described in S214 is as follows: The local density of each sample is used as the horizontal axis and the distance from the peak is used as the vertical axis to draw a decision graph. Samples that satisfy both high local density and large distance from the peak are selected as cluster centers. Specifically, based on the prior knowledge of the campus network scenario, cluster center samples that are significantly more prominent than other points in the decision graph are selected.

7. The method for real-time prediction and localization of network faults based on multimodal data fusion according to claim 1, characterized in that, The deviation between the multimodal fusion features and the baseline model described in step three is calculated using the following method: Let the multimodal fusion feature vector from step one be denoted as... via VAE encoder Convert to latent vector Using the formula calculate Compared with baseline model Mahalanobis distance.

8. The method for real-time prediction and localization of network faults based on multimodal data fusion according to claim 1, characterized in that, Step four, the root cause reasoning based on causal discovery, is as follows: S41. Causal graph construction: For the current scenario, a constraint-based causal discovery algorithm is used to learn causal relationships on a multimodal fusion dataset; S42. Root Cause Inference: When a network entity is detected to have triggered an abnormal warning state or has experienced a fault, the Bayesian inference algorithm is used to locate the root cause. The multimodal fusion feature vector corresponding to the abnormal warning state or fault is used as observation evidence and substituted into the causal graph. The posterior probability of each node is updated using the Bayesian theorem. Finally, several nodes with the highest posterior probability are selected as candidate root causes and arranged in descending order of probability.

9. The method for real-time prediction and localization of network faults based on multimodal data fusion according to claim 1, characterized in that, The specific calculation process for the monitoring signal mentioned in step five is as follows: By using weighted calculations, the fault triggering frequency, propagation delay, and index synchronization are transformed into continuous values ​​in the 0-1 range, which serve as supervision signals for training the graph attention network, denoted as... The calculation formula is as follows: ； in, Indicates the fault trigger frequency; Indicates the propagation delay; Indicates the synchronicity of indicators; This represents the weighting coefficient.

Images