An information acquisition method, apparatus and network device

Abstract

The application provides an information acquisition method, device and network equipment, wherein the information acquisition method comprises the following steps: acquiring a time sequence feature set corresponding to terminal network data in a first time period; acquiring an identification result corresponding to the time sequence feature set by using a first unsupervised model and a second unsupervised model; the identification result indicates that there is an abnormal value in the time sequence feature set or indicates that there is no abnormal value in the time sequence feature set; the abnormal value is used to indicate that the terminal is in a network abnormal state. The embodiment of the application can acquire network data of a terminal individual, and can analyze the network data by using an unsupervised model to identify whether the network state of the terminal individual is abnormal, thereby monitoring the network state of the terminal individual.

Description

Technical Field

[0001] This invention relates to the field of network intelligence technology, and in particular to an information acquisition method, apparatus, and network device. Background Technology

[0002] The number of network terminals is growing explosively, making the effective management of this massive number of terminals a major challenge for network operators, especially in monitoring their health status. When a network terminal malfunctions, it may not report the anomaly. Network operators need to use the terminal's user plane and control plane data to determine whether the terminal is in a normal or abnormal state, and then provide targeted fault analysis and solutions for the abnormal terminals.

[0003] Currently, network operators primarily monitor network quality through statistical metrics such as attach success rate, Public Data Network (PDN) connection success rate, and bearer establishment success rate. A success rate below 95% is considered an abnormal network. However, existing technical solutions monitor the overall network quality and lack monitoring of individual network terminals. Summary of the Invention

[0004] The purpose of this invention is to provide an information acquisition method, apparatus, and network device to solve the problem that existing technologies cannot monitor the network status of individual network terminals.

[0005] To address the aforementioned technical problems, embodiments of the present invention provide an information acquisition method, comprising:

[0006] Obtain the time-series feature set corresponding to the terminal network data within the first time period; the time-series feature set includes time-series feature values ​​in at least two dimensions;

[0007] The recognition results corresponding to the time-series feature set are obtained by using the first unsupervised model and the second unsupervised model;

[0008] The identification result indicates that there is an outlier in the time-series feature set, or indicates that there is no outlier in the time-series feature set; the outlier is used to indicate that the terminal is in a network abnormal state.

[0009] Optionally, obtaining the time-series feature set corresponding to the terminal network data within the first time period includes:

[0010] Obtain the initial temporal characteristic values ​​of the terminal network data within the first time period;

[0011] The initial time-series feature values ​​are subjected to similarity analysis and clustering to obtain the time-series feature set.

[0012] Optionally, obtaining the recognition result corresponding to the time-series feature set using the unsupervised model includes:

[0013] Using the first unsupervised model, the first prediction error value of the time series feature set is obtained;

[0014] The reconstruction error value of the time series feature set is obtained using the second unsupervised model;

[0015] The recognition result is obtained based on the first prediction error value and the reconstruction error value.

[0016] Optionally, obtaining the recognition result based on the first prediction error value and the reconstruction error value includes:

[0017] The time series feature set is updated based on the first prediction error value, the reconstruction error value, and the reconstruction error threshold to obtain the updated time series feature set.

[0018] Using the first unsupervised model, obtain the second prediction error value corresponding to the updated time-series feature set;

[0019] The recognition result is obtained based on the comparison between the first prediction error value and the second prediction error value.

[0020] Optionally, updating the time-series feature set based on the first prediction error value, the reconstruction error value, and the reconstruction error threshold to obtain the updated time-series feature set includes:

[0021] Based on the first prediction error value, the reconstruction error value, and the reconstruction error threshold, the predicted outlier value is obtained;

[0022] The predicted outliers are deleted from the time series feature set to obtain the updated time series feature set.

[0023] Optionally, obtaining the predicted outlier based on the first prediction error value, the reconstruction error value, and the reconstruction error threshold includes:

[0024] In the time series feature set, a first target prediction anomaly is identified where the reconstruction error value is greater than the reconstruction error threshold.

[0025] Determine a first target temporal feature value that has the largest reconstruction error value in the set of temporal features;

[0026] Determine a second target temporal feature value that has the largest first prediction error value in the temporal feature set;

[0027] The overlapping time series feature values ​​between the first target time series feature value and the second target time series feature value are identified as the second target prediction anomalies;

[0028] The predicted outlier is obtained based on the first target predicted outlier and the second target predicted outlier.

[0029] Optionally, obtaining the recognition result based on the comparison result of the first prediction error value and the second prediction error value includes:

[0030] If the second prediction error value is less than the first prediction error value, it is determined that the identification result indicates that there is an outlier in the time series feature set;

[0031] The outlier value is the predicted outlier value.

[0032] Optionally, after obtaining the recognition result based on the comparison result of the first prediction error value and the second prediction error value, the method further includes:

[0033] The first operation is repeated until the first prediction error value is less than the prediction error threshold.

[0034] The first operation includes: updating the reconstruction error threshold based on the comparison result of the first prediction error value and the second prediction error value; updating the time series feature set based on the first prediction error value, the reconstruction error value and the reconstruction error threshold to obtain the updated time series feature set; the reconstruction error threshold is the updated reconstruction error threshold.

[0035] Optionally, updating the reconstruction error threshold based on the comparison result of the first prediction error value and the second prediction error value includes:

[0036] If the second prediction error value is less than the first prediction error value, the reconstruction error threshold is reduced by the first threshold.

[0037] If the second prediction error value is greater than or equal to the first prediction error value, the reconstruction error threshold is increased by a second threshold.

[0038] Optionally, after obtaining the recognition result corresponding to the time-series feature set using an unsupervised model, the method further includes:

[0039] Update the first time period based on the preset duration and the current time.

[0040] This invention also provides an information acquisition device, comprising:

[0041] The first acquisition module is used to acquire a time-series feature set corresponding to terminal network data within a first time period; the time-series feature set includes time-series feature values ​​in at least two dimensions;

[0042] The second acquisition module is used to acquire the recognition results corresponding to the time-series feature set using an unsupervised model;

[0043] The identification result indicates that there is an outlier in the time-series feature set, or indicates that there is no outlier in the time-series feature set; the outlier is used to indicate that the terminal is in a network abnormal state.

[0044] Optionally, the first acquisition module includes:

[0045] The first acquisition unit is used to acquire the initial temporal feature value of the terminal network data within the first time period;

[0046] The first processing unit is used to perform similarity analysis and clustering on the initial time-series feature values ​​to obtain the time-series feature set.

[0047] Optionally, the second acquisition module includes:

[0048] The second acquisition unit is used to acquire the first prediction error value of the time series feature set using the first unsupervised model;

[0049] The third acquisition unit is used to acquire the reconstruction error value of the time series feature set using the second unsupervised model;

[0050] The second processing unit is used to obtain the recognition result based on the first prediction error value and the reconstruction error value.

[0051] Optionally, the second processing unit is specifically used for:

[0052] The time series feature set is updated based on the first prediction error value, the reconstruction error value, and the reconstruction error threshold to obtain the updated time series feature set.

[0053] Using the first unsupervised model, obtain the second prediction error value corresponding to the updated time-series feature set;

[0054] The recognition result is obtained based on the comparison between the first prediction error value and the second prediction error value.

