Link detection method and device, storage medium, and computer equipment

Abstract

The present application discloses a link anomaly detection method and device, storage medium, and computer equipment, the method comprising: obtaining the start time, end time, and node ID of each link of multiple radio frequency links, determining the frame interval between each adjacent two radio frequency links based on the start time and end time; sorting each frame interval by value, and counting the number of occurrences of different frame interval values ​​in the total number of frame intervals, and determining the frame interval threshold based on the sorting and proportion; dividing the radio frequency link into session atoms according to the frame interval threshold; identifying abnormal links in the radio frequency link according to the session atoms, and outputting the node ID corresponding to the abnormal link. Compared with the link feature detection method based on the detection matrix in the prior art, the embodiment of the present application helps to improve the speed of link anomaly detection.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a link detection method and device, a storage medium, and a computer device. Background Art

[0002] With the rapid development of smart substations, the reliable operation of substation networks is the key to the application of network transmission in substations. In the existing technology, the link feature detection method based on the detection matrix meets the timeliness requirements of link feature extraction and classification, but the detection performance is poor; the link feature detection method based on distributed traveling waves has a low false alarm rate and good fault detection and positioning performance, but the detection process is time-consuming. In order to further improve the operation and maintenance level of smart substations, how to quickly detect link anomalies is a problem that needs to be solved urgently. Summary of the invention

[0003] In view of this, the present application provides a link anomaly detection method and device, a storage medium, and a computer device, which are helpful to quickly discover abnormal problems in the link.

[0004] According to one aspect of the present application, a link anomaly detection method is provided, the method comprising:

[0005] Obtaining the start time, end time and node ID of each link of multiple radio frequency links, and determining the frame interval between each two adjacent radio frequency links based on the start time and the end time;

[0006] Sorting the frame intervals according to the size of the values, and counting the proportions of the number of occurrences of different frame interval values ​​in the total number of frame intervals, and determining the frame interval threshold based on the sorting and the proportions;

[0007] dividing the radio frequency link into session atoms according to the frame interval threshold;

[0008] An abnormal link in the radio frequency link is identified according to the session atom, and a node ID corresponding to the abnormal link is output.

[0009] Optionally, the step of sorting the frame intervals according to the size of the values, counting the proportion of the number of occurrences of different frame interval values ​​in the total number of frame intervals, and determining the frame interval threshold based on the sorting and the proportion includes:

[0010] Sort the frame intervals in ascending order;

[0011] The first frame interval is used as a first frame interval threshold, and it is determined whether the first frame interval satisfies a preset frame interval threshold condition, wherein the preset frame interval threshold condition is that the ratio of the number of frame intervals less than or equal to the frame interval threshold to the total number of frame intervals reaches a preset ratio;

[0012] If the first frame interval satisfies the preset frame interval threshold condition, determining the first frame interval as the frame interval threshold;

[0013] If the first frame interval does not satisfy the preset frame interval threshold condition, the next frame interval in the order is used as the second frame interval threshold until a frame interval threshold that satisfies the preset frame interval threshold condition is obtained.

[0014] Optionally, dividing the radio frequency link into session atoms according to the frame interval threshold includes:

[0015] The start frame and the end frame are determined according to the frame interval being greater than the frame interval threshold, and the radio frequency link is divided based on the start frame and the end frame to obtain multiple session atoms.

[0016] Optionally, the identifying an abnormal link in the radio frequency link according to the session atom includes:

[0017] Obtain multiple time windows by presetting time, obtain the number of session atoms in each of the time windows, and obtain the decision threshold between different session atoms in the time windows;

[0018] If the number of the session atoms in the time window is greater than or equal to the decision threshold, it is determined that there is no abnormality in the radio frequency link in the time window;

[0019] If the number of the session atoms in the time window is less than the decision threshold, it is determined that an abnormality exists in the radio frequency link in the time window.

[0020] Optionally, after obtaining a plurality of time windows by preset time, obtaining the number of session atoms in each of the time windows, and obtaining the decision threshold between different session atoms in the time windows, the method further includes:

[0021] Aggregating the decision thresholds in each of the time windows to obtain an aggregated decision threshold;

[0022] If the sum of the session atoms in each of the time windows is greater than or equal to the aggregation decision threshold, it is determined that there is no abnormality in the radio frequency link;

[0023] If the sum of the session atoms in each of the time windows is less than the aggregation decision threshold, it is determined that an abnormality exists in the radio frequency link.

[0024] Optionally, the identifying an abnormal link in the radio frequency link according to the session atom further includes:

[0025] Get multiple time windows by presetting time;

[0026] Obtaining the signal-to-noise ratio of the nodes at both ends of each session atom in each time window, and obtaining the link interruption probability in each time window by using a time-frequency analysis method;

[0027] If the link interruption probability within the time window is less than the probability of a preset signal-to-noise ratio threshold, determining that an abnormality exists in the radio frequency link;

[0028] If the link interruption probability within the time window is greater than or equal to the probability of a preset signal-to-noise ratio threshold, it is determined that there is no abnormality in the radio frequency link.

[0029] Optionally, the outputting the node ID corresponding to the abnormal link includes:

[0030] The k-means clustering algorithm is used to classify abnormal links and output the classified abnormal links.

