Network configuration feature extraction method and related apparatus

Abstract

The embodiment of the application provides a network configuration feature extraction method and related device, the method comprises the following steps: obtaining a first configuration feature based on a preset rule and a network element configuration file, wherein the preset rule comprises a first rule and a second rule, the first rule is used for extracting a first configuration object and a second configuration object from the network element configuration file, the second rule comprises a connection relationship between the first configuration object and the second configuration object, and the first configuration feature indicates parameter attributes and / or function attributes of the first configuration object and the second configuration object. The application can efficiently obtain the information of the configuration object of the network element to realize efficient and accurate network configuration anomaly detection.

Description

Technical Field

[0001] This invention relates to the field of communication technology, and in particular to a method and related apparatus for extracting network configuration features. Background Technology

[0002] During the deployment and service activation of network elements, various configuration commands are typically issued to the network elements, including basic configurations, port configurations, protocol configurations, and various service configurations. Some of these configurations need to be completed manually. During the network element configuration process, configuration errors may occur due to various reasons, such as the technical level of service personnel or their adherence to operational standards. Configuration errors in network elements can affect service quality and user experience, and may even lead to service interruptions and threaten the stable operation of the network. Therefore, it is necessary to rely on other methods to find configuration errors and correct them promptly to eliminate potential risks.

[0003] Currently, the most common configuration inspection method is to manually formulate inspection rules for various configurations. However, with the wide variety of network elements and the enormous number of configuration objects for each element, manually formulating inspection rules to obtain each configuration object for inspection requires significant program development and maintenance costs. Another method involves inferring the correctness of a configuration by using information such as forwarding table entries generated after configuration distribution, but this method can only cover a limited range of configuration types.

[0004] In summary, how to efficiently obtain information about the configuration objects of network elements to achieve efficient and accurate network configuration anomaly detection is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0005] This application discloses a network configuration feature extraction method and related apparatus, which can efficiently obtain information about the configuration objects of network elements to achieve efficient and accurate anomaly detection of network configuration.

[0006] Firstly, this application provides a method for extracting network configuration features, the method comprising:

[0007] The first configuration feature is obtained based on preset rules and network element configuration files. The preset rules include a first rule and a second rule. The first rule is used to extract a first configuration object and a second configuration object from the network element configuration file. The second rule includes the connection relationship between the first configuration object and the second configuration object. The first configuration feature indicates the parameter attributes and / or functional attributes of the first configuration object and the second configuration object.

[0008] Optionally, the aforementioned connection relationships include semantic connection relationships and / or topological connection relationships. Optionally, the aforementioned semantic connection relationships include one or more of the following: reference relationships, parameter matching relationships, companion relationships, logical operation matching relationships, group commonality relationships, cooperative relationships, and inclusion relationships.

[0009] Optionally, the first rule mentioned above may include a regular expression for extracting the first configuration object and the second configuration object.

[0010] Optionally, the above configuration objects can be module configurations or command configurations in the network element configuration file.

[0011] In this application, configuration objects to be detected are obtained from network element configuration files based on given preset rules. Then, configuration features are constructed through the connection relationships between configuration objects. These constructed configuration features can be used to detect abnormal configuration objects, thereby quickly detecting errors in implicit network specifications and logical configurations and reducing the risk of network incidents. Furthermore, since this application constructs configuration features based on connection relationships to achieve configuration anomaly detection, it can not only more accurately detect whether the content of configuration objects is abnormal, but also whether the parameter matching relationships between configuration objects are abnormal, thus achieving more comprehensive configuration anomaly detection. In addition, the network configuration feature extraction method provided in this application can extract configuration features with high network configuration consistency. For example, various network topologies such as Internet Protocol Radio Access Network (IPRAN), Packet Transport Network (PTN), or Data Communication Network (DCN) can all use this application to extract configuration features, and then perform configuration anomaly detection based on the extracted configuration features. It is evident that the implementation method of this application has strong network adaptability and a wide range of applicable scenarios. Moreover, compared to existing solutions that rely on manual rules for various configurations, this application eliminates the need for significant program development and maintenance costs, thereby reducing implementation costs. In summary, this application enables efficient and accurate anomaly detection in network configurations by acquiring configuration object information of network elements at low cost and with high coverage.

[0012] In one possible implementation, the aforementioned first configuration feature includes the values ​​of parameter attributes and / or the number of functional attributes of the aforementioned first configuration object and the aforementioned second configuration object.

[0013] In this application, the values ​​of configuration object parameter attributes and the number of functional attributes are used as configuration features for anomaly detection, which can quickly and accurately detect specific abnormal configuration objects.

[0014] In one possible implementation, the aforementioned method further includes: obtaining a second configuration feature based on the aforementioned preset rules and the aforementioned network element configuration file, wherein the aforementioned preset rules further include a third rule and a fourth rule, the aforementioned third rule is used to extract a third configuration object from the aforementioned network element configuration file, the aforementioned fourth rule includes the connection relationship between the attributes of the aforementioned third configuration object, and the aforementioned second configuration feature indicates the parameter attributes and / or functional attributes of the aforementioned third configuration object. Optionally, the connection relationship between the attributes of the configuration object may include the connection relationship between parameter attributes, the connection relationship between functional attributes, and the connection relationship between parameter attributes and functional attributes in the configuration object.

[0015] Optionally, the connection relationships between properties of a configuration object include semantic connection relationships between properties of the same configuration object, which may include one or more of the following relationships: reference relationship, parameter matching relationship, companion relationship, and logical operation matching relationship.

[0016] In this application, configuration features can also be constructed through the connection relationships between the attributes of configuration objects. These constructed configuration features are also used to detect configuration objects with abnormalities, thereby enabling more comprehensive configuration anomaly detection.

[0017] In one possible implementation, the aforementioned method further includes: obtaining multiple configuration features based on the aforementioned preset rules and the aforementioned network element configuration file, wherein the aforementioned multiple configuration features include the aforementioned first configuration feature; and obtaining a processing result based on the aforementioned multiple configuration features.

[0018] In this application, multiple configuration features can be extracted from the network element configuration file according to given preset rules, multiple configuration features can be obtained based on multiple connection relationships, and then the multiple configuration features can be processed to obtain the final anomaly detection result, thereby realizing the batch anomaly detection of configuration objects and improving the efficiency of anomaly detection.

[0019] In one possible implementation, obtaining the processing result based on the aforementioned multiple configuration features includes:

[0020] The first anomaly detection result is obtained based on the anomaly detection model and the aforementioned configuration features.

[0021] In this application, the above-mentioned configuration features can be input into the anomaly detection model for detection to obtain detection results.

[0022] Optionally, the anomaly detection model can be a detection model built based on the Isolation Forest algorithm or the Local Outlier Factor (LOF) algorithm; or, the anomaly detection model can be a pre-trained detection model built based on deep learning (DL) algorithms.

[0023] In one possible implementation, obtaining the processing result based on the aforementioned multiple configuration features includes:

[0024] The classification results are obtained based on the aforementioned configuration features, and the aforementioned classification results include one or more feature types.

[0025] In this application, multiple configuration features are classified before anomaly detection is performed. Anomaly detection is then performed based on the classified configuration features, which can improve the accuracy and efficiency of anomaly detection.

[0026] In one possible implementation, the classification result is obtained based on the aforementioned multiple configuration features, including:

[0027] Based on one or more topological connection relationships included in the aforementioned preset rules, the aforementioned multiple configuration features are classified to obtain one or more feature types. The aforementioned one or more topological connection relationships include the topological connection relationships of network elements involved in the aforementioned network element configuration files in the network. Configuration features with the same connection relationship in the aforementioned one or more topological connection relationships belong to the same feature type.

[0028] In this application, the classification of configuration features based on topological connection relationships allows network element configurations with the same topological attributes (such as the same network element role) to be classified into the same category. Since network element configurations with the same topological attributes are the same or similar, classifying them into the same category can help detect abnormal configurations more accurately.

[0029] In one possible implementation, the classification result is obtained based on the aforementioned multiple configuration features, including:

[0030] Based on one or more semantic connection relationships included in the aforementioned preset rules, the aforementioned multiple configuration features are classified to obtain one or more feature types. Among them, configuration features with the same connection relationship in the aforementioned one or more semantic connection relationships belong to the same feature type.

[0031] In this application, the classification of configuration features based on semantic connection relationships can group the configuration features of network elements with the same semantic connection relationship into the same category. Since the configurations of network elements with the same semantic connection relationship are the same or similar, grouping them into the same category can help detect abnormal configurations more accurately.

[0032] In one possible implementation, the aforementioned classification result includes a first feature type, and after obtaining the classification result based on the aforementioned multiple configuration features, it further includes:

[0033] Based on a threshold, it is determined whether the configuration object corresponding to the configuration feature included in the aforementioned first feature type is abnormal. Wherein, if the number of configuration features included in the aforementioned first feature type is less than the aforementioned threshold, it indicates that the corresponding configuration object is abnormal, or if the number of configuration features included in the aforementioned first feature type is greater than or equal to the aforementioned threshold, it indicates that the corresponding configuration object is normal.

[0034] In this application, abnormal configurations can be initially detected during configuration feature classification, thereby speeding up the anomaly detection process and improving efficiency.

[0035] In one possible implementation, after obtaining the classification result based on the aforementioned multiple configuration features, the method further includes:

[0036] Based on the configuration features of one or more feature types in the aforementioned classification results and the anomaly detection model, anomaly detection is performed to obtain a second anomaly detection result.

[0037] In this application, anomaly detection based on the classified configuration features can improve the accuracy and efficiency of anomaly detection.

[0038] In one possible implementation, the aforementioned method further includes:

[0039] A configuration template is generated based on the aforementioned first configuration object, the aforementioned second configuration object, and the connection relationship between the aforementioned first configuration object and the aforementioned second configuration object.

[0040] In this application, a corresponding configuration template can be generated based on existing network element configuration objects and connection relationships. This allows for the rapid completion of configuration operations for newly added network elements based on the configuration template when similar network elements are subsequently added to the network, thereby improving configuration efficiency.

