Abnormal link detection method, device and storage medium

Abstract

The embodiment of the present application provides an abnormal link detection method, including: receiving network data of at least one network node in a communication link; obtaining network features corresponding to the network data; inputting the network features into a first model to obtain a detection result of whether the communication link is an abnormal link, wherein the first model is based on the labeled samples, K labeled samples and M unlabeled samples in the first sample set, and the second model obtained in the last training is trained, and the model obtained when the training meets the preset conditions, the K labeled samples are obtained by respectively labeling the K unlabeled samples in the first sample set, and the M unlabeled samples are unlabeled samples selected from the first sample set as negative samples, and the first sample set includes the labeled samples and unlabeled samples pre-stored before selecting the K unlabeled samples and the M unlabeled samples. The embodiment of the present application improves the accuracy of detecting abnormal links.

Description

Technical Field

[0001] The present application relates to the field of artificial intelligence technology, and in particular to an abnormal link detection method, device and storage medium. Background Art

[0002] With the rapid development of telecommunications networks and the growing and diversified needs of users, network communication companies need to handle large-scale communication data and more complex network operation and maintenance. If the anomalies on network equipment cannot be discovered and handled in a timely manner, users will not be able to communicate normally, thus affecting the user experience.

[0003] In practical applications, an abnormal link detection model can be used to detect a communication link to obtain a detection result of whether the communication link is an abnormal link. However, the abnormal link detection model is usually a classifier obtained by training a large number of labeled samples, and each labeled sample is obtained by manual labeling, which requires a lot of manpower, and there are some errors in manual labeling. How to improve the detection accuracy of abnormal links through existing labeled samples is a technical problem to be solved by those skilled in the art. Summary of the invention

[0004] The embodiments of the present application disclose an abnormal link detection method, device and storage medium, which can detect communication links through an abnormal link detection model obtained by training samples selected from unlabeled samples and existing labeled samples, thereby improving the accuracy of detecting abnormal links.

[0005] In the first aspect, the embodiment of the present application discloses an abnormal link detection method, including: receiving network data of at least one network node in a communication link; obtaining network features corresponding to the network data; inputting the network features into a first model to obtain a detection result of the communication link, the detection result is used to indicate whether the communication link is an abnormal link, the first model is based on the labeled samples, K labeled samples and M unlabeled samples in the first sample set, the second model obtained by the last training is trained, and the model obtained when the training meets the preset conditions, the K labeled samples are obtained by respectively labeling the K unlabeled samples in the first sample set, the M unlabeled samples are unlabeled samples selected from the first sample set as negative samples, and the first sample set includes the labeled samples and unlabeled samples pre-stored before selecting the K unlabeled samples and the M unlabeled samples. In this way, after receiving the network data of the network node in the communication link, the network features of the network data are obtained, and then the network features are input into the abnormal link detection model obtained by training the samples selected from the unlabeled samples and the existing labeled samples, so as to detect the communication link, thereby improving the accuracy of detecting abnormal links.

[0006] In a possible example, before inputting the network features into the first model, the method further includes: obtaining an abnormality score value of each unlabeled sample in the first sample set; arranging the abnormality score values ​​of each unlabeled sample in the first sample set in descending order to obtain a first sort; and taking the unlabeled samples corresponding to the first K sequence numbers in the first sort as K unlabeled samples. In other words, the selected samples to be labeled are the most abnormal K unlabeled samples in the first sample set, and the sample set for training the abnormal link detection model includes samples that may be abnormal, which can improve the effect of model training and facilitate improving the accuracy of detecting abnormal links.

[0007] In a possible example, the method further includes: taking the unlabeled samples corresponding to the last L sequence numbers in the first sort as L unlabeled samples; and selecting M unlabeled samples from the L unlabeled samples. In other words, the selected unlabeled samples are M unlabeled samples randomly selected from the most normal L unlabeled samples in the first sample set, and the unlabeled samples are used as negative samples, then the newly added samples in the sample set for training the abnormal link detection model are samples of normal links, which can avoid the introduction of noise, improve the effect of model training, and facilitate improving the accuracy of detecting abnormal links.

[0008] In a possible example, before inputting the network features into the first model, the method further includes: obtaining network topology information of the communication link; and using a set of pre-stored unlabeled samples and labeled samples corresponding to the network topology information as the first sample set. In other words, selecting unlabeled samples and labeled samples corresponding to the network topology information of the communication link as samples to be selected for training can improve the effect of model training and facilitate improving the accuracy of detecting whether a communication link is an abnormal link.

[0009] In the second aspect, the embodiment of the present application discloses a model training method, including: selecting K unlabeled samples from a first sample set; selecting M unlabeled samples as negative samples from the first sample set. The first sample set includes labeled samples and unlabeled samples pre-stored before selecting K unlabeled samples and M unlabeled samples; training the second model obtained in the last training according to the labeled samples, K labeled samples and M unlabeled samples in the first sample set, and obtaining the first model when the training meets the preset conditions, and the K labeled samples are obtained by labeling the K unlabeled samples respectively. In this way, by selecting samples from unlabeled samples, the model can learn the distribution of positive and negative samples in unlabeled samples during the training process. And retraining the model obtained in the last training according to the selected samples and the existing labeled samples can further improve the accuracy of detection.

[0010] In a possible example, selecting K unlabeled samples from the first sample set includes: obtaining an abnormality score value of each unlabeled sample in the first sample set; arranging the abnormality score values ​​of each unlabeled sample in the first sample set in descending order to obtain a first sort; and taking the unlabeled samples corresponding to the first K sequence numbers in the first sort as the K unlabeled samples. In other words, the selected samples to be labeled are the most abnormal K unlabeled samples in the first sample set, and the sample set for training the abnormal link detection model includes samples that may be abnormal, which can improve the effect of model training and facilitate improving the accuracy of detecting abnormal links.

[0011] In a possible example, selecting M unlabeled samples as negative samples from the first sample set includes: taking the unlabeled samples corresponding to the last L numbers in the first sort as L unlabeled samples; and selecting M unlabeled samples from the L unlabeled samples. In other words, the selected unlabeled samples are M unlabeled samples randomly selected from the most normal L unlabeled samples in the first sample set, and the unlabeled samples are used as negative samples, then the newly added samples in the sample set for training the abnormal link detection model are samples of normal links, which can avoid the introduction of noise, improve the effect of model training, and facilitate improving the accuracy of detecting abnormal links.

[0012] In a possible example, selecting M unlabeled samples as negative samples from the first sample set includes: counting the number of positive samples among the labeled samples and K labeled samples in the first sample set; according to the number of positive samples, selecting M unlabeled samples as negative samples from the first sample set, where M is equal to the number of positive samples. That is, the number of negative samples added to the sample set for training the abnormal link detection model is equal to the number of positive samples in the sample set, which can relatively achieve a balance between positive and negative samples, reduce label noise, improve the effect of model training, and facilitate improving the accuracy of detecting abnormal links. In a possible example, before selecting K unlabeled samples from the first sample set, the method also includes: obtaining network topology information of the communication link to be detected; and using a set of unlabeled samples and labeled samples corresponding to the network topology information stored in advance as the first sample set. That is, selecting unlabeled samples and labeled samples corresponding to the network topology information of the communication link as samples to be selected for training can improve the effect of model training and facilitate improving the accuracy of detecting whether the communication link is an abnormal link.

[0013] In combination with the first aspect, the second aspect or any possible example, in a possible example, before obtaining the abnormal score value of each unlabeled sample in the first sample set, the method also includes: obtaining the abnormal score value of each unlabeled sample in the second sample set, the second sample set includes the labeled samples and unlabeled samples pre-stored before selecting P unlabeled samples; arranging in descending order according to the abnormal score value of each unlabeled sample in the second sample set to obtain a second sort; taking the unlabeled samples corresponding to the first P sequence numbers in the second sort as P unlabeled samples; constructing a third model based on the labeled samples and P labeled samples in the second sample set, the P labeled samples are obtained by labeling the P unlabeled samples respectively, and the third model is the initialization model corresponding to the first model and the second model. In this way, the initialization model of the abnormal link detection model is constructed based on the P labeled samples corresponding to the most abnormal P unlabeled samples and the existing labeled samples, which can improve the effect of model training and facilitate the improvement of the accuracy of detecting abnormal links.

[0014] In the third aspect, the embodiment of the present application discloses an abnormal link detection device, including: a communication unit for receiving network data of at least one network node in the communication link; a processing unit for obtaining network features corresponding to the network data; inputting the network features into the first model to obtain the detection result of the communication link, the detection result is used to indicate whether the communication link is an abnormal link, the first model is based on the labeled samples, K labeled samples and M unlabeled samples in the first sample set, the second model obtained by the last training is trained, and the model obtained when the training meets the preset conditions, the K labeled samples are obtained by respectively labeling the K unlabeled samples in the first sample set, the M unlabeled samples are unlabeled samples selected from the first sample set as negative samples, and the first sample set includes the labeled samples and unlabeled samples pre-stored before selecting the K unlabeled samples and the M unlabeled samples. In this way, after receiving the network data of the network node in the communication link, the network features of the network data are obtained, and then the network features are input into the abnormal link detection model obtained by training the samples selected from the unlabeled samples and the existing labeled samples, so as to detect the communication link, thereby improving the accuracy of detecting abnormal links.

[0015] In a possible example, the processing unit is further used to obtain an abnormality score value of each unlabeled sample in the first sample set; the first order is obtained by arranging the abnormality score values ​​of each unlabeled sample in the first sample set in descending order; and the unlabeled samples corresponding to the first K serial numbers in the first order are used as K unlabeled samples. In other words, the selected samples to be labeled are the most abnormal K unlabeled samples in the first sample set, and the sample set for training the abnormal link detection model includes samples that may be abnormal, which can improve the effect of model training and facilitate improving the accuracy of detecting abnormal links.

[0016] In a possible example, the processing unit is further used to use the unlabeled samples corresponding to the last L sequence numbers in the first sort as L unlabeled samples; and select M unlabeled samples from the L unlabeled samples. In other words, the selected unlabeled samples are M unlabeled samples randomly selected from the most normal L unlabeled samples in the first sample set, and the unlabeled samples are used as negative samples, then the newly added samples in the sample set for training the abnormal link detection model are samples of normal links, which can avoid the introduction of noise, improve the effect of model training, and facilitate improving the accuracy of detecting abnormal links.