[0031] According to another aspect of the present application, a link anomaly detection device is provided, the device comprising:

[0032] An acquisition module, used to acquire the start time, end time and node ID of each link of multiple radio frequency links, and determine the frame interval between each two adjacent radio frequency links based on the start time and the end time;

[0033] A determination module, configured to sort the frame interval values, count the proportion of occurrences of different frame interval values ​​in the total number of frame intervals, and determine a frame interval threshold based on the sorting and the proportion;

[0034] A division module, used for dividing the radio frequency link into session atoms according to the frame interval threshold;

[0035] The output module is used to identify the abnormal link in the radio frequency link according to the session atom, and output the node ID corresponding to the abnormal link.

[0036] Optionally, the determining module is further used to:

[0037] Sort the frame intervals in ascending order;

[0038] The first frame interval is used as a first frame interval threshold, and it is determined whether the first frame interval satisfies a preset frame interval threshold condition, wherein the preset frame interval threshold condition is that the ratio of the number of frame intervals less than or equal to the frame interval threshold to the total number of frame intervals reaches a preset ratio;

[0039] If the first frame interval satisfies the preset frame interval threshold condition, determining the first frame interval as the frame interval threshold;

[0040] If the first frame interval does not satisfy the preset frame interval threshold condition, the next frame interval in the order is used as the second frame interval threshold until a frame interval threshold that satisfies the preset frame interval threshold condition is obtained.

[0041] Optionally, the division module is further used to:

[0042] The start frame and the end frame are determined according to the frame interval being greater than the frame interval threshold, and the radio frequency link is divided based on the start frame and the end frame to obtain multiple session atoms.

[0043] Optionally, the device further includes: a judgment module, configured to:

[0044] Obtain multiple time windows by presetting time, obtain the number of session atoms in each of the time windows, and obtain the decision threshold between different session atoms in the time windows;

[0045] If the number of the session atoms in the time window is greater than or equal to the decision threshold, it is determined that there is no abnormality in the radio frequency link in the time window;

[0046] If the number of the session atoms in the time window is less than the decision threshold, it is determined that an abnormality exists in the radio frequency link in the time window.

[0047] Optionally, the decision module is further used to: after obtaining multiple time windows through the preset time, obtaining the number of session atoms in each of the time windows, and obtaining the decision thresholds between different session atoms in the time windows, aggregate the decision thresholds in each of the time windows to obtain an aggregated decision threshold;

[0048] If the sum of the session atoms in each of the time windows is greater than or equal to the aggregation decision threshold, it is determined that there is no abnormality in the radio frequency link;

[0049] If the sum of the session atoms in each of the time windows is less than the aggregation decision threshold, it is determined that an abnormality exists in the radio frequency link.

[0050] Optionally, the output module is further used to:

[0051] Get multiple time windows by presetting time;

[0052] Obtaining the signal-to-noise ratio of the nodes at both ends of each session atom in each time window, and obtaining the link interruption probability in each time window by using a time-frequency analysis method;

[0053] If the link interruption probability within the time window is less than the probability of a preset signal-to-noise ratio threshold, determining that an abnormality exists in the radio frequency link;

[0054] If the link interruption probability within the time window is greater than or equal to the probability of a preset signal-to-noise ratio threshold, it is determined that there is no abnormality in the radio frequency link.

[0055] Optionally, the output module is further used to:

[0056] The k-means clustering algorithm is used to classify abnormal links and output the classified abnormal links.

[0057] According to another aspect of the present application, a storage medium is provided, on which a computer program is stored, and when the program is executed by a processor, the above-mentioned link anomaly detection method is implemented.

[0058] According to another aspect of the present application, a computer device is provided, including a storage medium, a processor, and a computer program stored on the storage medium and executable on the processor, wherein the processor implements the above-mentioned link anomaly detection method when executing the program.

[0059] By means of the above technical scheme, the present application provides a link anomaly detection method and device, storage medium, and computer equipment. First, the start time, end time, and node ID of each link of multiple radio frequency links are obtained, and the frame interval between each adjacent radio frequency link is determined based on the start time and end time; secondly, each frame interval is sorted by value, and the proportion of the number of occurrences of different frame interval values ​​in the total number of frame intervals is counted, and the frame interval threshold is determined based on the sorting and proportion; then, according to the frame interval threshold, the radio frequency link is divided into session atoms; finally, the abnormal link in the radio frequency link is identified according to the session atom, and the node ID corresponding to the abnormal link is output. Compared with the link feature detection method based on the detection matrix in the prior art, the embodiment of the present application improves the speed of link anomaly detection.