[0041] In one possible implementation, the aforementioned first configuration object and / or the aforementioned second configuration object are configuration objects for a first network element; the aforementioned method further includes:

[0042] Obtain the second topology connection relationship, which includes the topology connection relationship of the newly added network element in the target network. The target network is the network where the network element involved in the aforementioned network element configuration file is located. The network element involved in the aforementioned network element configuration file includes the aforementioned first network element.

[0043] Based on the aforementioned second topology connection relationship, it is determined that the newly added network element has the same function as the aforementioned first network element;

[0044] Information about the configuration object of the newly added network element is generated based on the aforementioned configuration template.

[0045] In this application, configuration templates can be used to quickly generate configuration information for new network elements, which helps to improve the configuration efficiency of network elements.

[0046] Secondly, this application provides a network configuration feature extraction apparatus, the apparatus comprising:

[0047] The processing unit is used to obtain a first configuration feature based on preset rules and network element configuration files. The preset rules include a first rule and a second rule. The first rule is used to extract a first configuration object and a second configuration object from the network element configuration file. The second rule includes the connection relationship between the first configuration object and the second configuration object. The first configuration feature indicates the parameter attributes and / or functional attributes of the first configuration object and the second configuration object.

[0048] In one possible implementation, the aforementioned connection relationships include semantic connection relationships and / or topological connection relationships.

[0049] In one possible implementation, the aforementioned semantic connection relationship includes one or more of the following: reference relationship, parameter matching relationship, companion relationship, logical operation matching relationship, group commonality relationship, cooperation relationship, and inclusion relationship.

[0050] In one possible implementation, the aforementioned first configuration feature includes the values ​​of parameter attributes and / or the number of functional attributes of the aforementioned first configuration object and the aforementioned second configuration object.

[0051] In one possible implementation, the aforementioned processing unit is further configured to:

[0052] The second configuration feature is obtained based on the aforementioned preset rules and the aforementioned network element configuration file. The aforementioned preset rules also include a third rule and a fourth rule. The aforementioned third rule is used to extract a third configuration object from the aforementioned network element configuration file. The aforementioned fourth rule includes the connection relationship between the attributes of the aforementioned third configuration object. The aforementioned second configuration feature indicates the parameter attributes and / or functional attributes of the aforementioned third configuration object.

[0053] In one possible implementation, the aforementioned processing unit is further configured to:

[0054] Based on the aforementioned preset rules and the aforementioned network element configuration file, multiple configuration features are obtained, including the aforementioned first configuration feature;

[0055] The processing result is obtained based on the aforementioned configuration features.

[0056] In one possible implementation, the aforementioned processing unit is specifically used for:

[0057] The first anomaly detection result is obtained based on the anomaly detection model and the aforementioned configuration features.

[0058] In one possible implementation, the aforementioned processing unit is specifically used for:

[0059] The classification results are obtained based on the aforementioned configuration features, and the aforementioned classification results include one or more feature types.

[0060] In one possible implementation, the aforementioned processing unit is specifically used for:

[0061] Based on one or more topological connection relationships included in the aforementioned preset rules, the aforementioned multiple configuration features are classified to obtain one or more feature types. The aforementioned one or more topological connection relationships include the topological connection relationships of network elements involved in the aforementioned network element configuration files in the network. Configuration features with the same connection relationship in the aforementioned one or more topological connection relationships belong to the same feature type.

[0062] In one possible implementation, the aforementioned processing unit is specifically used for:

[0063] Based on one or more semantic connection relationships included in the aforementioned preset rules, the aforementioned multiple configuration features are classified to obtain one or more feature types. Among them, configuration features with the same connection relationship in the aforementioned one or more semantic connection relationships belong to the same feature type.

[0064] In one possible implementation, the classification result includes a first feature type, and the processing unit is further configured to determine, after obtaining the classification result based on the aforementioned multiple configuration features, whether the configuration object corresponding to the configuration features included in the first feature type is abnormal based on a threshold, wherein if the number of configuration features included in the first feature type is less than the aforementioned threshold, it indicates that the corresponding configuration object is abnormal, or if the number of configuration features included in the first feature type is greater than or equal to the aforementioned threshold, it indicates that the corresponding configuration object is normal.

[0065] In one possible implementation, the aforementioned processing unit is further configured to, after obtaining the classification result based on the aforementioned multiple configuration features, perform anomaly detection based on the configuration features of one or more feature types in the aforementioned classification result and the anomaly detection model respectively, to obtain a second anomaly detection result.

[0066] In one possible implementation, the aforementioned processing unit is further configured to:

[0067] A configuration template is generated based on the aforementioned first configuration object, the aforementioned second configuration object, and the connection relationship between the aforementioned first configuration object and the aforementioned second configuration object.

[0068] In one possible implementation, the aforementioned first configuration object and / or the aforementioned second configuration object are configuration objects of the first network element; the aforementioned processing unit is further configured to:

[0069] Obtain the second topology connection relationship, which includes the topology connection relationship of the newly added network element in the target network. The target network is the network where the network element involved in the aforementioned network element configuration file is located. The network element involved in the aforementioned network element configuration file includes the aforementioned first network element.

[0070] Based on the aforementioned second topology connection relationship, it is determined that the newly added network element has the same function as the aforementioned first network element;

[0071] Information about the configuration object of the newly added network element is generated based on the aforementioned configuration template.

[0072] Thirdly, this application provides an apparatus including a processor and a memory for implementing the methods described in the first aspect and its possible implementations. The memory is coupled to the processor, and when the processor executes a computer program stored in the memory, the network apparatus can implement the methods described in the first aspect or any possible implementation of the first aspect.

[0073] The device may also include a communication interface for communicating with other devices. For example, the communication interface may be a transceiver, circuit, bus, module, or other type of communication interface. The communication interface includes a receiving interface for receiving messages and a sending interface for sending messages.

[0074] In one possible implementation, the device may include:

[0075] Memory, used to store computer programs;

[0076] The processor is used to obtain a first configuration feature based on preset rules and network element configuration files. The preset rules include a first rule and a second rule. The first rule is used to extract a first configuration object and a second configuration object from the network element configuration file. The second rule includes the connection relationship between the first configuration object and the second configuration object. The first configuration feature indicates the parameter attributes and / or functional attributes of the first configuration object and the second configuration object.

[0077] It should be noted that the computer program in the memory of this application can be pre-stored or downloaded from the Internet and stored after use of the device. This application does not specifically limit the source of the computer program in the memory. The coupling in the embodiments of this application is an indirect coupling or connection between devices, units, or modules, which can be electrical, mechanical, or other forms, for information interaction between devices, units, or modules.

[0078] Fourthly, this application provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the method described in any one of the first aspects and its possible embodiments.

[0079] Fifthly, this application provides a computer program product, including a computer program that, when executed by a processor, causes the computer to perform the method described in any of the first aspects above.

[0080] It is understood that the apparatus described in the second and third aspects, the computer storage medium described in the fourth aspect, and the computer program product described in the fifth aspect are all used to execute the method provided in any one of the first aspects. Therefore, the beneficial effects they can achieve can be referred to the beneficial effects in the corresponding methods, and will not be repeated here. Attached Figure Description

[0081] The accompanying drawings used in the embodiments of this application will be described below.

[0082] Figure 1 The diagram shown is a network scenario provided in this application;

[0083] Figure 2 The diagram shown is a flowchart of the network configuration anomaly detection method provided in this application;

[0084] Figure 3 The diagram shown is a flowchart of the network configuration feature extraction method provided in this application;

[0085] Figure 4 The diagram shown is a schematic diagram of the logic structure of the device provided in this application;

[0086] Figure 5 The diagram shown is a schematic representation of the hardware structure of the device provided in this application. Detailed Implementation

[0087] The embodiments of this application will now be described with reference to the accompanying drawings.

[0088] First, let's introduce the technical terms used in the embodiments of this application.

[0089] 1. Network element configuration file

[0090] A configuration file is a machine-readable operating specification containing hardware or software, or a file containing information from another file or information about a specific user (such as the user's login ID). For example, in computer science, a configuration file is a computer file that configures parameters and initial settings for some computer programs. A network element configuration file is a configuration file that is readable or executable by network elements in the network. After a network element executes its configuration file, it supports the corresponding network functions specified in that configuration file, such as routing functions.

[0091] 2. Configuration objects and their properties

[0092] A network element configuration file includes one or more module configurations. Each module configuration includes one or more configurations corresponding to a network function, such as protocol configuration, address configuration, interface configuration, process configuration, routing configuration, and quality of service (QoS) configuration. One or more of the above module configurations can be presented via command lines. A module configuration may include one or more command lines. A command line is also called a command configuration. A command configuration may include functional attributes and / or parameter attributes. The configuration object can be one of the above module configurations, or it can be one of the command configurations included in the above module configurations. The attributes of the configuration object are the functional attributes and / or parameter attributes included in the command configuration.

[0093] For example,

[0094] “

[0095] interface G0 / 0 / 1

[0096] IP address 173.185.129.53 255.255.255.252

[0097] "

[0098] This section configures two commands within a module configuration to configure the Internet Protocol (IP) address under the G0 / 0 / 1 interface. If the configuration object is a module configuration, then the above module configuration is configuration object A, "interface G0 / 0 / 1" is sub-configuration object a1 of configuration object A, and "ip address 173.185.129.53255.255.255.252" is sub-configuration object a2 of configuration object A. If the configuration object is a command configuration within the above module configuration, then configuration object B is "interface G0 / 0 / 1", and configuration object C is "ip address 173.185.129.53 255.255.255.252". In configuration object C, "ip address" is a functional attribute, and "173.185.129.53 255.255.255.252" is a parameter attribute.

