Network topology-based machine room fault node identification method and system

Abstract

The application relates to the technical field of network operation and communication monitoring, and discloses a computer room fault node identification method and system based on a network topology, which comprises the following steps: acquiring real-time network topology data and link transmission indexes, constructing a weighted directed graph and an evolution sequence; projecting the historical data in time sequence according to the sequence to obtain a node state vector; calculating a deviation value, extracting a deviation feature and searching for a potential abnormal area if the deviation value is out of limit; obtaining a leading index through clustering and grouping, evaluating the propagation influence, and determining a priority sequence; locating an initial fault source, tracking a congestion link, mapping a business influence range through a logical address, extracting a link security risk feature, calculating a correction coefficient, adjusting an abnormal threshold value, and evaluating a positioning difficulty level; finally, searching for similar cases to generate a repair instruction, feeding back model parameters, and obtaining an optimized stable configuration. The method can realize accurate identification and closed-loop optimization of computer room faults.

Description

Technical Field

[0001] This invention relates to the field of network operation and maintenance and communication monitoring technology, and in particular to a method and system for identifying faulty nodes in a computer room based on network topology. Background Technology

[0002] Currently, in the field of modern information technology, network data centers, as the core hub connecting various devices and services, are directly related to the business continuity and data security of enterprises. With the deepening of digital transformation, data center network structures are becoming increasingly complex and dynamically evolving. Quickly and accurately identifying faulty nodes has become an indispensable key link in fault prediction and health management systems. Accurate fault location can not only significantly shorten business interruption time, but also, by capturing subtle shifts in network structure, transform passive response into proactive defense in the face of sudden problems, thereby ensuring the efficient operation of large-scale data centers.

[0003] In existing technologies, a traditional approach based on preset rules or simple metrics is typically employed. This involves real-time collection of operational status data from devices such as switches via gateways or monitoring software, comparing this data to fixed thresholds. When specific metrics (such as traffic or packet loss rate) exceed preset limits, alarms are triggered. Maintenance personnel then verify the physical status of relevant links and devices one by one based on the alarm information and manual investigation to pinpoint the source of the fault. However, because traditional methods rely heavily on static rules, they fail to adequately consider the dynamic adjustments in the connections between network nodes and the cascading effects of anomaly propagation. Especially when a critical device failure triggers a cascading performance degradation across multiple nodes, it is difficult to effectively capture deep-seated anomaly patterns hidden within the structural evolution trajectory, often leading to misjudgments or missed diagnoses.

[0004] In summary, existing technologies suffer from low accuracy in identifying fault nodes in dynamic environments and poor troubleshooting efficiency. Summary of the Invention

[0005] This invention provides a method and system for identifying faulty nodes in a data center based on network topology, in order to solve the problems of low accuracy and poor troubleshooting efficiency in identifying faulty nodes in dynamic environments.

[0006] Firstly, to address the aforementioned technical problems, this invention provides a method for identifying faulty nodes in a data center based on network topology, comprising:

[0007] Real-time network topology data and link transmission indicators are acquired, and a weighted directed graph is constructed using the network topology data and the link transmission indicators. The network structure evolution sequence is obtained by extracting time-series features based on the weighted directed graph.

[0008] Historical pattern data is extracted from the network structure evolution sequence and subjected to temporal spatial projection to obtain node state vectors;

[0009] The deviation value is obtained by calculating the Euclidean distance between the node state vector and the preset historical mean. If the deviation value exceeds the preset deviation threshold, the deviation feature is extracted based on the node state vector, and the potential abnormal region is obtained by local subgraph search based on the deviation feature.

[0010] The potential abnormal regions are clustered into groups to obtain the dominant index of the group, and the propagation impact is assessed based on the dominant index of the group to obtain the fault identification priority sequence.

[0011] The initial fault source is located based on the fault identification priority sequence, and the path simulation and tracing of the initial fault source is used to obtain the marked congested link. The service entity is matched based on the marked congested link to obtain the service bearer entity, and the risk quantification assessment of the service bearer entity is performed to obtain the service continuous impact range.

[0012] Extract the link security risk characteristics within the continuous influence range of the business, calculate the correction coefficient based on the link security risk characteristics, use the correction coefficient to perform anomaly threshold correction to obtain the corrected anomaly threshold, and perform a quantitative evaluation of positioning fuzziness based on the corrected anomaly threshold to obtain the final positioning difficulty level.

[0013] Based on the final location difficulty level, a comprehensive decision on the repair plan is made to obtain a repair instruction. The repair instruction is executed and parameters are adjusted to obtain an optimized stable network configuration.

[0014] Secondly, the present invention provides a data center fault node identification system based on network topology, comprising:

[0015] The topology evolution monitoring module is used to acquire real-time network topology data and link transmission indicators, construct a weighted directed graph using the network topology data and the link transmission indicators, and extract the network structure evolution sequence based on the time-series features of the weighted directed graph.

[0016] The temporal state quantization module is used to extract historical pattern data from the network structure evolution sequence and perform temporal spatial projection to obtain node state vectors.

[0017] The abnormal pattern identification module is used to calculate the Euclidean distance between the node state vector and the preset historical mean to obtain the deviation value. If the deviation value exceeds the preset deviation threshold, the deviation features are extracted based on the node state vector, and the potential abnormal region is obtained by local subgraph search based on the deviation features.

[0018] The priority assessment module is used to perform node clustering and grouping of the potential abnormal regions to obtain the group dominant index, and to perform propagation impact assessment based on the group dominant index to obtain a fault identification priority sequence.

[0019] The business impact assessment module is used to locate the initial fault source according to the fault identification priority sequence, perform path simulation and tracing on the initial fault source to obtain the marked congested link, perform business entity matching on the marked congested link to obtain the business bearer entity, and perform risk quantification assessment on the business bearer entity to obtain the scope of continuous business impact.

[0020] The threshold dynamic correction module is used to extract the link security risk characteristics within the continuous influence range of the service, calculate the correction coefficient based on the link security risk characteristics, use the correction coefficient to perform abnormal threshold correction to obtain the corrected abnormal threshold, and perform a quantitative evaluation of positioning fuzziness based on the corrected abnormal threshold to obtain the final positioning difficulty level.

[0021] The closed-loop repair and optimization module is used to make a comprehensive decision on the repair scheme based on the final location difficulty level, obtain a repair instruction, execute the repair instruction and adjust the parameters to obtain an optimized stable network configuration.

[0022] Compared with the prior art, the present invention has the following beneficial effects:

[0023] (1) This invention constructs a weighted directed graph by collecting real-time network topology data, and uses graph embedding processing to generate graph feature vectors that quantify the network state. The structural difference between these vectors and the vectors from the previous time step is calculated to determine the final network structure evolution sequence. This method can transform the originally abstract network connection relationship into a continuously traceable dynamic evolution trajectory, effectively capturing the hidden deep structural mutation points in network operation. This overcomes the limitations of traditional methods that rely on a single indicator or static rules, and achieves rapid fault perception in a dynamic environment, improving the accuracy and response speed of fault node identification in the computer room.

[0024] (2) This invention uses a time-series embedding algorithm to process historical data to obtain node vector representations, and uses an anomaly pattern analysis module to extract offset components with deviations exceeding a threshold, mapping them back to the network topology space to delineate potential node anomaly areas. This method can transform high-dimensional discrete data such as traffic and latency into intuitive topology anomaly descriptions, clearly depicting the root causes of business difficulties such as local hotspot aggregation or uneven link load, thereby achieving accurate locking from global dynamic features to local anomaly sources, avoiding the inefficient operation of maintenance personnel checking massive alarms one by one, and significantly shortening the time for fault location.