[0060] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0061] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0062] Figure 1 A schematic diagram of a link anomaly detection method provided in an embodiment of the present application is shown;

[0063] Figure 2 A schematic diagram of a frame interval distribution provided by an embodiment of the present application is shown;

[0064] Figure 3 A schematic diagram of a process flow of another link anomaly detection method provided in an embodiment of the present application is shown;

[0065] Figure 4 A schematic diagram of a process flow of another link anomaly detection method provided in an embodiment of the present application is shown;

[0066] Figure 5 A simulation schematic diagram of false alarm rate comparison provided by an embodiment of the present application is shown;

[0067] Figure 6 A simulation schematic diagram of a fault detection rate comparison provided by an embodiment of the present application is shown;

[0068] Figure 7 A simulation schematic diagram of a time-consuming comparison of a detection process provided by an embodiment of the present application is shown;

[0069] Figure 8 A schematic diagram of the structure of a link anomaly detection device provided in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0070] The present application will be described in detail below with reference to the accompanying drawings and in combination with embodiments. It should be noted that the embodiments and features in the embodiments of the present application can be combined with each other without conflict.

[0071] In this embodiment, a link abnormality detection method is provided. Figure 1 As shown, the method includes:

[0072] Step 101, obtaining the start time, end time and node ID of each link of multiple radio frequency links, and determining the frame interval between each two adjacent radio frequency links based on the start time and the end time;

[0073] Step 102, sorting the frame intervals according to the size of the values, and counting the proportion of the number of occurrences of different frame interval values ​​in the total number of frame intervals, and determining the frame interval threshold based on the sorting and the proportion;

[0074] Step 103, dividing the radio frequency link into session atoms according to the frame interval threshold;

[0075] Step 104: Identify an abnormal link in the radio frequency link according to the session atom, and output a node ID corresponding to the abnormal link.

[0076] Embodiments of the present application can be used in various wireless networks to detect whether there are abnormalities in the links. Embodiments of the present application obtain the start time and end time of multiple radio frequency links, and obtain the node ID of each link through positioning technology. In many scenarios, a certain area only contains one node. If the positioning accuracy is sufficient to clearly distinguish two different nodes, the location information can be used as the node ID at this time. The time information of each radio frequency transmission can be detected by an energy-based signal detector or a Bayesian-based signal detector, etc. The frame interval between adjacent two radio frequency links is determined according to the start time and end time. The interval between frames can better reflect the channel access characteristics of the wireless network; sort the frame intervals according to the value size, and count the proportion of the occurrence times of different frame interval values in the total number of frame intervals. Determine the frame interval threshold based on the sorting and proportion; according to the frame interval threshold, divide the radio frequency link into session atoms. A session atom is composed of adjacent start frames and end frames and all frames in between; identify abnormal links in the radio frequency link according to the session atoms, and output the node ID corresponding to the abnormal link.

[0077] By applying the technical solution of this embodiment, the frame interval ratio is used to find the frame interval threshold, the abnormal link is identified through the session atom, and the location information corresponding to the abnormal link is output, reducing the detection range, and thus improving the speed of discovering link abnormalities.

[0078] It should be noted that the Carrier Sense Multiple Access with Collision Avoidance (CSMA / CA) mechanism ensures that ongoing communications are not interrupted and enables multi-user access at the same time. The sum of the Distributed Inter-Frame Space (DIFS) and the Random Backoff (BO) separates between two session atoms. The above process is mainly controlled by the Network Allocation Vector and the Binary Exponential Backoff, and the frame interval must satisfy the constraint condition: Short Inter-Frame Space (SIFS) < DIFS < DIFS + BO. It is precisely due to the existence of this constraint condition that the CSMA / CA wireless network signal exhibits the characteristic of local aggregation in time. Therefore, the observed frames can be divided into session atoms.

[0079] Furthermore, as a refinement and extension of the specific implementation manner of the above embodiment, in order to fully illustrate the specific implementation process of this embodiment, another link abnormality detection method is provided, as Figure 3 shown. This method includes:

[0080] Step 301, obtain the start time, end time of multiple radio frequency links, and the node ID of each link, and determine the frame interval between adjacent two radio frequency links based on the start time and the end time;

[0081] Step 302, sorting the frame intervals in ascending order of value, taking the first frame interval as the first frame interval threshold, and judging whether the first frame interval meets a preset frame interval threshold condition, wherein the preset frame interval threshold condition is that the ratio of the number of frame intervals less than or equal to the frame interval threshold to the total number of frame intervals reaches a preset ratio; if the first frame interval meets the preset frame interval threshold condition, determining the first frame interval as the frame interval threshold; if the first frame interval does not meet the preset frame interval threshold condition, continuing to take the next frame interval in the order as the second frame interval threshold, until a frame interval threshold that meets the preset frame interval threshold condition is obtained;