[0055] Optionally, the second processing unit is specifically used for:

[0056] Based on the first prediction error value, the reconstruction error value, and the reconstruction error threshold, the predicted outlier value is obtained;

[0057] The predicted outliers are deleted from the time series feature set to obtain the updated time series feature set.

[0058] Optionally, the second processing unit is specifically used for:

[0059] In the time series feature set, a first target prediction anomaly is identified where the reconstruction error value is greater than the reconstruction error threshold.

[0060] Determine a first target temporal feature value that has the largest reconstruction error value in the temporal feature set;

[0061] Determine a second target temporal feature value that has the largest first prediction error value in the temporal feature set;

[0062] The overlapping time series feature values ​​between the first target time series feature value and the second target time series feature value are identified as the second target prediction anomalies;

[0063] The predicted outlier is obtained based on the first target predicted outlier and the second target predicted outlier.

[0064] Optionally, the second processing unit is specifically used for:

[0065] If the second prediction error value is less than the first prediction error value, it is determined that the identification result indicates that there is an outlier in the time series feature set;

[0066] The outlier value is the predicted outlier value.

[0067] Optionally, the second processing unit is further specifically used for:

[0068] The first operation is repeated until the first prediction error value is less than the prediction error threshold.

[0069] The first operation includes: updating the reconstruction error threshold based on the comparison result of the first prediction error value and the second prediction error value; updating the time series feature set based on the first prediction error value, the reconstruction error value and the reconstruction error threshold to obtain the updated time series feature set; the reconstruction error threshold is the updated reconstruction error threshold.

[0070] Optionally, the second processing unit is further specifically used for:

[0071] If the second prediction error value is less than the first prediction error value, the reconstruction error threshold is reduced by the first threshold.

[0072] If the second prediction error value is greater than or equal to the first prediction error value, the reconstruction error threshold is increased by a second threshold.

[0073] Optionally, the device further includes:

[0074] The update module is used to update the first time period based on the preset duration and the current time.

[0075] This invention also provides a network device, including a processor and a transceiver, wherein:

[0076] The processor is configured to acquire a time-series feature set corresponding to terminal network data within a first time period; the time-series feature set includes time-series feature values ​​in at least two dimensions;

[0077] Using an unsupervised model, the recognition results corresponding to the time-series feature set are obtained;

[0078] The identification result indicates that there is an outlier in the time-series feature set, or indicates that there is no outlier in the time-series feature set; the outlier is used to indicate that the terminal is in a network abnormal state.

[0079] Optionally, the processor is specifically used for:

[0080] Obtain the initial temporal characteristic values ​​of the terminal network data within the first time period;

[0081] The initial time-series feature values ​​are subjected to similarity analysis and clustering to obtain the time-series feature set.

[0082] Optionally, the processor is specifically used for:

[0083] The step of using the unsupervised model to obtain the recognition result corresponding to the time-series feature set includes:

[0084] Using the first unsupervised model, the first prediction error value of the time series feature set is obtained;

[0085] The reconstruction error value of the time series feature set is obtained using the second unsupervised model;

[0086] The recognition result is obtained based on the first prediction error value and the reconstruction error value.

[0087] Optionally, the processor is specifically used for:

[0088] The time series feature set is updated based on the first prediction error value, the reconstruction error value, and the reconstruction error threshold to obtain the updated time series feature set.

[0089] Using the first unsupervised model, obtain the second prediction error value corresponding to the updated time-series feature set;

[0090] The recognition result is obtained based on the comparison between the first prediction error value and the second prediction error value.

[0091] Optionally, the processor is specifically used for:

[0092] Based on the first prediction error value, the reconstruction error value, and the reconstruction error threshold, the predicted outlier value is obtained;

[0093] The predicted outliers are deleted from the time series feature set to obtain the updated time series feature set.

[0094] Optionally, the processor is specifically used for:

[0095] In the time series feature set, a first target prediction anomaly is identified where the reconstruction error value is greater than the reconstruction error threshold.

[0096] Determine a first target temporal feature value that has the largest reconstruction error value in the temporal feature set;

[0097] Determine a second target temporal feature value that has the largest first prediction error value in the temporal feature set;

[0098] The overlapping time series feature values ​​between the first target time series feature value and the second target time series feature value are identified as the second target prediction anomalies;

[0099] The predicted outlier is obtained based on the first target predicted outlier and the second target predicted outlier.

[0100] Optionally, the processor is specifically used for:

[0101] If the second prediction error value is less than the first prediction error value, it is determined that the identification result indicates that there is an outlier in the time series feature set;

[0102] The outlier value is the predicted outlier value.

[0103] Optionally, after the processor obtains the recognition result based on the comparison result of the first prediction error value and the second prediction error value, the processor is further specifically configured to:

[0104] The first operation is repeated until the first prediction error value is less than the prediction error threshold.

[0105] The first operation includes: updating the reconstruction error threshold based on the comparison result of the first prediction error value and the second prediction error value; updating the time series feature set based on the first prediction error value, the reconstruction error value and the reconstruction error threshold to obtain the updated time series feature set; the reconstruction error threshold is the updated reconstruction error threshold.

[0106] Optionally, the processor is specifically used for:

[0107] If the second prediction error value is less than the first prediction error value, the reconstruction error threshold is reduced by the first threshold.

[0108] If the second prediction error value is greater than or equal to the first prediction error value, the reconstruction error threshold is increased by a second threshold.

[0109] Optionally, after the processor obtains the recognition result corresponding to the time-series feature set using an unsupervised model, the processor is further configured to:

[0110] Update the first time period based on the preset duration and the current time.

[0111] This invention also provides a network device, including a memory, a processor, and a program stored in the memory and executable on the processor; when the processor executes the program, it implements the information acquisition method as described in any one of the above.

[0112] This invention also provides a readable storage medium storing a program, which, when executed by a processor, implements the steps of the information acquisition method described in any of the above embodiments.

[0113] At least one of the above-described technical solutions of the present invention has the following beneficial effects:

[0114] In the above scheme, by acquiring the temporal feature set corresponding to the terminal network data within a first time period, wherein the temporal feature set includes at least two temporal feature values, the network data of an individual terminal can be acquired; and an unsupervised model is used to obtain the identification result corresponding to the temporal feature set, wherein the identification result indicates that there are outliers in the temporal feature set, or indicates that there are no outliers in the temporal feature set; the outliers are used to indicate that the terminal is in an abnormal network state, thus realizing the identification of whether there are abnormalities in the network state of an individual terminal by analyzing network data through an unsupervised model, thereby realizing the monitoring of the network state of an individual network terminal. Attached Figure Description

[0115] Figure 1One of the flowcharts for the information acquisition method provided in the embodiments of the present invention;

[0116] Figure 2 A schematic diagram of the time series prediction model provided in an embodiment of the present invention;

[0117] Figure 3 The second flowchart of the information acquisition method provided in the embodiments of the present invention;

[0118] Figure 4 A flowchart illustrating the identification results of obtaining a time-series feature set corresponding to dynamic terminal network data, provided in an embodiment of the present invention;

[0119] Figure 5 This is a schematic diagram of the structure of the information acquisition device provided in an embodiment of the present invention;

[0120] Figure 6 This is one of the structural schematic diagrams of a network device provided in an embodiment of the present invention;

[0121] Figure 7 This is a second schematic diagram of the network device provided in an embodiment of the present invention. Detailed Implementation

[0122] To make the technical problems, technical solutions and advantages of the present invention clearer, a detailed description will be given below in conjunction with the accompanying drawings and specific embodiments.

