Network exception processing method, apparatus and device

Abstract

The application provides an abnormality processing method, device and equipment of a network, performance index data and service index data of each network element are obtained from a performance index database and a service index database respectively, detection of core network abnormal indexes and cause positioning analysis are realized according to the obtained data by using an Isolation Forest algorithm model and an AutoMap algorithm model, the deficiency of manual experience is avoided, real-time online detection is realized, network problems are discovered in time, network healthy operation is ensured, and user perception is improved.

Description

Technical Field

[0001] This application relates to the field of communication technology, and in particular to a method, apparatus and device for handling network anomalies. Background Technology

[0002] With the advent of the internet age, people's lives have become inseparable from the internet. Network service indicators in network operators reflect the proportion of successful service establishments at key network nodes out of the total number of service requests. Under normal circumstances, network key performance indicators (KPIs) fluctuate within a certain range, which does not require special attention. However, when the indicators are abnormal, it indicates that there are more service establishment failures and a lower success rate. At this time, network managers should pay close attention to this issue, find the problem in time, and avoid more serious network degradation, which would affect the user experience.

[0003] In existing technologies, the determination of abnormal network KPI indicators is achieved by using fixed thresholds or calculating thresholds using fixed formulas. The methods for locating the causes of abnormal network KPI indicators typically involve statistical analysis of the log data of the network nodes corresponding to the relevant indicators, analyzing the percentage of different cause types in records of business establishment failures, and then manually judging whether this percentage is normal based on experience.

[0004] However, the methods for identifying and locating abnormal KPI indicators in online systems are insufficient to account for differences caused by a variety of factors. Relying solely on traditional fixed thresholds and human experience is far from adequate. Summary of the Invention

[0005] This application provides a method, apparatus, and device for handling network anomalies. It addresses the shortcomings of existing technologies in network failure detection and cause localization.

[0006] Firstly, this application provides a method for handling network anomalies, including:

[0007] Retrieve performance metrics data and business metrics data for each network element from the performance metrics database and the business metrics database, respectively.

[0008] Anomaly detection is performed on the performance and business metrics data of each network element using a pre-deployed Isolation Forest algorithm, resulting in anomaly metrics for each network element.

[0009] For each network element, determine whether the network element is abnormal based on the corresponding abnormal indicators.

[0010] In conjunction with the first aspect, in some embodiments, the network anomaly handling method provided in this application further includes:

[0011] If any network element's abnormal indicator indicates that the network element is abnormal, then the log file corresponding to the network element is retrieved from the log file database;

[0012] Statistical analysis was performed on the network failure reason codes in the log files to obtain the reason codes with the highest failure frequency;

[0013] Based on the cause code, user-side cause analysis and wireless-side cause analysis are performed to obtain user-side location analysis results and wireless-side location analysis results for abnormal indicators.

[0014] In conjunction with the first aspect, in some embodiments, the method further includes:

[0015] Based on the pre-deployed multidimensional time series correlation analysis algorithm AutoMap model, correlation analysis is performed on the pre-acquired user data, wireless information data, the performance index database, the business index database, and the log file database to determine the location analysis results of other abnormal indicators besides the user side and the wireless side.

[0016] The location analysis results of the other abnormal indicators include abnormal behavior maps and the proportion of influencing factors.

[0017] In conjunction with the first aspect, in some embodiments, the method further includes:

[0018] Output the user-side positioning analysis results, the wireless-side positioning analysis results, and the positioning analysis results of other abnormal indicators;

[0019] Receive feedback data input by the user, wherein the feedback data is the data obtained after the user has corrected the cause of the anomaly and the cause of the anomaly.

[0020] The parameters of the AutoMap algorithm model and / or the Isolation Forest algorithm are optimized based on the feedback data.

[0021] In conjunction with the first aspect, in some embodiments, before obtaining the performance indicator data and service indicator data of each network element from the performance indicator database and the service indicator database respectively, the method further includes:

[0022] Obtain performance metrics, service metrics, and log files for each network element in the network from the core network equipment;

[0023] The performance metrics, service metrics, and log files of each network element are filtered and preprocessed. The processed performance metrics of each network element are stored in the performance metrics database, the processed service metrics are stored in the service metrics database, and the processed log files are stored in the log file database.

[0024] In conjunction with the first aspect, in some embodiments, the filtering and preprocessing of performance metrics, service metrics, and log files for each network element includes:

[0025] The performance metrics, service metrics, and data in the log files of each network element are filtered and processed according to the network element name, time, and log file format.

[0026] The filtered performance metrics, business metrics, and log files are preprocessed to obtain the processed performance metrics, processed business metrics, and processed log files for each network element. The preprocessing includes missing value handling, text encoding, data integration, and data transformation.

[0027] Secondly, this application provides a network anomaly handling apparatus, comprising:

[0028] The first acquisition module is used to acquire performance indicator data and business indicator data of each network element from the performance indicator database and the business indicator database, respectively.

[0029] The anomaly detection module is used to perform anomaly detection on the performance index data and business index data of each network element through the pre-deployed Isolation Forest algorithm, and obtain the anomaly index corresponding to each network element.

[0030] The anomaly confirmation module is used to determine whether a network element is abnormal based on the anomaly indicators corresponding to that network element.

[0031] In conjunction with the second aspect, in some embodiments, the network anomaly handling apparatus provided in this application further includes:

[0032] The second acquisition module is used to acquire the log file corresponding to the network element from the log file database if any network element's abnormal indicator indicates that the network element has an abnormality.

[0033] The third acquisition module is used to perform statistical analysis on the network failure reason codes in the log file and obtain the reason codes with the highest failure frequency.

[0034] The first analysis module is used to perform user-side cause analysis and wireless-side cause analysis based on the cause code, and to obtain user-side location analysis results and wireless-side location analysis results of abnormal indicators.