[0017] In a possible example, the processing unit is also used to obtain an abnormality score value for each unlabeled sample in the second sample set, the second sample set includes labeled samples and unlabeled samples pre-stored before selecting P unlabeled samples; the second sorting is obtained by descending order according to the abnormality score value of each unlabeled sample in the second sample set; the unlabeled samples corresponding to the first P serial numbers in the second sorting are used as P unlabeled samples; a third model is constructed based on the labeled samples and P labeled samples in the second sample set, the P labeled samples are obtained by labeling the P unlabeled samples respectively, and the third model is the initialization model corresponding to the first model and the second model. In this way, the initialization model of the abnormal link detection model is constructed based on the P labeled samples corresponding to the most abnormal P unlabeled samples and the existing labeled samples, which can improve the effect of model training and facilitate the improvement of the accuracy of detecting abnormal links.

[0018] In a possible example, the processing unit is further used to obtain network topology information of the communication link; and a set of pre-stored unlabeled samples and labeled samples corresponding to the network topology information and device information is used as the first sample set. In other words, selecting unlabeled samples and labeled samples corresponding to the network topology information of the communication link as samples to be selected for training can improve the effect of model training and facilitate improving the accuracy of detecting whether a communication link is an abnormal link.

[0019] In a fourth aspect, an embodiment of the present application discloses a model training device, including: a selection module for selecting K unlabeled samples from a first sample set; and selecting M unlabeled samples as negative samples from the first sample set, the first sample set including labeled samples and unlabeled samples pre-stored before selecting K unlabeled samples and M unlabeled samples; a training module for training the second model obtained from the last training according to the labeled samples, K labeled samples and M unlabeled samples in the first sample set, and obtaining the first model when the training meets the preset conditions, and the K labeled samples are obtained by respectively labeling the K unlabeled samples in the first sample set. In this way, by selecting samples from unlabeled samples, the model can learn the distribution of positive and negative samples in unlabeled samples during the training process. And according to the selected samples and the existing labeled samples, the model obtained from the last training is retrained to further improve the accuracy of detection.

[0020] In a possible example, the selection module is specifically used to obtain the abnormality score value of each unlabeled sample in the first sample set; the abnormality score value of each unlabeled sample in the first sample set is arranged in descending order to obtain a first sort; and the unlabeled samples corresponding to the first K sequence numbers in the first sort are used as K unlabeled samples. In other words, the selected samples to be labeled are the most abnormal K unlabeled samples in the first sample set, and the sample set for training the abnormal link detection model includes samples that may be abnormal, which can improve the effect of model training and facilitate the improvement of the accuracy of detecting abnormal links.

[0021] In a possible example, the selection module is specifically used to select the unlabeled samples corresponding to the last L serial numbers in the first sort as L unlabeled samples; and select M unlabeled samples from the L unlabeled samples. In other words, the selected unlabeled samples are M unlabeled samples randomly selected from the most normal L unlabeled samples in the first sample set, and the unlabeled samples are used as negative samples. Then, the newly added samples in the sample set for training the abnormal link detection model are samples of normal links, which can avoid the introduction of noise, improve the effect of model training, and facilitate improving the accuracy of detecting abnormal links.

[0022] In a possible example, the selection module is specifically used to count the number of positive samples among the labeled samples and K labeled samples in the first sample set; based on the number of positive samples, M unlabeled samples are selected from the first sample set as negative samples, where M is equal to the number of positive samples among the labeled samples and K labeled samples in the first sample set. In other words, the number of negative samples added to the sample set for training the abnormal link detection model is equal to the number of positive samples in the sample set, which can relatively achieve a balance between positive and negative samples, reduce label noise, improve the effect of model training, and facilitate improving the accuracy of detecting abnormal links.

[0023] In a possible example, the selection module is also used to obtain the abnormality score value of each unlabeled sample in the second sample set, the second sample set includes the labeled samples and unlabeled samples pre-stored before selecting P unlabeled samples; the second sorting is obtained by descending the abnormality score value of each unlabeled sample in the second sample set; the unlabeled samples corresponding to the first P serial numbers in the second sorting are used as P unlabeled samples; a third model is constructed based on the labeled samples and P labeled samples in the second sample set, the P labeled samples are obtained by labeling the P unlabeled samples respectively, and the third model is the initialization model corresponding to the first model and the second model. In this way, the initialization model of the abnormal link detection model is constructed based on the P labeled samples corresponding to the most abnormal P unlabeled samples and the existing labeled samples, which can improve the effect of model training and facilitate the improvement of the accuracy of detecting abnormal links.

[0024] In a possible example, the selection module is further used to obtain network topology information of the communication link to be detected; and a set of pre-stored unlabeled samples and labeled samples corresponding to the network topology information is used as the first sample set. In other words, selecting unlabeled samples and labeled samples corresponding to the network topology information of the communication link as samples to be selected for training can improve the effect of model training and facilitate improving the accuracy of detecting whether a communication link is an abnormal link.

[0025] In combination with the first aspect, the third aspect or any possible example, in one possible example, M is equal to the number of positive samples in the labeled samples in the first sample set and the K labeled samples. In this way, the number of negative samples newly added to the sample set for training the abnormal link detection model is equal to the number of positive samples in the sample set, which can relatively achieve a balance between positive and negative samples, reduce label noise, improve the effect of model training, and facilitate improving the accuracy of detecting abnormal links.

[0026] In combination with the first aspect, the second aspect, the third aspect, the fourth aspect or any possible example, in a possible example, the network data includes at least one of the following: signal-to-noise ratio, input signal level, errored seconds, severe errored seconds, unavailable time, network topology information. In this way, abnormal link detection is performed through different network data, which can improve the diversity of detection.

[0027] In the fifth aspect, an embodiment of the present application provides another device, including a processor and a memory and a communication interface connected to the processor, the memory is used to store one or more programs, and is configured to execute the steps of any of the above aspects by the processor, the device includes an abnormal link detection device and a model training device.

[0028] In a sixth aspect, the present application provides a computer-readable storage medium, in which instructions are stored, and when the computer-readable storage medium is run on a computer, the computer executes any of the methods described above.

[0029] In a seventh aspect, the present application provides a computer program product, which is used to store a computer program. When the computer program runs on a computer, it enables the computer to execute any of the methods described above.

[0030] In an eighth aspect, the present application provides a chip, including a processor and a memory, wherein the processor is used to call and execute instructions stored in the memory, so that a device equipped with the chip executes any of the methods described above.

[0031] In a ninth aspect, the present application provides another chip, comprising: an input interface, an output interface and a processing circuit, wherein the input interface, the output interface and the processing circuit are connected via an internal connection path, and the processing circuit is used to execute any of the above methods.

[0032] In the tenth aspect, the present application provides another chip, including: an input interface, an output interface, a processor, and optionally, a memory. The input interface, the output interface, the processor and the memory are connected through an internal connection path. The processor is used to execute the code in the memory. When the code is executed, the processor is used to execute the method in any of the above aspects.

[0033] In the eleventh aspect, an embodiment of the present application provides a chip system, including at least one processor, a memory and an interface circuit, the memory, the transceiver and at least one processor are interconnected through lines, and a computer program is stored in at least one memory; the computer program is executed by the processor according to any of the methods in the above aspects. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] The following is an introduction to the drawings used in the embodiments of the present application.

[0035] Figure 1 It is a flowchart of a model training method provided in an embodiment of the present application;

[0036] Figure 2 It is a structural diagram of a communication system provided in an embodiment of the present application;

[0037] Figure 3 It is a schematic diagram of a process flow of a detection node provided in an embodiment of the present application;

[0038] Figure 4 It is a flowchart of an abnormal link detection method provided in an embodiment of the present application;

[0039] Figure 5It is a structural schematic diagram of a model training device provided in an embodiment of the present application;

[0040] Figure 6 It is a structural schematic diagram of an abnormal link detection device provided in an embodiment of the present application;

[0041] Figure 7 It is a structural schematic diagram of a device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0042] When describing the embodiments of the present application, some concepts used in the following description are first explained.

[0043] (1) Normal links and abnormal links.

[0044] No abnormal situation occurs during the communication process of a normal link. An abnormal link is the opposite of a normal link, and an abnormal situation occurs during the communication process of an abnormal link. The abnormal situation includes at least one of the following situations: a network node in the communication link is disconnected from other network nodes, or the network node does not receive a pre-received signal (or information), or the network node does not send a signal to be transmitted to a network node to be received, or the network node sends a signal to be transmitted to a network node that should not receive the signal, etc., which are not limited here.

[0045] (2) Binary classification, positive samples and negative samples.

[0046] Binary classification means that there are two categories in the classification task, for example, classify a picture to determine whether the picture is a car. Positive samples include categories that need to be identified in binary classification tasks. Negative samples are the opposite of positive samples. Negative samples include categories that do not need to be identified in binary classification tasks. For example, to classify a picture to determine whether the image in the picture belongs to a car, the car is the type that needs to be identified, the picture of the car can be used as a positive sample, and any picture that is not a car can be used as a negative sample. In the abnormal link detection scenario, the category that needs to be identified is the sample of the abnormal link. Therefore, in an embodiment of the present application, the positive sample corresponds to the sample of the abnormal link, and the negative sample corresponds to the sample of the normal link.

[0047] (3) Outliers and non-outliers.

[0048] An outlier is a sample that is significantly different from other data in a sample. A non-outlier is the opposite of an outlier. A non-outlier is a sample of the same type as other data in a sample. Since the number of normal data is much larger than the number of abnormal data, an outlier can be understood as abnormal data, and a non-outlier can be understood as normal data. That is, in the embodiment of the present application, an outlier can be understood as a positive sample, and a non-outlier can be understood as a negative sample.

[0049] (4) True positive (TP) samples, false negative (FN) samples, false positive (FP) samples and true negative (TN) samples.

[0050] True positive samples are actually positive samples, and the binary classification model predicts them as positive samples. False negative samples are actually positive samples, but the binary classification model predicts them as negative samples. False positive samples are actually negative samples, but the binary classification model predicts them as positive samples. True negative samples are actually negative samples, and the binary classification model predicts them as negative samples.

[0051] (5) Abnormal link detection model, first model and second model.