[0025] (3) This invention determines the priority of fault identification through clustering algorithms, simulates data flow using path tracing methods to define the scope of impact on business continuity, and extracts similar cases from historical databases based on the final location difficulty level to determine the node anomaly repair sequence. This method can scientifically schedule operation and maintenance resources based on the impact of fault propagation and the cost of repair, and continuously update system parameters using a feedback loop mechanism, thereby enabling the system to continuously adapt to the latest state of the data center network, quickly repair current faults while iteratively optimizing network configuration, and enhancing the system's stability and business continuity assurance capabilities. Attached Figure Description

[0026] Figure 1 This is a schematic diagram of the method for identifying faulty nodes in a computer room based on network topology provided in the first embodiment of the present invention;

[0027] Figure 2 This is a schematic diagram of the structure of a computer room fault node identification system based on network topology provided in the second embodiment of the present invention. Detailed Implementation

[0028] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0029] Reference Figure 1 The first embodiment of the present invention provides a method for identifying faulty nodes in a data center based on network topology, including the following steps:

[0030] S11, acquire real-time network topology data and link transmission indicators, construct a weighted directed graph using the network topology data and the link transmission indicators, and extract time-series features based on the weighted directed graph to obtain the network structure evolution sequence;

[0031] S12, extract historical pattern data from the network structure evolution sequence and perform temporal spatial projection to obtain node state vectors;

[0032] S13, calculate the Euclidean distance between the node state vector and the preset historical mean to obtain the deviation value. If the deviation value exceeds the preset deviation threshold, extract the deviation features based on the node state vector, and perform local subgraph search based on the deviation features to obtain potential abnormal regions.

[0033] S14, perform node clustering and grouping of the potential abnormal regions to obtain group dominant indicators, and conduct propagation impact assessment based on the group dominant indicators to obtain a fault identification priority sequence.

[0034] S15, the initial fault source is located according to the fault identification priority sequence, and the path simulation and tracing of the initial fault source is performed to obtain the marked congested link. The service entity is matched according to the marked congested link to obtain the service bearer entity, and the risk quantification assessment of the service bearer entity is performed to obtain the service continuous impact range.

[0035] S16, extract the link security risk characteristics within the continuous influence range of the service, calculate the correction coefficient based on the link security risk characteristics, use the correction coefficient to perform anomaly threshold correction to obtain the corrected anomaly threshold, and perform a quantitative evaluation of positioning fuzziness based on the corrected anomaly threshold to obtain the final positioning difficulty level.

[0036] S17, based on the final location difficulty level, a comprehensive decision is made on the repair plan to obtain a repair instruction, the repair instruction is executed and parameter feedback is adjusted to obtain an optimized stable network configuration.

[0037] In step S11, real-time network topology data and link transmission indicators are acquired, a weighted directed graph is constructed using the network topology data and the link transmission indicators, and a network structure evolution sequence is obtained by extracting time-series features based on the weighted directed graph.

[0038] Specifically, a weighted directed graph is constructed using the network topology data and the link transmission indicators. A network structure evolution sequence is obtained by extracting time-series features from the weighted directed graph, including:

[0039] The network topology data is parsed to obtain physical connection relationships. An adjacency matrix is ​​constructed based on the physical connection relationships to obtain an adjacency matrix that reflects the physical connection relationships.

[0040] The link transmission metrics are weighted and fused to obtain the comprehensive link weight, and the adjacency matrix is ​​assigned a value based on the comprehensive link weight to obtain a weighted directed graph.

[0041] The Deep Walk algorithm is used to perform graph embedding processing on the weighted directed graph to obtain graph feature vectors;

[0042] Obtain the feature vector of the historical graph, calculate the Euclidean distance between the feature vector of the graph and the feature vector of the historical graph, and mark the mutation points according to the Euclidean distance to obtain the network structure evolution sequence.

[0043] First, real-time network topology data and link transmission metrics are acquired. Real-time network topology data refers to the raw packet set reflecting the physical connection status between equipment in the data center, specifically including topological features such as source MAC addresses, destination MAC addresses, and Virtual LAN (VLAN) tags. Link transmission metrics are dynamic performance parameters that quantify link communication quality, specifically including transmission latency values ​​characterizing communication efficiency and link load values ​​characterizing bandwidth utilization. These data and metrics together constitute the initial input features for subsequently constructing the weighted directed graph.

[0044] In one implementation, packet parsing is performed on the network topology data to extract the source unique identifier, destination unique identifier, and virtual LAN label. Then, an adjacency matrix is ​​constructed: the entire set of nodes in the current network is obtained, and a square matrix with the number of rows and columns equal to the total number of nodes is constructed based on the size of the entire node set. If the parsed physical connection relationship shows that there is a direct physical link between node A and node B, the element at the intersection of the row corresponding to node A and the column corresponding to node B in the square matrix is ​​marked as one; otherwise, it is marked as zero, thus obtaining an adjacency matrix reflecting the physical connection relationship.

[0045] Subsequently, the transmission delay and link load values ​​of the links corresponding to the adjacency matrix are extracted as link transmission indicators. The transmission delay and link load values ​​are obtained in real time through network sniffing devices or traffic monitoring probes deployed at network nodes. Specifically, the system captures real-time traffic packets forwarded by switch ports, parses preset field information in the packet header, and calculates the round-trip time (RTT) of the data packet from the source to the destination to obtain the transmission delay value. Simultaneously, by querying the port counters in the switch management information base (MIB) or using Simple Network Management Protocol (SNMP) polling, the system obtains the number of inbound and outbound traffic bytes per preset unit of time for each port in real time, and calculates the link load value in conjunction with the link's rated bandwidth.

[0046] Before calculating the overall link weight, the link transmission metrics need to be standardized. Specifically, the maximum and minimum latency of all links in the network within a preset period are obtained, and the real-time latency values ​​are mapped to a first dimensionless value between zero and one using a deviation standardization method. Similarly, the link load percentage is mapped to a second dimensionless value between zero and one. Then, the first dimensionless value is multiplied by a first weight parameter, and the second dimensionless value is multiplied by a second weight parameter; the sum is defined as the overall link weight. The overall link weight is obtained by weighted fusion of the transmission latency value and the link load value. Specifically, the transmission latency value is multiplied by a preset first weight parameter to obtain a first product, and the link load value is multiplied by a preset second weight parameter to obtain a second product. The sum of the first and second products is used as the overall link weight.

[0047] It should be noted that the preset first and second weight parameters are determined based on network performance sensitivity analysis. The analytic hierarchy process (AHP) is used to compare the weights of latency and load in network evaluation pairwise, constructing a judgment matrix and calculating the eigenvector corresponding to the largest eigenvalue. After normalizing the eigenvector, the parameter values ​​are obtained. In this embodiment, for data center environments with high real-time requirements, the first weight parameter is typically set to 0.6 and the second weight parameter to 0.4 to highlight the impact of latency on structural offset. Next, matrix assignment is performed: all elements in the adjacency matrix with a value of one are traversed, and the corresponding link in the physical topology is located based on the element's row and column index. The link's comprehensive weight is obtained, and the elements in the adjacency matrix that were originally one are replaced with their corresponding comprehensive link weights, resulting in a weighted directed graph.