[0123] like Figure 1 As shown, an embodiment of the present invention provides an information acquisition method, including:

[0124] Step 101: Obtain the time-series feature set corresponding to the terminal network data within the first time period; the time-series feature set includes time-series feature values ​​of at least two dimensions.

[0125] In step 101, the network data of the individual terminal can be obtained based on Deep Packet Inspection (DPI) technology through External Data Representation (xDR). Specifically, obtaining the terminal network data includes extracting user plane characteristics such as the number of uplink and downlink Internet Protocol (IP) packets and uplink and downlink latency, as well as control plane characteristics such as the number of bearer establishment requests and the number of successful bearer establishments from the xDR. In other words, the terminal network data includes both control plane data and user plane data.

[0126] After acquiring the network data of individual terminals in the first time period, a corresponding time-series feature set is obtained based on the terminal network data. Each time-series feature set includes time-series feature values ​​in at least two dimensions. Step 101 enables the acquisition of network data for individual terminals and the merging of this data into a time-series feature set, facilitating subsequent monitoring of the network status of individual terminals based on the time-series feature set.

[0127] Step 102: Use an unsupervised model to obtain the recognition results corresponding to the time-series feature set;

[0128] The identification result indicates that there is an outlier in the time-series feature set, or indicates that there is no outlier in the time-series feature set; the outlier is used to indicate that the terminal is in a network abnormal state.

[0129] After acquiring the network data of individual terminals, in step 102, based on the terminal network data, anomaly identification is performed on the terminal network data using an unsupervised learning algorithm to obtain the identification result. The identification result can indicate that there are outliers in the time series feature set, that is, the terminal network state is abnormal at the time corresponding to the outlier. The identification result can also indicate that there are no outliers in the time series feature set, that is, the terminal network state is not abnormal.

[0130] In this step, the operator does not need to parse the terminal's communication protocol. Instead, it uses an unsupervised learning algorithm to analyze the terminal's network data to detect terminal anomalies, thereby enabling monitoring and management of the terminal's operational status.

[0131] Optionally, obtaining the time-series feature set corresponding to the terminal network data within the first time period includes:

[0132] Obtain the initial temporal characteristic values ​​of the terminal network data within the first time period;

[0133] The initial time-series feature values ​​are subjected to similarity analysis and clustering to obtain the time-series feature set.

[0134] It should be noted that, due to the large number of feature dimensions in the acquired terminal network data, dimensionality reduction processing is required to obtain a temporal feature set. Specifically, terminal network data within the first time period is acquired, and initial temporal feature values ​​are obtained based on the terminal network data. Similarity analysis and feature clustering processing are performed on the initial temporal feature values, and similar features and features within each cluster are merged into a temporal feature set. The terminal network data of a single terminal may include multiple temporal feature sets, each temporal feature set including temporal feature values ​​of at least two dimensions, and each dimension of temporal feature values ​​including temporal feature values ​​from at least two time points.

[0135] Similarity analysis and clustering were performed on the initial temporal feature values ​​of the terminal network data to obtain the temporal feature set of the terminal, as shown in Table 1 below.

[0136] Table 1. Schematic diagram of the timing characteristics set of the terminal

[0137]

[0138] As shown in Table 1, similarity analysis and clustering were performed on the initial temporal feature values ​​of the terminal network data to obtain temporal feature values ​​corresponding to three dimensions, namely Feature1, Feature2 and Feature3. T1, T2, T3 and T4 represent four moments within the first time period. The temporal feature values ​​Feature1 in dimension one include a1, a2, a3 and a4. The temporal feature values ​​Feature2 in dimension two include b1, b2, b3 and b4. The temporal feature values ​​Feature3 in dimension three include c1, c2, c3 and c4.

[0139] Optionally, obtaining the recognition result corresponding to the time-series feature set using the unsupervised model includes:

[0140] Using the first unsupervised model, the first prediction error value of the time series feature set is obtained;

[0141] The reconstruction error value of the time series feature set is obtained using the second unsupervised model;

[0142] The recognition result is obtained based on the first prediction error value and the reconstruction error value.

[0143] To improve the accuracy of anomaly identification results of unsupervised learning algorithms in terminal network data, this invention uses two unsupervised models, namely a first unsupervised model and a second unsupervised model, to label and verify the terminal network data, thereby improving the accuracy of anomaly identification in the terminal network data.

[0144] Furthermore, the first unsupervised model is a Long Short-Term Memory (LSTM) prediction model, and the second unsupervised model is a Variational Auto-Encoder (VAE) recognition model.

[0145] Specifically, the first prediction error value of the time series feature set is obtained by using the first unsupervised model, and the reconstruction error value of the time series feature set is obtained by using the second unsupervised model. Based on the results of the two unsupervised models (the first prediction error value and the reconstruction error value), the recognition result is obtained.

[0146] Optionally, obtaining the recognition result based on the first prediction error value and the reconstruction error value includes:

[0147] The time series feature set is updated based on the first prediction error value, the reconstruction error value, and the reconstruction error threshold to obtain the updated time series feature set.

[0148] Using the first unsupervised model, obtain the second prediction error value corresponding to the updated time-series feature set;

[0149] The recognition result is obtained based on the comparison between the first prediction error value and the second prediction error value.

[0150] In this embodiment of the invention, the temporal feature set is updated through mutual verification and interaction between two unsupervised models: an LSTM prediction model (first unsupervised model) and a VAE recognition model (second unsupervised model). Specifically, the LSTM prediction model is used to obtain the first prediction error value corresponding to the temporal feature set, and the VAE recognition model is used to obtain the reconstruction error value corresponding to the temporal feature set. Based on the first prediction error value, the reconstruction error value, and a preset reconstruction error threshold, the temporal feature set is updated. Compared to the original temporal feature set, the updated temporal feature set may have deleted temporal feature values. Then, the LSTM prediction model is used to obtain the second prediction error value corresponding to the updated temporal feature set. Based on the comparison between the second and first prediction error values, the recognition result is obtained. That is, based on the comparison between the second and first prediction error values, it is determined whether the deleted temporal feature value obtained by comparing the updated temporal feature set with the original temporal feature set is an outlier, i.e., whether it indicates that the terminal is in a network abnormal state at the time corresponding to the deleted temporal feature value.

[0151] Further, obtaining the updated time-series feature set based on the first prediction error value, the reconstruction error value, and the reconstruction error threshold includes:

[0152] Based on the first prediction error value, the reconstruction error value, and the reconstruction error threshold, the predicted outlier value is obtained;

[0153] The predicted outliers are deleted from the time series feature set to obtain the updated time series feature set.

[0154] To further explain, the updated time series feature set, compared to the original time series feature set, removes the predicted outliers, which are the "deleted time series feature values" mentioned above. These predicted outliers are obtained based on the first prediction error value, the reconstruction error value, and the preset reconstruction error threshold.

[0155] It should be noted that this predicted outlier can be considered a high-probability outlier, but whether the predicted outlier is determined to be an outlier needs to be determined based on the comparison between the second prediction error value and the first prediction error value.