[0052] In an embodiment of the present application, an abnormal link detection model is used to detect whether a communication link is an abnormal link. It should be noted that the application refers to the initialization model of the abnormal link detection model as the third model, the abnormal link detection model obtained by the last training as the second model, and the second model is trained. The abnormal link detection model obtained when the training is completed is called the first model. When the second model is not the third model, the training method of the first model and the second model is the same. Among them, the initialization model refers to the model obtained when constructing the abnormal link detection model, which can be understood as the model obtained by the first training, and the third model can also be understood as the initialization model of the first model and the second model. The parameters of the third model can be understood as the initialization parameters of the abnormal link detection model, and constructing the initialization model can be understood as obtaining the initialization parameters of the abnormal link detection model. The parameters of the second model can be understood as the initialization parameters of the first model, and training the second model can be understood as updating the parameters of the second model, and can also be understood as obtaining the initialization parameters of the first model.

[0053] The abnormal link detection model can be a neural network. The neural network can be composed of neural units. The neural unit can be a neural unit composed of x s The output of the operation unit with the intercept 1 as input can be:

[0054]

[0055] Where, s = 1, 2, ... n, n is a natural number greater than 1, W s For x s, b is the bias of the neural unit. f is the activation function of the neural unit, which is used to introduce nonlinear characteristics into the neural network to convert the input signal in the neural unit into the output signal. The output signal of the activation function can be used as the input of the next convolutional layer. The activation function can be a sigmoid function. A neural network is a network formed by connecting many of the above-mentioned single neural units together, that is, the output of one neural unit can be the input of another neural unit. The input of each neural unit can be connected to the local receptive field of the previous layer to extract the features of the local receptive field. The local receptive field can be an area composed of several neural units. If the abnormal link detection model is a neural network, the parameters of the abnormal link detection model can be understood as W in formula (1) s and b.

[0056] (6) Network data.

[0057] In an embodiment of the present application, the network data includes device information of the network node, performance data, and network topology information of the communication link corresponding to the network node, etc., which is not limited here. Among them, the network topology information of the communication link is used to describe the connection relationship between each network node in the communication link, and the device information of each network node. The device information is used to describe the hardware parameters of the network node, such as device model, voltage limit size, current limit size, storage capacity, transmission rate, etc. The performance data of the network node may include but is not limited to at least one of the following information: signal-to-noise ratio (SNR or S / N), input signal level (signal level at receiver input, RSL), errored seconds (the number of errored seconds, ES), severely errored seconds (the number of severely errored seconds, SES), unavailable time (the period of unavailability, UAS), skewness, etc.

[0058] The signal-to-noise ratio is also called the signal-to-noise ratio, which refers to the ratio of the signal to the noise in a network node or a communication link. The noise here refers to the irregular additional signal (or information) that does not exist in the original signal generated by the network node, and the signal does not change with the change of the original signal. max Represents the maximum signal-to-noise ratio during the observation period, SNR minIndicates the minimum signal-to-noise ratio during the observation period. The observation period can also be called the observation time or observation duration, etc. The observation period can be a preset fixed duration, which is the same for all communication links and all network nodes; it can also be a different time set for each communication link and each network node; it can also be a dynamic time determined by the gateway node used to manage the network node in the communication link, that is, the time is not a certain value, and the time can be determined by the gateway node according to the channel quality, network load, etc., which is not limited here.

[0059] The level of the input signal refers to the logarithm of the ratio of power, voltage or current between two network nodes when a network node sends a signal to another network node. max Indicates the maximum input signal level during the observation period.

[0060] Errored seconds are used to describe the number of bit errors that occur in one second. Severely errored seconds correspond to situations where the bit error rate during any one-second observation period is greater than a threshold, or signal loss is detected, etc. In the embodiment of the present application, ES max Indicates the maximum error second during the observation period, SES max Indicates the maximum severely errored second during the observation period.

[0061] The unavailable time starts when the network node generates 10 consecutive severe error seconds and reports until the error seconds per second for 10 consecutive seconds are not severe error seconds. max Indicates the maximum unavailable time during the observation period.

[0062] Skewness, also known as skewness or skewness coefficient, is a measure of the direction and degree of skewness of the statistical data distribution and is used to measure the asymmetry of the probability distribution of random variables. 0 indicates the most perfect symmetry, and the skewness of the normal distribution is 0. Please refer to formula (2) for the calculation of skewness.

[0063]

[0064] Among them, S represents skewness, i represents the i-th value, n is the number of samples, μ is the mean, and σ is the standard deviation.

[0065] (7) Network characteristics.

[0066] In the embodiments of the present application, network characteristics are used to describe the performance characteristics corresponding to network data. The present application does not limit the method for obtaining network characteristics, and statistical analysis can be performed based on network data of different dimensions. When network data of a network node is received, the network characteristics of the network node can be determined based on the network data. Taking network node 1 as an example, the variance of the SNR and the SNR of network node 1 during the observation period can be obtained. max 、SNR min , skewness of RSL, ES max , SES max 、UAS max wait.

[0067] When receiving network data of multiple network nodes on a communication link, the network characteristics of each network node can be obtained separately, or the network characteristics of the communication link can be obtained by combining the network data of each network node. Taking network node 1 and network node 2 as an example, both network nodes 1 and network node 2 are network nodes on a communication link L1, the variance and SNR of SNR of network node 1 and network node 2 during the observation period can be obtained respectively. max 、SNR min , skewness of RSL, ES max , SES max , UASmax, etc.; the SNR between network node 1 and network node 2 can be obtained max , or SNR max The variance, or SNR max The sum of squared differences; the SNR between network node 1 and network node 2 can be obtained min , or SNR min The variance, or SNR min The sum of square differences; can be used to obtain the RSL between network node 1 and network node 2 max , or RSL max Skewness; Get the ES between network node 1 and network node 2 max ; You can obtain the SES between network node 1 and network node 2 max ; The UAS between network node 1 and network node 2 can be obtained max And the network characteristics of the communication link can be described by a piece of data, the network characteristics of the communication link L1 x = {the variance of the SNR of network node 1, the skewness of the RSL of network node 1, the variance of the SNR of network node 2, the skewness of the RSL of network node 2, the SNR between network node 1 and network node 2 max The sum of squared differences, SNR between network nodes 1 and 2 min The sum of the squared differences between network node 1 and network node 2 max, SES between network node 1 and network node 2 max , UAS between network node 1 and network node 2 max}.

[0068] Network features can also be obtained through network embedding methods. Network embedding methods aim to learn low-dimensional potential representations of nodes in the network. The learned feature representations can be used as features for various graph-based tasks, such as classification, clustering, link prediction, and visualization. The central idea is to find a mapping function that converts each node in the network into a low-dimensional potential representation. Obtaining network features of network nodes through network embedding methods can improve the accuracy and efficiency of feature acquisition.

[0069] (8) Labeled samples, unlabeled samples, the first sample set, and the second sample set.

[0070] In an embodiment of the present application, the data of the labeled sample includes a label, and the label is used to indicate whether the labeled sample is a positive sample or a negative sample. The data of the unlabeled sample does not include a label. The labeled sample may also be referred to as a labeled sample, or labeled data or labeled data, etc., and the unlabeled sample may also be referred to as unlabeled data or unlabeled data, etc. In an embodiment of the present application, labeled samples and unlabeled samples are used as examples. The positive samples in the labeled samples correspond to samples of abnormal links, and the negative samples in the labeled samples correspond to samples of normal links. Both the labeled samples and the unlabeled samples may include network data of network nodes. The network data may refer to the definition (6) above, which will not be repeated here.

[0071] In an embodiment of the present application, the first sample set includes labeled samples and unlabeled samples before the samples selected for training the first model. The second sample set includes labeled samples and unlabeled samples before the samples selected for building the third model. When the samples selected in the first sample set are K unlabeled samples and M unlabeled samples, the first sample set can be understood as a set of labeled samples and unlabeled samples before the K unlabeled samples and M unlabeled samples are selected. When the samples selected in the second sample set are P unlabeled samples, the second sample set can be understood as a set of labeled samples and unlabeled samples before the P unlabeled samples are selected.

[0072] The present application does not limit the selection method of the first sample set and the second sample set. All or part of the samples can be selected. Some of the samples can be samples acquired in recent times, or can be historical samples of the communication link to be detected, or can be historical samples of the communication link of the same type as the communication link, etc., which are not limited here. Taking the first sample set as an example, the network topology information of the labeled samples and the unlabeled samples in the first sample set is consistent with the network topology information of the communication link to be detected. Among them, the communication link to be detected can be the communication link deployed by the abnormal link detection model. The samples in the first sample set can be historical samples of the communication link, or historical samples of the communication link of the same type as the communication link. It can be understood that when unlabeled samples and labeled samples corresponding to the same network topology information are selected as the first sample set, the effect of model training can be improved, which is convenient for improving the accuracy of communication link detection.

[0073] (9) Evaluation indicators of abnormal link detection model.

[0074] In an embodiment of the present application, the evaluation index of the abnormal link detection model is used to evaluate the detection effect of the abnormal link detection model. The better the detection effect (or effect), it can be understood that the abnormal link detection model identifies the abnormal link. The corresponding value of the evaluation index is larger. The evaluation index may include precision (precision, P), recall rate (recall, R), sensitivity (true positive rate, TPR), specificity (false positive rate, FPR), accuracy (accuracy), F1 value (F1-score), etc., which are not limited here.

[0075] Among them, precision is also called accuracy, which refers to the ratio of the number of samples correctly classified as positive to all samples classified as positive. Recall rate refers to the ratio of the number of samples correctly classified as positive to all positive samples. Sensitivity refers to the ratio of the number of samples correctly identified as positive to all positive samples. Specificity refers to the ratio of the number of samples incorrectly identified as positive to all negative samples. Accuracy refers to the ratio of the number of samples correctly classified to all samples. F1 value is also called harmonic mean. When the recall rate is larger, the predicted coverage rate is higher and the precision is smaller. Therefore, the F1 value can be used to reconcile precision and recall rate. For the calculation of precision P, recall rate R, sensitivity TPR, specificity FPR, accuracy rate and F1 value, please refer to formula (3), formula (4), formula (5), formula (6), formula (7) and formula (8) respectively.

[0076] P=TP / (TP+FP) (3)

[0077] R=TP / (TP+FN) (4)

[0078] TPR=TP / (TP+FN) (5)

[0079] FPR=FP / (FP+TN) (6)

[0080] acc=(TP+FN) / (TP+FN+FP+TN) (7)

[0081] F1=(2*P*R) / (P+R) (8)

[0082] In the above formula, acc represents accuracy, TP represents the number of true positive samples, FP represents the number of false positive samples, FN represents the number of false negative samples, and TN represents the number of true negative samples. When the number of all positive samples is equal to the number of true positive samples and false negative samples, the recall rate and sensitivity are equal.