[0099] For example, "ip binding vpn-instance 958" is a command configuration within a module configuration used to configure a Virtual Private Network (VPN) instance bound to an IP address. In this case, "ip binding vpn-instance 958" can be a configuration object, or the module configuration can be a configuration object, with "ip binding vpn-instance 958" being a sub-configuration object of that object. In this command configuration, "ip binding vpn-instance" is the functional attribute, and "958" is the parameter attribute.

[0100] 3. The connection relationships between configuration objects and the connection relationships between the properties of configuration objects.

[0101] The connections between configuration objects include semantic connections and / or topological connections. Semantic connections refer to the semantic associations between multiple configuration objects or between the properties of multiple configuration objects, and can include one or more of the following: reference relationships, parameter matching relationships, companion relationships, logical operation matching relationships, family commonalities, collaboration relationships, and inclusion relationships.

[0102] ① A reference relationship refers to the relationship where one configuration object references the properties of another configuration object. For example, the reference relationship between parameter properties or function properties between module configurations or command configurations.

[0103] ② Parameter matching refers to the relationship between the parameter attributes of one configuration object and that of another configuration object, similar to a reference relationship. For example, the parameter attributes of an interface configuration in one configuration object may match the parameter attributes of a protocol process configuration in another configuration object.

[0104] ③ Companionship refers to the relationship between configuration objects that occur together, such as the relationship between primary and backup paths. Companionship is not limited to two configuration objects; it can also be between multiple configuration objects.

[0105] ④ Logical operation matching relationship refers to the relationship between the parameter attributes of configuration objects that conform to certain logical operation rules. For example, the IP address masks configured at both ends of the link have an "AND" logical relationship, such as the mutual exclusion operation logical relationship between the primary and backup paths.

[0106] ⑤ The common relationship of the group refers to the consistent configuration of network elements with the same networking form or the same function. For example, the configuration of the intermediate system to intermediate system (ISIS) process of all network elements in a certain loop is consistent, and the quality of service (QoS) configuration is always the same.

[0107] ⑥ Collaboration relationship refers to the relationship between network elements that require collaborative configuration to function properly. For example, the base station gateway (CSG), access service gateway (ASG), and radio service gateway (RSG) must collaborate to configure the same route in order to establish a connection.

[0108] ⑦ Inclusion relationship refers to the relationship where one configuration object contains another configuration object, such as the inclusion relationship between aggregate routes and detailed routes.

[0109] The aforementioned topology connection relationship indicates the specific physical connection relationship of network elements in the network. This topology connection relationship can include specific topology information of the network element, such as information about the network element's role, information about the link connection relationship of the network element in the network, information about the connection interface or connection port of the network element link, etc. The network element role refers to the role played by the network element in the network. For example, in a slice packet network (SPN), network element roles include user-end provider edge (UPE) devices, service provider-end provider edge (SPE) devices, and network provider-end provider edge (SPE) devices.

[0110] The connections between properties of a configuration object include semantic connections between properties within the same configuration object. Semantic connections between properties of the same configuration object refer to the semantic associations between properties of the configuration object, which can include one or more of the following relationships: reference relationships, parameter matching relationships, companion relationships, and logical operation matching relationships. Specifically:

[0111] The reference relationships between properties of a configuration object refer to the relationships where one configuration object references properties of another configuration object. Examples include references between parameter properties or function properties within the same configuration object.

[0112] The parameter matching relationship between the properties of a configuration object refers to the relationship between the parameter properties of one configuration object and those of the same configuration object, similar to a reference relationship. For example, the relationship between the parameter properties of an interface configuration in a configuration object and the parameter properties of a protocol process configuration.

[0113] The companion relationship between properties of a configuration object refers to the relationship where properties of the same configuration object appear together, such as the relationship where primary and backup paths appear together. Companion relationships are not limited to two properties; they can also include relationships between multiple properties.

[0114] The logical operation matching relationship between the attributes of the configuration object refers to the relationship between the parameter attributes of the configuration object that conforms to certain logical operation rules, such as the mutual exclusion operation logical relationship between primary and backup paths.

[0115] The connection relationships described above are merely examples and do not constitute a limitation of this application.

[0116] 4. Configuration Features

[0117] The configuration features in this application are features extracted from configuration objects based on the connection relationships between configuration objects or the connection relationships between the attributes of configuration objects. For example, there are a first object and a second object. The first object can be a configuration object or an attribute of a configuration object. The second object can also be a configuration object or an attribute of a configuration object, and a first connection relationship exists between the first object and the second object. Then, a first configuration feature can be extracted from the first object and the second object based on this first connection relationship. The first configuration feature indicates the parameter attributes and / or functional attributes of the first object and the second object.

[0118] For example, in one specific implementation, the first configuration feature may include the values ​​of parameter attributes and / or the number of functional attributes of the first object and the second object.

[0119] Alternatively, for example, in another specific implementation, the first configuration feature may include the name of the functional attribute in the first object and the second object, as well as the value of the parameter attribute and / or the number of functional attributes in the first object and the second object.

[0120] Alternatively, the configuration features may include other information, such as information indicating whether the values ​​of the extracted parameter attributes are equal, or information indicating whether the VPN instance is referenced by the interface, etc. This application does not limit this.

[0121] 5. Regular Expressions

[0122] Regular expressions are logical formulas for manipulating strings (including ordinary characters (such as letters from a to z) and special characters (also known as "metacharacters")). They use predefined specific characters and combinations of these characters to form a "rule string," which expresses a filtering logic for the string. A regular expression is a text pattern that describes one or more strings to match when searching text.

[0123] In this application, the configuration objects that need to be detected for anomalies can be found in the network element configuration file by matching the predefined regular expressions, and then these configuration objects can be extracted from the configuration file.

[0124] See Figure 1 , Figure 1 The illustration shows a specific network application scenario to which this application embodiment applies. This scenario includes a network 110 and a network management device 120.

[0125] The network 110 includes multiple network elements. For example, the network can be a network of various networking forms, such as an Internet Protocol Radio Access Network (IPRAN), a Packet Transport Network (PTN), or a Data Communication Network (DCN).

[0126] The network management device 120 can communicate with each network element in the network 110 and obtain configuration information from each network element. This network management device can be a software-defined network (SDN) controller, an operation and maintenance center (OMC), a network management system, etc.

[0127] It should be noted that the above Figure 1 The network scenario shown is merely an example and does not constitute a limitation on the embodiments of this application.

[0128] For a network to function properly, its network elements need to be configured. To avoid configuration errors, anomaly detection can be performed on the configuration files of these network elements. However, due to the vast size of the network architecture, the large number of network elements, and the complex and cumbersome configuration information, existing solutions cannot achieve low-cost, high-coverage configuration anomaly detection.

[0129] To achieve low-cost, high-coverage configuration anomaly detection, this application provides a network configuration anomaly detection method, which can be applied to the above-mentioned... Figure 1 Anomaly detection for the network configuration shown.

[0130] See Figure 2 The network configuration anomaly detection method provided in this application embodiment may include, but is not limited to, the following steps:

[0131] S201. Obtain network element configuration files.

[0132] In a specific embodiment, the entity executing this method can be referred to as a configuration detection device, which can be... Figure 1 The network management device 120 shown may be a server or device that is independent of the network management device 120.

[0133] If the configuration detection device is a network management device 120, then the network management device 120 can obtain the configuration files of one or more network elements in the network 110.

[0134] If the configuration detection device is a server or device independent of the network management device 120, then the server or device can communicate with the network management device 120 to obtain configuration files of one or more network elements in the network 110 from the network management device 120. Alternatively, the server or device can receive network element configuration files input by the user through an interactive interface. This application embodiment does not limit the method by which the server or device obtains network element configuration files.

[0135] For example, the network configuration anomaly detection method of this application can be implemented by software or hardware. Specifically, if implemented by software, the software can be deployed and run in the above-mentioned configuration detection device.

[0136] The network element configuration file obtained above can be one or more network element configuration files. Optionally, each network element corresponds to one network element configuration file.

[0137] S202. Extract multiple configuration objects from the network element configuration files obtained above based on the extraction rules.

[0138] For example, the extraction rule may include a regular expression for extracting the multiple configuration objects, which can be used to extract the multiple configuration objects from the configuration file obtained above. Alternatively, the extraction rule may also include template extraction algorithms such as spell, drain, or frequent template tree (FT tree), which can first distinguish the parameter attributes and functional attributes of the configuration objects in the network element configuration file based on these template extraction algorithms, and then extract the multiple configuration objects using regular expressions.

[0139] In a specific embodiment, the extraction rule can be a rule pre-configured in the configuration detection device. Alternatively, the extraction rule can be a rule input by the user received by the configuration detection device. Or, some rules in the extraction rule (e.g., the aforementioned spell, drain, or FT tree template extraction algorithms) can be pre-configured in the configuration detection device, while other rules (e.g., regular expressions) can be rules input by the user received by the configuration detection device.

[0140] Optionally, the rules that the configuration detection device receives from user input may include: the configuration detection device can receive extraction rules input by the user through an interactive interface; or, the configuration detection device can communicate with a user terminal and receive extraction rules sent by the user terminal, etc.

[0141] To facilitate understanding of the above regular expressions, examples are provided below.

[0142] Example 1, assuming the first configuration object is:

[0143] “interface Tunnel1

[0144] destination 129.140.127.41”;

[0145] Assume the second configuration object is:

[0146] "ip route-static vpn-instance 736 0.0.0.0 0.0.0.0static-vpn-peer129.140.127.41label 18

[0147] preference 90description NCE_AUTO";

[0148] Assume the third configuration object is:

[0149] "ipvpn-instance 736"

[0150] IPv4-family

[0151] tunnel binding destination 129.140.127.41Tunnel3".

[0152] The configuration of the first configuration object establishes a tunnel to the network element with a destination IP address of 129.140.127.41. The configuration of the second configuration object declares the default route to this destination IP address. The configuration of the third configuration object declares that the VPN instance is bound to this tunnel. Therefore, the regular expression matching the first configuration object in the network element configuration file could be "interfaceTunnel\d+\ndestination(.*)". That is, this regular expression searches the network element configuration file, and once an object matching this regular expression exists, it is retrieved. Similarly, the regular expressions matching the second and third configuration objects in this example are: "ip route-static vpn-instance\d+0.0.0.00.0.0.0static-vpn-peer(.*?)label–u file" and "ipvpn-instance\d+\nipv4-family\n tunnel binding destination(.*?)Tunnel\d+-u file". The "-u file" in this expression indicates that a record is generated for each network element configuration file.