[0035] In conjunction with the second aspect, in some embodiments, the apparatus further includes:

[0036] The second analysis module is used to perform correlation analysis on the pre-acquired user data, wireless information data, the performance index database, the business index database and the log file database according to the pre-deployed multi-dimensional time series correlation analysis algorithm AutoMap algorithm model, and to determine the location analysis results of other abnormal indicators besides the user side and the wireless side.

[0037] The location analysis results of the other abnormal indicators include abnormal behavior maps and the proportion of influencing factors.

[0038] In conjunction with the second aspect, in some embodiments, the apparatus further includes:

[0039] The result output module is used to output the user-side positioning analysis results, the wireless-side positioning analysis results, and the positioning analysis results of other abnormal indicators.

[0040] The data receiving module is used to receive feedback data input by the user. The feedback data is the data obtained after the user has corrected the cause of the abnormality and the reason for correcting the abnormal indicator.

[0041] The model optimization module is used to optimize the parameters of the AutoMap algorithm model and / or the Isolation Forest algorithm based on the feedback data.

[0042] In conjunction with the second aspect, in some embodiments, before the first acquisition module, the apparatus further includes:

[0043] The fourth acquisition module is used to acquire performance metrics, service metrics, and log files for each network element in the network from the core network equipment;

[0044] The data processing module is used to filter and preprocess the performance indicators, service indicators and log files of each network element, and store the processed performance indicators of each network element in the performance indicator database, the processed service indicators in the service indicator database, and the processed log files in the log file database.

[0045] In conjunction with the second aspect, in some embodiments, the data processing module includes:

[0046] The first processing unit is used to filter and process the performance indicators, service indicators and log files of each network element according to the network element name, time and log file format.

[0047] The second processing unit is used to preprocess the filtered performance indicators, business indicators and log files to obtain the processed performance indicators, processed business indicators and processed log files for each network element. The preprocessing includes missing value handling, text encoding, data integration and data transformation.

[0048] Thirdly, this application also provides an electronic device, including: a memory, a processor, a communication interface, and a display screen;

[0049] The memory stores computer-executed instructions;

[0050] The processor executes computer execution instructions stored in the memory to implement the method described in the first aspect.

[0051] Fourthly, this application also provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the network exception handling method described in the first aspect.

[0052] This application provides a method, apparatus, and equipment for handling network anomalies. Based on the Isolation Forest algorithm, it detects abnormal network indicators, adapts to network development, automatically learns from indicator fluctuations in real time, autonomously adjusts the model based on data characteristics, promptly and accurately detects abnormal network fluctuations, issues alarms, and accurately and clearly locates the impact of different factors on network service failures through the AutoMap algorithm, thus accurately identifying the key factors affecting network problems. Attached Figure Description

[0053] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0054] Figure 1 An application scenario diagram of the network anomaly handling method provided in the embodiments of this application;

[0055] Figure 2 A flowchart illustrating an embodiment of the network anomaly handling method provided in this application.

[0056] Figure 3 A flowchart illustrating a second embodiment of the network anomaly handling method provided in this application.

[0057] Figure 4 A flowchart illustrating Embodiment 3 of the network anomaly handling method provided in this application;

[0058] Figure 5A flowchart illustrating Embodiment 4 of the network anomaly handling method provided in this application;

[0059] Figure 6 A flowchart illustrating the specific implementation of the network anomaly handling method provided in this application embodiment;

[0060] Figure 7 A schematic diagram of the structure of a network anomaly handling device according to an embodiment of this application;

[0061] Figure 8 A schematic diagram of the structure of a second embodiment of the network anomaly handling device provided in this application;

[0062] Figure 9 A schematic diagram of the structure of the network anomaly handling device according to embodiment three provided in this application;

[0063] Figure 10 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application.

[0064] The accompanying drawings illustrate specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to particular embodiments. Detailed Implementation

[0065] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0066] The core network plays a crucial role in a carrier's network. Its anomalies often lead to call failures, network delays, and other network-wide malfunctions, significantly impacting service quality across the entire network and affecting hundreds of thousands of users, triggering widespread complaints. Therefore, it is essential to quickly and promptly identify core network anomalies and eliminate faults before their impact escalates. Key Performance Indicators (KPIs) are metrics that reflect network performance and equipment operational status. Analyzing KPIs provides a current state of various indicators, which is a vital reference for evaluating network performance. Identifying abnormal network KPIs often involves using fixed thresholds or calculating thresholds using fixed formulas. Problem localization for abnormal network KPIs typically relies on statistical methods, finding log data from network nodes corresponding to the relevant indicators, analyzing the percentage of different causes in service establishment failure records, and then manually judging whether this percentage is normal based on experience. However, these methods for identifying abnormal network KPIs often fail to adjust the thresholds in a timely manner as the network evolves. Over time, these thresholds often become invalid, preventing network administrators from accurately and promptly identifying network problems. Moreover, this method of determination is relatively simplistic. Different types of networks, networks from different manufacturers, and networks on different dates will exhibit varying index fluctuations, and traditional fixed threshold methods struggle to account for these differences. Furthermore, many factors can cause service failures at critical network nodes. Accurately identifying key factors and assessing their impact on failures requires more than just traditional human experience; it is insufficient.

[0067] To address the aforementioned problems, this application provides a method, apparatus, and device for handling network anomalies. This enables real-time online learning of KPI fluctuations, timely and accurate detection of network failures, and precise and clear analysis of the impact of different factors on network service failures, accurately locating the key factors affecting network problems. Specifically, traditional methods for determining abnormal network KPI indicators rely on fixed thresholds or methods that calculate thresholds using a fixed formula, with key factors being identified manually. During the research process, the inventors discovered that determining abnormal network KPI indicators using fixed thresholds cannot adjust the thresholds in a timely manner according to network development; over time, these thresholds often become invalid, failing to detect network problems promptly and accurately. Furthermore, human experience in identifying problem factors cannot accurately identify the main causes. Considering these issues, the inventors investigated whether an algorithm could be used to learn fluctuations in indicators in real-time online, autonomously adjust based on data characteristics, promptly and accurately detect network failures, and locate key factors affecting network problems through an algorithmic model. Based on this, the technical solution of this application is proposed.