[0048] In one implementation, the DeepWalk algorithm is used to embed the weighted directed graph into graph feature vectors. Specifically, a predetermined number of random walks are performed on each node in the weighted directed graph to generate a node sequence. The predetermined number of walks typically ranges from sixty to one hundred per node, determined based on the required traversal coverage of the graph. Node visit distribution is observed through simulation experiments, and the minimum number of loops that stabilizes the variance of node visit frequency is selected. The node sequence is then input into a jump language model for vectorization mapping.

[0049] It should be noted that the Skip-gram model is trained on-site based on the specific topology of the current data center network. Because the identifiers of data center network nodes (such as specifically coded device IDs) differ from the vocabulary in a general corpus, the system uses the node sequences generated by random walks as the training sample set. A single-layer neural network is used to learn the co-occurrence relationships of nodes in the sequence in real time under unsupervised conditions. Through backpropagation, the weights of the hidden layers are iteratively adjusted to map nodes with similar neighborhood structures to similar vector spaces, ensuring that the generated graph feature vectors accurately capture the private topology and traffic distribution patterns of the current network environment. Essentially, it is a neural network-based word vector construction model used to learn the co-occurrence relationships of elements in a sequence under unsupervised conditions. The specific mapping process involves using a sliding window to sample the node sequence to obtain pairs of center and background nodes. A single-layer neural network maximizes the conditional probability of predicting background nodes based on the center node, thus projecting the high-dimensional sparse node features into a low-dimensional dense vector space, ultimately outputting a fixed-dimensional graph feature vector.

[0050] Subsequently, the historical graph feature vector (generally the graph feature vector from the previous time step) stored in the cache unit is obtained as the historical reference vector. The Euclidean distance between the graph feature vector and the historical reference vector is calculated. The calculation method can refer to existing technologies, and will not be elaborated here. This yields the structural difference value. The structural difference value is then processed to mark abrupt change points. If the structural difference value exceeds a preset structural evolution threshold (typically 0.25), the current time step is marked as a structural abrupt change point; otherwise, it is marked as a stable operating point. This determines the final network structure evolution sequence.

[0051] It should be noted that the structural evolution threshold is set based on the statistical distribution of historical normal fluctuation data. The general setting method is to collect the structural difference values ​​of the data center network over seven consecutive working days, calculate the arithmetic mean of the set of values, and add three times the standard deviation as the threshold benchmark. Those skilled in the art can fine-tune it within the range of 0.2 to 0.35 according to the jitter frequency of the specific network to balance the monitoring sensitivity and false alarm rate.

[0052] In step S12, historical pattern data is extracted from the network structure evolution sequence and subjected to temporal spatial projection to obtain node state vectors, including:

[0053] The network structure evolution sequence is divided into a sliding window to obtain a set of continuous topology snapshots;

[0054] The adjacency relationship weight change values ​​at adjacent times are extracted from the continuous topological snapshot set to obtain historical pattern data;

[0055] The historical pattern data is input into a pre-trained long short-term memory network model for temporal embedding processing to obtain node state vectors.

[0056] In one implementation, the network topology states at multiple discrete time points included in the network structure evolution sequence are first obtained, and the network structure evolution sequence is segmented by a sliding window to obtain a continuous set of topology snapshots. Specifically, a sliding window of fixed duration is set, for example, the window length is set to thirty seconds, and the network topology states are sliced ​​according to the chronological order, so that each slice corresponds to a topology snapshot, thereby forming a continuous set of topology snapshots that completely records the topology evolution trajectory.

[0057] Subsequently, adjacency relationship weight changes at adjacent time points are extracted from the continuous topology snapshot set to obtain historical pattern data. Specifically, the weight values ​​of the same links in two adjacent topology snapshots are obtained, and the combined link weight at the later time point is subtracted from the combined link weight at the previous time point to obtain the difference. This difference is defined as the adjacency relationship weight change value. By accumulating the change values ​​of all links in each time slice, historical pattern data reflecting traffic migration or link status fluctuations is constructed.

[0058] Subsequently, historical pattern data is input into a pre-trained Long Short-Term Memory (LSTM) network model for temporal embedding processing to obtain node state vectors. It should be noted that the LSTM network model is essentially a recurrent neural network with a gating mechanism, capable of learning long-term dependencies in sequential data through forget gates, input gates, and output gates.

[0059] The training process of the Long Short-Term Memory (LSTM) network model involves collecting data on the normal operation patterns of the data center network over the past three months as a basic sample set. After normalization, the sample set is divided into a training set and a validation set. A stochastic gradient descent algorithm is used as the optimizer, with mean squared error as the loss function. The weight matrix and bias vector within the model are continuously adjusted through backpropagation until the model's loss on the validation set is lower than a preset convergence threshold. Regarding parameter selection, the number of hidden layer nodes is typically set between 64 and 256, based on a balance between network node size and feature dimensions. A common method is to select the optimal value for model generalization through cross-validation. In this embodiment, for a data center network with 500 nodes, the number of hidden layer nodes is preferably set to 128, and the learning rate is set to 0.001.

[0060] In practice, this model receives a fixed-length historical pattern data sequence as input and outputs a dense feature vector of the corresponding dimension for subsequent anomaly calculation. It uses high-dimensional and sparse historical pattern data as input, and leverages the nonlinear transformation of hidden layers to project the changing features of nodes into a low-dimensional dense feature space. Internal states are used to record the dynamic cumulative effect of node states over time, thereby generating a node state vector for each node within the current time window, which quantifies the dynamic changes in the network structure over time.

[0061] It is worth noting that the step size and length of the sliding window need to be set according to the sampling frequency of the data center network. By collecting the heartbeat message interval of the data center network under normal operating conditions, the length of the sliding window is set to three to five times the duration of the heartbeat message interval. In this embodiment, it is preferable to set the window length to 30 seconds and the window step size to 10 seconds to balance the real-time performance of the calculation and the smoothness of the feature.

[0062] In step S13, the Euclidean distance between the node state vector and the preset historical mean is calculated to obtain the deviation value. If the deviation value exceeds the preset deviation threshold, deviation features are extracted based on the node state vector, and a local subgraph search is performed based on the deviation features to obtain potential abnormal regions.

[0063] If the deviation value exceeds a preset deviation threshold, deviation features are extracted based on the node state vector, and a local subgraph search is performed based on the deviation features to obtain potential abnormal regions, including:

[0064] If the deviation value exceeds the preset deviation threshold, then the principal component analysis method is used to decompose the node state vector into dimensions to obtain the deviation features.

[0065] The deviation features are mapped to the weighted directed graph to obtain an anomaly pattern description;

[0066] According to the anomaly pattern description, a matching process is performed on the weighted directed graph to meet the preset search radius condition, thereby obtaining anomaly substructures, and the range covered by the anomaly substructures is determined as a potential anomaly region containing node state vectors.

[0067] In one implementation, the historical mean vector, pre-stored in a time-series database, is first obtained. This historical mean vector is the arithmetic mean of the state vectors of each node in the data center network under normal and stable operating conditions within a preset historical period. It should be noted that the acquisition and updating of the time-series database involves real-time monitoring of network status via a data acquisition interface, and the average normal state vector calculated each morning is written into the database. The database employs a sliding window update strategy, removing the furthest set of historical data every fixed period (e.g., 24 hours) and storing the latest normal state sample. The historical mean vector is updated in real-time by calculating the arithmetic mean of all samples within the window, ensuring the timeliness of the baseline data.