[0156] In this step, by deleting outliers and updating the time-series feature set, we can reduce the interference items in the time-series feature set. This allows us to optimize the training set of the LSTM prediction model based on the updated time-series feature set, thereby improving the accuracy of the LSTM prediction model and reducing prediction errors.

[0157] Preferably, obtaining the first prediction error value corresponding to the time-series feature set using the first unsupervised model includes:

[0158] The first unsupervised model is trained based on the training values ​​in the time series feature set to obtain a time series prediction model;

[0159] Based on the time series prediction model and the test values ​​in the time series feature set, the first prediction error value of the test value is obtained.

[0160] The following explains in detail the process of obtaining the first prediction error value corresponding to the time series feature set using the LSTM prediction model.

[0161] For a given set of temporal features, in this step, the temporal feature values ​​a1, a2, a3, and a4 from Feature1 (dimension one) of the temporal feature set shown in Table 1 are selected. These temporal feature values ​​(a1, a2, a3, and a4) are split into a training set and a test set. The training set includes training values, and the test set includes test values. The training set is input into the LSTM prediction model for training. When a preset training termination condition is met, such as the loss function no longer decreasing or the training reaching a certain number of iterations, training is stopped, resulting in a temporal prediction model. Prediction is performed using the temporal prediction model, and the prediction result is compared with the test values ​​in the test set to obtain the first prediction error value Err. t .

[0162] Preferably, the ratio of the number of training values ​​to the number of test values ​​is 3:1. For example, in the temporal feature values ​​a1, a2, a3 and a4 in Feature1, a1, a2 and a3 are training values ​​and a4 is a test value.

[0163] Please see Figure 2 The training set is input into the LSTM prediction model for training, and the resulting time series prediction model is as follows: Figure 2 As shown, Figure 2 In the time series prediction model section corresponding to the test set, solid lines represent prediction results and dashed lines represent test values.

[0164] Preferably, the reconstruction error value corresponding to the time-series feature set is obtained using a second unsupervised model, including:

[0165] Based on the time-series feature set, the second unsupervised model is trained to obtain an anomaly recognition model;

[0166] The reconstruction error value is obtained based on the anomaly identification model and the time series feature set.

[0167] This step first explains the process of using the VAE recognition model to obtain the reconstruction error value corresponding to the time series feature set.

[0168] For a set of temporal features, in this step, the temporal feature values ​​a1, a2, a3, and a4 in Feature1 of dimension one shown in Table 1 are also selected. The above temporal feature values ​​(a1, a2, a3, and a4) are input into the VAE recognition model for training. When the preset training termination condition is met, such as the loss function no longer decreasing, or the training reaches a certain number of iterations, the training is stopped, and the anomaly recognition model is obtained. Through the anomaly recognition model, the reconstruction error values ​​corresponding to the temporal feature values ​​a1, a2, a3, and a4 can be obtained respectively.

[0169] Preferably, obtaining the predicted outlier based on the first prediction error value, the reconstruction error value, and the reconstruction error threshold includes:

[0170] In the time series feature set, a first target prediction anomaly is identified where the reconstruction error value is greater than the reconstruction error threshold.

[0171] Determine a first target temporal feature value that has the largest reconstruction error value in the temporal feature set;

[0172] Determine a second target temporal feature value that has the largest first prediction error value in the temporal feature set;

[0173] The overlapping time series feature values ​​between the first target time series feature value and the second target time series feature value are identified as the second target prediction anomalies;

[0174] The predicted outlier is obtained based on the first target predicted outlier and the second target predicted outlier.

[0175] The following details the process of obtaining predicted outliers based on the first prediction error value, the reconstruction error value, and the preset reconstruction error threshold.

[0176] If the time series feature set contains at least one time series feature value a k If the corresponding reconstruction error value is greater than the preset reconstruction error threshold T0, it can be determined that at least one temporal feature value a is present. k The first target is predicted as an outlier, which means that the first target can be considered as the predicted outlier (a). k It is highly likely that this is an outlier, meaning that the temporal feature set (Feature1) of the terminal's network data is abnormal at time k. The reconstruction error threshold T0 can be a relatively large value.

[0177] Given a first preset number of M features and a second preset number of N features, the M time-series feature values ​​with the largest reconstruction error (first target time-series feature values) and the N time-series feature values ​​with the largest first prediction error (second target time-series feature values) are identified. Then, it is determined whether the first target time-series feature values ​​and the second target time-series feature values ​​overlap. If they overlap, the overlapping time-series feature value is determined to be a second target prediction outlier. For example, if M = 2, N = 3, and a certain time-series feature value a... p The corresponding reconstruction error value is the second largest, and this time series feature value a p If the first prediction error value is the largest, then the time series feature value a is determined. p The prediction of outliers for the second objective is to explain the prediction of outliers for the second objective (a) p In both unsupervised models, the second objective cannot be correctly predicted or reconstructed, and can be considered an outlier (a). p It is highly likely that this is an outlier, meaning that the time-series feature set (Feature1) of the network data of this terminal is abnormal at time p.

[0178] The first objective is to predict outliers (a) k ) and the second target predicted outlier (a p ) as the predicted outlier.

[0179] It should be noted that the second objective predicts outliers (a) p The value may be empty, meaning that the first target time series feature value and the second target time series feature value may not overlap, i.e., there is no second predicted outlier (a). p If the predicted outliers only include the first target predicted outliers (a) k ).

[0180] Next, the predicted outliers are removed from the time series feature set to obtain an updated time series feature set. Correspondingly, the test set and training set in the time series feature set are also updated. The LSTM prediction model is retrained to obtain an updated time series prediction model. Prediction is performed using the updated time series prediction model, and the prediction result is compared with the test value in the test set of the updated time series feature set to obtain the second prediction error value.

[0181] This invention reduces interference items (predicted outliers) in the time series feature set by deleting values ​​that are likely to be outliers obtained by the anomaly identification model and deleting values ​​that are judged to be outliers by both the time series prediction model and the anomaly identification model. This can optimize the training set of the time series prediction model, thereby improving the accuracy of the time series prediction model and reducing prediction errors.

[0182] Preferably, obtaining the recognition result based on the comparison result of the first prediction error value and the second prediction error value includes:

[0183] If the second prediction error value is less than the first prediction error value, it is determined that there is an outlier in the temporal feature set of the recognition result;

[0184] The outlier value is the predicted outlier value.

[0185] In other words, determining whether a predicted outlier is an anomaly indicating abnormal terminal network data is done by verifying the predicted outlier from the previous round based on the change in the prediction error of the current round's time-series prediction model. Specifically, if the new prediction error value (second prediction error model) corresponding to the updated time-series feature set is lower than the prediction error value (first prediction error value) corresponding to the previous round's time-series feature set, it indicates that the deleted time-series feature value (predicted outlier) did indeed have an abnormal impact on the data distribution in the time-series feature set, meaning that the predicted outlier is determined to be an outlier. Conversely, if the new prediction error value (second prediction error model) corresponding to the updated time-series feature set is not lower than the prediction error value (first prediction error value) corresponding to the previous round's time-series feature set, it indicates that the deleted time-series feature value (predicted outlier) did not have an abnormal impact on the data distribution in the time-series feature set, and the predicted outlier cannot be determined to be an outlier.