[0068] Figure 1 This diagram illustrates an application scenario of the network anomaly handling method provided in this application embodiment. For example... Figure 1 As shown, the network anomaly handling method provided in this application can be applied to actual network failure detection scenarios. These scenarios include at least a server and at least one core network management system. The server and the core network management system can be linked via a communication interface to enable data transmission. The server is a device capable of embedding algorithm models to manage user data and services. This solution does not limit the specific form of the above devices.

[0069] The technical solution of this application and how the technical solution of this application solves the above-mentioned technical problems are described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this application will now be described with reference to the accompanying drawings.

[0070] Figure 2 This is a flowchart illustrating an embodiment of the network anomaly handling method provided in this application. Figure 2 As shown, the specific steps include:

[0071] S101: Obtain the performance index data and service index data of each network element from the performance index database and the service index database, respectively.

[0072] In this step, the performance and service metrics data of each network element in the core network are managed by the network administrator. In order to monitor network anomalies in real time, it is necessary to obtain the performance and service metrics data of each network element.

[0073] Specifically, the server connects to the network management systems of various network elements via communication interfaces. These network element management systems transmit raw performance and service metrics data to the server. The server processes this data and stores the processed metrics in separate performance and service metric databases. To detect network failures, the server retrieves the necessary performance and service metrics data from these databases. Examples of data include user data, behavioral data, voice channel call drop rate, signaling channel call drop rate, switch call connection rate, call success rate, and long-distance call connection rate.

[0074] S102: Anomaly detection is performed on the performance index data and business index data of each network element using the pre-deployed Isolation Forest algorithm to obtain the anomaly index corresponding to each network element.

[0075] In this step, after obtaining the performance and service metrics data of each network element required for detection, in order to monitor network failure fluctuations in real time, the Isolation Forest algorithm is deployed to perform anomaly detection on the performance and service metrics data of each network element, thereby obtaining the anomaly metrics corresponding to each network element.

[0076] Specifically, by sampling the performance index data and business index data of each network element obtained in the above steps, a binary tree is constructed, and each binary tree is tested, the path length is recorded, and then the anomaly score of each test data is calculated according to the anomaly score calculation formula.

[0077] The specific calculation formula is as follows:

[0078]

[0079] c(n) = 2H(n-1) - (2(n-1) / n)

[0080] H(k)=ln(k)+ζ,ζ=0.5772156649

[0081] Where S(x,n) is the anomaly score of the binary tree formed by the training data of x in n samples, with a value range of [0,1], c(n) is the average path length, and H(k) is the harmonic function. The closer the calculated result is to 1, the more likely the indicator is an anomaly; the closer the result is to 0, the more likely the indicator is a normal indicator. The anomaly index corresponding to each network element is obtained based on the calculation results.

[0082] S103: For each network element, determine whether the network element is abnormal based on the corresponding abnormal indicators.

[0083] In this step, based on the formulas in the previous steps, the abnormal scores of the performance index data and service index data of each network element are calculated. Since the indexes can reflect the network performance and equipment operating status of the network element at this time, the abnormal scores are used to determine whether the network element is abnormal.

[0084] Specifically, if the indicator score is close to 1, it indicates that the indicator is abnormal, and therefore the network element corresponding to the indicator is abnormal. If the indicator score is close to 0, it indicates that the indicator is normal, and therefore the network element corresponding to the indicator is normal.

[0085] The network anomaly handling method provided in this embodiment acquires performance and service indicator data for each network element, then inputs them into a pre-deployed Isolation Forest algorithm model. Anomalies are detected in the performance and service indicator data for each network element, resulting in anomaly indicators for each element. Based on these anomaly indicators, the method determines whether the corresponding network element is abnormal. This achieves real-time online detection of network failure indicators and allows for timely and autonomous model adjustment based on data characteristics, improving the accuracy of anomaly indicator detection.

[0086] Figure 3 This is a flowchart illustrating a second embodiment of the network anomaly handling method provided in this application. Figure 3 As shown, the network anomaly handling method provided in this application further includes the following steps:

[0087] S104: If any network element's abnormal indicator indicates that the network element is abnormal, then retrieve the corresponding log file from the log file database.

[0088] In this step, based on the above embodiments, the network element is determined to be normal according to the abnormal index score. If the abnormal index of any network element indicates that the network element is abnormal, in order to more accurately locate the specific cause, it is necessary to obtain the log file corresponding to the abnormal network element and perform localization analysis based on the data in the log file.

[0089] Specifically, after obtaining the log files of each network element, the server filters and preprocesses them before saving the processed log files in the log file database. If any network element is found to be abnormal, the corresponding log file for the abnormal network element is retrieved from the log file database. The log file includes the network element name, time, user terminal information, user behavior information, base station signal information, base station configuration information, and network failure reason code, etc.

[0090] S105: Perform statistical analysis on the network failure reason codes in the log file to obtain the reason codes with the highest failure frequency.

[0091] In this step, the log files corresponding to the abnormal indicators obtained in the above steps are used to accurately analyze the causes of the abnormal indicators. Based on the cause codes in the log files, the most frequent cause codes are identified through statistical analysis.

[0092] Specifically, during network operation, a cause code is generated and stored in the log file for network failures caused by abnormal indicators. The specific cause of the abnormal indicator is analyzed, and the frequency of different cause codes is counted by classifying and counting the network failure cause codes in the log file. The one that appears most frequently is the cause code with the highest frequency.

[0093] S106: Perform user-side cause analysis and wireless-side cause analysis based on the cause code to obtain the user-side location analysis results and wireless-side location analysis results of the abnormal indicators.