[0083] The detection effect of the abnormal link detection model can also be determined by the precision recall (PR) curve corresponding to the precision and recall rate, the receiver operating characteristic (ROC) curve corresponding to the specificity and sensitivity, the area under the ROC curve (ROC area under curve, ROC-AUC) and the area under the PR curve (PR area under curve, PR-AUC) in the evaluation indicators. Among them, the horizontal axis (x) of the PR curve is the recall rate, and the vertical axis (y) is the precision. The horizontal axis (x) of the ROC curve is the specificity, and the vertical axis (y) is the sensitivity. The value of ROC-AUC is the area enclosed by the ROC curve, the horizontal axis and the vertical axis. The value of PR-AUC is the area enclosed by the PR curve, the horizontal axis and the vertical axis. The closer the ROC curve is to the upper left corner, the larger the value of AUC. The larger the value of AUC, the closer the precision and recall are to 1. The closer the precision and recall are to 1, the better the detection effect of the model.

[0084] (10)Pre-conditions.

[0085] In an embodiment of the present application, the preset condition is used to determine whether the abnormal link detection model has been trained, and is specifically used to determine that the abnormal link detection model training is completed when the evaluation index of the abnormal link detection model reaches or exceeds the threshold, or the evaluation index of the abnormal link detection model is difficult to improve, or the number of training times reaches or exceeds the threshold. If the abnormal link detection model obtained in the last training is the second model, the second model is trained, and the preset conditions satisfied when the second model training is completed may include but are not limited to at least one of the following information: the accuracy of the second model is greater than or equal to the first threshold; the recall rate of the second model is greater than or equal to the second threshold; the improvement of the accuracy of the second model is less than or equal to the third threshold; the improvement of the recall rate of the second model is less than or equal to the fourth threshold; the number of training times of the second model is greater than or equal to the fifth threshold; the accuracy of the second model is greater than or equal to the sixth threshold; the improvement of the accuracy of the second model is less than or equal to the seventh threshold; the harmonic mean F1 value corresponding to the accuracy and recall rate of the second model is greater than or equal to the eighth threshold, etc. The above thresholds are not limited, the third threshold can be equal to the fourth threshold, and in order to improve the training effect, the threshold of this training can be equal to or greater than the threshold of the last training.

[0086] (11) Unsupervised learning and supervised learning.

[0087] Unsupervised learning solves pattern recognition problems based on unlabeled samples. Commonly used unsupervised learning algorithms include matrix decomposition algorithm, isolation forest algorithm, principal components analysis (PCA), isometric mapping method, local linear embedding method, Laplace eigenmapping method, Hessian local linear embedding method and local tangent space arrangement method. A typical example of unsupervised learning is clustering, the purpose of clustering is to group similar things together, regardless of what the category is.

[0088] Supervised learning is the process of adjusting the parameters of the classifier using labeled samples to achieve the required performance. It is also called supervised training or teacher learning. Common supervised learning algorithms: regression analysis and statistical classification. The most typical algorithms are k-Nearest Neighbor (KNN) and support vector machine (SVM).

[0089] The method provided in this application is described below from the model training side and the model application side.

[0090] The training method of the abnormal link detection model provided in the embodiment of the present application involves artificial intelligence technology, and can be specifically applied to data training, machine learning, deep learning and other data processing methods, and the training data (such as the network data of the network nodes of the labeled samples in the embodiment of the present application) is symbolized and formalized for intelligent information modeling, extraction, preprocessing, training, etc., and finally a trained abnormal link detection model (such as the first model and the second model in the embodiment of the present application) is obtained; and the abnormal link detection method provided in the embodiment of the present application can use the above-mentioned trained abnormal link detection model (such as the first model in the embodiment of the present application), input the input data (such as the network features in the embodiment of the present application) into the abnormal link detection model, and obtain output data (such as the detection result of the communication link in the embodiment of the present application). It should be noted that the training method of the abnormal link detection model and the abnormal link detection method provided in the embodiment of the present application are inventions based on the same concept, and can also be understood as two parts in a system, or two stages of an overall process: such as the model training stage and the model application stage.

[0091] The model training phase includes a model initialization phase and a model training phase. Among them, the model training phase is used to train the previously obtained model (such as the first model in the embodiment of the present application). The model initialization phase is used to build a model (such as the third model in the embodiment of the present application). The present application does not limit the initialization method of the abnormal link detection model. A supervised learning method can be used to build an initialization model of the abnormal link detection model based on labeled samples (such as the labeled samples in the second sample set in the embodiment of the present application); or an unsupervised learning method can be used first to classify unlabeled samples (such as the unlabeled samples in the second sample set in the embodiment of the present application) to obtain unlabeled samples of abnormal links and unlabeled samples of normal links, and then the unlabeled samples of abnormal links are manually labeled, and the initialization model of the abnormal link detection model is constructed together with the labeled samples (such as the labeled samples in the second sample set in the embodiment of the present application).

[0092] In a possible example, the method for initializing the abnormal link detection model includes the following steps A1 to A3, wherein:

[0093] A1: Obtain the anomaly score value of each unlabeled sample in the second sample set.

[0094] In the embodiment of the present application, the third model is an initialization model of the abnormal link detection model. The second sample set includes pre-stored labeled samples and unlabeled samples before selecting samples for building the third model. When the samples selected in the second sample set are P unlabeled samples, the second sample set can be understood as a set of labeled samples and unlabeled samples before selecting P unlabeled samples.

[0095] The present application does not limit the method for selecting the second sample set, and all or part of the samples may be selected. Some of the samples may be samples acquired recently, or may be historical samples of the communication link to be detected, or may be historical samples of the communication link of the same type as the communication link, etc., which are not limited here. In a possible example, the network topology information of the labeled samples and the unlabeled samples in the second sample set is consistent with the network topology information of the communication link to be detected. Among them, the communication link to be detected may be a communication link deployed by the abnormal link detection model. The samples in the second sample set may be historical samples of the communication link, or may be historical samples of the communication link of the same type as the communication link. It can be understood that when unlabeled samples and labeled samples corresponding to the same network topology information are selected as the second sample set, the accuracy of detecting whether the communication link is an abnormal link can be improved.

[0096] The anomaly score value is used to describe the possibility of anomaly of the communication link corresponding to the unlabeled sample, which can be described by probability. This application does not limit the method for obtaining the anomaly score value, which can be obtained based on an unsupervised learning method; or a most abnormal labeled sample can be selected as a reference sample, and each unlabeled sample in the second sample set is compared with the reference sample to obtain the similarity value between each sample, and the similarity value is used as the anomaly score value, etc.

[0097] The present application does not limit the execution conditions of step A1, which may be executed after the abnormal link detection model is deployed on the detection node, or after the number of stored unlabeled samples exceeds a threshold, or after the time from the first received unlabeled sample exceeds a threshold, etc. The above thresholds are not limited.

[0098] A2: According to the abnormality score value of each unlabeled sample in the second sample set, P unlabeled samples are selected from the second sample set.

[0099] The present application does not limit P, which is a positive integer and can be set according to the number of unlabeled samples and / or the number of positive samples in labeled samples and / or the number of negative samples in labeled samples, or can be set according to evaluation indicators pre-set for the abnormal link detection model.

[0100] In an embodiment of the present application, the abnormality score value of any unlabeled sample in the P unlabeled samples is greater than or equal to the abnormality score value of any unlabeled sample in the second sample set except the P unlabeled samples. The present application does not limit the method for selecting P unlabeled samples, and the abnormality score values ​​of each unlabeled sample in the second sample set can be arranged in descending order or ascending order. When descending order is used as the second sorting, the unlabeled samples corresponding to the first P sequence numbers in the second sorting can be obtained. When the ascending order is used, the unlabeled samples corresponding to the last P sequence numbers can be obtained. The method for selecting P unlabeled samples can also first randomly select P reference unlabeled samples, and then compare the abnormality scores of the P reference unlabeled samples one by one from the remaining unlabeled samples, thereby replacing the smaller unlabeled samples in the P reference unlabeled samples. It should be noted that the P unlabeled samples may include unlabeled samples with equal abnormality scores, and the unlabeled samples in the second sample set except the P unlabeled samples may also be equal to the abnormality score values ​​of the unlabeled samples in the P unlabeled samples. The P unlabeled samples can be understood as the most abnormal unlabeled samples in the second sample set.

[0101] A3: Build a third model based on the labeled samples in the second sample set and P labeled samples.

[0102] The P labeled samples are obtained by labeling the P unlabeled samples respectively. The present application does not limit the labeling method of the P unlabeled samples. The P unlabeled samples can be manually labeled or directly used as positive samples.

[0103] The present application does not limit the method for constructing the third model. Logistic regression or decision tree algorithm can be used to classify the network data and labels of the labeled samples in the second sample set and P labeled samples, so as to obtain the parameters of the abnormal link detection model (i.e., the third model). Simply put, the abnormal link detection model is equivalent to a function, and the network data of each labeled sample (or the feature data corresponding to the network data) is a constant. The constant is multiplied by the parameters of the abnormal link detection model to obtain the label of the labeled sample. Then, the parameters of the abnormal link detection model can be obtained according to the network data and labels of each labeled sample in the second sample set and P labeled samples. Furthermore, the parameters obtained by classification can be adjusted according to methods such as gradient descent, Newton's method, conjugate gradient method, quasi-Newton method, heuristic methods (for example, simulated annealing method, genetic algorithm, ant colony algorithm and particle swarm algorithm, etc.), and then the parameters obtained last time are adjusted according to the above methods until the labeled samples and P labeled samples in the second sample set are determined. When the initialization training of the abnormal link detection model is completed, the parameters of the abnormal link detection model at the time of training are used as the initialization parameters of the abnormal link detection model (that is, the parameters of the third model).

[0104] It can be understood that in steps A1 to A3, P unlabeled samples are selected from the second sample set as new training data, and the P unlabeled samples are not randomly selected, but the most abnormal data selected according to the abnormal score values ​​of each unlabeled sample in the second sample set, which can reduce the workload of invalid labeling. The initialization model (i.e., the third model) of the abnormal link detection model is constructed by the P labeled samples corresponding to the most abnormal P unlabeled samples and the existing labeled samples, which can improve the accuracy of the model in detecting abnormal links.