[0082] In the embodiment of the present application, the start time, end time and node ID of multiple radio frequency links are obtained, and the frame interval between each adjacent radio frequency link is calculated according to the start time and end time of the link; each frame interval is sorted in order from small to large, and the frame interval is sorted from small to large as 5, 10, 15, 20, and the number of times each value is taken is 20, 5, 45, 30, respectively. The frame interval 5 ranked first is used as the first frame interval threshold, and it is judged whether the first frame interval meets the preset frame interval threshold condition. The preset frame interval threshold condition is that the number of frame intervals less than or equal to the frame interval threshold accounts for the proportion of the total number of frame intervals to reach a preset ratio. In the extraction of the frame interval threshold, the preset ratio is a value pre-set based on experience. The larger the preset ratio, the larger the frame interval threshold determined by it, and vice versa. In actual situations, the network and channel environments vary greatly, and the preset ratio should be determined based on the statistical distribution of the frame interval, that is, the worse the environment, the more conflicts, the smaller the proportion of typical frame intervals, and the preset ratio value should be appropriately reduced, otherwise it will increase. Assuming the preset ratio is 30%, the number of frame intervals of the frame interval threshold 5 is 20, accounting for 20% of the total number of frame intervals of 100. If 20% is less than 30%, the first frame interval 5 is determined to be the frame interval threshold; assuming the preset ratio is 5%, 20% is greater than 5%, the first frame interval does not meet the preset frame interval threshold condition, and the next frame interval 10 is continued to be used as the second frame interval threshold until the frame interval threshold that meets the preset frame interval threshold condition is obtained; 10 is used as the second frame interval threshold, and the number of frame intervals of the frame interval threshold 10 is 5, accounting for 5% of the total number of frame intervals of 100. , 5% is equal to 5%, then the second frame interval 10 is determined to be the frame interval threshold; in the absence of noise and interference collision, the frame interval threshold should take the minimum value of all frame intervals. In actual situations, noise and interference collisions cause the observed value of the frame interval to deviate from the original design value of the protocol. At this time, the minimum frame interval is not necessarily the most appropriate frame interval threshold. In order to more intuitively understand the distribution of frame intervals and find a suitable frame interval threshold, this application uses the NS2 simulation platform to establish an 802.11g wireless network, collects and counts the frame intervals of 47535 frames within 30s, and obtains the frame interval distribution as shown in the figure. Figure 2 shown. Figure 2 Among them, the frame length of 10us accounts for nearly 70%, and the "Short Interframe Space (SIFS)" of the 802.11g protocol is exactly 10us. Therefore, the frame interval ratio is considered to find the frame interval threshold.

[0083] Step 303, determining the start frame and the end frame according to the frame interval being greater than the frame interval threshold, dividing the radio frequency link based on the start frame and the end frame, and obtaining a plurality of session atoms;

[0084] Step 304, obtaining multiple time windows by presetting time, obtaining the signal-to-noise ratio of the nodes at both ends of each session atom in each time window, and obtaining the link interruption probability in each time window by using a time-frequency analysis method;

[0085] Step 305: Use the k-means clustering algorithm to classify the abnormal links, and output the classified abnormal links.

[0086] In the embodiment of the present application, the start frame and the end frame are determined according to the frame interval being greater than the frame interval threshold, and the radio frequency link is divided to obtain multiple reconstructed sub-frames. For the reconstructed sub-frames obtained, it is necessary to formally judge whether each session atom is reasonable: a legal session atom contains and only contains frames sent by two different nodes. The obtained session atom may contain more than two sending nodes of the frames, and it occurs in two situations: ① The frame interval threshold is reasonable, but due to interference, the interval between two or more session atoms is too small and cannot be distinguished from each other; ② The frame interval threshold is too large, and multiple session atoms are mistakenly divided into one session atom. In order to distinguish these two situations, it is necessary to count the proportion of the minimum frame interval in all frame intervals of the erroneous session atom. When the minimum frame interval accounts for a small proportion, the erroneous session atom is caused by interference: when the minimum frame interval accounts for a large proportion, the erroneous session atom is caused by the excessively large frame interval threshold. For the first case, this paper adopts a discard strategy, that is, the session atom is not used to infer the connection; for the second case, the frame interval threshold needs to be adjusted to reduce the error rate of session atom division. Multiple time windows are obtained by presetting the time. The preset time is reasonably set according to experience. The signal-to-noise ratio of the nodes at both ends of each session atom in each time window is obtained, and the link interruption probability in each time window is obtained by using the time-frequency analysis method. Assuming that the maximum transmission power of each transit node in the network is the same, it is recorded as P max In order to make the interference to the main node less than Q when the secondary node and the next transit node forward data, the relationship between the transmission power of the secondary node and the next transit node is as follows:

[0087]

[0088]

[0089] Among them, h s，v ,h rk，v They represent the channel fading parameters from the transmitting node and the transfer node to the main receiving node. The signal-to-noise ratio calculation formula from the secondary node to the next transfer node rk is as follows:

[0090]

[0091] Among them, h s，rkrepresents the channel fading parameter from the transmitting node to the relay node, and N0 represents the number of relay nodes. The signal-to-noise ratio calculation formula from the transmitting node to the relay node rk and then to the receiving node is:

[0092]

[0093] Among them, h rk，d represents the channel fading parameter from the transfer node to the secondary receiving node. According to the above calculation, the signal-to-noise ratio calculation formula of the secondary node transmitting the signal to the receiving node is:

[0094] y lot =max(min(y s,rk ,y rk，d ))

[0095] Among them, ruler is the set of transfer nodes. The corresponding cumulative distribution function F(y) is:

[0096]

[0097] In which, it is assumed that any two link channels in the hierarchical heterogeneous network obey Rayleigh fading, and its coefficient |h i,j | 2 It obeys exponential distribution, i and j represent different receiving nodes.