[0186] Further, after obtaining the recognition result based on the comparison result of the first prediction error value and the second prediction error value, the method further includes:

[0187] The first operation is repeated until the first prediction error value is less than the prediction error threshold.

[0188] The first operation includes: updating the reconstruction error threshold based on the comparison result of the first prediction error value and the second prediction error value; updating the time series feature set based on the first prediction error value, the reconstruction error value and the reconstruction error threshold to obtain the updated time series feature set; the reconstruction error threshold is the updated reconstruction error threshold.

[0189] In other words, when determining whether a predicted outlier is an outlier indicating abnormal terminal network data based on the first and second prediction error values, the reconstruction error threshold is adjusted according to the comparison result of the first and second prediction error values ​​to obtain an updated reconstruction error threshold. Then, the following steps are repeated: the time series feature set is updated according to the first prediction error value, the reconstruction error value, and the updated reconstruction error threshold to obtain the updated time series feature set. That is, the reconstruction error value corresponding to the updated time series feature set that is greater than the updated reconstruction error threshold is selected as the first target predicted outlier. The second target predicted outlier is selected from the N time series feature values ​​(first target time series feature values) with the largest first prediction error value and the M time series feature values ​​(second target time series feature values) with the largest reconstruction error value. The first target predicted outlier and the second target predicted outlier are used as predicted outliers, and the predicted outliers are deleted from the updated time series feature set. Furthermore, after each cycle, based on the comparison between the second prediction error value corresponding to the updated time series feature set in the next cycle and the first prediction error value corresponding to the time series feature set in the previous cycle, it is determined whether the prediction anomaly value in the previous cycle is an anomaly value indicating abnormal terminal network data.

[0190] Training can be stopped when the first prediction error value is small enough (less than the prediction error threshold), which means that the time series prediction model can make predictions very accurately. This indicates that the training set and test set in the updated time series feature set have similar and interference-free data distributions, meaning that all outliers have been deleted. In this case, training can be stopped. The updated time series feature set obtained after stopping training does not contain outliers, which means that the terminal network status is normal at the time corresponding to the time series feature values ​​in the final time series feature set.

[0191] Preferably, updating the reconstruction error threshold based on the comparison result of the first prediction error value and the second prediction error value includes:

[0192] If the second prediction error value is less than the first prediction error value, the reconstruction error threshold is reduced by the first threshold.

[0193] If the second prediction error value is greater than or equal to the first prediction error value, the reconstruction error threshold is increased by a second threshold.

[0194] In other words, the process of adjusting the reconstruction error threshold based on the comparison between the first and second prediction error values ​​is as follows:

[0195] If the new prediction error value (second prediction error model) corresponding to the updated time series feature set is lower than the prediction error value (first prediction error value) corresponding to the previous time series feature set, it indicates that the deleted time series feature values ​​(predicted outliers) did indeed have an abnormal impact on the data distribution in the time series feature set, and the reconstruction error threshold can be reduced (the reconstruction error threshold is reduced to the first threshold). If the new prediction error value (second prediction error model) corresponding to the updated time series feature set is not lower than the prediction error value (first prediction error value) corresponding to the previous time series feature set, it indicates that the deleted time series feature values ​​(predicted outliers) did not have an abnormal impact on the data distribution in the time series feature set, and the reconstruction error threshold should be increased (the reconstruction error threshold is increased to the second threshold).

[0196] It should be noted that the first threshold and the second threshold can be the same or different.

[0197] In this embodiment of the invention, the prediction error of the time series feature set is predicted by the time series prediction model, and the reconstruction error threshold of the anomaly identification model is dynamically adjusted to obtain new predicted anomaly values.

[0198] The following is combined Figure 3 This section details the process of information acquisition.

[0199] Step 1: Train the LSTM prediction model using the time-series feature set to obtain the trained time-series prediction model. Use the trained time-series prediction model to obtain the first prediction error value corresponding to the time-series feature set. Step 2: Train the VAE recognition model using the time-series feature set to obtain the trained anomaly recognition model. Use the trained anomaly recognition model to obtain the reconstruction error value corresponding to the time-series feature set. Step 3: Select the first target prediction anomaly value from the time-series feature set whose reconstruction error value is greater than the reconstruction error threshold, and the M first target time-series feature values ​​with the largest reconstruction error values. Step 4: Select the N second target time-series feature values ​​from the time-series feature set whose first prediction error values ​​are the largest. Step 5: Compare the M first target time-series feature values ​​and the N second target time-series feature values, and select the overlapping time-series feature values ​​as the second prediction anomaly values. Step 6: In the time-series feature set... Step 7: Delete the first and second prediction outliers to obtain an updated temporal feature set. Use the updated temporal feature set to retrain the LSTM prediction model to obtain the second prediction error value. Step 8: Obtain the comparison result between the second prediction error value and the first prediction error value, that is, determine whether the second prediction error value has increased or decreased compared to the first prediction error value. Step 9: Based on the comparison result, adjust the reconstruction error threshold to obtain an updated reconstruction error threshold. If the second prediction error value decreases compared to the first prediction error value, determine the first and second prediction outliers as outliers indicating abnormal terminal network status. Step 10: Repeat steps 3, 4, and 5 to obtain the first and second prediction outliers corresponding to the updated temporal feature set, and repeat steps 6, 7, and 8 until the first prediction error value is less than the preset error threshold.

[0200] In this embodiment of the invention, the accuracy of the time series prediction model is optimized by mutual verification and interaction between two unsupervised models: a time series prediction model and an anomaly detection model. The results of the anomaly detection model are used to determine the reconstruction error threshold of the anomaly detection model. Based on the common results of the two models, an anomaly value is obtained, which indicates that the time series feature value of the terminal is abnormal at a certain time or at certain times, that is, the network state of the terminal is abnormal at a certain time or at certain times.

[0201] Furthermore, after obtaining the recognition result based on the temporal feature set using the first unsupervised model and the second unsupervised model, the method further includes:

[0202] Update the first time period based on the preset duration and the current time.

[0203] It should be noted that, considering the changes over time, the samples of terminal network data also accumulate accordingly. Therefore, it is necessary to consider the identification results of the time-series feature set corresponding to the dynamic terminal network data.

[0204] In this embodiment, the first time period is updated according to the preset lifespan (preset duration) and the current time. That is, the data that exceeds the lifespan (data that is too old) in the time series feature set corresponding to the first time period is deleted and the data of the latest time is added. The data of the latest time is determined based on the current time. Through the above steps, the first time period and the time series feature set corresponding to the first time period are updated.

[0205] The following is combined Figure 4 This section details the process for obtaining the recognition results of the time-series feature set corresponding to dynamic terminal network data.

[0206] Steps 1 to 5 and Figure 3 Steps 1 to 5 are the same and will not be repeated here. Step 6: Delete the first and second prediction outliers and data that has exceeded its lifecycle (data that is too old) from the time-series feature set, and add the latest data to obtain an updated time-series feature set. Use the updated time-series feature set to retrain the LSTM prediction model to obtain the second prediction error value. Step 7: Obtain the comparison result between the second prediction error value and the first prediction error value, that is, determine whether the second prediction error value has increased or decreased compared to the first prediction error value. Step 8: Based on the comparison result, use the updated time-series feature set obtained in step 6 to retrain the VAE recognition model, and adjust the reconstruction error threshold to obtain an updated reconstruction error threshold. If the second prediction error value is lower than the first prediction error value, determine that the first and second prediction outliers are outliers indicating abnormal terminal network status. Step 9: Repeat steps 3, 4, and 5 to obtain the first and second prediction outliers corresponding to the updated time-series feature set, and repeat steps 6, 7, and 8 until the first prediction error value is less than the preset error threshold.