[0094] In this step, after obtaining the cause code with the highest failure frequency in the above steps, in order to accurately locate the cause of the problem, it is necessary to conduct preliminary location analysis on the user side and the wireless side based on statistical analysis methods, so as to obtain the user side location analysis results and the wireless side location analysis results.

[0095] Specifically, based on the cause code and the log file corresponding to the network element, it is determined whether there are users with high frequency of failures. If so, the analysis is stopped. It is also determined whether there are base station numbers with high frequency of failures. If so, the analysis is stopped. If neither the users with high frequency of failures nor the base station numbers exist, the analysis is stopped. The final user-side location analysis results include terminal reasons, user SIM card reasons, user subscription status, user behavior reasons, etc. The wireless-side location analysis results include base station signal reasons, base station configuration reasons, etc.

[0096] S107: Based on the pre-deployed multidimensional time series correlation analysis algorithm AutoMap model, perform correlation analysis on the data to determine the location analysis results of other abnormal indicators.

[0097] In this step, the preliminary location analysis of the user side and radio side based on statistical analysis in the previous steps was carried out. During network operation, the success rate of service creation at network nodes such as the initial registration success rate of Access and Mobility Management Function (AMF), the session establishment success rate of 5G Session Management Function Data Unit (SMF PDU), and the network connection success rate of Voice Over Long-Term Evolution (VOLTE) are affected by various factors. After excluding user-side and radio-side causes, many other factors remain, such as core network element-side factors, including system load, core network element CPU utilization, and configured network latency. To accurately analyze the main problem factors, the AutoMap algorithm, a multi-dimensional time series correlation analysis model, is deployed to perform correlation analysis on pre-acquired user data, radio information data, performance indicator databases, service indicator databases, and log file databases, thereby accurately deriving the location analysis results of other abnormal indicators.

[0098] Specifically, the analysis of the AutoMap algorithm model mainly consists of the following steps:

[0099] (1) Select the sampling interval parameter;

[0100] (2) Construct abnormal behavior graphs using multiple types of indicators;

[0101] (3) Use the "+" and "-" operations on the behavior map to extract the outline of the anomaly;

[0102] (4) Detect the cause based on the behavior map;

[0103] (5) Verify the results and calculate the accuracy;

[0104] (6) Update the weight matrix. If new anomalies occur, repeat the above steps. Finally, obtain the location analysis results of other anomalies besides the user side and the wireless side. The location analysis results of other anomalies include anomaly behavior graphs and percentage graphs of various influencing factors.

[0105] S108: Outputs user-side positioning analysis results, wireless-side positioning analysis results, and positioning analysis results of other abnormal indicators.

[0106] In this step, after obtaining the user-side positioning analysis results, wireless-side positioning analysis results, and positioning analysis results of other abnormal indicators through the preliminary positioning and deep positioning in steps S106 and S107 above, in order to provide alarms to relevant network element users, the above positioning analysis results are output and summarized into a work order, which is then dispatched to the relevant network element users.

[0107] Specifically, the work order includes abnormal behavior graphs, graphs showing the proportion of various influencing factors, and visualizations of various causes of problems. In addition to dispatching work orders to relevant network element users, it also adds SMS and DingTalk reminder functions to provide multiple alerts to relevant network element users.

[0108] S109: Receive feedback data input by the user.

[0109] In this step, after the work order is dispatched to the relevant network element user in the above steps, the user can evaluate and monitor the work order content based on experience and manual analysis, and then send the feedback data back to the server. The server receives the feedback data input by the user.

[0110] Specifically, work orders are generated and dispatched under the system accounts of relevant network element users, and there are corresponding feedback boxes in the system accounts. Users can correct the location reasons, including whether the location reasons are correct and the reasons for the real abnormal indicators analyzed by humans, thereby generating feedback data and sending the feedback data back to the server.

[0111] S110: Optimize the parameters of the AutoMap algorithm model and / or the Isolation Forest algorithm based on feedback data.

[0112] In this step, after the server receives the feedback data input by the user in the above steps, in order to make the network anomaly detection method more accurate and complete, the feedback data is added to the AutoMap algorithm model and / or the IsolationForest algorithm. By adjusting the parameters, the model is optimized.

[0113] Specifically, based on the user's input feedback data, the AutoMap algorithm and / or Isolation Forest algorithm, leveraging their self-learning capabilities, autonomously learn data features online and rapidly adjust their parameters to achieve model optimization.

[0114] The network anomaly handling method provided in this embodiment indicates anomalies relative to network elements through anomaly indicators. It analyzes the log files corresponding to the anomaly network element to identify the most frequent cause codes for failures. Based on these cause codes, statistical analysis is used to initially locate the causes on the user side and the wireless side, obtaining user-side and wireless-side location analysis results for the anomaly indicators. Then, a pre-deployed multi-dimensional time series correlation analysis algorithm, AutoMap, is used to further locate other problem causes. Finally, the user-side location analysis results, wireless-side location analysis results, and location analysis results for other anomaly indicators are output and summarized into work orders, which are then dispatched to the relevant network element users. Based on feedback data from relevant web page users, the algorithm model's parameters are adjusted to optimize the model. This method fully utilizes effective information to achieve in-depth network failure analysis, more accurately and comprehensively locating the causes of problems and avoiding the limitations and misjudgments of human experience.

[0115] Figure 4 This is a flowchart illustrating Embodiment 3 of the network anomaly handling method provided in this application. Figure 4 As shown, based on the above embodiment, before obtaining the performance indicator data and service indicator data of each network element from the performance indicator database and the service indicator database respectively in step S101, the following steps are also included:

[0116] S009: Obtain performance metrics, service metrics, and log files for each network element in the network from the core network equipment.

[0117] In this step, in order to monitor the success rate of establishing key network nodes in real time, network KPI indicators reflect network performance and equipment operating status. Therefore, network monitoring can be achieved by monitoring network KPI indicators in real time. The server needs to obtain the network KPI indicators and log files of each network element from the core network equipment.