[0098]

[0099] Among them, λ i,j Represents the probability distribution parameter. Similarly, the signal-to-noise ratio distribution function from the transit node to the receiving node is obtained. Then the network link interruption probability is obtained, which is the probability that the signal-to-noise ratio of the nodes at both ends is less than the signal-to-noise ratio threshold. The corresponding calculation formula is:

[0100]

[0101] The link interruption probability is calculated through the above process.

[0102] If the probability of link interruption within the time window is less than the probability of the preset signal-to-noise ratio threshold, it is determined that there is an abnormality in the radio frequency link; if the probability of link interruption within the time window is greater than or equal to the probability of the preset signal-to-noise ratio threshold, it is determined that there is no abnormality in the radio frequency link; the k-means clustering algorithm is used to classify abnormal links, and the classification of abnormal links includes: network congestion, network attack and network interruption, etc., and the classified abnormal link ID is output; the embodiment of the present application uses the k-means clustering algorithm (K-means algorithm) for feature classification. The core of the algorithm is to set parameters as the center point of each subset, calculate the similarity between the points in the data set and the center point, and classify the points into the subset with the highest similarity, and then calculate the mean in each subset to select the center point, and repeat the above steps until the center point no longer changes. The similarity is calculated using the minimization of the square error:

[0103]

[0104] Where: E is the sum of the mean square errors between all points in the data set, k j is a point in the randomly selected data set that is not the center point of this round, and C is the center point selected in this round. The K-means algorithm is based on the pre-set parameter K and is greatly affected by noise data that contains large differences from normal values. The specific steps of the algorithm are as follows:

[0105] Input: number of clusters K and a dataset with n objects.

[0106] Output: K cluster centers and their objects.

[0107] 1) Randomly select K objects as center points in a data set containing n objects;

[0108] 2) Calculate the distance from the center point and cluster the remaining data objects in the data set into the cluster with the smallest distance from the center point;

[0109] 3) Recalculate n center points in each cluster;

[0110] 4) Repeat steps 2) and 3) until the center point no longer changes;

[0111] 5) Output the results.

[0112] By applying the technical solution of this embodiment, the accuracy of the frame interval threshold is improved, thereby improving the accuracy of the RF link test, and the probability of RF link interruption is calculated based on the session atoms, thereby narrowing the detection range and improving the detection speed of the RF link.

[0113] Further, as a refinement and extension of the specific implementation of the above embodiment, in order to fully illustrate the specific implementation process of this embodiment, another link anomaly detection method is provided, such as Figure 4 As shown, the method includes:

[0114] Step 401, obtaining the start time, end time and node ID of each link of multiple radio frequency links, and determining the frame interval between each two adjacent radio frequency links based on the start time and the end time;

[0115] Step 402, sorting the frame intervals according to the size of the values, and counting the proportion of the number of occurrences of different frame interval values ​​in the total number of frame intervals, and determining the frame interval threshold based on the sorting and the proportion;

[0116] Step 403, dividing the radio frequency link into session atoms according to the frame interval threshold;

[0117] Step 404, obtaining multiple time windows by preset time, obtaining the number of session atoms in each of the time windows, and obtaining the decision threshold between different session atoms in the time window;

[0118] Step 405, aggregate the decision thresholds within each of the time windows to obtain an aggregate decision threshold; if the sum of the session atoms within each of the time windows is greater than or equal to the aggregate decision threshold, it is determined that there is no abnormality in the radio frequency link; if the sum of the session atoms within each of the time windows is less than the aggregate decision threshold, it is determined that there is an abnormality in the radio frequency link, and the node ID corresponding to the abnormal link is output.

[0119] In an embodiment of the present application, the start time, end time and node ID of each link of multiple radio frequency links are obtained, and the frame interval between each adjacent radio frequency link is determined according to the start time and the end time; each frame interval is sorted according to the value, and the proportion of the number of occurrences of different frame interval values ​​in the total number of frame intervals is counted, and the frame interval threshold is determined based on the sorting and the proportion; according to the frame interval threshold, the radio frequency link is divided into session atoms, multiple time windows are obtained by preset time, the number of session atoms in each time window is obtained, and the decision threshold of different session atoms in the time window is obtained, for example, using represents the time window t p =[pT win , (p+1)T win ) is the result of the connection relationship between the nodes, where Represents node φ i and φ j The connection between them is from φ i Pointing to φ j , p = 0, 1, ..., T / T win ”,·” means rounding down. Note that the time window t p Internal node φ i and φj The number of session atoms between is,φ i and φ j The decision threshold within the window where the connection exists is The judgment method is:

[0120]

[0121] When the number of session atoms in the time window is greater than or equal to the decision threshold, it is determined that the radio link in the time window is connected, and 1 indicates that there is no abnormality. If the number of session atoms in the time window is less than the decision threshold, it is determined that there is no connection in the radio link in the time window, and 0 indicates that there is an abnormality. The decision thresholds in each time window are aggregated to obtain the aggregated decision thresholds. For example:

[0122] use b T Represents the aggregation decision threshold. The aggregation rules are:

[0123]

[0124] If the sum of the session atoms in each time window is greater than or equal to the aggregation decision threshold, it is determined that there is no abnormality in the RF link, which is indicated by 1; if the sum of the session atoms in each time window is less than the aggregation decision threshold, it is determined that there is an abnormality in the RF link, which is indicated by 0, and the node ID corresponding to the abnormal link is output.