[0207] like Figure 5 As shown, this embodiment of the invention also provides an information acquisition device, including:

[0208] The first acquisition module 501 is used to acquire a time-series feature set corresponding to terminal network data within a first time period; the time-series feature set includes time-series feature values ​​in at least two dimensions;

[0209] The second acquisition module 502 is used to acquire the recognition result corresponding to the time series feature set using an unsupervised model;

[0210] The identification result indicates that there is an outlier in the time-series feature set, or indicates that there is no outlier in the time-series feature set; the outlier is used to indicate that the terminal is in a network abnormal state.

[0211] In this embodiment of the invention, by acquiring a time-series feature set corresponding to terminal network data within a first time period, wherein the time-series feature set includes at least two time-series feature values, it is possible to acquire network data of an individual terminal. Furthermore, an unsupervised model is used to acquire an identification result corresponding to the time-series feature set, wherein the identification result indicates the presence or absence of outliers in the time-series feature set. The outliers are used to indicate that the terminal is in an abnormal network state. This allows for the analysis of network data using an unsupervised model to identify whether the network state of an individual terminal is abnormal, thereby enabling the monitoring of the network state of individual network terminals.

[0212] Optionally, the first acquisition module 501 includes:

[0213] The first acquisition unit is used to acquire the initial temporal feature value of the terminal network data within the first time period;

[0214] The first processing unit is used to perform similarity analysis and clustering on the initial time-series feature values ​​to obtain the time-series feature set.

[0215] Optionally, the second acquisition module 502 includes:

[0216] The second acquisition unit is used to acquire the first prediction error value of the time series feature set using the first unsupervised model;

[0217] The third acquisition unit is used to acquire the reconstruction error value of the time series feature set using the second unsupervised model;

[0218] The second processing unit is used to obtain the recognition result based on the first prediction error value and the reconstruction error value.

[0219] Optionally, the second processing unit is specifically used for:

[0220] The time series feature set is updated based on the first prediction error value, the reconstruction error value, and the reconstruction error threshold to obtain the updated time series feature set.

[0221] Using the first unsupervised model, obtain the second prediction error value corresponding to the updated time-series feature set;

[0222] The recognition result is obtained based on the comparison between the first prediction error value and the second prediction error value.

[0223] Optionally, the second processing unit is specifically used for:

[0224] Based on the first prediction error value, the reconstruction error value, and the reconstruction error threshold, the predicted outlier value is obtained;

[0225] The predicted outliers are deleted from the time series feature set to obtain the updated time series feature set.

[0226] Optionally, the second processing unit is specifically used for:

[0227] In the time series feature set, a first target prediction anomaly is identified where the reconstruction error value is greater than the reconstruction error threshold.

[0228] Determine a first target temporal feature value that has the largest reconstruction error value in the temporal feature set;

[0229] Determine a second target temporal feature value that has the largest first prediction error value in the temporal feature set;

[0230] The overlapping time series feature values ​​between the first target time series feature value and the second target time series feature value are identified as the second target prediction anomalies;

[0231] The predicted outlier is obtained based on the first target predicted outlier and the second target predicted outlier.

[0232] Optionally, the second processing unit is specifically used for:

[0233] If the second prediction error value is less than the first prediction error value, it is determined that the identification result indicates that there is an outlier in the time series feature set;

[0234] The outlier value is the predicted outlier value.

[0235] Optionally, the second processing unit is further specifically used for:

[0236] The first operation is repeated until the first prediction error value is less than the prediction error threshold.

[0237] The first operation includes: updating the reconstruction error threshold based on the comparison result of the first prediction error value and the second prediction error value; updating the time series feature set based on the first prediction error value, the reconstruction error value and the reconstruction error threshold to obtain the updated time series feature set; the reconstruction error threshold is the updated reconstruction error threshold.

[0238] Optionally, the second processing unit is further specifically used for:

[0239] If the second prediction error value is less than the first prediction error value, the reconstruction error threshold is reduced by the first threshold.

[0240] If the second prediction error value is greater than or equal to the first prediction error value, the reconstruction error threshold is increased by a second threshold.

[0241] Optionally, the device further includes:

[0242] The update module is used to update the first time period based on the preset duration and the current time.

[0243] It should be noted that the information acquisition device provided in the embodiments of the present invention is a device capable of executing the above-described information acquisition method. Therefore, all embodiments of the above-described information acquisition method are applicable to this device and can achieve the same or similar technical effects.

[0244] like Figure 6 As shown, this embodiment of the invention also provides a network device, including a processor 601 and a transceiver 602, wherein:

[0245] The processor 601 is used to acquire a time-series feature set corresponding to terminal network data within a first time period; the time-series feature set includes time-series feature values ​​in at least two dimensions;

[0246] Using an unsupervised model, the recognition results corresponding to the time-series feature set are obtained;

[0247] The identification result indicates that there is an outlier in the time-series feature set, or indicates that there is no outlier in the time-series feature set; the outlier is used to indicate that the terminal is in a network abnormal state.

[0248] In this embodiment of the invention, by acquiring a time-series feature set corresponding to terminal network data within a first time period, wherein the time-series feature set includes at least two time-series feature values, it is possible to acquire network data of an individual terminal. Furthermore, an unsupervised model is used to acquire an identification result corresponding to the time-series feature set, wherein the identification result indicates the presence or absence of outliers in the time-series feature set. The outliers are used to indicate that the terminal is in an abnormal network state. This allows for the analysis of network data using an unsupervised model to identify whether the network state of an individual terminal is abnormal, thereby enabling the monitoring of the network state of individual network terminals.

[0249] Optionally, the processor 601 is specifically used for:

[0250] Obtain the initial temporal characteristic values ​​of the terminal network data within the first time period;

[0251] The initial time-series feature values ​​are subjected to similarity analysis and clustering to obtain the time-series feature set.

[0252] Optionally, the processor 601 is specifically used for:

[0253] Using the first unsupervised model, the first prediction error value of the time series feature set is obtained;

[0254] The reconstruction error value of the time series feature set is obtained using the second unsupervised model;

[0255] The recognition result is obtained based on the first prediction error value and the reconstruction error value.

[0256] Optionally, the processor 601 is specifically used for:

[0257] The time series feature set is updated based on the first prediction error value, the reconstruction error value, and the reconstruction error threshold to obtain the updated time series feature set.

[0258] Using the first unsupervised model, obtain the second prediction error value corresponding to the updated time-series feature set.

[0259] The recognition result is obtained based on the comparison between the first prediction error value and the second prediction error value.

[0260] Optionally, the processor 601 is specifically used for:

[0261] Based on the first prediction error value, the reconstruction error value, and the reconstruction error threshold, the predicted outlier value is obtained;

[0262] The predicted outliers are deleted from the time series feature set to obtain the updated time series feature set.