[0118] Specifically, the server connects to the core network equipment through a communication interface. The server obtains network element performance indicators and network element service indicators from the network management system of the core network equipment through the communication interface, and obtains log files through a secure file transfer protocol. The server obtains log files in real time every cycle, and the specific cycle can be set according to actual needs. This solution does not impose specific limitations.

[0119] S100: Filters, preprocesses, and stores the performance metrics, service metrics, and log files for each network element.

[0120] In this step, in order to accurately determine the cause of network anomalies, the performance metrics, service metrics, and log files of each network element obtained in the above steps are filtered, and the filtered performance metrics, service metrics, and log files are preprocessed. The preprocessed performance metrics, service metrics, and log files are stored in the service metrics database, and the processed log files are stored in the log file database.

[0121] Specifically, for each network element, key performance indicators and service indicators are selected for monitoring, such as coverage, quality, call setup characteristics, and mobility management. Specific categories include wireless resource connection establishment success rate, wireless call completion rate, and call drop rate. The selection of indicators can be based on specific network conditions; this solution does not impose specific limitations. For log files, the corresponding network element name and time need to be selected. To ensure the selected data can be input into the model for calculation, the selected performance indicators, service indicators, and log files undergo preprocessing. Preprocessing includes missing value handling, text encoding, data integration, and data transformation. If there are missing values ​​in the indicator data, data supplementation is performed; missing data in the log files can be ignored. Finally, the processed performance indicators are stored in a performance indicator database, the processed service indicators in a service indicator database, and the processed log files in a log file database.

[0122] The network anomaly handling method provided in this embodiment filters and preprocesses the performance indicators, service indicators, and log files of each network element obtained from the core network equipment, making the data input into the algorithm model more accurate and complete, and laying a solid data foundation for subsequent cause localization and analysis.

[0123] Figure 5 This is a flowchart illustrating Embodiment 4 of the network anomaly handling method provided in this application. Figure 5 As shown, in the above embodiment, step S100 involves filtering and preprocessing the performance metrics, service metrics, and log files for each network element, specifically including the following steps:

[0124] S1001: Filter and process the performance indicators, service indicators, and log files of each network element according to the network element name, time, and log file format.

[0125] In this step, after obtaining the performance metrics, service metrics, and log files for each network element, in order to accurately analyze and locate network failures based on actual scenarios, it is necessary to filter out the data that needs to be detected in the actual scenario from the performance metrics and service metrics of each network element, such as wireless resource connection establishment success rate, wireless call success rate, call drop rate, etc. Then, based on the filtered metric data, the log files corresponding to the metric data are filtered out from the log files, including network element name, time, user terminal information, user behavior information, base station signal information, base station configuration information, and network failure reason code, etc.

[0126] S1002: Preprocess the filtered performance metrics, service metrics, and log files to obtain the processed performance metrics, processed service metrics, and processed log files for each network element.

[0127] In this step, in order for the filtered performance metrics, business metrics, and log files to be used as a database for model training and computation, the filtered performance metrics, business metrics, and log files need to be preprocessed and stored.

[0128] Specifically, the preprocessing of the filtered performance metrics, business metrics, and log files includes missing value handling, text encoding, data integration, and data transformation. If there are missing data in the metric data, data supplementation is required. The log files are used to locate the cause; if some data in the log files is missing, it can be ignored.

[0129] The network anomaly handling method provided in this embodiment makes the data more accurate by filtering and preprocessing the acquired performance indicators, business indicators and log files, which makes the subsequent model training and calculation more convenient and complete.

[0130] The following section provides a detailed explanation of the network anomaly handling method provided in this application, using specific examples. Figure 6 This is a flowchart illustrating the specific implementation of the network anomaly handling method provided in this application embodiment. For example... Figure 6 As shown, it specifically includes:

[0131] S201: Connect to the network management interface to obtain network metrics and log files.

[0132] In this step, in order to obtain real-time network operation data of each network element of the core network equipment, the server needs to connect to the core network equipment through a communication interface to achieve data transmission.

[0133] Specifically, the server obtains network element performance metrics for each network element from the network management system of the core network equipment via a communication interface every 10 minutes; it also obtains network element service metrics for each network element from the same network management system every 15 minutes via a file transfer protocol every 15 minutes.

[0134] S202: Data filtering and preprocessing storage.

[0135] In this step, after acquiring the data information of each network element of the core network device in real time in the above steps, in order to analyze the reasons for network failure caused by abnormal indicators, it is necessary to filter, preprocess and store the data information of each network element separately.

[0136] Specifically, network KPIs are selected from the network element performance metrics and service metrics acquired for each network element. These include AMF initial registration success rate, SMF PDU session establishment success rate, and VoLTE network connection success rate. Based on the selected network KPIs, corresponding log files are selected from the log files of each network element. These log files contain information such as network element name, time, user terminal information, user behavior information, base station signal information, base station configuration information, and network failure reason codes. The selected network element performance metrics, service metrics, and log files are then preprocessed. Preprocessing includes missing value handling, text encoding, data integration, and data transformation. Finally, the processed performance metrics are stored in a performance metric database, the processed service metrics are stored in a service metric database, and the processed log files are stored in a log file database.

[0137] S203: Deploy the Isolation Forest algorithm, a real-time online anomaly detection algorithm, to detect anomalies in network metrics.

[0138] In this step, in order to avoid the limitations of traditional threshold methods in identifying network KPI anomalies, the Isolation Forest algorithm, a real-time online anomaly detection algorithm, is pre-deployed to acquire data online in real time, learn data features autonomously online, and detect network indicator anomalies.

[0139] Specifically, a binary tree is constructed by sampling from the performance index database and the business index database. Each binary tree is tested, the path length is recorded, and then the anomaly score for each test data is calculated according to the anomaly score calculation formula.