[0153] Example 2, suppose the configuration of an interface module (referred to as the first configuration) is as follows:

[0154] "interface 10GE2 / 0 / 1

[0155] IP address 173.185.129.53 255.255.255.252

[0156] ip binding vpn-instance 958”

[0157] Alternatively, the configuration of this interface module (referred to as the second configuration) is as follows:

[0158] "interface 10GE2 / 0 / 1

[0159] IP address 173.185.129.53 255.255.255.252

[0160] isis enable 6001”

[0161] The configuration of the entire interface module described above can be viewed as a single configuration object, or each command configuration within that interface module can be considered a configuration object. The command configuration "ip address 173.185.129.53255.255.255.252" is used to configure the IP address for interface 10GE2 / 0 / 1. The command configuration "ip binding vpn-instance 958" is used to configure the VPN instance bound to interface 10GE2 / 0 / 1. The command configuration "isis enable 6001" is used to configure the corresponding ISIS protocol for interface 10GE2 / 0 / 1.

[0162] The regular expression for matching the IP address in the aforementioned interface module in the network element configuration file can be “interface(?:(?:GigabitEthernet\d+ / \d+ / \d+)|(?:\d+GE\d+ / \d+ / \d+)|(?:Ethernet\d+ / \d+ / \d+)|(?:FlexE\d+ / \d+ / \d+))\nip address.*?”. The regular expression for matching the VPN instance configuration in this interface module can be “interface(?:(?:GigabitEthernet\d+ / \d+ / \d+)|(?:\d+GE\d+ / \d+ / \d+)|(?:Ethernet\d+ / \d+ / \d+)|(?:FlexE\d+ / \d+ / \d+))\nip binding vpn-instance.*?”. The regular expression matching the ISIS protocol configuration in this interface module can be "interface(?:(?:GigabitEthernet\d+ / \d+ / \d+)|(?:\d+GE\d+ / \d+ / \d+)|(?:Ethernet\d+ / \d+ / \d+)|(?:FlexE\d+ / \d+ / \d+))\nisis enable.*?'".

[0163] Example 3, assuming the first configuration object is:

[0164] "interface 10GE2 / 0 / 4.1"

[0165] IP address 10.100.109.69 255.255.255.252

[0166] ip binding vpn-instance 859"

[0167] The second configuration object is:

[0168] "ip route-static vpn-instance 859 10.100.109.69 255.255.255.252NULL0preference 180"

[0169] The first configuration object configured the IP address and the bound VPN instance of the service-side interface 10GE2 / 0 / 4.1, and the second configuration object configured the black hole route corresponding to the service interface.

[0170] In the network element configuration file, the regular expression for matching the IP address in the first configuration object can be "interface.* / n ip address(.*?)(.*)–l and-u module". The regular expression for matching the VPN instance configuration in the first configuration object can be "interface.* / n ip binding vpn-instance\d+-u module". The regular expression for matching the second configuration object can be "ip route-static vpn-instance\d+(.*?)(.*?)NULL0 preference\d+-l and–u module". Here, "-u module" in the regular expression indicates that each module is extracted, and the extracted IP address and subnet mask are ANDed using the "-l and" parameter to calculate the corresponding network segment.

[0171] Example 4, assuming the first configuration object is:

[0172] "106-PTN970-50GE Access Ring 7-CRAN-1"

[0173] interface 10GE2 / 0 / 3

[0174] ptp port-state primary master

[0175] "ptp enable"

[0176] The second configuration object is:

[0177] "578-PTN980-50GE Access Ring 7-CRAN"

[0178] interface 10GE4 / 0 / 8

[0179] clock synchronization enabled

[0180] "ptp enable"

[0181] The first configuration object described above is for the source device port, and the second configuration object is for the destination device port. As you can see, neither of these configuration objects contains parameter attributes; they are all functional attribute configurations. Specifically, "ptp port-state primary master" indicates that time synchronization is in master state. In this state, the interface will only transmit time information to the peer and will not obtain time information from the peer. "ptp enable" enables the time synchronization function; and "clock synchronization enable" enables obtaining the clock frequency from the port.

[0182] In the network element configuration file, the regular expression for matching the configuration that enables obtaining clock frequency from the port in the configuration object can be "clock synchronization enable –u module". The regular expression for matching the configuration that indicates that time synchronization is in master state in the configuration object can be "ptp port-state primary master –umodule"; the regular expression for matching the configuration that enables the time synchronization function in the configuration object can be "ptp enable –umodule".

[0183] The regular expressions described above are merely examples and do not constitute a limitation of this application.

[0184] S203. Based on the feature construction rules and the above-mentioned multiple configuration objects, obtain multiple configuration features.

[0185] The feature construction rule includes the connection relationships between the aforementioned configuration objects. These connection relationships can be between multiple configuration objects, and / or between attributes of configuration objects. These connection relationships can include semantic connection relationships and / or topological connection relationships. For a detailed description of semantic and topological connection relationships, please refer to the preceding descriptions; they will not be repeated here.

[0186] In a specific embodiment, the feature construction rule can be a rule pre-configured in the configuration detection device. Alternatively, the feature construction rule can be a rule input by the user received by the configuration detection device. For example, the feature construction rule input by the user can be received by the configuration detection device through an interactive interface. Alternatively, the configuration detection device can communicate with a user terminal and receive feature construction rules sent by the user terminal, etc. Optionally, the feature construction rule and the extraction rule described above can be obtained simultaneously or separately; this application does not impose any restrictions on this.

[0187] For example, to facilitate understanding of the above feature construction rules, the following example illustrates the following:

[0188] For example, in Example 1 above, the second and third configuration objects reference the values ​​of parameter attributes in the first configuration object, that is, they reference the destination IP address 129.140.127.41. Furthermore, both the second and third configuration objects include this destination IP address; therefore, it can also be said that the third configuration object references the destination IP address of the second configuration object. That is, there are reference relationships between each pair of the first, second, and third configuration objects. Therefore, the feature construction rules corresponding to these three configuration objects include information about these reference relationships, indicating that the connection relationship between each pair of the three configuration objects is a reference relationship. Optionally, this reference relationship information can be given along with the extraction rules for the three configuration objects. For example, this reference relationship information can be represented as "consistency" or other characters; this application does not impose any restrictions on this.

[0189] For example, in Example 2 above, the configuration of the interface module requires an IP address to be configured before a VPN instance or ISIS protocol can be configured. However, VPN instances and ISIS protocols cannot be configured together. Therefore, the IP address configuration and VPN instance configuration, or the IP address configuration and ISIS protocol configuration, of this interface are related. Thus, the feature construction rules corresponding to the configuration objects in the interface module configuration include information about this relationship. Optionally, the information about this relationship can be provided along with the extraction rules for the configuration object. For example, this information about the relationship can be represented as "Companion" or other characters; this application does not impose any restrictions on this.

[0190] For example, in Example 3 above, the corresponding network segment can be calculated based on the IP address "10.100.109.69" and the subnet mask "255.255.255.252" in the configuration object. The network segment where the IP address of the service-side interface and its corresponding black hole route resides must be equal. Therefore, the network segment calculated from the IP address and subnet mask in the first configuration object must be equal to the network segment calculated from the IP address and subnet mask in the second configuration object, meaning there is a logical operation matching relationship between the first and second configuration objects, or between their attributes. Therefore, the feature construction rules corresponding to these two configuration objects include information about the logical operation matching relationship, indicating that the connection relationship between the two configuration objects is a logical operation matching relationship. Optionally, this logical operation matching relationship information can be given along with the extraction rules for the two configuration objects. For example, this logical operation matching relationship information can be represented as "logic" or other characters; this application does not impose any restrictions on this.

[0191] For example, in Example 4 above, there is a topological connection between the first configuration object and the second configuration object. Therefore, the feature construction rules corresponding to these two configuration objects include information about the topological connection, indicating that the connection between the two configuration objects is a topological connection. Optionally, this topological connection information can be provided along with the extraction rules for the two configuration objects. For example, this topological connection information can be represented as "Topo" or "topology" or other characters; this application does not impose any restrictions on this.

[0192] Based on the above description, after determining the connection relationships between configuration objects, the configuration detection device can extract features from the corresponding configuration objects based on these connection relationships to generate corresponding configuration features. For the multiple configuration objects extracted above, multiple configuration features can be generated based on the multiple connection relationships in the feature construction rules. For the definition of configuration features, please refer to the description of configuration features in point 4 of the above technical terminology introduction. For ease of understanding, the following example illustrates configuration features extracted based on the above connection relationships, taking the example that configuration features include the values ​​of parameter attributes and / or the number of functional attributes of configuration objects:

[0193] ① An example of extracting configuration features based on reference relationships.

[0194] For Example 1 above, based on the description of Example 1 above, it is known that there are reference relationships between each pair of the first configuration object, the second configuration object, and the third configuration object. Knowing that there are reference relationships between the second and first configuration objects, between the third and first configuration objects, and between the second and third configuration objects, a configuration feature representing these reference relationships can be extracted from these three configuration objects. This configuration feature can be represented, for example, as: {value:129.140.127.41,feature1:1,feature2:1,feature3:1}, where:

[0195] The value is the value of the referenced parameter attribute mentioned above, which is the destination IP address mentioned above;

[0196] feature1 represents the functional attribute "destination" in the first configuration object mentioned above, which represents the destination address of the tunnel. Since this functional attribute appears only once in the configuration object corresponding to the reference relationship, the value of feature1 is 1, which means that the number of the "destination" functional attribute is one.