[0263] Optionally, the processor 601 is specifically used for:

[0264] In the time series feature set, a first target prediction anomaly is identified where the reconstruction error value is greater than the reconstruction error threshold.

[0265] Determine a first target temporal feature value that has the largest reconstruction error value in the temporal feature set;

[0266] Determine a second target temporal feature value that has the largest first prediction error value in the temporal feature set;

[0267] The overlapping time series feature values ​​between the first target time series feature value and the second target time series feature value are identified as the second target prediction anomalies;

[0268] The predicted outlier is obtained based on the first target predicted outlier and the second target predicted outlier.

[0269] Optionally, the processor 601 is specifically used for:

[0270] If the second prediction error value is less than the first prediction error value, it is determined that the identification result indicates that there is an outlier in the time series feature set;

[0271] The outlier value is the predicted outlier value.

[0272] Optionally, after the processor obtains the recognition result based on the comparison result of the first prediction error value and the second prediction error value, the processor 601 is further specifically configured to:

[0273] The first operation is repeated until the first prediction error value is less than the prediction error threshold.

[0274] The first operation includes: updating the reconstruction error threshold based on the comparison result of the first prediction error value and the second prediction error value; updating the time series feature set based on the first prediction error value, the reconstruction error value and the reconstruction error threshold to obtain the updated time series feature set; the reconstruction error threshold is the updated reconstruction error threshold.

[0275] Optionally, the processor 601 is further specifically used for:

[0276] If the second prediction error value is less than the first prediction error value, the reconstruction error threshold is reduced by the first threshold.

[0277] If the second prediction error value is greater than or equal to the first prediction error value, the reconstruction error threshold is increased by a second threshold.

[0278] Optionally, after the processor obtains the recognition result corresponding to the time-series feature set using an unsupervised model, the processor is further configured to:

[0279] Update the first time period based on the preset duration and the current time.

[0280] It should be noted that the network device provided in the embodiments of the present invention is a network device capable of executing the above-described information acquisition method. Therefore, all embodiments of the above-described information acquisition method are applicable to this network device and can achieve the same or similar technical effects.

[0281] like Figure 7As shown, this embodiment of the invention also provides a network device, including: a processor 701; and a memory 703 connected to the processor 701 via a bus interface 702, the memory 703 being used to store programs and data used by the processor 701 when performing operations, and the processor 701 calling and executing the programs and data stored in the memory 703.

[0282] The transceiver 704 is connected to the bus interface 702 and is used to receive and send data under the control of the processor 701. Specifically, the processor 701 is used to read the program in the memory 703 and execute the following processes:

[0283] Obtain the time-series feature set corresponding to the terminal network data within the first time period; the time-series feature set includes time-series feature values ​​in at least two dimensions;

[0284] Using an unsupervised model, the recognition results corresponding to the time-series feature set are obtained;

[0285] The identification result indicates that there is an outlier in the time-series feature set, or indicates that there is no outlier in the time-series feature set; the outlier is used to indicate that the terminal is in a network abnormal state.

[0286] Optionally, the processor 701 is specifically used for:

[0287] Obtain the initial temporal characteristic values ​​of the terminal network data within the first time period;

[0288] The initial time-series feature values ​​are subjected to similarity analysis and clustering to obtain the time-series feature set.

[0289] Optionally, the processor 701 is specifically used for:

[0290] Using the first unsupervised model, the first prediction error value of the time series feature set is obtained;

[0291] The reconstruction error value of the time series feature set is obtained using the second unsupervised model;

[0292] The recognition result is obtained based on the first prediction error value and the reconstruction error value.

[0293] Optionally, the processor 701 is specifically used for:

[0294] The time series feature set is updated based on the first prediction error value, the reconstruction error value, and the reconstruction error threshold to obtain the updated time series feature set.

[0295] Using the first unsupervised model, obtain the second prediction error value corresponding to the updated time-series feature set.

[0296] The recognition result is obtained based on the comparison between the first prediction error value and the second prediction error value.

[0297] Optionally, the processor 701 is specifically used for:

[0298] Based on the first prediction error value, the reconstruction error value, and the reconstruction error threshold, the predicted outlier value is obtained;

[0299] The predicted outliers are deleted from the time series feature set to obtain the updated time series feature set.

[0300] Optionally, the processor 701 is specifically used for:

[0301] In the time series feature set, a first target prediction anomaly is identified where the reconstruction error value is greater than the reconstruction error threshold.

[0302] Determine a first target temporal feature value that has the largest reconstruction error value in the temporal feature set;

[0303] Determine a second target temporal feature value that has the largest first prediction error value in the temporal feature set;

[0304] The overlapping time series feature values ​​between the first target time series feature value and the second target time series feature value are identified as the second target prediction anomalies;

[0305] The predicted outlier is obtained based on the first target predicted outlier and the second target predicted outlier.

[0306] Optionally, the processor 701 is specifically used for:

[0307] If the second prediction error value is less than the first prediction error value, it is determined that the identification result indicates that there is an outlier in the time series feature set;

[0308] The outlier value is the predicted outlier value.

[0309] Optionally, after the processor 701 obtains the recognition result based on the comparison result of the first prediction error value and the second prediction error value, the processor 701 is further specifically used for:

[0310] The first operation is repeated until the first prediction error value is less than the prediction error threshold.

[0311] The first operation includes: updating the reconstruction error threshold based on the comparison result of the first prediction error value and the second prediction error value; updating the time series feature set based on the first prediction error value, the reconstruction error value and the reconstruction error threshold to obtain the updated time series feature set; the reconstruction error threshold is the updated reconstruction error threshold.

[0312] Optionally, the processor 701 is further specifically used for:

[0313] If the second prediction error value is less than the first prediction error value, the reconstruction error threshold is reduced by the first threshold.

[0314] If the second prediction error value is greater than or equal to the first prediction error value, the reconstruction error threshold is increased by a second threshold.

[0315] Optionally, after the processor 701 obtains the recognition result corresponding to the time-series feature set using an unsupervised model, the processor 701 is further configured to:

[0316] Update the first time period based on the preset duration and the current time.

[0317] Among them, Figure 7 In this context, the bus architecture can include any number of interconnected buses and bridges, specifically linking various circuits together, represented by one or more processors (processor 701) and memory (memory 703). The bus architecture can also link various other circuits such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art and therefore will not be described further herein. The bus interface provides an interface. The transceiver 704 can be multiple elements, including transmitters and receivers, providing a unit for communicating with various other devices over a transmission medium. Processor 701 is responsible for managing the bus architecture and general processing, and memory 703 can store data used by processor 701 during operation.

[0318] In addition, specific embodiments of the present invention also provide a computer-readable storage medium having a computer program stored thereon, wherein the program, when executed by a processor, implements the steps of the information acquisition method as described above.

[0319] Specifically, the computer-readable storage medium is applied to the aforementioned terminal. When applied to the terminal, the execution steps in the method for reporting smoke alarms are as described in detail above, and will not be repeated here.

[0320] In the several embodiments provided in this application, it should be understood that the disclosed methods and apparatus can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0321] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can be physically comprised separately, or two or more units can be integrated into one unit. The integrated unit described above can be implemented in hardware or in the form of hardware plus software functional units.

