Network element anomaly detection method, device, equipment and medium

Abstract

The present disclosure provides a network element anomaly detection method, apparatus, device and medium, which relates to the field of anomaly detection technology for wireless communications. The method comprises: obtaining original KPI data groups corresponding to multiple key performance indicators (KPIs) of a network element, each original KPI data group being three-dimensional data including a time dimension, a network element dimension and a KPI dimension; performing statistical analysis on multiple original KPI data in the original KPI data group, converting the original KPI data group into a target KPI data group, the target KPI data group being two-dimensional data including a network element dimension and a KPI dimension; calculating a statistical value of the network element and a distance value between the statistical value and a mean value corresponding to the statistical value to obtain a distance value set of the network element; performing quartile anomaly detection on the distance value set of each network element to obtain the number of abnormal distance values of the network element; obtaining a total distance value of the network element based on the distance value set of the network element; and judging whether the network element is abnormal based on the number of abnormal distance values corresponding to each network element and the total distance value.

Description

Technical Field

[0001] The present disclosure relates to the technical field of anomaly detection in wireless communications, and in particular to a method, apparatus, device, and medium for detecting anomalies in network elements. Background Art

[0002] In the daily operation and maintenance of modern communication networks, operators generally obtain KPIs (Key Performance Indicators) to determine whether network anomalies occur.

[0003] Currently, anomaly detection in the wireless field is divided into two types: single-KPI anomaly detection methods and multi-KPI anomaly detection methods. Single-KPI anomaly detection methods primarily focus on fluctuations within a time period, which is ideal for anomaly detection. However, in the wireless field, fluctuations in network data are often caused by unexpected events, such as students leaving and returning to campus, and high-speed trains entering and leaving stations. Single-KPI anomaly detection methods are ineffective in these situations. Multi-KPI anomaly detection methods are often ineffective at detecting single-dimensional anomalies. Furthermore, for large, ultra-high-dimensional datasets, such methods have high algorithmic complexity, poor interpretability of the results, and high recalculation costs after dimensionality changes.

[0004] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present disclosure, and therefore may include information that does not constitute prior art known to ordinary technicians in the field. Summary of the Invention

[0005] The present disclosure provides a network element anomaly detection method, apparatus, device and medium, which at least to some extent solve the time complexity of multi-KPI anomaly detection methods on high-dimensional data and the problem that the model cannot be reused after dimensionality transformation.

[0006] Other features and advantages of the present disclosure will become apparent from the following detailed description, or may be learned in part by practice of the present disclosure.

[0007] According to one aspect of the present disclosure, a method for detecting anomalies of a network element is provided, comprising:

[0008] Obtaining original KPI data groups corresponding to multiple key performance indicators (KPIs) of the network element, where each original KPI data group is three-dimensional data including a time dimension, a network element dimension, and a KPI dimension, and the original KPI data in the original KPI data group is used to represent the KPI of the network element in a first metric interval in each cycle in a first time period;

[0009] By performing statistical analysis on multiple original KPI data in the original KPI data group, the original KPI data group is converted into a target KPI data group, where the target KPI data group is two-dimensional data including a network element dimension and a KPI dimension, and the target KPI data in the target KPI data group is used to represent a statistical value of a second metric interval of the network element in each cycle in the first time period, wherein each cycle includes multiple second metric intervals, and the duration of the second metric interval is greater than the duration of the first metric interval;

[0010] Calculate the statistical value of the network element and the distance value between the statistical value and the mean value corresponding to the statistical value to obtain a distance value set of the network element;

[0011] For each network element's distance value set, perform quartile anomaly detection to obtain the number of abnormal distance values of the network element;

[0012] Based on the distance value set of the network elements, the total distance value of the network elements is obtained by statistics;

[0013] Based on the number of abnormal distance values and the total distance value corresponding to each network element, it is determined whether the network element is abnormal.