[0197] feature2 represents the functional attribute "static-vpn-peer" in the second configuration object mentioned above, which represents the IP address of the static route. Since this functional attribute appears only once in the configuration object corresponding to the reference relationship, the value of feature2 is 1, which means that the number of the "static-vpn-peer" functional attribute is one.

[0198] feature3 represents the "tunnel binding destination" attribute in the third configuration object mentioned above, which represents the destination IP address of the tunnel binding. Since this attribute appears only once in the configuration object corresponding to the reference relationship, the value of feature3 is 1, indicating that the number of "tunnel binding destination" attributes is one.

[0199] Alternatively, the above configuration feature can be represented as: {value:129.140.127.41,destination:1,static-vpn-peer:1,tunnel binding destination:1}. The meaning of this configuration feature is the same as described above and will not be repeated.

[0200] In addition, the extraction of configuration features based on parameter matching relationships is similar to the extraction of configuration features based on reference relationships described above. For details, please refer to the description of extracting configuration features based on reference relationships above, which will not be repeated here.

[0201] ② An example of extracting configuration features based on symbiotic relationships.

[0202] Regarding Example 2 above, based on the above description of Example 2, it can be seen that the IP address configuration of the above interface and the VPN instance configuration, or the IP address configuration of the interface and the ISIS protocol configuration, are related.

[0203] In one specific implementation, if each command configuration in the interface module is regarded as a configuration object, then the symbiotic relationship between the IP address configuration and the VPN instance configuration of the interface, or between the IP address configuration and the ISIS protocol configuration of the interface, can be said to be the symbiotic relationship between configuration objects.

[0204] Based on this symbiotic relationship, the IP address of the interface, the VPN instance bound to the interface, and the ISIS protocol corresponding to the interface can be used as three features for configuration feature extraction. Therefore, for the first configuration mentioned above, the extracted configuration features can be represented as {feature1:1, feature2:1, feature3:0}. Where:

[0205] The feature1 represents the function attribute "ip address", which represents the IP address of the interface. Since this function attribute appears only once in the first configuration corresponding to this companion relationship, the value of feature1 is 1, which means that the number of the "ip address" function attribute in the first configuration is one.

[0206] The feature2 represents the function attribute "ip binding vpn-instance", which means the VPN instance bound to the interface. Since this function attribute appears only once in the first configuration corresponding to this companion relationship, the value of feature2 is 1, which means that the number of the "ip binding vpn-instance" function attribute in the first configuration is one.

[0207] The feature3 represents the functional attribute "isis enable", which means that the ISIS protocol corresponding to this interface is not present in the first configuration corresponding to this companion relationship. Therefore, the value of the feature3 is 0, which means that the number of the "isis enable" functional attributes in the first configuration is zero.

[0208] Similarly, for the second configuration mentioned above, the extracted configuration features can be represented as {feature1:1,feature2:0,feature3:1}, where feature1, feature2, and feature3 are the same as the configuration features obtained for the first configuration, and their corresponding values ​​have the same meaning. For details, please refer to the above description, which will not be repeated here.

[0209] Alternatively, in another specific implementation, if the configuration of the entire interface module is regarded as a configuration object, then the symbiotic relationship between the IP address configuration of the interface and the VPN instance configuration, or between the IP address configuration of the interface and the ISIS protocol configuration, can be said to be the symbiotic relationship between the attributes of the configuration object.

[0210] Taking the first configuration as an example, based on the symbiotic relationship between the attributes of this configuration object, the IP address of the interface and the VPN instance bound to the interface can be used as features to extract configuration features. The extracted configuration features can then be represented as {feature1:1, feature2:1}. The meanings of feature1 and feature2 and their values ​​are the same as described above. Similarly, the configuration features extracted for the second configuration can be represented as {feature1:1, feature2:1}. The meanings of feature1 and its value are the same as described above, while the meanings of feature2 and its value are the same as described above, i.e., feature2 represents the functional attribute "isis enable".

[0211] Optionally, the configuration features extracted based on the symbiotic relationship may also include the values ​​of corresponding parameter attributes, depending on the actual situation. This application does not impose any restrictions on this.

[0212] ③ An example of extracting configuration features based on logical operation matching relationships.

[0213] Regarding Example 3 above, based on the above description of Example 3, it can be seen that there is a logical operation matching relationship between the first configuration object and the second configuration object, or in other words, there is a logical operation matching relationship between the attributes of the first configuration object and the second configuration object.

[0214] Based on the above logical operation matching relationship, the configuration features obtained from the first configuration object and the second configuration object can be represented as {feature1:1, feature2:10.100.109.68, feature3:10.100.109.68}, where:

[0215] feature1:1 indicates that the configuration of the interface is a business-side interface.

[0216] Feature 2: 10.100.109.68 is the network segment where the above-mentioned service interface is located, calculated based on the IP address and subnet mask extracted from the first configuration object.

[0217] feature3:10.100.109.68: is the network segment where the IP address of the black hole route is located, calculated based on the IP address and subnet mask extracted from the second configuration object mentioned above.

[0218] If the values ​​of feature2 and feature3 are the same, it indicates that the configuration in the logical operation matching relationship is normal. If the values ​​of feature2 and feature3 are different, it indicates that the configuration in the logical operation matching relationship is abnormal.

[0219] ④ An example of extracting configuration features based on topological connection relationships.

[0220] Suppose that the topological information of a certain topological connection relationship includes the following:

[0221]

[0222] Based on this topology information, the corresponding configuration objects can be extracted from the corresponding network element configuration files. The extracted configuration objects are shown in the first and second configuration objects in Example 4 above.

[0223] Based on the topological connection between the first configuration object and the second configuration object, the configuration features extracted from the first and second configuration objects can be represented as {feature0:0, feature1:1, feature2:1, feature3:1, feature4:0, feature5:1}, where:

[0224] feature0 to feature2 are the configuration features of the source device port, which are the configuration features of the first configuration object mentioned above. feature3 to feature5 are the configuration features of the destination device port, which are the configuration features of the second configuration object mentioned above.

[0225] feature0:0 indicates that the source device port did not obtain the clock frequency from the destination device port;

[0226] feature1:1 indicates that the source device port time synchronization is in master state;

[0227] Feature 2:1 indicates that the source device port can perform time synchronization;

[0228] feature3:1 indicates that the destination device port obtains the clock frequency from the source device port;

[0229] feature4:0 indicates that the destination device port is not in master state;

[0230] Feature 5:1 indicates that the host device port can perform time synchronization.

[0231] The examples of configuration features extracted above do not constitute a limitation of this application. There are other implementations that extract configuration features based on other connection relationships, which are not listed here.

[0232] S204. Based on the above configuration features, perform anomaly detection and obtain the anomaly detection results.

[0233] In one specific implementation, after the configuration detection device obtains the above-mentioned multiple configuration features, it can input the multiple configuration features into the anomaly detection model for detection and obtain anomaly detection results.

[0234] For example, the anomaly detection model may be a detection model built based on the Isolation Forest algorithm or the Local Outlier Factor (LOF) algorithm; or, the anomaly detection model may be a pre-trained detection model built based on the deep learning (DL) algorithm.

[0235] The basic theoretical basis of the Isolation Forest algorithm is that outliers account for a very small proportion of the total sample size; and the feature values ​​of outliers differ significantly from those of normal samples. In other words, outliers can be isolated with fewer random feature segmentations compared to normal samples.

[0236] For the LOF algorithm described above, if each of the multiple configuration features is considered as a point in a coordinate system, then the LOF algorithm mainly determines whether a point p is an outlier by comparing the density of each point p with the density of its neighboring points. The lower the density of point p, the more likely it is to be identified as an outlier. The density is calculated based on the distance between points; the farther the distance between points, the lower the density, and the closer the distance, the higher the density. Furthermore, because LOF calculates density based on the neighboring points of point p, rather than on all points globally, it avoids incorrectly identifying normal points as outliers due to varying data density distributions; hence, it is called the "local" anomaly factor.

[0237] Specifically, the above anomaly detection model can detect abnormal configuration features among the multiple configuration features, thereby determining that the configuration object corresponding to the abnormal configuration feature is abnormal.

[0238] In another specific implementation, before inputting the above-mentioned multiple configuration features into the anomaly detection model for anomaly detection, the multiple configuration features can be classified to obtain one or more feature types, and then anomaly detection can be performed according to the feature types.

[0239] In specific embodiments, clustering algorithms can be used to classify the constructed configuration features, which can then be divided into multiple feature types. These clustering algorithms can be, for example, K-Means clustering, mean-shift clustering, density-based clustering, or agglomerative hierarchical clustering, etc. Specific configuration feature classification can include various classification methods, which are illustrated below.

[0240] Classification method one is to classify based on module configuration, functional attributes, or parameter attributes.

[0241] Specifically, if classified based on module configuration, then the configuration features corresponding to modules that perform the same function can be grouped into the same category, while the configuration features corresponding to modules that perform different functions can be grouped into different categories. For example, the configuration features corresponding to the communication tunnel configuration module can be grouped into the same category, while the configuration features corresponding to the communication tunnel configuration module and the Ethernet link aggregation (Eth-Trunk) configuration module can be grouped into different categories.

[0242] If classification is based on functional attributes, then configuration features corresponding to the same functional attribute can be grouped into the same category, while configuration features corresponding to different functional attributes can be grouped into different categories. For example, configuration features that include the functional attribute of IP address can be grouped into the same category, while configuration features that do not include the functional attribute of IP address can be classified separately.

[0243] If classification is based on parameter attributes, then configuration features with the same parameter attribute can be grouped into the same category, while configuration features with different parameter attributes can be grouped into different categories. For example, configuration features that include the parameter attribute "192.168.0.1" can be grouped into the same category, while configuration features that do not include the parameter attribute "192.168.0.1" can be classified separately.

[0244] The second classification method is based on semantic connection relationships.