[0068] The Euclidean distance between the node state vector obtained at the current moment and the historical mean vector is calculated. The calculation method of the Euclidean distance can refer to existing technology, and will not be elaborated here. The calculated result is defined as the deviation value. Then, the deviation value is compared with a preset deviation threshold. If the deviation value does not exceed the preset deviation threshold, it is determined that the current node state is within the normal fluctuation range. The system stores the current observation data as a normal sample point in the database for subsequent historical mean updates, without triggering any alarm or repair actions, and continues to execute the real-time monitoring of the next cycle. If the deviation value exceeds the preset deviation threshold, it is determined that the current network node has an abnormal state tendency. In the case of determining that there is an abnormal tendency, the principal component analysis method is used to perform dimensional decomposition processing on the node state vector to obtain a set of offset components as deviation features. Specifically, the node state vector is first centered, that is, the empirical mean of the currently observed node state vector set is calculated, and the empirical mean is subtracted from each original node state vector. The resulting difference vector is the centered node state vector. This operation eliminates the influence of the coordinate origin offset on principal component extraction.

[0069] It should be noted that the deviation threshold is set based on the probability modeling of the historical deviation value distribution. By collecting the deviation value sequence of the data center network under historical normal conditions, the probability distribution curve of the sequence is fitted with a Gaussian distribution, and the deviation value with a cumulative probability of 99% is selected as the deviation threshold.

[0070] Subsequently, the corresponding covariance matrix is ​​constructed and eigenvalue decomposition is performed. The eigenvectors corresponding to the three principal components with the largest eigenvalues ​​are extracted. The original node state vectors are projected onto the subspace formed by these eigenvectors to obtain the projection vectors. Next, the reconstruction residual values ​​for each dimension are calculated. This involves reconstructing the state vectors by performing an inverse transformation using the projection vectors and the corresponding eigenvectors. The vector difference between the original node state vectors and the reconstructed state vectors is then calculated, along with the absolute or squared value of this difference in each dimension. The calculated result is defined as the reconstruction residual value. A larger reconstruction residual value indicates that more original information in that dimension was lost during dimensionality reduction, meaning that fluctuations in that dimension cannot be explained by the normal principal components, thus defining it as a deviation feature.

[0071] Finally, the deviation features are mapped to the current structural graph (i.e., the original weighted directed graph). Specifically, the system uses the extracted offset components as the core elements and retrieves a set of nodes and links in the current topology snapshot that meet the preset search radius condition; the search radius refers to the logical hop count (usually set to 2-3 hops) spreading outward from the node associated with the offset component. By matching continuous link segments within the radius where the adjacency weight changes in the same direction and the change magnitude exceeds a preset proportion (e.g., 30%), highly correlated abnormal substructures are identified. Subsequently, all topology nodes and interconnecting links covered by this abnormal substructure are collectively defined as potential abnormal regions, thereby achieving a physical correspondence from abstract vector offset to specific topology space.

[0072] In step S14, the potential anomaly regions are clustered into groups to obtain group dominant indicators, and the propagation impact is assessed based on the group dominant indicators to obtain a fault identification priority sequence, including:

[0073] A feature similarity matrix is ​​constructed based on the node state vectors within the potential anomaly region, and the feature similarity matrix is ​​input into a preset density clustering model for grouping, resulting in anomaly feature cluster groups containing topological adjacency density;

[0074] Calculate the variance contribution rate of each indicator within the abnormal feature cluster group, and filter the indicators based on the variance contribution rate to obtain the dominant indicators of the group containing numerical intensity.

[0075] The fault propagation impact value is obtained by weighted summation of the numerical intensity of the dominant index of the group and the topological adjacency density of the abnormal feature cluster group.

[0076] Based on the fault propagation impact value, the abnormal feature clusters are grouped in descending order to obtain a fault identification priority sequence containing the abnormal feature clusters.

[0077] In one implementation, the node state vectors of each node within the potential anomaly region are first extracted. A feature similarity matrix is ​​then calculated by performing feature correlation calculation on the potential anomaly region. This involves calculating the Pearson correlation coefficient between the node state vectors of any two nodes within the region. The Pearson correlation coefficient is used as a measure of the behavioral similarity between nodes, and a symmetric second-order matrix, the feature similarity matrix, is constructed based on this. Subsequently, the feature similarity matrix is ​​input into a preset density clustering model for grouping. The density clustering model is preferably a density-based spatial clustering model with noise applications, namely the DBSCAN model. Its technical essence is to automatically discover clusters of arbitrary shapes based on the density of sample distribution. Specifically, it involves setting a neighborhood radius and a minimum number of core point samples, identifying the set of nodes that meet the density reachability condition, obtaining anomaly feature cluster groups, and statistically analyzing the connection density of each anomaly feature cluster group in the physical topology, defined as the topological adjacency density.

[0078] It should be noted that the neighborhood radius and minimum sample number in the density clustering model are preset based on the physical distribution of server racks and the size of logical subnets in the data center. Typically, the average number of ports occupied by switches in the rack under normal conditions is collected and used as the benchmark reference value for the minimum sample number. In this embodiment, the neighborhood radius is preferably set to 0.5 and the minimum sample number is set to 3.

[0079] Subsequently, the variance contribution rate of each feature indicator within each anomalous feature cluster group is calculated. The variance contribution rate is calculated by dividing the variance of a single indicator by the sum of the variances of all indicators within the group. Based on the variance contribution rate, a significant indicator extraction operation is performed: the variance contribution rates are arranged from high to low, and the top few indicators with a cumulative contribution rate exceeding a preset contribution threshold (e.g., 80%) are selected as the dominant indicators for the group. The quantified values ​​of these indicators are then extracted as numerical intensity. Numerical intensity refers to the absolute degree or relative change of the dominant transmission indicator from the historical baseline. Specifically, if the dominant indicator is traffic, the numerical intensity corresponds to the absolute value of the difference between the current traffic value and the historical mean; if the dominant indicator is latency, the numerical intensity is expressed as the standard deviation of latency fluctuation. This intensity value characterizes the destructive power of the anomalous feature cluster in a specific dimension. The higher the value, the more severe the impact of the indicator on the normal logic of the network, and it is a key weighting factor for subsequent calculations of the impact of fault propagation.

[0080] The propagation impact is quantified by measuring the numerical strength of the dominant index of the group and the topological adjacency density of the anomalous feature cluster group, resulting in a fault propagation impact value. Specifically, the numerical strength is multiplied by a preset third weight parameter to obtain a third product, and the topological adjacency density is multiplied by a preset fourth weight parameter to obtain a fourth product. The sum of the third and fourth products is defined as the fault propagation impact value, which reflects the possibility that the feature cluster will trigger a chain reaction in the network. The setting of the third and fourth weight parameters is based on the source analysis of historical fault propagation paths. Typically, in core business areas, to emphasize the supporting role of the topology in fault propagation, the fourth weight parameter is preferably set to 0.7, while the third weight parameter is set to 0.3.

[0081] Finally, the abnormal feature clusters are sorted in descending order according to the fault propagation impact value to obtain a fault identification priority sequence containing the abnormal feature clusters.

[0082] It is worth noting that the feature similarity matrix is ​​not limited to the Pearson correlation coefficient. In practical applications, those skilled in the art will understand that cosine similarity or cosine distance can also be used to replace the above calculation method to adapt to feature association analysis under different scales, which does not depart from the core idea of ​​this invention. Furthermore, for outlier nodes that are not classified into any anomalous feature cluster, the system marks them as isolated occasional perturbations and assigns them the lowest priority in the priority sequence, thereby ensuring that identification resources are concentrated on group faults with propagation potential.