[0125] It should be noted that in order to verify the comprehensive effectiveness of the proposed steady-state link feature extraction and classification method based on inter-frame spacing technology, a simulation was conducted. The simulation environment is: Windows 7 system, 4GDDR4, processor model is Intel Core i5-7500, CPU frequency is 2.6GHz, simulation software is MATLAB2016b. The specific experimental content and experimental results are as follows:

[0126] Experiment 1: Comparison of false alarm rates of three methods

[0127] The proposed method is used in experiments with a layered heterogeneous network link interruption fault detection method based on genetic algorithm and a layered heterogeneous network link interruption fault detection method based on distributed traveling waves. Samples with different numbers of links are randomly selected as experimental samples to compare the false alarm rates of the three methods. The experimental results are shown in Figure 2. Figure 5 As shown, Figure 5 In this paper, EBD represents the proposed steady-state link feature extraction and classification method based on inter-frame spacing technology, EGA represents the hierarchical heterogeneous network link interruption fault detection method based on genetic algorithm, and ETW represents the hierarchical heterogeneous network link interruption fault detection method based on distributed traveling waves.

[0128] Depend on Figure 5It can be seen that when the number of links is different, the detection false alarm rates of the three methods all increase with the increase of the number of network links. Observing the detection false alarm rate curves corresponding to each method, the false alarm rate curve of the proposed method is the most gentle, indicating that the change of its false alarm rate with the increase of the number of links is small; when the number of links is the same, among the three methods, the false alarm rate of the hierarchical heterogeneous network link interruption fault detection method based on genetic algorithm is the highest, and the detection false alarm rate of the proposed method is the lowest; Based on the above analysis, the following conclusions can be drawn: the detection false alarm rate of the proposed method is lower than that of the experimental comparison method, and the accuracy of link fault detection is significantly improved.

[0129] Experiment 2: Comparison of fault detection rates of three methods

[0130] Experiments were conducted using the proposed method, a layered heterogeneous network link interruption fault detection method based on genetic algorithm, and a layered heterogeneous network link interruption fault detection method based on distributed traveling waves. The link fault detection rates of the three methods were compared. The experimental results are shown in Figure 2. Figure 6 shown. Figure 6 In the example, LN represents the number of network links in the experiment, in units of bars, and is represented by t; FDR represents the fault detection rate, in units of %; EBD, EGA, and E1W represent the same meaning as Figure 5 Same as in.

[0131] analyze Figure 6 Data show that when the number of network links is the same, among the three methods, the link fault detection rate of the proposed method is the highest, and is not less than 90.75%; when the number of links is different, the link fault detection rate of the three methods decreases with the increase of the number of links. When the increase in the number of links is the same, the fault detection rate of the proposed method decreases the least; Based on the above analysis, the following conclusions can be drawn: the proposed method has the highest fault detection recall rate and the best recall performance.

[0132] Experiment 3: Comparison of detection efficiency of three methods

[0133] Experiments were conducted using the proposed method, a layered heterogeneous network link interruption fault detection method based on genetic algorithm, and a layered heterogeneous network link interruption fault detection method based on distributed traveling waves. The relationship between the detection time of each method and the change in the number of links was compared to evaluate the detection efficiency of each method. The experimental data when the number of links was 100, 300, and 600 were recorded, and the experimental results were obtained as follows: Figure 7 shown. Figure 7 In the above table, Method represents the link interruption fault detection method; Time represents the detection time in seconds; the remaining letters have the same meaning as Figure 7 same.

[0134] analyze Figure 7The data shows that when the number of links increases from 100 to 300, the detection time of the proposed method increases by 10.64s. The experimental comparison shows that the detection time of the other two methods increases by 14.12s and 17.26s. When the number of links increases by the same amount, the increase in detection time of the proposed method is the least. When the number of links is 600, the detection time of the proposed method is 10.13s shorter than that of the hierarchical heterogeneous network link interruption fault detection method based on genetic algorithm, and 19.54s shorter than that of the hierarchical heterogeneous network link interruption fault detection method based on distributed traveling wave. The proposed method has the shortest detection time. Based on the above analysis, the following conclusions can be drawn: the detection time of the proposed method is shorter and the operation efficiency is higher.

[0135] Further, as Figure 1 The specific implementation of the method, the embodiment of the present application provides a link abnormality detection device, such as Figure 8 As shown, the device comprises:

[0136] An acquisition module, used to acquire the start time, end time and node ID of each link of multiple radio frequency links, and determine the frame interval between each two adjacent radio frequency links based on the start time and the end time;

[0137] A determination module, configured to sort the frame interval values, count the proportion of occurrences of different frame interval values ​​in the total number of frame intervals, and determine a frame interval threshold based on the sorting and the proportion;

[0138] A division module, used for dividing the radio frequency link into session atoms according to the frame interval threshold;

[0139] The output module is used to identify the abnormal link in the radio frequency link according to the session atom, and output the node ID corresponding to the abnormal link.