[0245] Specifically, the feature construction rules described in S203 above can include multiple semantic connection relationships, such as symbiotic relationships, referencing relationships, or group commonality relationships. Therefore, configuration features corresponding to the same semantic connection relationship can be grouped into the same category, while configuration features corresponding to different semantic connection relationships can be grouped into different categories. For example, taking symbiotic relationships and referencing relationships as examples, configuration features generated based on symbiotic relationships can be grouped into the same category, while configuration features generated based on referencing relationships can be grouped into another category.

[0246] The third classification method is based on topological connectivity.

[0247] Based on the foregoing description of topology connections, these connections can include information about network element roles, link connections within the network, and connection interfaces or ports. Therefore, specific classifications can be made based on this information. For example, regarding network element roles, configuration features corresponding to the same role are classified into the same category, while configuration features corresponding to different roles are classified into different categories. For instance, if the topology connection includes information about a loop network topology, which includes multiple network elements, since the network elements on the loop have the same roles and consistent configurations (i.e., their configurations are essentially the same), the configuration detection device can classify the configuration features corresponding to all network elements on that loop into the same category.

[0248] The classification methods described above do not constitute a limitation of this application. In specific implementations, other classification methods may be used to classify the above configuration features, and this application does not impose any restrictions on this.

[0249] In one specific implementation, for the multiple feature types obtained from the above classification, if the number of configuration features included in a certain feature type is greater than or equal to a threshold, then that feature type belongs to a major category. If the number of configuration features included in a certain feature type is less than the threshold, then that feature type belongs to a minor category. For the configuration features of a minor category, since they are significantly different from the configuration features of other categories, it can be confirmed that the configuration features in that minor category are abnormal, and thus it can be determined that the configuration objects corresponding to the configuration features in that minor category are abnormal.

[0250] In another specific implementation, for the aforementioned subcategories, instead of initially determining whether they are abnormal, they can be further classified into other major categories. Then, the aforementioned anomaly detection model can be used to perform anomaly detection on the configuration features in each major category. For example, assuming the final classification results in three major categories, the aforementioned anomaly detection model can be used to perform anomaly detection on the first, second, and third major categories respectively, and the anomaly detection results for each major category can be output. A detailed description of using the anomaly detection model for anomaly detection can be found in the corresponding description above, and will not be repeated here.

[0251] In a specific embodiment, the configuration features extracted from normal configuration objects meet certain rules. Then, configuration features that do not meet the rules are detected during the anomaly detection process and are considered abnormal configuration features. The configuration objects corresponding to the abnormal configuration features are abnormal. For ease of understanding, an example is given below.

[0252] For example, in the example of extracting configuration features based on reference relationships above, if the values ​​of feature1, feature2 and feature3 are all 1, then the configuration object has the functional attributes corresponding to these three features, indicating that the configuration in the reference relationship is normal. If at least one of these three features has a value other than 1, then at least one of the functional attributes corresponding to these three features in the configuration object does not exist, indicating that the configuration in the reference relationship is abnormal.

[0253] For example, in the example of extracting configuration features based on symbiotic relationships described above, within the symbiotic relationships between configuration objects, and based on the rule that "VPN instances or ISIS protocols can only be configured when an IP address is configured, but VPN instances and ISIS protocols cannot be configured together," the extracted configuration feature is considered normal only if it belongs to any one of the three features: {feature1:0, feature2:0, feature3:0}, {feature1:1, feature2:1, feature3:0}, or {feature1:1, feature2:0, feature3:1}. Otherwise, the configuration in the symbiotic relationship is abnormal. Furthermore, regarding the symbiotic relationships between attributes of configuration objects described above, for the two configuration features extracted based on the symbiotic relationships between the attributes of the configuration objects, if the values ​​of the two features are different, it is abnormal; if they are the same, it is normal.

[0254] For example, in the example of extracting configuration features based on logical operation matching relationship ③ above, if the values ​​of feature2 and feature3 are the same, it indicates that the configuration in the logical operation matching relationship is normal; if the values ​​of feature2 and feature3 are different, it indicates that the configuration in the logical operation matching relationship is abnormal.

[0255] For example, in example ④, which extracts configuration features based on topology connections, if the source device port's time synchronization is in the master state, it means the destination device port needs to obtain time synchronization from the source device port. However, time synchronization requires clock frequency synchronization. Therefore, the destination device port needs to obtain the clock frequency from the source device port for time synchronization. Based on this, if feature1 has a value of 1, then feature3 should also have a value of 1 for normal operation. If feature1 has a value of 1, then feature3 should have a value of 0, which is abnormal.

[0256] It should be noted that the above description of determining abnormal configuration is merely an example and does not constitute a limitation on this application.

[0257] In one specific implementation, for the above-described configuration anomaly detection after classification, the configuration detection device can calculate the confidence interval for each of the multiple feature types obtained from the classification. Then, it determines whether the configuration features in the corresponding feature type meet the requirements of the confidence interval for that feature type. If they meet, it is normal; otherwise, it is abnormal. For example, taking the first type of the multiple feature types as an example, as described above, the extracted configuration features include the values ​​of parameter attributes and / or the number of functional attributes. Therefore, the average and standard deviation of all configuration features in a certain feature type can be calculated. The confidence interval for that feature type is calculated based on the average and standard deviation. Then, for each configuration feature in that feature type, the value of each configuration feature can be compared with the confidence interval. If the value of the configuration feature is within the confidence interval, it is normal; otherwise, it is abnormal.

[0258] In one specific embodiment, in order to facilitate the configuration of newly added network elements in the network and improve the configuration efficiency of newly added network elements, a corresponding configuration template can be generated based on the existing configuration objects and the connection relationships between the configuration objects, and the configuration template can be saved for reference in the subsequent configuration of newly added network elements.

[0259] In one specific implementation, since multiple configuration objects have already been extracted from the network element configuration file, and the connection relationships existing among these multiple configuration objects can be obtained from the feature construction rules, a configuration template can be generated based on these multiple configuration objects and the connection relationships in the feature construction rules. For example, the generated configuration template can be a configuration template of attributes in the configuration objects, a configuration template of a single configuration object, or a configuration template of a network element configuration file.

[0260] Specifically, the configuration template for an attribute in a configuration object can include information about the corresponding attribute and its connection relationships with other attributes. These other attributes can be attributes within the same configuration object or attributes in different configuration objects.

[0261] The configuration template for a configuration object can include information about one or more attributes of the corresponding configuration object, as well as information about the connection relationships between the configuration object and other configuration objects. These other configuration objects can be other configuration objects within the same network element configuration file, or they can be other configuration objects in different network element configuration files.

[0262] The configuration template of a network element configuration file can include information about one or more configuration objects in the corresponding network element configuration file.

[0263] In another specific implementation, after the configuration detection device categorizes configuration features into multiple feature types using a clustering algorithm, it can extract the configuration objects corresponding to the configuration features of each feature type from the acquired network element configuration file for each feature type. The connection relationships between the extracted configuration objects are recorded. Then, a configuration template corresponding to each feature type is generated based on the extracted configuration objects and the recorded connection relationships. Similarly, the generated configuration template can be a configuration template for attributes within a configuration object, a configuration template for a single configuration object, or a configuration template for a network element configuration file. For a description of these different configuration templates, please refer to the above introduction; further details will not be repeated here.

[0264] In a specific embodiment, after the configuration detection device generates a configuration template, it can save the generated configuration template for future configuration reference and recommendation of newly added network elements. For example, the configuration template can be saved according to different network element roles and / or different functions. For instance, configuration templates can be saved according to network element roles CSG and ASG, and configuration templates can be saved according to functional modules, such as isis, interface, etc.

[0265] In one specific implementation, when the topology of the network containing the network element involved in the aforementioned network element configuration file changes, such as by adding a new network element, the configuration detection device can obtain the changed network topology connection relationship. This topology connection relationship includes the topology connection relationship of the newly added network element within the network. Then, based on the topology connection relationship of the newly added network element, a network element with the same function as the newly added network element is found. Based on the found network element, the corresponding configuration template is matched in the database storing configuration templates, thereby generating the configuration object information for the newly added network element based on the configuration template.

[0266] For example, assuming the newly added network element is a network element in a loop, the configuration detection device can find the original network element in the loop based on the new topology connection relationship and find the configuration template corresponding to the original network element from the configuration template database. Configuration information for the newly added network element is then generated based on this configuration template. For example, assuming the configuration of the original network element in the found configuration template includes an interface tunnel destination of 192.168.0.1, then a configuration generated for the newly added network element could be a configuration with an interface tunnel destination of 192.168.0.1.

[0267] Based on the above description, embodiments of this application also provide a method for extracting network configuration features. For example, see [link to relevant documentation]. Figure 3This method includes, but is not limited to, the following steps:

[0268] S301. Obtain preset rules and network element configuration files; the preset rules include a first rule and a second rule, the first rule is used to extract a first configuration object and a second configuration object from the network element configuration file, and the second rule includes the connection relationship between the first configuration object and the second configuration object;

[0269] S302. Obtain a first configuration feature based on the above-mentioned preset rules and network element configuration file, wherein the first configuration feature indicates the parameter attributes and / or functional attributes of the first configuration object and the second configuration object.

[0270] In its specific implementation, the first rule mentioned above can be referenced from the above. Figure 2 The description of the extraction rules in step S202, the second rule mentioned above can be referred to the above. Figure 2 The description of the feature construction rules in step S203. The first configuration object and the second configuration object can be as described above. Figure 2 The object among the multiple configuration objects in step S202. The first configuration feature can be one of the above-mentioned... Figure 2 The features among the multiple configuration features in step S203. Specifically, the specific implementations of steps S301 and S302 can also refer to the above. Figure 2 The descriptions of steps S201, S202, and S203 will not be repeated here.

[0271] In one specific embodiment, the network configuration feature extraction method may further include: obtaining a second configuration feature based on the preset rules and the network element configuration file, wherein the preset rules further include a third rule and a fourth rule, the third rule is used to extract a third configuration object from the network element configuration file, the fourth rule includes the connection relationship between the attributes of the third configuration object, and the second configuration feature indicates the parameter attributes and / or functional attributes of the third configuration object.