[0083] In step S15, the initial fault source is located according to the fault identification priority sequence, and path simulation tracing is performed on the initial fault source to obtain marked congested links. Service entities are matched based on the marked congested links to obtain service bearer entities, and risk quantification assessment is performed on the service bearer entities to obtain the scope of continuous service impact, including:

[0084] The highest priority abnormal feature cluster in the fault identification priority sequence is mapped to physical coordinates to obtain physical coordinates, and the node corresponding to the physical coordinates is determined as the initial fault source.

[0085] Dynamic path tracing is performed on the initial fault source to obtain marked congested links;

[0086] Extract the virtual local area network (VLAN) identifier from the marked congested link, and retrieve the service bearer entity containing redundant status that matches the VLAN identifier from the pre-established service configuration library;

[0087] The cumulative downtime probability is obtained by performing fault probability aggregation calculation on the redundant status of the service carrying entity. If the cumulative downtime probability exceeds the preset service risk threshold, the scope of continuous impact on the service is determined.

[0088] In one implementation, the fault identification priority sequence is first obtained, and the highest-priority anomaly feature cluster is extracted from the sequence. This anomaly feature cluster is then processed using physical coordinate mapping to obtain its physical coordinates. Specifically, the system accesses a pre-defined physical asset management database for data center equipment in real time via a data interface to obtain the rack number, slot number, and port number corresponding to each node in the anomaly feature cluster. It should be noted that the physical asset management database for data center equipment uses a data interface provided by the Data Center Asset Management System (ITAM). Its internal data sources include barcode scanning and entry when equipment is put into storage, as well as runtime automatic discovery protocols (such as the LLDP protocol). The update mechanism combines periodic synchronization with event-driven methods, performing a full asset synchronization every 24 hours and triggering incremental updates in real time based on equipment online / offline alarms to ensure the accuracy of asset locations.

[0089] Subsequently, the acquired asset location information is mapped onto the 3D topology model of the data center. It should be noted that the 3D topology model of the data center is a digital twin entity that integrates physical spatial coordinates with logical topological relationships. Its construction process involves first establishing the physical 3D framework of the data center using Building Information Modeling (BIM) technology, including the spatial layout of server racks, cable trays, and power distribution facilities; then, obtaining the logical connection relationships between devices according to a network topology discovery protocol, and using a coordinate transformation algorithm to project logical nodes onto their corresponding 3D physical coordinate points, thereby forming a topology network with geographical location attributes. Those skilled in the art will understand that this model does not require pre-training but is dynamically rendered based on physical measurement data and asset database data. Specifically, the physical coordinate mapping is implemented by first obtaining the geometric center coordinates of the server racks in the data center BIM model, and then performing Laplace eigenmaps on the logically connected topology graph using the least squares method to minimize the Euclidean distance between logically adjacent nodes in the physical coordinate system, thereby generating the real-time spatial coordinates of the nodes in the virtual digital twin environment.

[0090] The spatial center coordinates of the abnormal feature clusters are calculated based on the above model, and the physical node corresponding to these physical coordinates is determined as the initial fault source. Next, dynamic path tracing is performed on the initial fault source to obtain marked congested links. Specifically, the initial fault source is used as the starting point for traffic injection. A preset discrete event simulation engine is used to simulate the packet broadcasting and forwarding process under fault conditions. The buffer occupancy rate between adjacent nodes is monitored in real time. If the buffer occupancy rate of the link between adjacent nodes continuously exceeds a preset saturation ratio (e.g., 80%) within the simulation duration, the link is marked as a marked congested link.

[0091] The virtual local area network (VLAN) identifier is extracted from the congested link, and a service bearer entity matching search is performed in a pre-established service configuration database to obtain service bearer entities with redundant states that match the VLAN identifier. The cumulative downtime probability is obtained by aggregating the failure probabilities of the redundant states of the service bearer entities. Specifically, the calculation logic involves obtaining the individual failure probabilities of all redundant nodes in the service bearer entity, and multiplying these individual failure probabilities together to define the cumulative downtime probability.

[0092] The single failure probability is calculated as follows: The combined link weights of all outgoing links of the node are extracted from the weighted directed graph, and the arithmetic mean of these combined link weights is calculated as the node's real-time load factor. The node state deviation value obtained in step S13 is extracted. The node state deviation value is multiplied by a preset attenuation coefficient α, the result is negative, and then substituted into the exponent of the natural exponential function to calculate the node health score. The preset attenuation coefficient α can be calibrated based on historical failure data, with a value range of 0.1 to 0.5. Subsequently, a preset average equipment failure interval time is obtained, and the normalization upper and lower limits are determined based on historical statistics of similar equipment. This is then converted into a baseline failure probability in the [0,1] interval using min-max normalization. Finally, the node's real-time load factor, node health score, and baseline failure probability are weighted and summed to obtain the single failure probability. For example, when a node's load remains high and its state vector deviates significantly from the historical average, its single failure probability will increase accordingly, thus truly reflecting the possibility of individual failures in a redundant architecture.

[0093] It should be noted that the weight combination used for the weighted summation here is based on regression analysis of historical fault data. Specifically, the real-time load factor, health score, and baseline fault probability of nodes in each fault event are extracted from the historical fault database as independent variable features, and whether a node actually failed is used as the dependent variable label to construct a multiple linear regression model. The historical samples are fitted using the least squares method to obtain the regression coefficients corresponding to each feature. These regression coefficients are normalized so that their sum is 1, thus obtaining the weight combination used for the weighted summation. This weight combination can be periodically retrained and updated based on newly accumulated fault data to maintain its timeliness and accuracy.

[0094] If the cumulative downtime probability exceeds a preset business risk threshold, the service is deemed to face a substantial interruption risk, and all related nodes and links belonging to the service are defined as the scope of continuous business impact. If the cumulative downtime probability does not exceed the business risk threshold, the current redundancy mechanism is deemed to effectively cover the risk. In this case, although the system does not trigger a business interruption alarm, it will automatically trigger a "shadow monitoring mode," which temporarily reduces the monitoring frequency of the service-bearing entity from thirty seconds to five seconds and continuously collects performance indicators for three rounds for verification. If the deviation does not increase after three rounds, the original frequency is restored and potential risk markers are cleared.

[0095] It should be noted that the preset business risk thresholds are set based on the requirements of the business level agreement. Specifically, different probability thresholds are set for different levels of business: for core financial transaction businesses, the availability requirement is usually 99.999%, and the corresponding business risk threshold is set to an extremely low value (such as 0.0001), that is, a response is triggered once the cumulative downtime probability exceeds one in ten thousand; for ordinary internal office businesses, the availability requirement is 99.9%, and the threshold can be relaxed to 0.001. Those skilled in the art can adjust this value based on actual business security needs.

[0096] In step S16, link security risk features within the continuous impact range of the service are extracted, correction coefficients are calculated based on the link security risk features, anomaly threshold correction is performed using the correction coefficients to obtain a corrected anomaly threshold, and a quantitative evaluation of positioning fuzziness is performed based on the corrected anomaly threshold to obtain the final positioning difficulty level, including:

[0097] Obtain the link security risk characteristics within the continuous impact range of the aforementioned service;

[0098] The abnormal fluctuation amplitude is calculated based on the link security risk characteristics, and the abnormal fluctuation amplitude is fitted by least squares curve fitting to obtain the deviation cumulative distribution model.

[0099] Based on the link encryption level matching the link security risk characteristics, a corresponding protection coefficient is obtained, and the protection coefficient is mapped to the deviation cumulative distribution model to obtain a threshold correction coefficient.