[0105] After obtaining the initialization model of the abnormal link detection model, the model training phase can be entered, and the method used in each training process is the same. This application does not limit the execution conditions of model training. It can be triggered after receiving network data from a network node in a communication link, or it can be that the number of unlabeled samples received or pre-stored exceeds a threshold, or it can be that the time with the last model training exceeds a threshold, or it can be that the network data sent by the network node in the communication link has not been received for a long time, etc. The above thresholds and time lengths are not limited.

[0106] The present application does not limit the training method of the abnormal link detection model. The abnormal link detection model obtained in the previous training can be trained based on the newly added labeled samples; or an unsupervised learning method can be first used to determine the unlabeled samples of abnormal links and the unlabeled samples of normal links in the unlabeled samples in the sample set, and then the unlabeled samples of abnormal links are labeled and trained together with the labeled samples (such as the labeled samples in the first sample set in the embodiment of the present application); or the abnormal link detection model obtained in the previous training can be used to select the most abnormal unlabeled samples, label the unlabeled samples, and then train them together with the labeled samples, etc.

[0107] Please refer to Figure 1 , Figure 1 Schematic diagram of a model training method proposed in the embodiment of the present application. Figure 1 As shown, the method can be performed by an abnormal link detection model or an abnormal link detection device or a detection node or a terminal and the method includes:

[0108] S102: Select K unlabeled samples from the first sample set.

[0109] This application does not limit K, K is a positive integer, and the description of P can be referred to, which will not be repeated here. Optionally, K and P are equal. In other words, the number of the most abnormal unlabeled samples selected by the abnormal link detection model during the model initialization phase and the model training phase is equal. It can be understood that no matter what value K takes, new unlabeled samples are selected, and the abnormal link detection model is trained based on the new unlabeled samples, which can achieve incremental learning, improve the effect of model training, and facilitate improving the accuracy of detecting abnormal links.

[0110] This application does not limit the method for selecting K unlabeled samples. You can select them randomly or select the most abnormal K unlabeled samples. It can be understood that randomly selecting K unlabeled samples from the sample set for training can allow the abnormal link detection model to learn the distribution of positive and negative samples in the unlabeled samples during the training process. Since abnormal data is less than normal data, random selection may result in no or very few positive samples.

[0111] In a possible example, step S102 includes the following steps B1 and B2, wherein:

[0112] B1: Obtain the anomaly score value of each unlabeled sample in the first sample set.

[0113] The method for obtaining the abnormal score value can refer to the description of A1, and can also be obtained based on the abnormal detection model (i.e., the second model) obtained in the previous training, etc., which is not limited here. Obtaining the abnormal score value of the unlabeled sample through the abnormal detection model obtained in the previous training can improve the efficiency and accuracy of obtaining the abnormal score value.

[0114] B2: According to the abnormality score value of each unlabeled sample in the first sample set, K unlabeled samples are selected from the first sample set.

[0115] In the embodiment of the present application, the abnormality score value of any unlabeled sample in the K unlabeled samples is greater than or equal to the abnormality score value of any unlabeled sample in the first sample set except the K unlabeled samples. The method for obtaining the K unlabeled samples can refer to the description of A2, which is not repeated here.

[0116] It can be understood that in step B1 and step B2, the samples to be labeled selected from the unlabeled samples are the most abnormal K unlabeled samples in the first sample set. In other words, the sample set of the abnormal link detection model includes samples that may be abnormal, which can improve the effect of model training and facilitate improving the accuracy of the model in detecting abnormal links.

[0117] S104: Select M unlabeled samples from the first sample set as negative samples.

[0118] The present application does not limit M, M is a positive integer, and the description of P can be referred to, which will not be repeated here. In the embodiment of the present application, the M unlabeled samples are unlabeled samples selected from the first sample set as negative samples, that is, the M unlabeled samples are regarded as data of a normal link.

[0119] This application does not limit the method for selecting M unlabeled samples, and the most normal M unlabeled samples can be randomly selected. It can be understood that randomly selecting M unlabeled samples as negative samples in the sample set can allow the abnormal link detection model to learn the distribution of positive and negative samples in the unlabeled samples during the training process. It should be noted that the M unlabeled samples should be different from the K unlabeled samples.

[0120] In a possible example, step S104 includes the following two methods, wherein:

[0121] The first method is to count the number of positive samples among the labeled samples in the first sample set and the K labeled samples; according to the number of positive samples, M unlabeled samples are selected from the first sample set as negative samples, where M is equal to the number of positive samples.

[0122] Among them, the number of labeled samples in the first sample set and the number of positive samples in the K labeled samples can be understood as the number of samples of abnormal links in the sample set of the second model. In other words, the number of samples of abnormal links in the sample set for training the abnormal link detection model is first counted, and then the most normal unlabeled samples are selected from the first sample set, and the number of selected unlabeled samples is equal to the number of samples of abnormal links counted. In this way, the number of newly added negative samples in the sample set for training the abnormal link detection model is equal to the number of positive samples in the sample set, and a relative balance between positive and negative samples can be achieved, which reduces label noise, improves the effect of model training, and facilitates improving the accuracy of the model in detecting abnormal links.

[0123] In the second mode, step S104 includes the following steps C1 to C3, wherein:

[0124] C1: Get the anomaly score value of each unlabeled sample in the first sample set.

[0125] Among them, step C1 can refer to the description of step B1, which will not be repeated here.

[0126] C2: Select L unlabeled samples from the first sample set according to the anomaly score value of each unlabeled sample in the first sample set.

[0127] The present application does not limit L, L is a positive integer, and the description of P can be referred to, which will not be repeated here. In an embodiment of the present application, the abnormality score value of any unlabeled sample in the L unlabeled samples is less than or equal to the abnormality score value of any sample other than the L unlabeled samples in the first sample set. The present application does not limit the method for selecting L unlabeled samples, and the abnormality score values ​​of each unlabeled sample in the first sample set can be arranged in descending order or ascending order. When descending order is used as the first sorting, the unlabeled samples corresponding to the last L sequence numbers in the first sorting can be obtained. When arranged in ascending order, the unlabeled samples corresponding to the first L sequence numbers can be obtained. The method for selecting L unlabeled samples can also first randomly select L reference unlabeled samples from the first sample set, and then compare the abnormality scores of the L reference unlabeled samples one by one from the remaining unlabeled samples, thereby replacing the larger unlabeled samples in the L reference unlabeled samples. It should be noted that the L unlabeled samples may include unlabeled samples with equal anomaly scores, and the unlabeled samples other than the L unlabeled samples and the K unlabeled samples in the first sample set may also have anomaly scores equal to those of the unlabeled samples in the L unlabeled samples. The L unlabeled samples can be understood as the most normal part of the unlabeled samples in the first sample set, or as non-outliers in the first sample set.

[0128] C3: Select M unlabeled samples from L unlabeled samples.

[0129] Among them, the M unlabeled samples can be randomly selected from the L unlabeled samples, or can be samples obtained in recent time, or can be historical samples of the communication link, or can be historical samples of the communication link of the same type as the communication link, etc., which are not limited here.

[0130] It can be understood that in steps C1 to C3, the unlabeled samples selected according to the abnormal score values ​​of the unlabeled samples are M unlabeled samples randomly selected from the most normal L unlabeled samples in the first sample set, and the unlabeled samples are used as negative samples. In other words, the samples newly added to the sample set for training the abnormal link detection model are samples of normal links, which can avoid the introduction of noise, improve the effect of model training, and facilitate improving the accuracy of the model in detecting abnormal links.

[0131] It should be noted that the above two methods do not constitute a limitation on the embodiments of the present application. In practical applications, the first method and the second method can be combined to select M unlabeled samples.

[0132] S106: According to the labeled samples, K labeled samples and M unlabeled samples in the first sample set, the second model obtained in the previous training is trained, and the first model is obtained when the training meets the preset conditions.

[0133] Among them, the preset conditions can refer to the definitions in the previous text and will not be repeated here. In one possible example, the preset conditions include at least one of the following: the accuracy of the second model is greater than or equal to the first threshold; the recall rate of the second model is greater than or equal to the second threshold; the improvement in accuracy is less than or equal to the third threshold; the improvement in recall rate is less than or equal to the fourth threshold; the number of training times of the second model is greater than or equal to the fifth threshold; the accuracy rate of the second model is greater than or equal to the sixth threshold; the improvement in accuracy rate is less than or equal to the seventh threshold; the harmonic mean corresponding to the accuracy and recall rate is greater than or equal to the eighth threshold. In this way, by determining whether the second model is trained through different preset conditions, the accuracy of the first model in detecting abnormal links after training is completed can be improved.

[0134] The present application does not limit the training method of the second model, and the parameters of the second model can be adjusted according to methods such as gradient descent method, Newton algorithm, conjugate gradient method, quasi-Newton method, heuristic method (for example, simulated annealing method, genetic algorithm, ant colony algorithm and particle swarm algorithm, etc.). Then, based on the above method, the parameters of the second model obtained last time are adjusted until it is determined that the training of the second model meets the preset conditions, and the training is determined to be completed, and the second model obtained after the training is used as the first model.

[0135] exist Figure 1In the described method, K unlabeled samples are first selected from the first sample set, and then M unlabeled samples are selected from the first sample set as negative samples. After the K unlabeled samples are labeled, the K labeled samples obtained by labeling are used together with the M unlabeled samples and the labeled samples in the first sample set to train the second model obtained by the last training, thereby obtaining the first model that has been trained. In this way, by using the samples selected from the unlabeled samples, the model can learn the distribution of positive and negative samples in the unlabeled samples during the training process. And according to the selected samples and the existing labeled samples, the model obtained by the last training is retrained to further improve the accuracy of detection.

[0136] See also Figure 2 , Figure 2 is an architecture diagram of a communication system provided in an embodiment of the present application. Figure 2 As shown, the communication system may include a terminal (e.g., terminal 211), a network node (e.g., network node 221, network node 222), a detection node (e.g., detection node 231), and a target device (e.g., network device 241, application server 251). The embodiments of the present application do not limit the number of the above devices.

[0137] The communication system in the embodiment of the present application may be a communication system supporting the fourth generation (4G) access technology, for example, the long term evolution (LTE) access technology; or, the communication system may be a communication system supporting the fifth generation (5G) access technology, for example, the new radio (NR) access technology; or, the communication system may be a communication system supporting multiple wireless technologies, for example, a communication system supporting the LTE technology and the NR technology; or, the communication system may be a communication system supporting microwave communication technology, wavelength division communication technology, optical transport network (OTN) technology, wireless communication technology, broadband and narrowband technology, etc. In addition, the communication system may be applicable to future-oriented communication technologies.