[0140] The specific calculation formula is as follows:

[0141]

[0142] c(n) = 2H(n-1) - (2(n-1) / n)

[0143] H(k)=ln(k)+ζ,ζ=0.5772156649

[0144] Where S(x,n) is the anomaly score of the binary tree formed by the training data of x in n samples, with a value range of [0,1], c(n) is the average path length, and H(k) is the harmonic function. The closer the calculated result is to 1, the more likely the indicator is an anomaly; the closer the result is to 0, the more likely the indicator is a normal indicator. The anomaly index corresponding to each network element is obtained based on the calculation results.

[0145] S204: Preliminary analysis of the causes of abnormal indicators based on statistical analysis methods.

[0146] In this step, the Isolation Forest algorithm, an online anomaly detection algorithm, is used to detect anomalies through the above steps. Finally, anomaly indicators are obtained. Based on the anomaly indicators, log files corresponding to the anomaly indicators are extracted from the log file database. Based on the network failure reason codes in the log files, a preliminary localization analysis of the user-side and wireless-side causes of the anomaly indicators is achieved based on statistical analysis methods.

[0147] Specifically, based on the cause code and the log file corresponding to the network element, it is determined whether there are users with high frequency of failures. If so, the analysis is stopped. It is also determined whether there are base station numbers with high frequency of failures. If so, the analysis is stopped. If neither the users with high frequency of failures nor the base station numbers exist, the analysis is stopped. The final user-side location analysis results include terminal reasons, user SIM card reasons, user subscription status, user behavior reasons, etc. The wireless-side location analysis results include base station signal reasons, base station configuration reasons, etc.

[0148] S205: Deploy correlation algorithm models to achieve in-depth mining and analysis of network problems corresponding to abnormal indicators.

[0149] In this step, the preliminary location analysis of the user side and radio side based on statistical analysis in the previous steps was carried out. During network operation, the success rate of AMF initial registration, SMF PDU session establishment, and VoLTE network connection are all affected by various factors. After excluding user-side and radio-side causes, many other factors remain, such as core network element-side factors, including system load, core network element CPU utilization, and configured network latency. To accurately analyze the main problem factors, the AutoMap algorithm, a multi-dimensional time series correlation analysis model, is deployed to perform correlation analysis on pre-acquired user data, radio information data, performance indicator databases, service indicator databases, and log file databases, thereby accurately deriving the location analysis results of other abnormal indicators.

[0150] Specifically, the analysis of the AutoMap algorithm model mainly consists of the following steps:

[0151] (1) Select the sampling interval parameter;

[0152] (2) Construct abnormal behavior graphs using multiple types of indicators;

[0153] (3) Use the "+" and "-" operations on the behavior map to extract the outline of the anomaly;

[0154] (4) Detect the cause based on the behavior map;

[0155] (5) Verify the results and calculate the accuracy;

[0156] (6) Update the weight matrix. If new anomalies occur, repeat the above steps. Finally, obtain the location analysis results of other anomalies besides the user side and the wireless side. The location analysis results of other anomalies include anomaly behavior graphs and percentage graphs of various influencing factors.

[0157] S206: Integrate with the work order system, SMS platform, and DingTalk platform to package and distribute network failure indicators and location analysis results.

[0158] In this step, after the preliminary location analysis and in-depth location analysis through the above steps S204 and S205, in order to resolve network failures in a timely manner and avoid network degradation, the network failure indicators and location analysis results are summarized into a work order and distributed to the relevant network element users through the work order system. Reminders are also sent through the SMS platform and DingTalk platform.

[0159] Specifically, the compiled work orders include network failure indicators, location analysis results, and visualization charts of various causes of problems. The location analysis results include abnormal behavior charts and charts showing the proportion of various influencing factors.

[0160] S207: Added user return order function to receive user feedback data.

[0161] In this step, the server connects to the work order system through a communication interface and sends work orders to the system. To improve the algorithm model and make network detection more accurate, relevant network element users have corresponding feedback boxes set up under their accounts in the work order system. Users can correct the location reasons, including whether the location reasons are correct and the reasons for the real abnormal indicators analyzed by humans, thereby generating feedback data and sending the feedback data back to the server.

[0162] S208: Adjust and optimize the model based on user feedback data.

[0163] In this step, after receiving user feedback data through the user return order function, the server feeds the feedback data back to the AutoMap algorithm model and / or Isolation Forest in order to optimize the model. The model is then optimized by adjusting the parameters.

[0164] Specifically, based on the user's input feedback data, the AutoMap algorithm and / or Isolation Forest algorithm, leveraging their self-learning capabilities, autonomously learn data features online and rapidly adjust their parameters to achieve model optimization.

[0165] The network anomaly handling method provided in this embodiment involves a server connecting to core network equipment to obtain real-time network element performance indicators, service indicators, and log files for each network element. It then uses the Isolation Forest algorithm for real-time online anomaly detection, performing preliminary and in-depth analysis of network problems corresponding to these anomalies based on statistical analysis methods and correlation algorithm models. Finally, it alerts relevant network element users through work order dispatch and reminders via SMS and DingTalk, and optimizes the algorithm model through a return-to-work function. This method avoids the limitations of traditional fixed threshold-based anomaly indicator determination, adapts to network development, automatically learns from indicator fluctuations in real-time, autonomously adjusts the model based on data characteristics, and promptly and accurately detects network anomalies. Furthermore, the correlation algorithm enables in-depth localization analysis of network failures, providing greater accuracy.

[0166] Figure 7 A schematic diagram of the structure of an embodiment of the network anomaly handling device provided in this application is shown below. Figure 7 As shown, the network anomaly handling device 300 includes:

[0167] The first acquisition module 301 is used to acquire performance indicator data and business indicator data of each network element from the performance indicator database and the business indicator database, respectively.

[0168] The anomaly detection module 302 is used to perform anomaly detection on the performance index data and service index data of each network element through a pre-deployed Isolation Forest algorithm, and obtain the anomaly index corresponding to each network element.

[0169] The anomaly confirmation module 303 is used to determine whether a network element is abnormal based on the corresponding anomaly indicators for each network element.