[0140] Optionally, the determining module is further used to:

[0141] Sort the frame intervals in ascending order;

[0142] The first frame interval is used as a first frame interval threshold, and it is determined whether the first frame interval satisfies a preset frame interval threshold condition, wherein the preset frame interval threshold condition is that the ratio of the number of frame intervals less than or equal to the frame interval threshold to the total number of frame intervals reaches a preset ratio;

[0143] If the first frame interval satisfies the preset frame interval threshold condition, determining the first frame interval as the frame interval threshold;

[0144] If the first frame interval does not satisfy the preset frame interval threshold condition, the next frame interval in the order is used as the second frame interval threshold until a frame interval threshold that satisfies the preset frame interval threshold condition is obtained.

[0145] Optionally, the division module is further used to:

[0146] The start frame and the end frame are determined according to the frame interval being greater than the frame interval threshold, and the radio frequency link is divided based on the start frame and the end frame to obtain multiple session atoms.

[0147] Optionally, the device further includes: a judgment module, configured to:

[0148] Obtain multiple time windows by presetting time, obtain the number of session atoms in each of the time windows, and obtain the decision threshold between different session atoms in the time windows;

[0149] If the number of the session atoms in the time window is greater than or equal to the decision threshold, it is determined that there is no abnormality in the radio frequency link in the time window;

[0150] If the number of the session atoms in the time window is less than the decision threshold, it is determined that an abnormality exists in the radio frequency link in the time window.

[0151] Optionally, the decision module is further used to: after obtaining multiple time windows through the preset time, obtaining the number of session atoms in each of the time windows, and obtaining the decision thresholds between different session atoms in the time windows, aggregate the decision thresholds in each of the time windows to obtain an aggregated decision threshold;

[0152] If the sum of the session atoms in each of the time windows is greater than or equal to the aggregation decision threshold, it is determined that there is no abnormality in the radio frequency link;

[0153] If the sum of the session atoms in each of the time windows is less than the aggregation decision threshold, it is determined that an abnormality exists in the radio frequency link.

[0154] Optionally, the output module is further used to:

[0155] Get multiple time windows by presetting time;

[0156] Obtaining the signal-to-noise ratio of the nodes at both ends of each session atom in each time window, and obtaining the link interruption probability in each time window by using a time-frequency analysis method;

[0157] If the link interruption probability within the time window is less than the probability of a preset signal-to-noise ratio threshold, determining that an abnormality exists in the radio frequency link;

[0158] If the link interruption probability within the time window is greater than or equal to the probability of a preset signal-to-noise ratio threshold, it is determined that there is no abnormality in the radio frequency link.

[0159] Optionally, the output module is further used to:

[0160] The k-means clustering algorithm is used to classify abnormal links and output the classified abnormal links.

[0161] It should be noted that for other corresponding descriptions of the functional units involved in the link anomaly detection device provided in the embodiment of the present application, reference can be made to Figure 1 , Figure 3 and Figure 4 The corresponding description in the method will not be repeated here.

[0162] Based on the above Figure 1 , Figure 3 and Figure 4 The method shown in the embodiment of the present application accordingly provides a storage medium on which a computer program is stored, and when the computer program is executed by a processor, the above-mentioned Figure 1 , Figure 3 and Figure 4 The link anomaly detection method shown.

[0163] Based on this understanding, the technical solution of the present application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.), and includes a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each implementation scenario of the present application.

[0164] Based on the above Figure 1 , Figure 3 and Figure 4 The method shown, and Figure 8 In order to achieve the above-mentioned purpose, the embodiment of the present application further provides a computer device, which can be a personal computer, a server, a network device, etc. The computer device includes a storage medium and a processor; the storage medium is used to store a computer program; the processor is used to execute the computer program to achieve the above-mentioned Figure 1 , Figure 3 and Figure 4 The link anomaly detection method shown.

[0165] Optionally, the computer device may further include a user interface, a network interface, a camera, a radio frequency (RF) circuit, a sensor, an audio circuit, a WI-FI module, etc. The user interface may include a display, an input unit such as a keyboard, etc., and the optional user interface may also include a USB interface, a card reader interface, etc. The network interface may optionally include a standard wired interface, a wireless interface (such as a Bluetooth interface, a WI-FI interface), etc.

[0166] Those skilled in the art will appreciate that the computer device structure provided in this embodiment does not limit the computer device, and may include more or fewer components, or a combination of certain components, or different component arrangements.

[0167] The storage medium may also include an operating system and a network communication module. The operating system is a program that manages and saves the hardware and software resources of the computer device, and supports the operation of information processing programs and other software and / or programs. The network communication module is used to realize communication between the components inside the storage medium, and communication with other hardware and software in the physical device.

[0168] Through the description of the above implementation methods, those skilled in the art can clearly understand that the present application can be implemented by means of software plus necessary general hardware platforms, or by hardware to obtain the start time, end time and node ID of each link of multiple radio frequency links, and determine the frame interval between each adjacent radio frequency link based on the start time and end time; sort each frame interval by value, and count the number of occurrences of different frame interval values ​​in the total number of frame intervals, and determine the frame interval threshold based on the sorting and proportion; divide the radio frequency link into session atoms according to the frame interval threshold; identify abnormal links in the radio frequency link according to the session atoms, and output the node ID corresponding to the abnormal link. Compared with the link feature detection method based on the detection matrix in the prior art, the embodiment of the present application improves the speed of link anomaly detection.