[0272] Similarly, in specific implementation, the third rule mentioned above can be referenced from the above. Figure 2 The description of the extraction rules in step S202, and the fourth rule mentioned above can be referred to the above. Figure 2 The description of the feature construction rules in step S203. The third configuration object can be the one described above. Figure 2 The second configuration feature can be one of the multiple configuration objects mentioned above in step S202. Figure 2 The features among the multiple configuration features in step S203. Specifically, the specific implementations of steps S301 and S302 can also refer to the above. Figure 2 The descriptions of steps S201, S202, and S203 will not be repeated here.

[0273] In summary, this application obtains the configuration objects to be detected from the network element configuration file for a given preset rule. Then, configuration features are constructed through the connection relationships between configuration objects. These constructed configuration features can be used to detect abnormal configuration objects, thereby quickly detecting errors in implicit network norms and logical configurations and reducing the risk of network accidents. Furthermore, since this application constructs configuration features of configuration objects based on connection relationships to achieve configuration anomaly detection, it can not only more accurately detect whether the content of configuration objects is abnormal, but also detect whether the parameter matching relationships between configuration objects are abnormal, thus achieving more comprehensive configuration anomaly detection. In addition, the network configuration feature extraction method provided by this application can extract configuration features with high network configuration consistency. For example, various network topologies such as Internet Protocol Radio Access Network (IPRAN), Packet Transport Network (PTN), or Data Communication Network (DCN) can all use this application to extract configuration features, and then perform configuration anomaly detection based on the extracted configuration features. It is evident that the implementation method of this application has strong network adaptability and a wide range of applicable scenarios. Moreover, compared to existing solutions that rely on manual rules for various configurations, this application eliminates the need for significant program development and maintenance costs, thereby reducing implementation costs. In summary, this application enables efficient and accurate anomaly detection in network configurations by acquiring configuration object information of network elements at low cost and with high coverage.

[0274] The foregoing mainly describes the network configuration feature extraction method provided in the embodiments of this application. It is understood that each device, in order to achieve the corresponding functions, includes hardware structures and / or software modules for executing each function. Based on the units and steps of the various examples described in the embodiments disclosed herein, this application can be implemented in hardware or a combination of hardware and computer software. Whether a function is executed by hardware or by computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0275] This application embodiment can divide the device into functional modules according to the above method example. For example, each function can be divided into its own functional module, or two or more functions can be integrated into one module. The integrated module can be implemented in hardware or as a software functional module. It should be noted that the module division in this application embodiment is illustrative and only represents one logical functional division. In actual implementation, there may be other division methods.

[0276] When dividing each function into modules according to its corresponding function. Figure 4 A schematic diagram of a specific logical structure of the device is shown. This device can be the aforementioned configuration detection device, a chip within the configuration detection device, or a processing system within the configuration detection device, etc. The device 400 includes a processing unit 401. Wherein:

[0277] The processing unit 401 is used to obtain a first configuration feature based on preset rules and network element configuration files. The preset rules include a first rule and a second rule. The first rule is used to extract a first configuration object and a second configuration object from the network element configuration file. The second rule includes the connection relationship between the first configuration object and the second configuration object. The first configuration feature indicates the parameter attributes and / or functional attributes of the first configuration object and the second configuration object.

[0278] In one specific implementation, the aforementioned connection relationship includes semantic connection relationship and / or topological connection relationship.

[0279] In one specific implementation, the aforementioned semantic connection relationship includes one or more of the following: reference relationship, parameter matching relationship, companion relationship, logical operation matching relationship, group commonality relationship, cooperation relationship, and inclusion relationship.

[0280] In one specific implementation, the aforementioned first configuration feature includes the values ​​of parameter attributes and / or the number of functional attributes of the aforementioned first configuration object and the aforementioned second configuration object.

[0281] In one specific embodiment, the aforementioned processing unit is further configured to:

[0282] The second configuration feature is obtained based on the aforementioned preset rules and the aforementioned network element configuration file. The aforementioned preset rules also include a third rule and a fourth rule. The aforementioned third rule is used to extract a third configuration object from the aforementioned network element configuration file. The aforementioned fourth rule includes the connection relationship between the attributes of the aforementioned third configuration object. The aforementioned second configuration feature indicates the parameter attributes and / or functional attributes of the aforementioned third configuration object.

[0283] In one specific embodiment, the aforementioned processing unit is further configured to:

[0284] Based on the aforementioned preset rules and the aforementioned network element configuration file, multiple configuration features are obtained, including the aforementioned first configuration feature;

[0285] The processing result is obtained based on the aforementioned configuration features.

[0286] In one specific implementation, the aforementioned processing unit is specifically used for:

[0287] The first anomaly detection result is obtained based on the anomaly detection model and the aforementioned configuration features.

[0288] In one specific implementation, the aforementioned processing unit is specifically used for:

[0289] The classification results are obtained based on the aforementioned configuration features, and the aforementioned classification results include one or more feature types.

[0290] In one specific implementation, the aforementioned processing unit is specifically used for:

[0291] Based on one or more topological connection relationships included in the aforementioned preset rules, the aforementioned multiple configuration features are classified to obtain one or more feature types. The aforementioned one or more topological connection relationships include the topological connection relationships of network elements involved in the aforementioned network element configuration files in the network. Configuration features with the same connection relationship in the aforementioned one or more topological connection relationships belong to the same feature type.

[0292] In one specific implementation, the aforementioned processing unit is specifically used for:

[0293] Based on one or more semantic connection relationships included in the aforementioned preset rules, the aforementioned multiple configuration features are classified to obtain one or more feature types. Among them, configuration features with the same connection relationship in the aforementioned one or more semantic connection relationships belong to the same feature type.

[0294] In one specific implementation, the aforementioned classification result includes a first feature type. The aforementioned processing unit is further configured to, after obtaining the classification result based on the aforementioned multiple configuration features, determine whether the configuration object corresponding to the configuration features included in the aforementioned first feature type is abnormal based on a threshold. The number of configuration features included in the aforementioned first feature type is less than the aforementioned threshold, indicating that the corresponding configuration object is abnormal. Alternatively, the number of configuration features included in the aforementioned first feature type is greater than or equal to the aforementioned threshold, indicating that the corresponding configuration object is normal.

[0295] In one specific implementation, the aforementioned processing unit is further configured to, after obtaining the classification result based on the aforementioned multiple configuration features, perform anomaly detection based on the configuration features of one or more feature types in the aforementioned classification result and the anomaly detection model respectively, to obtain a second anomaly detection result.

[0296] In one specific embodiment, the aforementioned processing unit is further configured to:

[0297] A configuration template is generated based on the aforementioned first configuration object, the aforementioned second configuration object, and the connection relationship between the aforementioned first configuration object and the aforementioned second configuration object.

[0298] In one specific implementation, the aforementioned first configuration object and / or the aforementioned second configuration object are configuration objects of the first network element; the aforementioned processing unit is further configured to:

[0299] Obtain the second topology connection relationship, which includes the topology connection relationship of the newly added network element in the target network. The target network is the network where the network element involved in the aforementioned network element configuration file is located. The network element involved in the aforementioned network element configuration file includes the aforementioned first network element.

[0300] Based on the aforementioned second topology connection relationship, it is determined that the newly added network element has the same function as the aforementioned first network element;

[0301] Information about the configuration object of the newly added network element is generated based on the aforementioned configuration template.

[0302] Figure 4 The specific operation and beneficial effects of each unit in the device 400 shown can be found in the above description. Figure 2 The specific method embodiments and their corresponding descriptions are not repeated here.

[0303] Figure 5 The diagram shown illustrates a specific hardware structure of the device provided in this application. This device can be the configuration detection device described in the above embodiments, or it can be a chip within the configuration detection device, or it can be a processing system within the configuration detection device, etc. The device 500 includes: a processor 501, a memory 502, and a communication interface 503. The processor 501, the communication interface 503, and the memory 502 can be interconnected or interconnected via a bus 504.

[0304] For example, memory 502 is used to store computer programs and data of storage device 500. Memory 502 may include, but is not limited to, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), or compact disc read-only memory (CD-ROM).

[0305] The communication interface 503 includes a sending interface and a receiving interface. There can be multiple communication interfaces 503, which are used to support the device 500 in communication, such as receiving or sending data or messages.

[0306] For example, processor 501 may be a central processing unit, a general-purpose processor, a digital signal processor, an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. The processor may also be a combination that implements computational functions, such as a combination of one or more microprocessors, a combination of a digital signal processor and a microprocessor, etc. Processor 501 can be used to read the program stored in the aforementioned memory 502, causing device 500 to execute as described above. Figure 2 The network configuration anomaly detection method described in its specific embodiments. Alternatively, the processor 501 can be used to read the program stored in the memory 502, causing the device 500 to execute as described above. Figure 3 The network configuration feature extraction method described in its specific embodiments.

[0307] In one specific embodiment, the processor 501 can be used to read the program stored in the memory 502 and perform the following operations: obtain a first configuration feature based on preset rules and network element configuration files, wherein the preset rules include a first rule and a second rule, the first rule is used to extract a first configuration object and a second configuration object from the network element configuration file, the second rule includes the connection relationship between the first configuration object and the second configuration object, and the first configuration feature indicates the parameter attributes and / or functional attributes of the first configuration object and the second configuration object.

[0308] Figure 5 The specific operation and beneficial effects of each unit in the device 500 shown can be found in the above description. Figure 2 The specific method embodiments and their corresponding descriptions, or see the above. Figure 3 The specific method embodiments and their corresponding descriptions are not repeated here.

[0309] This application also provides a computer-readable storage medium storing a computer program that is executed by a processor to perform the above-described tasks. Figure 2 The method described in any of the specific method embodiments.

[0310] This application also provides a computer-readable storage medium storing a computer program that is executed by a processor to perform the above-described tasks. Figure 3 The method described in any of the specific method embodiments.