[0170] Figure 8 A schematic diagram of the structure of the network anomaly handling device according to embodiment two of this application is shown below. Figure 8 As shown, the network anomaly handling device 300 further includes:

[0171] The second acquisition module 304 is used to retrieve the log file corresponding to any network element from the log file database if any network element's abnormal indicator indicates that the network element has an abnormality.

[0172] The third acquisition module 305 is used to perform statistical analysis on the network failure reason codes in the log file and obtain the reason codes with the highest failure frequency.

[0173] The first analysis module 306 is used to perform user-side cause analysis and wireless-side cause analysis based on the cause code, and to obtain user-side location analysis results and wireless-side location analysis results of abnormal indicators.

[0174] The second analysis module 307 is used to perform correlation analysis on the data in the pre-acquired user data, wireless information data, performance index database, business index database and log file database according to the pre-deployed multi-dimensional time series correlation analysis algorithm AutoMap algorithm model, and to determine the location analysis results of other abnormal indicators besides the user side and wireless side.

[0175] The results of the location analysis of other abnormal indicators include abnormal behavior maps and the proportion of influencing factors.

[0176] The result output module 308 is used to output the user-side positioning analysis results, the wireless-side positioning analysis results, and the positioning analysis results of other abnormal indicators.

[0177] The data receiving module 309 is used to receive feedback data input by the user. The feedback data includes whether the user's opinion on the cause of the anomaly is correct and the data obtained after correcting the cause of the anomaly.

[0178] The model optimization module 310 is used to optimize the parameters of the AutoMap algorithm model and / or the IsolationForest algorithm based on feedback data.

[0179] The fourth acquisition module 311 is used to acquire performance indicators, service indicators and log files of each network element in the network from the core network equipment.

[0180] The data processing module 312 is used to filter and preprocess the performance indicators, service indicators and log files of each network element, and store the processed performance indicators of each network element in the performance indicator database, the processed service indicators in the service indicator database, and the processed log files in the log file database.

[0181] Figure 9 A schematic diagram of the structure of the network anomaly handling device embodiment three provided in this application, the data processing module 312 includes:

[0182] The first processing unit 3121 is used to filter and process the performance indicators, service indicators and log files of each network element according to the network element name, time and log file format.

[0183] The second processing unit 3122 is used to preprocess the filtered performance indicators, business indicators and log files to obtain the processed performance indicators, processed business indicators and processed log files for each network element. The preprocessing includes missing value handling, text encoding, data integration and data transformation.

[0184] This application also provides an electronic device. Figure 10 This is a schematic diagram of the structure of the electronic device provided in the embodiments of this application, such as... Figure 10 As shown, the electronic device 400 includes: a memory 401, a processor 402, a communication interface 403, and a display screen 404;

[0185] Memory 401 stores computer-executed instructions.

[0186] Processor 402 executes computer execution instructions stored in memory to implement the method in any of the embodiments.

[0187] Communication interface 403 is used to interface with various network management systems in the core network to achieve data transmission.

[0188] Display 404 is used to display alarm information and analysis results.

[0189] Optionally, the various devices described above in the electronic device 400 can be connected via a system bus.

[0190] The memory 401 can be a separate memory unit or a memory unit integrated into the processor 402. The number of processors 402 can be one or more.

[0191] It should be understood that the display can also be used to display the processor's processing results and for human-computer interaction. In some embodiments, the display can be the front panel of a terminal device; in other embodiments, the display can be a flexible display screen disposed on a curved or folded surface of the terminal device. Furthermore, the display can also be configured as a non-rectangular, irregularly shaped display screen, i.e., a non-rectangular screen. The display can be made of materials such as Liquid Crystal Display (LCD) and Organic Light-Emitting Diode (OLED).

[0192] It should be understood that the processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), etc. A general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in this application can be directly manifested as being executed by a hardware processor, or executed by a combination of hardware and software modules within the processor.

[0193] The system bus can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The system bus can be divided into address bus, data bus, control bus, etc. For ease of representation, only one thick line is used in the diagram, but this does not indicate that there is only one bus or one type of bus. Memory may include random access memory (RAM) and may also include non-volatile memory (NVM), such as at least one disk storage device.

[0194] All or part of the steps in the above-described method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a readable memory. When the program is executed, it performs the steps of the above-described method embodiments; and the aforementioned memory (storage medium) includes: read-only memory (ROM), RAM, flash memory, hard disk, solid-state drive, magnetic tape, floppy disk, optical disk, and any combination thereof.

[0195] The electronic device provided in this embodiment is used to execute the technical solutions in any of the foregoing method embodiments. Its implementation principle and technical effect are similar, and will not be described again here.

[0196] This application also provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the method in any of the embodiments.

[0197] The aforementioned computer-readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory, electrically erasable programmable read-only memory, erasable programmable read-only memory, programmable read-only memory, read-only memory, magnetic storage, flash memory, magnetic disk, or optical disk. The readable storage medium can be any available medium accessible to a general-purpose or special-purpose computer.

[0198] Optionally, a readable storage medium can be coupled to a processor, enabling the processor to read information from and write information to the readable storage medium. Alternatively, the readable storage medium can be an integral part of the processor. Both the processor and the readable storage medium can reside in an Application Specific Integrated Circuit (ASIC). Alternatively, the processor and the readable storage medium can exist as discrete components within the device.

[0199] This application also provides a computer program product, which includes a computer program stored in a computer-readable storage medium. At least one processor can read the computer program from the computer-readable storage medium, and when the at least one processor executes the computer program, it can implement the technical solutions provided in any of the above method embodiments.

[0200] Other embodiments of this application will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this application are indicated by the following claims.

[0201] It should be understood that this application is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this application is limited only by the appended claims.