[0169] Those skilled in the art will appreciate that the accompanying drawings are only schematic diagrams of a preferred implementation scenario, and the modules or processes in the accompanying drawings are not necessarily necessary for implementing the present application. Those skilled in the art will appreciate that the modules in the devices in the implementation scenario can be distributed in the devices of the implementation scenario according to the description of the implementation scenario, or can be changed accordingly and located in one or more devices different from the present implementation scenario. The modules of the above-mentioned implementation scenario can be combined into one module, or can be further split into multiple submodules.

[0170] The above serial numbers of this application are only for description and do not represent the advantages and disadvantages of the implementation scenarios. The above disclosure is only a few specific implementation scenarios of this application, but this application is not limited to them, and any changes that can be thought of by technicians in this field should fall within the scope of protection of this application.

Claims

1. A link anomaly detection method, characterized in that: The method comprises: Obtaining the start time, end time and node ID of each link of multiple radio frequency links, and determining the frame interval between each two adjacent radio frequency links based on the start time and the end time; Sorting the frame intervals according to the size of the values, and counting the proportions of the number of occurrences of different frame interval values ​​in the total number of frame intervals, and determining the frame interval threshold based on the sorting and the proportions; According to the frame interval threshold, dividing the radio frequency link into session atoms, including: determining a start frame and an end frame according to the frame interval being greater than the frame interval threshold, dividing the radio frequency link based on the start frame and the end frame, and obtaining a plurality of session atoms; wherein one session atom is composed of an adjacent start frame and an end frame and all frames therebetween; An abnormal link in the radio frequency link is identified according to the session atom, and a node ID corresponding to the abnormal link is output.

2. The link anomaly detection method according to claim 1, characterized in that: The step of sorting the frame intervals according to the size of the values, counting the proportion of the number of occurrences of different frame interval values ​​in the total number of frame intervals, and determining the frame interval threshold based on the sorting and the proportion includes: Sort the frame intervals in ascending order; The first frame interval is used as a first frame interval threshold, and it is determined whether the first frame interval satisfies a preset frame interval threshold condition, wherein the preset frame interval threshold condition is that the ratio of the number of frame intervals less than or equal to the frame interval threshold to the total number of frame intervals reaches a preset ratio; If the first frame interval satisfies the preset frame interval threshold condition, determining the first frame interval as the frame interval threshold; If the first frame interval does not satisfy the preset frame interval threshold condition, the next frame interval in the order is used as the second frame interval threshold until a frame interval threshold that satisfies the preset frame interval threshold condition is obtained.

3. The link anomaly detection method according to claim 1 or 2, characterized in that: The identifying an abnormal link in the radio frequency link according to the session atom includes: Obtain multiple time windows by presetting time, obtain the number of session atoms in each of the time windows, and obtain the decision threshold between different session atoms in the time windows; If the number of the session atoms in the time window is greater than or equal to the decision threshold, it is determined that there is no abnormality in the radio frequency link in the time window; If the number of the session atoms in the time window is less than the decision threshold, it is determined that an abnormality exists in the radio frequency link in the time window.

4. The link anomaly detection method according to claim 1 or 2, characterized in that: The identifying an abnormal link in the radio frequency link according to the session atom further includes: Get multiple time windows by presetting time; Obtaining the signal-to-noise ratio of the nodes at both ends of each session atom in each time window, and obtaining the link interruption probability in each time window by using a time-frequency analysis method; If the link interruption probability within the time window is less than the probability of a preset signal-to-noise ratio threshold, determining that an abnormality exists in the radio frequency link; If the link interruption probability within the time window is greater than or equal to the probability of a preset signal-to-noise ratio threshold, it is determined that there is no abnormality in the radio frequency link.

5. The link anomaly detection method according to claim 1 or 2, characterized in that: The outputting the node ID corresponding to the abnormal link includes: The k-means clustering algorithm is used to classify abnormal links and output the classified abnormal links.

6. A link anomaly detection device, characterized in that: The device comprises: An acquisition module, used to acquire the start time, end time and node ID of each link of multiple radio frequency links, and determine the frame interval between each two adjacent radio frequency links based on the start time and the end time; A determination module, configured to sort the frame interval values, count the proportion of occurrences of different frame interval values ​​in the total number of frame intervals, and determine a frame interval threshold based on the sorting and the proportion; A division module, used for dividing the radio frequency link into session atoms according to the frame interval threshold; An output module, configured to identify an abnormal link in the radio frequency link according to the session atom, and output a node ID corresponding to the abnormal link; The division module is further used to: determine the start frame and the end frame according to the frame interval being greater than the frame interval threshold, divide the radio frequency link based on the start frame and the end frame, and obtain multiple session atoms; wherein a session atom is composed of adjacent start frames and end frames and all frames therebetween.

7. A storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method for detecting link anomalies according to any one of claims 1 to 5 is implemented.

8. A computer device comprising a storage medium, a processor, and a computer program stored in the storage medium and executable on the processor, characterized in that: When the processor executes the computer program, the method for link anomaly detection described in any one of claims 1 to 5 is implemented.

Images