[0322] The integrated units implemented as software functional units described above can be stored in a computer-readable storage medium. These software functional units, stored in a storage medium, include several instructions that cause a computer device (which may be a personal computer, server, or network device, etc.) to execute some steps of the transmission and reception methods described in the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0323] The above describes the preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. An information acquisition method, characterized in that, include: Obtain the set of temporal features corresponding to the terminal network data within the first time period; The time-series feature set includes time-series feature values ​​in at least two dimensions; wherein, the acquisition of the terminal network data includes: extracting user plane features including the number of uplink and downlink Internet Protocol (IP) packets and uplink and downlink latency, and control plane features including the number of bearer establishment requests and the number of bearer establishment successes from the external data representation xDR; An unsupervised model is used to obtain the recognition result corresponding to the time-series feature set; wherein, the recognition result indicates that there are outliers in the time-series feature set, or indicates that there are no outliers in the time-series feature set; the outliers are used to indicate that the terminal is in an abnormal network state; The step of using the unsupervised model to obtain the recognition result corresponding to the time-series feature set includes: Using the first unsupervised model, the first prediction error value of the time series feature set is obtained; The reconstruction error value of the time series feature set is obtained using the second unsupervised model; In the time series feature set, a first target prediction anomaly is identified where the reconstruction error value is greater than the reconstruction error threshold. Determine a first target temporal feature value that has the largest reconstruction error value in the temporal feature set; Determine a second target temporal feature value that has the largest first prediction error value in the temporal feature set; The overlapping time series feature values ​​between the first target time series feature value and the second target time series feature value are identified as the second target prediction anomalies; The predicted anomaly value is obtained based on the first target predicted anomaly value and the second target predicted anomaly value; The predicted outliers are deleted from the time series feature set to obtain the updated time series feature set. Using the first unsupervised model, obtain the second prediction error value corresponding to the updated time-series feature set; If the second prediction error value is less than the first prediction error value, it is determined that the identification result indicates that there is an outlier in the time-series feature set; the outlier is the predicted outlier.

2. The information acquisition method according to claim 1, characterized in that, The step of obtaining the time-series feature set corresponding to the terminal network data within the first time period includes: Obtain the initial temporal characteristic values ​​of the terminal network data within the first time period; The initial time-series feature values ​​are subjected to similarity analysis and clustering to obtain the time-series feature set.

3. The information acquisition method according to claim 1, characterized in that, After obtaining the recognition result based on the comparison result of the first prediction error value and the second prediction error value, the method further includes: The first operation is repeated until the first prediction error value is less than the prediction error threshold. The first operation includes: updating the reconstruction error threshold based on the comparison result of the first prediction error value and the second prediction error value; updating the time series feature set based on the first prediction error value, the reconstruction error value and the reconstruction error threshold to obtain the updated time series feature set; the reconstruction error threshold is the updated reconstruction error threshold.

4. The information acquisition method according to claim 3, characterized in that, The step of updating the reconstruction error threshold based on the comparison result of the first prediction error value and the second prediction error value includes: If the second prediction error value is less than the first prediction error value, the reconstruction error threshold is reduced by the first threshold. If the second prediction error value is greater than or equal to the first prediction error value, the reconstruction error threshold is increased by a second threshold.

5. The information acquisition method according to claim 1, characterized in that, After obtaining the recognition results corresponding to the time-series feature set using an unsupervised model, the method further includes: Update the first time period based on the preset duration and the current time.

6. An information acquisition device, characterized in that, include: The first acquisition module is used to acquire the time-series feature set corresponding to the terminal network data within the first time period; The time-series feature set includes time-series feature values ​​in at least two dimensions; wherein, the acquisition of the terminal network data includes: extracting user plane features including the number of uplink and downlink Internet Protocol (IP) packets and uplink and downlink latency, and control plane features including the number of bearer establishment requests and the number of bearer establishment successes from the external data representation xDR; The second acquisition module is used to acquire the recognition result corresponding to the time-series feature set using an unsupervised model; wherein the recognition result indicates that there is an outlier in the time-series feature set, or indicates that there is no outlier in the time-series feature set; the outlier is used to indicate that the terminal is in a network abnormal state; The second acquisition module includes: The second acquisition unit is used to acquire the first prediction error value of the time series feature set using the first unsupervised model; The third acquisition unit is used to acquire the reconstruction error value of the time series feature set using the second unsupervised model; The second processing unit is specifically configured to: determine a first target prediction anomaly value in the time-series feature set whose reconstruction error value is greater than a reconstruction error threshold; determine a first target time-series feature value in the time-series feature set whose reconstruction error value is the largest of a first preset number; determine a second target time-series feature value in the time-series feature set whose first prediction error value is the largest of a second preset number; determine the time-series feature value that overlaps with the first target time-series feature value and the second target time-series feature value as the second target prediction anomaly value; and obtain the prediction anomaly value based on the first target prediction anomaly value and the second target prediction anomaly value. The predicted outliers are deleted from the time series feature set to obtain the updated time series feature set. Using the first unsupervised model, obtain the second prediction error value corresponding to the updated time-series feature set; If the second prediction error value is less than the first prediction error value, it is determined that the identification result indicates that there is an outlier in the time-series feature set; the outlier is the predicted outlier.

7. A network device, comprising a processor and a transceiver, characterized in that: The processor is used to acquire a set of time-series features corresponding to terminal network data within a first time period. The time-series feature set includes time-series feature values ​​in at least two dimensions; wherein, the acquisition of the terminal network data includes: extracting user plane features including the number of uplink and downlink Internet Protocol (IP) packets and uplink and downlink latency, and control plane features including the number of bearer establishment requests and the number of bearer establishment successes from the external data representation xDR; An unsupervised model is used to obtain the recognition result corresponding to the time-series feature set; wherein, the recognition result indicates that there are outliers in the time-series feature set, or indicates that there are no outliers in the time-series feature set; the outliers are used to indicate that the terminal is in an abnormal network state; Specifically, the processor is used for: Using the first unsupervised model, the first prediction error value of the time series feature set is obtained; The reconstruction error value of the time series feature set is obtained using the second unsupervised model; In the time series feature set, a first target prediction anomaly is identified where the reconstruction error value is greater than the reconstruction error threshold. Determine a first target temporal feature value that has the largest reconstruction error value in the temporal feature set; Determine a second target temporal feature value that has the largest first prediction error value in the temporal feature set; The overlapping time series feature values ​​between the first target time series feature value and the second target time series feature value are identified as the second target prediction anomalies; The predicted anomaly value is obtained based on the first target predicted anomaly value and the second target predicted anomaly value; The predicted outliers are deleted from the time series feature set to obtain the updated time series feature set. Using the first unsupervised model, obtain the second prediction error value corresponding to the updated time-series feature set; If the second prediction error value is less than the first prediction error value, it is determined that the identification result indicates that there is an outlier in the time-series feature set; the outlier is the predicted outlier.

8. A network device, comprising a memory, a processor, and a program stored in the memory and executable on the processor; characterized in that, When the processor executes the program, it implements the information acquisition method as described in any one of claims 1 to 5.

9. A readable storage medium, characterized in that, The readable storage medium stores a program that, when executed by a processor, implements the steps of the information acquisition method as described in any one of claims 1 to 5.

Images