[0138] The communication system can also be applied to other communication systems, for example, C-V2X system, public land mobile network (PLMN), device-to-device (D2D) network, machine-to-machine (M2M) network, Internet of Things (IoT), wireless local area networks (WLAN) or other networks, etc., without limitation herein.

[0139] In the embodiment of the present application, the terminal can be connected to the network node in a wireless or wired manner, and then connected to the target device in a wireless or wired manner through the network node. The terminal can be a device that provides voice or data connectivity to the user, and the terminal can be called user equipment (UE), mobile station, subscriber unit, station, terminal equipment (TE), etc. The terminal can be a cellular phone, a personal digital assistant (PDA), a wireless modem, a handheld device (handheld), a laptop computer, a cordless phone, a wireless local loop (WLL) station, a mobile phone, a tablet computer (pad), etc. With the development of wireless communication technology, devices that can access wireless communication networks, communicate with wireless network sides, or communicate with other objects through wireless networks can all be terminals in the embodiments of the present application. For example, terminals and cars in intelligent transportation, household appliances in smart homes, power meter reading instruments, voltage monitoring instruments, environmental monitoring instruments in smart grids, video monitoring instruments in intelligent security networks, cash registers, etc. The terminal may be statically fixed or mobile. Figure 2 As shown, the terminal is a mobile phone.

[0140] The network node in the embodiment of the present application is used to provide transmission services for the terminal. The network node can act as a relay node (RN) to provide wireless backhaul services to the terminal. The wireless backhaul service refers to the data and / or signaling backhaul service provided through the wireless backhaul link. On the one hand, the relay node can provide wireless access services to the terminal through the access link (AL); on the other hand, the relay node can be connected to the target device through a one-hop or multi-hop backhaul link (BL), so that the relay node can realize the forwarding of data and / or signaling between the terminal and the target device, thereby expanding the coverage of the communication system. For example, such as Figure 2 As shown, the network node is a relay node.

[0141] The target device in the embodiment of the present application is deployed in a communication link, and is used to provide a device for a terminal to have a wireless communication function. The target device may be a base station, an access point, a node, an evolved node (environment Bureau, eNB) or a 5G base station (next generation base station, gNB), which refers to a device in an access network that communicates with a wireless terminal through one or more sectors on an air interface. By converting received air interface frames into Internet Protocol (IP) packets, the base station can act as a router between the wireless terminal and the rest of the access network, which may include an Internet Protocol network. The base station can also coordinate the management of the attributes of the air interface.

[0142] The target device may also be an application server, for example, a server of an intelligent traffic system (ITS), a server of a navigation application, a server of a payment application, a server of a medical information system, a server of an electronic information archive management, etc., which is not limited here. Figure 2 As shown, the target devices include access network devices and application servers.

[0143] The detection node in the embodiment of the present application is deployed in the communication link to monitor whether the communication link is an abnormal link. An abnormal detection model can be deployed on the detection node. The detection node can be a node deployed separately in the communication system, or a node deployed on each network node. It is not limited here and can be deployed according to the actual situation of the communication link. It can be understood that when the detection node is a node deployed on each network node, only one network node is detected, which can improve the efficiency of detection. When the detection node is a node deployed separately in the communication system, the detection node can obtain the network data of any network node in the communication link, thereby comprehensively analyzing the entire communication link, which can improve the accuracy of detection.

[0144] The detection node can be used to obtain network data of at least one network node in the communication link; obtain network features of the network data; and input the network features into the abnormal link detection model to obtain a detection result of whether the communication link is an abnormal link. Figure 3 , Figure 3 A schematic diagram of the structure of a detection node provided in an embodiment of the present application. Figure 3 As shown, the detection node 300 may include an input module 301, a feature acquisition module 302, a detection training module 303, an output module 304, and the like.

[0145] Among them, the input module 301 can be used to obtain network data of at least one network node in the communication link. The feature acquisition module 302 can be used to obtain the network features of the network data. The detection training module 303 can be used to detect the network features and obtain the detection result of whether the communication link is an abnormal link. The detection training module 303 can also be used to train the abnormal link detection model. The output module 304 can be used to output the detection result. When the detection result is an abnormal link, it can also be reported by the output module 304 (it can be reported to a pre-assigned business personnel, or it can be reported to the system, and the system assigns business personnel, etc., which is not limited here).

[0146] It should be noted that the abnormal link detection model provided in the present application can be applied to any communication link. In other application scenarios of abnormal detection, the training data in the sample set for training the abnormal detection model can be different from the network data in the embodiment of the present application, and the data features of the training data can also be different from the network features in the embodiment of the present application. The method for selecting the sample set can be adopted. Figure 1 The method described in the embodiment is selected and adopted Figure 1 The training is performed using the training method described in the embodiment.

[0147] See also Figure 4 , Figure 4 is a flow chart of an abnormal link detection method provided by an embodiment of the present application. The method can be applied to Figure 2 In any of the communication networks described, the method can be performed by an abnormal link detection model or an abnormal link detection device or a detection node or a terminal and the method includes but is not limited to the following steps:

[0148] S402: Receive network data from at least one network node in a communication link.

[0149] The network data may include but is not limited to the performance data of the network nodes and the network topology information of the communication links corresponding to the network nodes, etc., which are not limited here. The network topology information is used to describe the connection relationship between each network node in the communication link. The performance data may include but is not limited to at least one of the following information: signal-to-noise ratio, input signal level, errored seconds, severely errored seconds, unavailable time, skewness, etc., which can be specifically referred to the previous definition and will not be repeated here.

[0150] The present application does not limit the execution conditions of step S402. It can be sent by the network node at regular intervals. The time can be a fixed time, which is the same for all network nodes, or a different time corresponding to each network node; it can also be a dynamic time determined by an execution subject such as an abnormal link detection model or an abnormal link detection device or a detection node or a terminal. The time can be determined based on the channel quality, network load, etc., and is not limited here. The network data of the network node may be sent when a constraint condition is met. The constraint condition may include transmitting a new service, the service ends or is stopped from being transmitted or cannot be transmitted, and the number of transmitted services exceeds a threshold, etc. The network data of the network node may be sent after receiving a request sent by the execution subject to obtain the network data of the network node, etc.

[0151] S404: Acquire network features corresponding to the network data.

[0152] Among them, network characteristics are used to describe the performance characteristics of communication links, which can be obtained by statistical analysis based on network data of different dimensions, or acquired through network embedding methods, etc. For details, please refer to the previous definition and will not be repeated here.

[0153] S406: Input the network features into the first model to obtain the detection result of the communication link.

[0154] In an embodiment of the present application, the detection result of the communication link is used to indicate whether the communication link is an abnormal link. The first model is a model obtained when the training meets the preset conditions by training the second model obtained in the previous training based on the labeled samples, K labeled samples and M unlabeled samples in the first sample set. The K labeled samples are obtained by labeling the K unlabeled samples in the first sample set respectively, and the M unlabeled samples are unlabeled samples selected from the first sample set as negative samples. The first sample set includes the labeled samples and unlabeled samples pre-stored before selecting the K unlabeled samples and the M unlabeled samples. The method for selecting the K unlabeled samples and the M unlabeled samples, as well as the training method of the first model can be referred to. Figure 1 The described method will not be described in detail here.

[0155] In a possible example, before step S406, the method further includes: obtaining network topology information of the communication link; and using a set of pre-stored unlabeled samples and labeled samples corresponding to the network topology information as a first sample set. In other words, selecting unlabeled samples and labeled samples corresponding to the network topology information of the communication link as samples to be selected for training can improve the effect of model training and facilitate improving the accuracy of detecting whether a communication link is an abnormal link.

[0156] The network topology information may be obtained from the network data of the network nodes received in step S402, or may be obtained from the network data of the network nodes in the communication link obtained previously, or may be obtained from the network topology information of the pre-stored communication link, etc., which is not limited here.

[0157] In a possible example, the preset conditions include at least one of the following: the precision of the second model is greater than or equal to the first threshold; the recall rate of the second model is greater than or equal to the second threshold; the improvement in precision is less than or equal to the third threshold; the improvement in recall rate is less than or equal to the fourth threshold; the number of training times of the second model is greater than or equal to the fifth threshold; the accuracy rate of the second model is greater than or equal to the sixth threshold; the improvement in accuracy rate is less than or equal to the seventh threshold; the harmonic mean corresponding to the precision and recall rate is greater than or equal to the eighth threshold. In this way, by determining whether the second model is trained through different preset conditions, the accuracy of the first model in detecting abnormal links after training is completed can be improved.

[0158] In a possible example, before step S406, the method further includes: obtaining an abnormality score value of each unlabeled sample in the first sample set; arranging the abnormality score values ​​of each unlabeled sample in the first sample set in descending order to obtain a first sorting; and taking the unlabeled samples corresponding to the first K sequence numbers in the first sorting as K unlabeled samples. In other words, the selected samples to be labeled are the most abnormal K unlabeled samples in the first sample set, and the sample set for training the abnormal link detection model includes samples that may be abnormal, which can improve the effect of model training and facilitate improving the accuracy of detecting abnormal links.

[0159] In a possible example, before step S406, the method further includes: taking the unlabeled samples corresponding to the last L sequence numbers in the first sort as L unlabeled samples; and selecting M unlabeled samples from the L unlabeled samples. In other words, the selected unlabeled samples are M unlabeled samples randomly selected from the most normal L unlabeled samples in the first sample set, and the unlabeled samples are used as negative samples, then the newly added samples in the sample set for training the abnormal link detection model are samples of normal links, which can avoid the introduction of noise, improve the effect of model training, and facilitate improving the accuracy of detecting abnormal links.

[0160] In a possible example, before obtaining the abnormal score value of each unlabeled sample in the first sample set, the method also includes: obtaining the abnormal score value of each unlabeled sample in the second sample set, the second sample set includes the labeled samples and unlabeled samples pre-stored before selecting P unlabeled samples; arranging the abnormal score value of each unlabeled sample in the second sample set in descending order to obtain a second sorting; taking the unlabeled samples corresponding to the first P sequence numbers in the second sorting as P unlabeled samples; constructing a third model based on the labeled samples and P labeled samples in the second sample set, the P labeled samples are obtained by labeling the P unlabeled samples respectively, and the third model is the initialization model corresponding to the first model and the second model. In this way, the initialization model of the abnormal link detection model is constructed based on the P labeled samples corresponding to the most abnormal P unlabeled samples and the existing labeled samples, which can improve the effect of model training and facilitate the improvement of the accuracy of detecting abnormal links. In a possible example, M is equal to the number of positive samples in the labeled samples and K labeled samples in the first sample set. In this way, the number of negative samples added to the training sample set of the abnormal link detection model is equal to the number of positive samples in the sample set, which can achieve a balance between positive and negative samples, reduce label noise, and improve the accuracy of detecting abnormal links.