[0311] This application also provides a computer program product, which, when read and executed by a computer, performs the above-mentioned... Figure 2 The method described in any of the specific method embodiments.

[0312] This application also provides a computer program product, which, when read and executed by a computer, performs the above-mentioned... Figure 3 The method described in any of the specific method embodiments.

[0313] In summary, this application obtains the configuration objects to be detected from the network element configuration file for a given preset rule. Then, configuration features are constructed through the connection relationships between configuration objects. These constructed configuration features can be used to detect abnormal configuration objects, thereby quickly detecting errors in implicit network norms and logical configurations and reducing the risk of network accidents. Furthermore, since this application constructs configuration features of configuration objects based on connection relationships to achieve configuration anomaly detection, it can not only more accurately detect whether the content of configuration objects is abnormal, but also detect whether the parameter matching relationships between configuration objects are abnormal, thus achieving more comprehensive configuration anomaly detection. In addition, the network configuration feature extraction method provided by this application can extract configuration features with high network configuration consistency. For example, various network topologies such as Internet Protocol Radio Access Network (IPRAN), Packet Transport Network (PTN), or Data Communication Network (DCN) can all use this application to extract configuration features, and then perform configuration anomaly detection based on the extracted configuration features. It is evident that the implementation method of this application has strong network adaptability and a wide range of applicable scenarios. Moreover, compared to existing solutions that rely on manual rules for various configurations, this application eliminates the need for significant program development and maintenance costs, thereby reducing implementation costs. In summary, this application enables efficient and accurate anomaly detection in network configurations by acquiring configuration object information of network elements at low cost and with high coverage.

[0314] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.

Claims

1. A method for extracting network configuration features, characterized in that, The method includes: The first configuration feature is obtained based on preset rules and network element configuration files. The preset rules include a first rule and a second rule. The first rule is used to extract a first configuration object and a second configuration object from the network element configuration file. The second rule includes the connection relationship between the first configuration object and the second configuration object. The first configuration feature indicates the functional attributes of the first configuration object and the second configuration object. The first configuration feature includes the number of functional attributes of the first configuration object and the second configuration object; the first configuration feature is used to determine whether the first configuration object and the second configuration object are abnormal. The connection relationships include semantic connection relationships; the semantic connection relationships include one or more of the following: reference relationship, parameter matching relationship, companion relationship, logical operation matching relationship, cooperation relationship and containment relationship.

2. The method according to claim 1, characterized in that, The first configuration feature further indicates the parameter attributes of the first configuration object and the second configuration object; the first configuration feature includes the values ​​of the parameter attributes of the first configuration object and the second configuration object.

3. The method according to claim 1 or 2, characterized in that, The method further includes: The second configuration feature is obtained based on the preset rules and the network element configuration file. The preset rules also include a third rule and a fourth rule. The third rule is used to extract a third configuration object from the network element configuration file. The fourth rule includes the connection relationship between the attributes of the third configuration object. The second configuration feature indicates the parameter attributes and / or functional attributes of the third configuration object.

4. The method according to any one of claims 1-3, characterized in that, The method further includes: Multiple configuration features are obtained based on the preset rules and the network element configuration file, and the multiple configuration features include the first configuration feature; The processing result is obtained based on the aforementioned multiple configuration features.

5. The method according to claim 4, characterized in that, The process of obtaining the processing result based on the multiple configuration features includes: The first anomaly detection result is obtained based on the anomaly detection model and the multiple configuration features.

6. The method according to claim 4, characterized in that, The process of obtaining the processing result based on the multiple configuration features includes: The classification result is obtained based on the multiple configuration features, and the classification result includes one or more feature types.

7. The method according to claim 6, characterized in that, The process of obtaining classification results based on the multiple configuration features includes: The multiple configuration features are classified based on one or more topology connection relationships included in the preset rules to obtain one or more feature types. The one or more topology connection relationships include the topology connection relationships of network elements involved in the network element configuration file in the network. Configuration features with the same connection relationship in the one or more topology connection relationships belong to the same feature type.

8. The method according to claim 6, characterized in that, The process of obtaining classification results based on the multiple configuration features includes: The multiple configuration features are classified based on one or more semantic connection relationships included in the preset rules to obtain one or more feature types, wherein configuration features with the same connection relationship in the one or more semantic connection relationships belong to the same feature type.

9. The method according to any one of claims 6-8, characterized in that, The classification result includes a first feature type. After obtaining the classification result based on the multiple configuration features, it further includes: Based on a threshold, it is determined whether the configuration object corresponding to the configuration features included in the first feature type is abnormal. Wherein, if the number of configuration features included in the first feature type is less than the threshold, it indicates that the corresponding configuration object is abnormal, or if the number of configuration features included in the first feature type is greater than or equal to the threshold, it indicates that the corresponding configuration object is normal.

10. The method according to any one of claims 6-9, characterized in that, After obtaining the classification result based on the multiple configuration features, the process further includes: Anomaly detection is performed based on configuration features of one or more feature types in the classification results and anomaly detection models to obtain a second anomaly detection result.

11. The method according to any one of claims 1-10, characterized in that, The method further includes: A configuration template is generated based on the first configuration object, the second configuration object, and the connection relationship between the first configuration object and the second configuration object.

12. The method according to claim 11, characterized in that, The first configuration object and / or the second configuration object are configuration objects of the first network element, and the method further includes: Obtain a second topology connection relationship, which includes the topology connection relationship of newly added network elements in the target network. The target network is the network where the network elements involved in the network element configuration file are located, and the network elements involved in the network element configuration file include the first network element. Based on the second topology connection relationship, it is determined that the newly added network element has the same function as the first network element; Information about the configuration object of the newly added network element is generated based on the configuration template.

13. A network configuration feature extraction device, characterized in that, The device includes: The processing unit is configured to obtain a first configuration feature based on preset rules and network element configuration files. The preset rules include a first rule and a second rule. The first rule is used to extract a first configuration object and a second configuration object from the network element configuration file. The second rule includes the connection relationship between the first configuration object and the second configuration object. The first configuration feature indicates the functional attributes of the first configuration object and the second configuration object. The first configuration feature includes the number of functional attributes of the first configuration object and the second configuration object; the first configuration feature is used to determine whether the first configuration object and the second configuration object are abnormal. The connection relationships include semantic connection relationships; the semantic connection relationships include one or more of the following: reference relationship, parameter matching relationship, companion relationship, logical operation matching relationship, cooperation relationship and containment relationship.

14. The apparatus according to claim 13, characterized in that, The first configuration feature further indicates the parameter attributes of the first configuration object and the second configuration object; the first configuration feature includes the values ​​of the parameter attributes of the first configuration object and the second configuration object.

15. The apparatus according to claim 13 or 14, characterized in that, The processing unit is further configured to: The second configuration feature is obtained based on the preset rules and the network element configuration file. The preset rules also include a third rule and a fourth rule. The third rule is used to extract a third configuration object from the network element configuration file. The fourth rule includes the connection relationship between the attributes of the third configuration object. The second configuration feature indicates the parameter attributes and / or functional attributes of the third configuration object.

16. The apparatus according to any one of claims 13-15, characterized in that, The processing unit is further configured to: Multiple configuration features are obtained based on the preset rules and the network element configuration file, and the multiple configuration features include the first configuration feature; The processing result is obtained based on the aforementioned multiple configuration features.

17. The apparatus according to claim 16, characterized in that, The processing unit is specifically used for: The first anomaly detection result is obtained based on the anomaly detection model and the multiple configuration features.

18. The apparatus according to claim 17, characterized in that, The processing unit is specifically used for: The classification result is obtained based on the multiple configuration features, and the classification result includes one or more feature types.

19. The apparatus according to claim 18, characterized in that, The processing unit is specifically used for: The multiple configuration features are classified based on one or more topology connection relationships included in the preset rules to obtain one or more feature types. The one or more topology connection relationships include the topology connection relationships of network elements involved in the network element configuration file in the network. Configuration features with the same connection relationship in the one or more topology connection relationships belong to the same feature type.

20. The apparatus according to claim 18, characterized in that, The processing unit is specifically used for: The multiple configuration features are classified based on one or more semantic connection relationships included in the preset rules to obtain one or more feature types, wherein configuration features with the same connection relationship in the one or more semantic connection relationships belong to the same feature type.

21. The apparatus according to any one of claims 18-20, characterized in that, The classification result includes a first feature type. The processing unit is further configured to, after obtaining the classification result based on the plurality of configuration features, determine whether the configuration object corresponding to the configuration features included in the first feature type is abnormal based on a threshold. Wherein, if the number of configuration features included in the first feature type is less than the threshold, it indicates that the corresponding configuration object is abnormal, or if the number of configuration features included in the first feature type is greater than or equal to the threshold, it indicates that the corresponding configuration object is normal.

22. The apparatus according to any one of claims 18-21, characterized in that, The processing unit is further configured to, after obtaining the classification result based on the plurality of configuration features, perform anomaly detection based on the configuration features of one or more feature types in the classification result and the anomaly detection model respectively, to obtain a second anomaly detection result.

23. The apparatus according to any one of claims 13-22, characterized in that, The processing unit is further configured to: A configuration template is generated based on the first configuration object, the second configuration object, and the connection relationship between the first configuration object and the second configuration object.

24. The apparatus according to claim 23, characterized in that, The first configuration object and / or the second configuration object are configuration objects of the first network element; the processing unit is further configured to: Obtain a second topology connection relationship, which includes the topology connection relationship of newly added network elements in the target network. The target network is the network where the network elements involved in the network element configuration file are located, and the network elements involved in the network element configuration file include the first network element. Based on the second topology connection relationship, it is determined that the newly added network element has the same function as the first network element; Information about the configuration object of the newly added network element is generated based on the configuration template.

25. An apparatus, characterized in that, The device includes a processor and a memory; wherein the memory is used to store a computer program, and the processor is used to invoke the computer program to cause the device to perform the method as described in any one of claims 1-12.

26. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the method described in any one of claims 1-12.

27. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the method according to any one of claims 1-12.

Images