[0100] The original node anomaly threshold is proportionally adjusted according to the threshold correction coefficient to obtain the corrected node anomaly threshold, and the ambiguity is calculated based on the corrected node anomaly threshold to obtain the final positioning difficulty level.

[0101] In one implementation, historical communication logs and security policy configurations within the continuous impact range of the service are first obtained, and link security risk characteristics, including secure link topology attributes and link encryption levels, are extracted from them. Based on these link security risk characteristics, abnormal fluctuation amplitudes are calculated. The standard deviation of packet loss rate and the skewness values ​​of protocol response delay for each link within a preset time period are extracted. The standard deviation of packet loss rate is multiplied by a preset fifth weight parameter to obtain a fifth product, and the skewness value of protocol response delay is multiplied by a preset sixth weight parameter to obtain a sixth product. The sum of the fifth and sixth products is defined as the abnormal fluctuation amplitude that quantifies the uncertainty of link operation.

[0102] It should be noted that the preset fifth and sixth weight parameters are set based on the contribution of network service quality indicators to link stability. The general setting method is to use subjective evaluation combined with historical fault correlation analysis to proportionally allocate the degree of interference of packet loss rate and delay skew to fault identification. In this embodiment, the fifth weight parameter is preferably set to 0.7 and the sixth weight parameter is set to 0.3.

[0103] Using the abnormal fluctuation amplitude as the input variable, a curve fitting process is performed using the least squares method to obtain a cumulative deviation distribution model. First, a system of linear equations relating observation time and fluctuation amplitude is constructed, where the fitted value at each observation time equals the slope parameter multiplied by the time value at that observation time, plus the intercept parameter. Here, the slope parameter represents the rate of risk growth over time, and the intercept parameter represents the background noise in the initial environment. Then, the slope parameter and intercept parameter are determined by minimizing the sum of squared errors between the observed and fitted values. Specifically, the actual abnormal fluctuation amplitude collected at each observation time is subtracted from the corresponding fitted value to obtain the difference. The square of this difference is calculated to obtain the single-point squared error. The single-point squared errors at all observation times are summed to obtain the sum of squared errors. By taking the partial derivatives of the sum of squared errors with respect to the slope parameter and the intercept parameter respectively, and setting the derivatives to zero, the parameters obtained are the optimal parameters that minimize the sum of errors, thus forming a cumulative deviation distribution model that reflects the trend of risk accumulation over time.

[0104] Subsequently, a corresponding protection coefficient is matched based on the link encryption level in the link security risk characteristics. In one implementation, the system matches the protection coefficient according to a preset level correspondence table. The preset level correspondence table records the mapping relationship between the security strength of different encryption algorithms and the detection transparency. Its setting is based on national commercial cryptographic algorithm standards and data center security guidelines, quantifying the degree to which encrypted messages hinder deep packet inspection technology by evaluating their effectiveness. Typically, the protection coefficient for regular unencrypted traffic is set to a baseline value of one, and the protection coefficient is proportionally reduced as the number of encryption bits increases. In this embodiment, the level correspondence table specifically shows that the protection coefficient for a high encryption level (e.g., using 256-bit encryption) is 0.75, the protection coefficient for a medium encryption level (e.g., using 128-bit encryption) is 0.9, and the protection coefficient for a low encryption level (e.g., using 64-bit encryption or plaintext) is 1.1.

[0105] A threshold correction coefficient is obtained by mapping the protection coefficient to the cumulative deviation distribution model. The original node anomaly threshold is then proportionally adjusted based on this threshold correction coefficient to obtain a corrected node anomaly threshold. Finally, ambiguity calculation is performed based on the corrected node anomaly threshold to obtain the final positioning difficulty level. Ambiguity calculation refers to calculating the absolute deviation between the corrected node anomaly threshold and a preset global standard threshold. The ratio of this absolute deviation to the global standard threshold is defined as the positioning ambiguity index. It should be noted that the preset global standard threshold is a reference benchmark determined based on the average fault tolerance range of all nodes in the network. A common setting method is to collect the average of the maximum deviation values ​​of all nodes in the network that have not triggered fault alarms in the past year. In this embodiment, a typical value for the global standard threshold is 0.9. The system determines the level based on the magnitude of the positioning ambiguity index. If the ratio is greater than a preset difficulty cutoff point (e.g., 0.5), it is determined to be a high difficulty level; otherwise, it is determined to be a low difficulty level.

[0106] It should be noted that the preset difficulty threshold is set based on the statistical distribution of historical manual troubleshooting time in the data center. The system analyzes historical maintenance records, defining cases with troubleshooting time exceeding 4 hours and involving network architecture correlation analysis at layers 3 or higher as high-difficulty, and calculates the average ambiguity index corresponding to these cases as the threshold benchmark. In typical scenarios, the difficulty threshold is set between 0.5 and 0.6 to distinguish between simple faults requiring only single-node verification and complex faults requiring cross-tunnel and cross-protocol stack collaborative analysis. It is worth noting that for potential division-by-zero risks during calculation, such as when the global standard threshold is zero, the system automatically replaces the global standard threshold with a preset minimum non-zero positive number (e.g., 0.0001) to ensure the stability of the calculation logic.

[0107] In step S17, a comprehensive decision on the repair plan is made based on the final location difficulty level to obtain a repair instruction. The repair instruction is executed and parameter feedback adjustments are made to obtain an optimized stable network configuration, including:

[0108] Based on the final location difficulty level, similar cases are matched in a pre-established historical database to obtain similar anomaly pattern cases and corresponding repair time weights.

[0109] The optimal operation logic is obtained by quantifying and predicting the execution cost based on the repair time weight, and the optimal operation logic is then converted into a repair instruction.

[0110] Execute the repair instruction and obtain real-time performance indicators, and calculate the feedback deviation value between the real-time performance indicators and the preset stop-loss target;

[0111] Node weight parameters are extracted from the weighted directed graph, and the node weight parameters are iteratively fine-tuned based on the feedback deviation value to obtain the optimized stable network configuration.

[0112] In one implementation, the final location difficulty level is first obtained, and similar case matching is performed in a pre-established historical database. Specifically, the final location difficulty level is combined with the abnormal pattern description generated in the previous steps as a retrieval index. The historical records with the highest cosine similarity of feature vectors are searched in the historical database, and these historical records are defined as similar abnormal pattern cases. The corresponding repair time weight is extracted from these cases. The repair time weight is a physical quantity that quantifies the execution efficiency of a specific repair action in the current environment. It is the product of the standard time required to complete this type of repair task and the resource consumption intensity. Specifically, the historical average execution time of the instruction in the similar case library is obtained, and an adjustment factor is matched according to the current network load. The higher the load, the larger the corresponding adjustment factor value. The historical average execution time is multiplied by the adjustment factor to obtain the repair time weight. This weight is used to represent the time cost of different repair paths in the repair cost evaluation matrix. The smaller the weight, the faster the solution stops the loss in the current state, thereby helping the system to lock in the optimal operation logic.

[0113] It should be noted that the acquisition and updating of the historical database is achieved through an integrated operation and maintenance log automatic capture module, which stores the handling process, operation steps and actual time consumption of each fault in a structured manner. The database adopts an incremental learning update strategy. After each repair task is completed, the system will automatically package the current anomaly characteristics and handling results into the database. If a highly similar old case is found, its repair time weight will be updated by using the moving average method to ensure the effectiveness of the repair suggestions.