[0161] exist Figure 4 In the described method, after receiving the network data of the network nodes in the communication link, the network features of the network data are obtained, and then the network features are input into an abnormal link detection model obtained by training with samples selected from unlabeled samples and existing labeled samples, so as to detect the communication link and improve the accuracy of detecting abnormal links.

[0162] The method of the embodiment of the present application is described in detail above, and the device of the embodiment of the present application is provided below.

[0163] and Figure 1 For details on the embodiments shown in the drawings, see Figure 5 , Figure 5 is a structural diagram of a model training device provided in an embodiment of the present application. The model training device 500 may include a selection module 501 and a training model 502, wherein:

[0164] The selection module 501 is used to select K unlabeled samples from the first sample set; and select M unlabeled samples from the first sample set as negative samples, the first sample set including the labeled samples and unlabeled samples pre-stored before selecting the K unlabeled samples and the M unlabeled samples;

[0165] The training module 502 is used to train the second model obtained in the previous training according to the labeled samples, K labeled samples and M unlabeled samples in the first sample set, and obtain the first model when the training meets the preset conditions. The K labeled samples are obtained by labeling the K unlabeled samples in the first sample set respectively.

[0166] In a possible example, the selection module 501 is specifically used to obtain the abnormality score value of each unlabeled sample in the first sample set; the abnormality score value of each unlabeled sample in the first sample set is arranged in descending order to obtain a first sort; and the unlabeled samples corresponding to the first K sequence numbers in the first sort are used as K unlabeled samples. In other words, the selected samples to be labeled are the most abnormal K unlabeled samples in the first sample set, and the sample set for training the abnormal link detection model includes samples that may be abnormal, which can improve the effect of model training and facilitate the improvement of the accuracy of detecting abnormal links.

[0167] In a possible example, the selection module 501 is specifically used to select the unlabeled samples corresponding to the last L sequence numbers in the first sort as L unlabeled samples; and select M unlabeled samples from the L unlabeled samples. In other words, the selected unlabeled samples are M unlabeled samples randomly selected from the most normal L unlabeled samples in the first sample set, and the unlabeled samples are used as negative samples, then the samples newly added to the sample set for training the abnormal link detection model are samples of normal links, which can avoid the introduction of noise, improve the effect of model training, and facilitate improving the accuracy of detecting abnormal links.

[0168] In a possible example, the selection module 501 is specifically used to count the number of positive samples among the labeled samples and K labeled samples in the first sample set; according to the number of positive samples, M unlabeled samples are selected from the first sample set as negative samples, where M is equal to the number of positive samples among the labeled samples and K labeled samples in the first sample set. In other words, the number of negative samples added to the sample set for training the abnormal link detection model is equal to the number of positive samples in the sample set, which can relatively achieve a balance between positive and negative samples, reduce label noise, improve the effect of model training, and facilitate improving the accuracy of detecting abnormal links.

[0169] In a possible example, the selection module 501 is also used to obtain the abnormality score value of each unlabeled sample in the second sample set, the second sample set includes the labeled samples and unlabeled samples pre-stored before selecting P unlabeled samples; the second sorting is obtained by descending the abnormality score value of each unlabeled sample in the second sample set; the unlabeled samples corresponding to the first P sequence numbers in the second sorting are used as P unlabeled samples; a third model is constructed based on the labeled samples and P labeled samples in the second sample set, the P labeled samples are obtained by labeling the P unlabeled samples respectively, and the third model is the initialization model corresponding to the first model and the second model. In this way, the initialization model of the abnormal link detection model is constructed based on the P labeled samples corresponding to the most abnormal P unlabeled samples and the existing labeled samples, which can improve the effect of model training and facilitate the improvement of the accuracy of detecting abnormal links.

[0170] In a possible example, the network data includes at least one of the following: signal-to-noise ratio, input signal level, errored seconds, severe errored seconds, unavailable time, and network topology information. In this way, abnormal link detection can be performed using different network data to improve detection diversity.

[0171] exist Figure 5 In the device shown, K unlabeled samples are first selected from the first sample set, and then M unlabeled samples are selected from the first sample set as negative samples. After the K unlabeled samples are labeled, the K labeled samples obtained by labeling are used together with the M unlabeled samples and the labeled samples in the first sample set to train the second model obtained by the last training, thereby obtaining the first model that has been trained. In this way, by selecting samples from the unlabeled samples, the model can learn the distribution of positive and negative samples in the unlabeled samples during the training process. And according to the selected samples and the existing labeled samples, the model obtained by the last training is retrained to further improve the accuracy of detection.

[0172] and Figure 4 For details on the embodiments shown in the drawings, see Figure 6 , Figure 6 6 is a schematic diagram of the structure of an abnormal link detection device provided in an embodiment of the present application. The abnormal link detection device 600 may include a communication unit 601 and a processing unit 602, wherein:

[0173] The communication unit 601 is used to receive network data of at least one network node in the communication link;

[0174] The processing unit 602 is used to obtain network features corresponding to network data; the network features are input into the first model to obtain a detection result of the communication link, and the detection result is used to indicate whether the communication link is an abnormal link. The first model is based on the labeled samples, K labeled samples and M unlabeled samples in the first sample set, and the second model obtained by the previous training is trained. The model is obtained when the training meets the preset conditions. The K labeled samples are obtained by labeling the K unlabeled samples in the first sample set respectively. The first sample set includes unlabeled samples and labeled samples that are pre-stored before selecting the K unlabeled samples and the M unlabeled samples.

[0175] In a possible example, the processing unit 602 is further used to obtain an abnormality score value of each unlabeled sample in the first sample set; to obtain a first sorting by arranging in descending order according to the abnormality score value of each unlabeled sample in the first sample set; and to use the unlabeled samples corresponding to the first K sequence numbers in the first sorting as K unlabeled samples. In other words, the selected samples to be labeled are the most abnormal K unlabeled samples in the first sample set, and the sample set for training the abnormal link detection model includes samples that may be abnormal, which can improve the effect of model training and facilitate improving the accuracy of detecting abnormal links.

[0176] In a possible example, the processing unit 602 is further used to use the unlabeled samples corresponding to the last L sequence numbers in the first sort as L unlabeled samples; and select M unlabeled samples from the L unlabeled samples. In other words, the selected unlabeled samples are M unlabeled samples randomly selected from the most normal L unlabeled samples in the first sample set, and the unlabeled samples are used as negative samples, then the samples newly added to the sample set for training the abnormal link detection model are samples of normal links, which can avoid the introduction of noise, improve the effect of model training, and facilitate improving the accuracy of detecting abnormal links.

[0177] In a possible example, the processing unit 602 is also used to obtain an abnormality score value for each unlabeled sample in the second sample set, the second sample set includes labeled samples and unlabeled samples pre-stored before selecting P unlabeled samples; the second sorting is obtained by descending order according to the abnormality score value of each unlabeled sample in the second sample set; the unlabeled samples corresponding to the first P sequence numbers in the second sorting are used as P unlabeled samples; a third model is constructed based on the labeled samples and P labeled samples in the second sample set, the P labeled samples are obtained by labeling the P unlabeled samples respectively, and the third model is the initialization model corresponding to the first model and the second model. In this way, the initialization model of the abnormal link detection model is constructed based on the P labeled samples corresponding to the most abnormal P unlabeled samples and the existing labeled samples, which can improve the effect of model training and facilitate the improvement of the accuracy of detecting abnormal links.

[0178] In a possible example, M is equal to the number of positive samples in the labeled samples in the first sample set and the K labeled samples. In this way, the number of negative samples added to the sample set for training the abnormal link detection model is equal to the number of positive samples in the sample set, which can achieve a balance between positive and negative samples, reduce label noise, improve the effect of model training, and facilitate improving the accuracy of detecting abnormal links.

[0179] In a possible example, the processing unit 602 is further used to obtain network topology information of the communication link; and a set of pre-stored unlabeled samples and labeled samples corresponding to the network topology information and device information is used as the first sample set. In other words, selecting unlabeled samples and labeled samples corresponding to the network topology information of the communication link as samples to be selected for training can improve the effect of model training and facilitate improving the accuracy of detecting whether a communication link is an abnormal link.

[0180] In a possible example, the network data includes at least one of the following: signal-to-noise ratio, input signal level, errored seconds, severe errored seconds, unavailable time, and network topology information. In this way, abnormal link detection can be performed using different network data to improve detection diversity.

[0181] exist Figure 6 In the described device, after receiving the network data of the network nodes in the communication link, the network features of the network data are obtained, and then the communication link is detected by an abnormal link detection model obtained by training samples selected from unlabeled samples and existing labeled samples, thereby improving the detection accuracy.

[0182] See also Figure 7 , Figure 7 A device 700 provided in an embodiment of the present application includes a processor 701 , a memory 702 , and a communication interface 703 . The processor 701 , the memory 702 , and the communication interface 703 are interconnected via a bus 704 .

[0183] The memory 702 includes, but is not limited to, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM), or a portable read-only memory (CD-ROM), and the memory 702 is used for related computer programs and data. The communication interface 703 is used to receive and send data.

[0184] The processor 701 may be a device with a processing function, and may include one or more processors. The processor may be a general-purpose processor or a dedicated processor, etc. The processor may be a baseband processor or a central processing unit. The baseband processor may be used to process the communication protocol and communication data, and the central processing unit may be used to control the communication device, execute the software program, and process the data of the software program.

[0185] The processor 701 in the device 700 is used to read the computer program code stored in the memory 702. In an embodiment of the present application, the device 700 may include an abnormal link detection device, or a model training device, or a detection node or any other possible device.

[0186] When the device 700 is a model training device or a detection node, the processor 701 is used to perform the following operations:

[0187] Select K unlabeled samples from the first sample set;

[0188] Select M unlabeled samples from the first sample set as negative samples;

[0189] The second model obtained in the previous training is trained according to the labeled samples, K labeled samples and M unlabeled samples in the first sample set, and the first model is obtained when the training meets the preset conditions. The K labeled samples are obtained by labeling the K unlabeled samples in the first sample set respectively, and the first sample set includes the labeled samples and unlabeled samples pre-stored before selecting the K unlabeled samples and the M unlabeled samples.