Claims

1. A method for handling network anomalies, characterized in that, include: The performance metrics data and service metrics data of each network element in the core network are obtained from the performance metrics database and the service metrics database, respectively. Anomaly detection is performed on the performance metrics data and service metrics data of each network element through the pre-deployed Isolation Forest algorithm to obtain the abnormal metrics corresponding to each network element. For each network element, determine whether the network element is abnormal based on the corresponding abnormal indicators; If any network element's abnormal indicator indicates that the network element is abnormal, then the log file corresponding to the network element is retrieved from the log file database; Statistical analysis was performed on the network failure reason codes in the log files to obtain the reason codes with the highest failure frequency; Based on the cause code, user-side cause analysis and wireless-side cause analysis are performed to obtain user-side location analysis results and wireless-side location analysis results for abnormal indicators. The user-side location analysis results are obtained by statistically analyzing the cause code and the log files corresponding to the network element to determine if there are users with high-frequency failures. These results include terminal-related reasons, user SIM card-related reasons, user subscription status, and user behavior-related reasons. The wireless-side location analysis results are obtained by statistically analyzing the presence of base station numbers with high-frequency failures. These results include base station signal-related reasons and base station configuration-related reasons. Based on the pre-deployed multi-dimensional time series correlation analysis algorithm - AutoMap algorithm model, correlation analysis is performed on the pre-acquired user data, wireless information data, the performance index database, the business index database and the log file database to determine the location analysis results of other abnormal indicators besides the user side and the wireless side. The location analysis results of the other abnormal indicators include abnormal behavior maps and the proportion of influencing factors.

2. The method according to claim 1, characterized in that, The method further includes: Output the user-side positioning analysis results, the wireless-side positioning analysis results, and the positioning analysis results of the other abnormal indicators; Receive feedback data input by the user, wherein the feedback data is the data obtained after the user has corrected the cause of the anomaly and the cause of the anomaly. The parameters of the AutoMap algorithm model and / or the Isolation Forest algorithm are optimized based on the feedback data.

3. The method according to claim 1 or 2, characterized in that, Before obtaining the performance index data and service index data of each network element from the performance index database and the service index database respectively, the method further includes: Obtain performance metrics, service metrics, and log files for each network element in the network from the core network equipment; The performance metrics, service metrics, and log files of each network element are filtered and preprocessed. The processed performance metrics of each network element are stored in the performance metrics database, the processed service metrics are stored in the service metrics database, and the processed log files are stored in the log file database.

4. The method according to claim 3, characterized in that, The filtering and preprocessing of performance metrics, service metrics, and log files for each network element includes: Filter the performance metrics, service metrics, and log files of each network element according to network element name, time, and log file format; The filtered performance metrics, business metrics, and log files are preprocessed to obtain the processed performance metrics, processed business metrics, and processed log files for each network element. The preprocessing includes missing value handling, text encoding, data integration, and data transformation.

5. A network anomaly handling device, characterized in that, include: The first acquisition module is used to acquire performance indicator data and business indicator data of each network element from the performance indicator database and the business indicator database, respectively. The anomaly detection module is used to perform anomaly detection on the performance index data and business index data of each network element through the pre-deployed Isolation Forest algorithm, and obtain the anomaly index corresponding to each network element. The anomaly confirmation module is used to determine whether a network element is abnormal based on the anomaly indicators corresponding to that network element. The second acquisition module is used to acquire the log file corresponding to the network element from the log file database if any network element's abnormal indicator indicates that the network element has an abnormality. The third acquisition module is used to perform statistical analysis on the network failure reason codes in the log file and obtain the reason codes with the highest failure frequency. The first analysis module is used to perform user-side cause analysis and wireless-side cause analysis based on the cause code, and obtain user-side location analysis results and wireless-side location analysis results of abnormal indicators. The user-side location analysis results are obtained by statistically analyzing the cause codes and log files corresponding to network elements to determine if there are users with high-frequency failures. The user-side location analysis results include terminal reasons, user SIM card reasons, user subscription status, and user behavior reasons. The wireless-side location analysis results are obtained by statistically analyzing the base station numbers with high-frequency failures. The wireless-side location analysis results include base station signal reasons and base station configuration reasons. The second analysis module is used to perform correlation analysis on the pre-acquired user data, wireless information data, the performance index database, the business index database and the log file database according to the pre-deployed multi-dimensional time series correlation analysis algorithm AutoMap algorithm model, and to determine the location analysis results of other abnormal indicators besides the user side and the wireless side. The location analysis results of the other abnormal indicators include abnormal behavior maps and the proportion of influencing factors.

6. The apparatus according to claim 5, characterized in that, The device further includes: The result output module is used to output the user-side positioning analysis results, the wireless-side positioning analysis results, and the positioning analysis results of other abnormal indicators. The data receiving module is used to receive feedback data input by the user. The feedback data is the data obtained after the user has corrected the cause of the abnormality and the reason for correcting the abnormal indicator. The model optimization module is used to optimize the parameters of the AutoMap algorithm model and / or the IsolationForest algorithm based on the feedback data.

7. The apparatus according to claim 5 or 6, characterized in that, Prior to the first acquisition module, the device further includes: The fourth acquisition module is used to acquire performance metrics, service metrics, and log files for each network element in the network from the core network equipment; The data processing module is used to filter and preprocess the performance indicators, service indicators and log files of each network element, and store the processed performance indicators of each network element in the performance indicator database, the processed service indicators in the service indicator database, and the processed log files in the log file database.

8. The apparatus according to claim 7, characterized in that, The data processing module includes: The first processing unit is used to filter and process the performance indicators, service indicators and log files of each network element according to the network element name, time and log file format. The second processing unit is used to preprocess the filtered performance indicators, business indicators and log files to obtain the processed performance indicators, processed business indicators and processed log files for each network element. The preprocessing includes missing value handling, text encoding, data integration and data transformation.

9. An electronic device, comprising: Memory, processor, communication interface, display screen; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory to implement the method as described in any one of claims 1 to 4.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the network exception handling method as described in any one of claims 1 to 4.

Images