[0114] Subsequently, the execution cost is quantified and predicted based on the repair time weight to obtain the optimal operation logic. First, a preset set of candidate operation logics is obtained, including operations such as port restart, switching to a backup link, service migration, and configuration rollback. The estimated execution cost of each candidate operation logic is calculated by multiplying the basic resource cost of each operation by the repair time weight. By comparing the execution cost values ​​of each operation, the operation with the smallest value is selected as the optimal operation logic, and the optimal operation logic is converted into a repair instruction that can be directly executed by the network device. The repair instruction is executed, and real-time performance indicators are obtained using traffic monitoring probes deployed on the switch port. The real-time performance indicators include the real-time throughput and real-time retransmission rate after repair. The feedback deviation value between the real-time performance indicators and the preset stop-loss target is calculated. Specifically, the target throughput in the stop-loss target is subtracted from the real-time throughput to obtain the first deviation value, and the real-time retransmission rate is subtracted from the target retransmission rate in the stop-loss target to obtain the second deviation value. The first and second deviation values ​​are normalized, and the square root of the sum of squares is obtained to obtain the feedback deviation value.

[0115] Finally, node weight parameters for quantifying node connection strength are extracted from the weighted directed graph. These parameters are then iteratively fine-tuned based on the feedback deviation value to obtain an optimized stable network configuration. Specifically, the feedback deviation value is multiplied by a preset iteration step size to obtain the adjustment increment. If the feedback deviation value is positive, the original node weight parameters are subtracted from the adjustment increment; if the feedback deviation value is negative, the original node weight parameters are added to the adjustment increment. By updating the node weight parameters, the system can adapt to changes in the current network environment during subsequent topology processing. It should be noted that the preset stop-loss target is determined based on the data center service continuity standard. A common setting method is to select the lowest acceptable performance limit for this type of service under normal load. The typical range of the iteration step size is 0.01 to 0.05, and its setting is based on the balance between system convergence speed and stability.

[0116] It is worth noting that the aforementioned feedback adjustment mechanism constructs a logical closed loop from fault handling effectiveness to front-end monitoring. Those skilled in the art will understand that the iterative fine-tuning process aims to correct deviations caused by network aging or environmental changes; in one possible implementation, if the feedback deviation value after multiple consecutive iterations still exceeds the restart threshold, the system will trigger a global retraining process. This invention not only solves the current fault identification problem but also ensures the long-term stability of the network configuration through feedback optimization, which does not depart from the core idea of ​​this invention. For the weight formulas involved in the calculation process, those skilled in the art can refer to existing gradient descent or reinforcement learning parameter update protocols for specific implementation.

[0117] In summary, this invention captures network structure evolution characteristics through graph embedding and time-series algorithms, defines fault priorities and business impact ranges by combining path tracing and cluster analysis, and optimizes repair paths and adaptively updates models by utilizing historical case matching and feedback mechanisms. This enables intelligent operation and maintenance of data center network faults from accurate perception and in-depth tracing to closed-loop repair.

[0118] Reference Figure 2 The second embodiment of the present invention provides a data center fault node identification system based on network topology, comprising:

[0119] The topology evolution monitoring module is used to acquire real-time network topology data and link transmission indicators, construct a weighted directed graph using the network topology data and the link transmission indicators, and extract the network structure evolution sequence based on the time-series features of the weighted directed graph.

[0120] The temporal state quantization module is used to extract historical pattern data from the network structure evolution sequence and perform temporal spatial projection to obtain node state vectors.

[0121] The abnormal pattern identification module is used to calculate the Euclidean distance between the node state vector and the preset historical mean to obtain the deviation value. If the deviation value exceeds the preset deviation threshold, the deviation features are extracted based on the node state vector, and the potential abnormal region is obtained by local subgraph search based on the deviation features.

[0122] The priority assessment module is used to perform node clustering and grouping of the potential abnormal regions to obtain the group dominant index, and to perform propagation impact assessment based on the group dominant index to obtain a fault identification priority sequence.

[0123] The business impact assessment module is used to locate the initial fault source according to the fault identification priority sequence, perform path simulation and tracing on the initial fault source to obtain the marked congested link, perform business entity matching on the marked congested link to obtain the business bearer entity, and perform risk quantification assessment on the business bearer entity to obtain the scope of continuous business impact.

[0124] The threshold dynamic correction module is used to extract the link security risk characteristics within the continuous influence range of the service, calculate the correction coefficient based on the link security risk characteristics, use the correction coefficient to perform abnormal threshold correction to obtain the corrected abnormal threshold, and perform a quantitative evaluation of positioning fuzziness based on the corrected abnormal threshold to obtain the final positioning difficulty level.

[0125] The closed-loop repair and optimization module is used to make a comprehensive decision on the repair scheme based on the final location difficulty level, obtain a repair instruction, execute the repair instruction and adjust the parameters to obtain an optimized stable network configuration.

[0126] It should be noted that the network topology-based computer room fault node identification system provided in this embodiment of the invention is used to execute all the process steps of the network topology-based computer room fault node identification method in the above embodiment. The working principles and beneficial effects of the two are one-to-one, so they will not be described again.

[0127] It should be noted that the system embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Furthermore, in the accompanying drawings of the system embodiments provided by this invention, the connection relationships between modules indicate that they have communication connections, which can be specifically implemented as one or more communication buses or signal lines. Those skilled in the art can understand and implement this without any creative effort.

[0128] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above descriptions are merely specific embodiments of the present invention and are not intended to limit the scope of protection of the present invention. In particular, it should be noted that any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention for those skilled in the art.

Claims

1. A method for identifying faulty nodes in a data center based on network topology, characterized in that, include: Real-time network topology data and link transmission indicators are acquired, and a weighted directed graph is constructed using the network topology data and the link transmission indicators. The network structure evolution sequence is obtained by extracting time-series features based on the weighted directed graph. Historical pattern data is extracted from the network structure evolution sequence and subjected to temporal spatial projection to obtain node state vectors; The deviation value is obtained by calculating the Euclidean distance between the node state vector and the preset historical mean. If the deviation value exceeds the preset deviation threshold, the deviation feature is extracted based on the node state vector, and the potential abnormal region is obtained by local subgraph search based on the deviation feature. The potential abnormal regions are clustered into groups to obtain the dominant index of the group, and the propagation impact is assessed based on the dominant index of the group to obtain the fault identification priority sequence. The initial fault source is located based on the fault identification priority sequence, and the path simulation and tracing of the initial fault source is used to obtain the marked congested link. The service entity is matched based on the marked congested link to obtain the service bearer entity, and the risk quantification assessment of the service bearer entity is performed to obtain the service continuous impact range. Extract the link security risk characteristics within the continuous influence range of the business, calculate the correction coefficient based on the link security risk characteristics, use the correction coefficient to perform anomaly threshold correction to obtain the corrected anomaly threshold, and perform a quantitative evaluation of positioning fuzziness based on the corrected anomaly threshold to obtain the final positioning difficulty level. Based on the final location difficulty level, a comprehensive decision on the repair plan is made to obtain a repair instruction. The repair instruction is executed and parameters are adjusted to obtain an optimized stable network configuration.