[0190] In a possible example, the processor 701 is specifically configured to perform the following operations:

[0191] Obtain anomaly score values ​​for each unlabeled sample in the first sample set;

[0192] Arrange the anomaly score of each unlabeled sample in the first sample set in descending order to obtain a first ranking;

[0193] The unlabeled samples corresponding to the first K serial numbers in the first sort are taken as K unlabeled samples.

[0194] In a possible example, the processor 701 is specifically configured to perform the following operations:

[0195] The unlabeled samples corresponding to the last L numbers in the first sort are taken as L unlabeled samples;

[0196] Select M unlabeled samples from L unlabeled samples.

[0197] In a possible example, the processor 701 is specifically configured to perform the following operations:

[0198] Count the number of labeled samples in the first sample set and the number of positive samples in the K labeled samples;

[0199] According to the number of positive samples, M unlabeled samples are selected from the first sample set as negative samples, where M is equal to the number of positive samples.

[0200] In a possible example, before selecting K unlabeled samples from the first sample set, the processor 701 is further configured to perform the following operations:

[0201] Acquire network topology information of the communication link to be detected;

[0202] A set of pre-stored unlabeled samples and labeled samples corresponding to the network topology information is used as a first sample set. When the device 700 is an abnormal link detection apparatus, the processor 701 is used to perform the following operations:

[0203] receiving network data of at least one network node in the communication link;

[0204] Obtain network features corresponding to network data;

[0205] The network features are input into the first model to obtain the detection result of the communication link, and the detection result is used to indicate whether the communication link is an abnormal link. The first model is a model obtained when the training meets the preset conditions by training the second model obtained in the previous training based on the labeled samples, K labeled samples and M unlabeled samples in the first sample set. The K labeled samples are obtained by labeling the K unlabeled samples in the first sample set respectively, and the M unlabeled samples are unlabeled samples selected from the first sample set as negative samples. The first sample set includes the labeled samples and unlabeled samples stored in advance before selecting the K unlabeled samples and the M unlabeled samples.

[0206] In a possible example, before inputting the network features into the first model, the processor 701 is further configured to perform the following operations:

[0207] Obtain anomaly score values ​​for each unlabeled sample in the first sample set;

[0208] Arrange the anomaly score of each unlabeled sample in the first sample set in descending order to obtain a first ranking;

[0209] The unlabeled samples corresponding to the first K serial numbers in the first sort are taken as K unlabeled samples.

[0210] In a possible example, the processor 701 is further configured to perform the following operations:

[0211] The unlabeled samples corresponding to the last L numbers in the first sort are taken as L unlabeled samples;

[0212] Select M unlabeled samples from L unlabeled samples.

[0213] In a possible example, M is equal to the number of labeled samples in the first sample set and the number of positive samples in the K labeled samples.

[0214] In a possible example, before inputting the network features into the first model, the processor 701 is further configured to perform the following operations:

[0215] Obtain network topology information of communication links;

[0216] A set consisting of pre-stored unlabeled samples and labeled samples corresponding to the network topology information is used as a first sample set.

[0217] When the device 700 may include an abnormal link detection device, or a model training device, or a detection node or any other possible device, in a possible example, before obtaining the abnormality score value of each unlabeled sample in the first sample set, the processor 701 is further configured to perform the following operations:

[0218] Obtaining an anomaly score value of each unlabeled sample in a second sample set, where the second sample set includes labeled samples and unlabeled samples pre-stored before selecting the P unlabeled samples;

[0219] Arrange the anomaly score of each unlabeled sample in the second sample set in descending order to obtain a second ranking;

[0220] The unlabeled samples corresponding to the first P numbers in the second sorting are taken as P unlabeled samples;

[0221] A third model is constructed according to the labeled samples in the second sample set and P labeled samples, where the P labeled samples are obtained by labeling P unlabeled samples respectively, and the third model is an initialization model corresponding to the first model and the second model.

[0222] In a possible example, the network data includes at least one of the following: signal-to-noise ratio, level of input signal, bit error seconds, severe bit error seconds, unavailable time, and network topology information.

[0223] It should be noted that the implementation of each operation can also refer to Figure 1 and Figure 4 The corresponding description of the method embodiment shown.

[0224] The embodiment of the present application also provides a chip, including a processor and a memory, wherein the processor is used to call and execute instructions stored in the memory from the memory, so that a device equipped with the chip executes Figure 1 and Figure 4 Any of the methods shown.

[0225] The embodiment of the present application also provides another chip, including: an input interface, an output interface and a processing circuit, wherein the input interface, the output interface and the processing circuit are connected through an internal connection path, and the processing circuit is used to execute Figure 1 and Figure 4 Any of the methods shown.

[0226] The embodiment of the present application also provides another chip, including: an input interface, an output interface, a processor, and optionally, a memory, wherein the input interface, the output interface, the processor, and the memory are connected through an internal connection path, and the processor is used to execute the code in the memory. When the code is executed, the processor is used to execute Figure 1 and Figure 4 Any of the methods shown.

[0227] The embodiment of the present application also provides a chip system, including at least one processor, a memory and an interface circuit, wherein the memory, the transceiver and the at least one processor are interconnected through a line, and a computer program is stored in the at least one memory; when the computer program is executed by the processor, Figure 1 and Figure 4 The method flow shown is realized.

[0228] The present application also provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, which, when executed on a computer, Figure 1 and Figure 4 The method flow shown is realized.

[0229] The present application also provides a computer program product. When the computer program product is run on a computer, Figure 1 and Figure 4 The method flow shown is realized.

[0230] In summary, by implementing the embodiment of the present application, the second model obtained by the previous training is trained to obtain the first model based on the samples selected from the unlabeled samples and the existing labeled samples. After receiving the network data of the network nodes in the communication link, the network features of the network data are obtained, and then the network features are input into the first model to obtain the detection result of whether the communication link is an abnormal link, thereby improving the accuracy of the detection.

[0231] A person skilled in the art can understand that to implement all or part of the processes in the above-mentioned embodiments, the processes can be completed by a computer program or hardware related to the computer program, and the computer program can be stored in a computer-readable storage medium. When the computer program is executed, it can include the processes of the above-mentioned method embodiments. The aforementioned storage medium includes: ROM or random access memory RAM, magnetic disk or optical disk and other media that can store computer program codes.

Claims

1. A method for detecting abnormal links, characterized in that: include: receiving network data of at least one network node in the communication link; Obtaining network characteristics corresponding to the network data; The network feature is input into a first model to obtain a detection result of the communication link, wherein the detection result is used to indicate whether the communication link is an abnormal link. The first model is a model obtained when the training satisfies a preset condition by training a second model obtained in the previous training according to the labeled samples, K labeled samples and M unlabeled samples in the first sample set. The K labeled samples are obtained by respectively labeling the K unlabeled samples in the first sample set. The M unlabeled samples are unlabeled samples selected from the first sample set as negative samples according to the abnormality score value of each unlabeled sample in the first sample set. The first sample set includes labeled samples and unlabeled samples pre-stored before selecting the K unlabeled samples and the M unlabeled samples.

2. The method according to claim 1, characterized in that Before inputting the network features into the first model, the method further includes: Obtaining anomaly score values ​​for each unlabeled sample in the first sample set; Arrange the first sample set in descending order according to the anomaly score value of each unlabeled sample to obtain a first ranking; The unlabeled samples corresponding to the first K sequence numbers in the first sorting are used as the K unlabeled samples.

3. The method according to claim 2, characterized in that The method further comprises: The unlabeled samples corresponding to the last L sequence numbers in the first sorting are taken as L unlabeled samples; The M unlabeled samples are selected from the L unlabeled samples.

4. The method according to any one of claims 1 to 3, characterized in that The M is equal to the number of labeled samples in the first sample set and the number of positive samples in the K labeled samples.

5. The method according to claim 2 or 3, characterized in that: Before obtaining the abnormality score value of each unlabeled sample in the first sample set, the method further includes: Obtaining an anomaly score value of each unlabeled sample in a second sample set, where the second sample set includes labeled samples and unlabeled samples pre-stored before selecting the P unlabeled samples; Arrange the second sample set in descending order according to the anomaly score value of each unlabeled sample to obtain a second ranking; The unlabeled samples corresponding to the first P serial numbers in the second sorting are used as the P unlabeled samples; A third model is constructed according to the labeled samples in the second sample set and P labeled samples, where the P labeled samples are obtained by labeling the P unlabeled samples respectively, and the third model is an initialization model corresponding to the first model and the second model.

6. The method according to any one of claims 1 to 3, characterized in that Before inputting the network features into the first model, the method further includes: Acquiring network topology information of the communication link; A set consisting of pre-stored unlabeled samples and labeled samples corresponding to the network topology information is used as the first sample set.

7. The method according to any one of claims 1 to 3, characterized in that The network data includes at least one of the following: signal-to-noise ratio, level of input signal, errored seconds, severely errored seconds, unavailable time, skewness, and network topology information.

8. An abnormal link detection device, characterized in that: include: A communication unit, configured to receive network data of at least one network node in the communication link; A processing unit, used to obtain network features corresponding to the network data; The network feature is input into a first model to obtain a detection result of the communication link, wherein the detection result is used to indicate whether the communication link is an abnormal link. The first model is a model obtained when the training satisfies a preset condition by training a second model obtained in the previous training according to the labeled samples, K labeled samples and M unlabeled samples in the first sample set. The K labeled samples are obtained by respectively labeling the K unlabeled samples in the first sample set. The M unlabeled samples are unlabeled samples selected from the first sample set as negative samples according to the abnormality score value of each unlabeled sample in the first sample set. The first sample set includes labeled samples and unlabeled samples pre-stored before selecting the K unlabeled samples and the M unlabeled samples.

9. An abnormal link detection device, characterized in that: The method comprises a processor, a memory and a communication interface connected to the processor, wherein the memory is used to store one or more programs and is configured to be executed by the processor, and the programs include instructions for executing the steps in the method according to any one of claims 1 to 7.

10. A computer storage medium, characterized in that: The method comprises computer instructions, and when the computer instructions are executed on a terminal, the terminal is caused to execute the method according to any one of claims 1 to 7.

Images