2. The method for identifying faulty nodes in a computer room based on network topology according to claim 1, characterized in that, The process of constructing a weighted directed graph using the network topology data and the link transmission metrics, and extracting time-series features from the weighted directed graph to obtain a network structure evolution sequence, includes: The network topology data is parsed to obtain physical connection relationships. An adjacency matrix is ​​constructed based on the physical connection relationships to obtain an adjacency matrix that reflects the physical connection relationships. The link transmission metrics are weighted and fused to obtain the comprehensive link weight, and the adjacency matrix is ​​assigned a value based on the comprehensive link weight to obtain a weighted directed graph. The Deep Walk algorithm is used to perform graph embedding processing on the weighted directed graph to obtain graph feature vectors; Obtain the feature vector of the historical graph, calculate the Euclidean distance between the feature vector of the graph and the feature vector of the historical graph, and mark the mutation points according to the Euclidean distance to obtain the network structure evolution sequence.

3. The method for identifying faulty nodes in a computer room based on network topology according to claim 1, characterized in that, The step of extracting historical pattern data from the network structure evolution sequence and performing temporal spatial projection to obtain the node state vector includes: The network structure evolution sequence is divided into a sliding window to obtain a set of continuous topology snapshots; The adjacency relationship weight change values ​​at adjacent times are extracted from the continuous topological snapshot set to obtain historical pattern data; The historical pattern data is input into a pre-trained long short-term memory network model for temporal embedding processing to obtain node state vectors.

4. The method for identifying faulty nodes in a computer room based on network topology according to claim 1, characterized in that, If the deviation value exceeds a preset deviation threshold, then deviation features are extracted based on the node state vector, and a local subgraph search is performed based on the deviation features to obtain potential abnormal regions, including: If the deviation value exceeds the preset deviation threshold, then the principal component analysis method is used to decompose the node state vector into dimensions to obtain the deviation features. The deviation features are mapped to the weighted directed graph to obtain an anomaly pattern description; According to the anomaly pattern description, a matching process is performed on the weighted directed graph to meet the preset search radius condition, thereby obtaining anomaly substructures, and the range covered by the anomaly substructures is determined as a potential anomaly region containing node state vectors.

5. The method for identifying faulty nodes in a computer room based on network topology according to claim 1, characterized in that, The process involves clustering nodes in the potential anomaly regions to obtain grouping dominant indices, and then assessing the propagation impact based on these dominant indices to obtain a fault identification priority sequence, including: A feature similarity matrix is ​​constructed based on the node state vectors within the potential anomaly region, and the feature similarity matrix is ​​input into a preset density clustering model for grouping, resulting in anomaly feature cluster groups containing topological adjacency density; Calculate the variance contribution rate of each indicator within the abnormal feature cluster group, and filter the indicators based on the variance contribution rate to obtain the dominant indicators of the group containing numerical intensity. The fault propagation impact value is obtained by weighted summation of the numerical intensity of the dominant index of the group and the topological adjacency density of the abnormal feature cluster group. Based on the fault propagation impact value, the abnormal feature clusters are grouped in descending order to obtain a fault identification priority sequence containing the abnormal feature clusters.

6. The method for identifying faulty nodes in a computer room based on network topology according to claim 1, characterized in that, The process involves locating the initial fault source based on the fault identification priority sequence, tracing the path of the initial fault source to obtain marked congested links, matching service entities based on the marked congested links to obtain service bearer entities, and performing risk quantification assessment on the service bearer entities to obtain the scope of continuous service impact, including: Physical coordinates are obtained by mapping the highest priority abnormal feature cluster in the fault identification priority sequence to physical coordinates, and the node corresponding to the physical coordinates is determined as the initial fault source. Dynamic path tracing is performed on the initial fault source to obtain marked congested links; Extract the virtual local area network (VLAN) identifier from the marked congested link, and retrieve the service bearer entity containing redundant status that matches the VLAN identifier from the pre-established service configuration library; The cumulative downtime probability is obtained by performing fault probability aggregation calculation on the redundant status of the service carrying entity. If the cumulative downtime probability exceeds the preset service risk threshold, the scope of continuous impact on the service is determined.

7. The method for identifying faulty nodes in a computer room based on network topology according to claim 1, characterized in that, The process involves extracting link security risk characteristics within the continuous impact range of the service, calculating correction coefficients based on these characteristics, applying these correction coefficients to perform anomaly threshold correction to obtain a corrected anomaly threshold, and then performing a quantitative evaluation of the positioning fuzziness based on the corrected anomaly threshold to obtain the final positioning difficulty level, including: Obtain the link security risk characteristics within the continuous impact range of the aforementioned service; The abnormal fluctuation amplitude is calculated based on the link security risk characteristics, and the abnormal fluctuation amplitude is fitted by least squares curve fitting to obtain the deviation cumulative distribution model. Based on the link encryption level matching the link security risk characteristics, a corresponding protection coefficient is obtained, and the protection coefficient is mapped to the deviation cumulative distribution model to obtain a threshold correction coefficient. The original node anomaly threshold is proportionally adjusted according to the threshold correction coefficient to obtain the corrected node anomaly threshold, and the ambiguity is calculated based on the corrected node anomaly threshold to obtain the final positioning difficulty level.

8. The method for identifying faulty nodes in a computer room based on network topology according to claim 1, characterized in that, The process of making a comprehensive decision on the repair plan based on the final location difficulty level to obtain a repair instruction, executing the repair instruction and adjusting parameters to obtain an optimized stable network configuration includes: Based on the final location difficulty level, similar cases are matched in a pre-established historical database to obtain similar anomaly pattern cases and corresponding repair time weights. The optimal operation logic is obtained by quantifying and predicting the execution cost based on the repair time weight, and the optimal operation logic is then converted into a repair instruction. Execute the repair instruction and obtain real-time performance indicators, and calculate the feedback deviation value between the real-time performance indicators and the preset stop-loss target; Node weight parameters are extracted from the weighted directed graph, and the node weight parameters are iteratively fine-tuned based on the feedback deviation value to obtain the optimized stable network configuration.

9. The method for identifying faulty nodes in a computer room based on network topology according to claim 7, characterized in that, The link security risk characteristics include secure link topology attributes and link encryption level.

10. A data center fault node identification system based on network topology, characterized in that, include: The topology evolution monitoring module is used to acquire real-time network topology data and link transmission indicators, construct a weighted directed graph using the network topology data and the link transmission indicators, and extract the network structure evolution sequence based on the time-series features of the weighted directed graph. The temporal state quantization module is used to extract historical pattern data from the network structure evolution sequence and perform temporal spatial projection to obtain node state vectors. The abnormal pattern identification module is used to calculate the Euclidean distance between the node state vector and the preset historical mean to obtain the deviation value. If the deviation value exceeds the preset deviation threshold, the deviation features are extracted based on the node state vector, and the potential abnormal region is obtained by local subgraph search based on the deviation features. The priority assessment module is used to perform node clustering and grouping of the potential abnormal regions to obtain the group dominant index, and to perform propagation impact assessment based on the group dominant index to obtain a fault identification priority sequence. The business impact assessment module is used to locate the initial fault source according to the fault identification priority sequence, perform path simulation and tracing on the initial fault source to obtain the marked congested link, perform business entity matching on the marked congested link to obtain the business bearer entity, and perform risk quantification assessment on the business bearer entity to obtain the scope of continuous business impact. The threshold dynamic correction module is used to extract the link security risk characteristics within the continuous influence range of the service, calculate the correction coefficient based on the link security risk characteristics, use the correction coefficient to perform abnormal threshold correction to obtain the corrected abnormal threshold, and perform a quantitative evaluation of positioning fuzziness based on the corrected abnormal threshold to obtain the final positioning difficulty level. The closed-loop repair and optimization module is used to make a comprehensive decision on the repair scheme based on the final location difficulty level, obtain a repair instruction, execute the repair instruction and adjust the parameters to obtain an optimized stable network configuration.

Images