[0014] In one embodiment of the present disclosure, quartile anomaly detection is performed on the distance value set of each network element to obtain the number of abnormal distance values of the network element, including performing the following processing on the distance value set of each network element:

[0015] Arrange all distance values in the distance value set of the network element from small to large, and determine the first quartile Q1 and the third quartile Q3;

[0016] According to the first quartile Q1 and the third quartile Q3, the interquartile range IQR is calculated;

[0017] Determine a distance threshold based on the first quartile Q1, the third quartile Q3, the interquartile range IQR, and the minimum distance value in the distance value set of the network element;

[0018] Based on the distance value set of the network element and the distance threshold, the number of abnormal distance values of the network element is determined, where the abnormal distance is a distance value in the distance value set of the network element that is greater than the distance threshold.

[0019] In one embodiment of the present disclosure, a distance threshold is determined based on the first quartile Q1, the third quartile Q3, the interquartile range IQR, and the minimum distance value in the distance value set of the network element, including determining the distance threshold by the following formula:

[0020] D t =Q3+Q1-D min

[0021] Among them, D t Denotes the distance threshold, Dmin Indicates the minimum distance value in the distance value set of the network element.

[0022] In one embodiment of the present disclosure, the statistical value of the second metric interval includes one or more of the following types of statistical values:

[0023] Maximum value, minimum value, mean, ratio of standard deviation to sample number, kurtosis, skewness;

[0024] Among them, kurtosis is a statistic that measures the steepness of the distribution of all values in the population, and skewness is the symmetry of the distribution of the population values.

[0025] In one embodiment of the present disclosure, the length of the first time period is one week, the cycle is one day, the first measurement interval is 1 hour, and the second measurement interval is 6 hours.

[0026] In one embodiment of the present disclosure, calculating a statistical value of a network element and a distance value between the statistical value and a mean value corresponding to the statistical value to obtain a distance value set of the network element includes:

[0027] Calculate the Manhattan distance between the statistical value of the network element and the mean value corresponding to the statistical value to obtain a distance value set of the network element.

[0028] In one embodiment of the present disclosure, judging whether a network element is abnormal based on the number of abnormal distance values and the total distance value corresponding to each network element includes:

[0029] If the number of abnormal distance values of the network element is greater than a preset number threshold and the total distance value is less than or equal to the preset distance threshold, the network element is determined as a potential fault network element;

[0030] If the number of abnormal distance values of the network element is greater than a preset number threshold and the total distance value is greater than a preset distance threshold, the network element is determined to be a faulty network element;

[0031] When the number of abnormal distance values of the network element is less than or equal to the preset number threshold and the total distance value is greater than the preset distance threshold, the relevant information of the network element is sent to the manual review office.

[0032] According to another aspect of the present disclosure, a network element anomaly detection device is provided, comprising:

[0033] a data acquisition module, configured to acquire original KPI data groups corresponding to multiple key performance indicators (KPIs) of a network element, each original KPI data group being three-dimensional data including a time dimension, a network element dimension, and a KPI dimension, wherein the original KPI data in the original KPI data group represents the KPI of the network element in a first metric interval within each cycle in a first time period;

[0034] a data processing module, configured to convert the original KPI data group into a target KPI data group by performing statistical analysis on multiple original KPI data in the original KPI data group, where the target KPI data group is two-dimensional data including a network element dimension and a KPI dimension, and the target KPI data in the target KPI data group is used to represent a statistical value of a second metric interval of the network element in each cycle in the first time period, where each cycle includes multiple second metric intervals, and the duration of the second metric interval is greater than the duration of the first metric interval;

[0035] A distance calculation module is used to calculate the statistical value of the network element and the distance value between the statistical value and the mean value corresponding to the statistical value to obtain a distance value set of the network element;

[0036] The first detection module is used to perform quartile anomaly detection on the distance value set of each network element to obtain the number of abnormal distance values of the network element;

[0037] A distance statistics module is used to obtain the total distance value of the network element based on the distance value set of the network element;

[0038] The second detection module is used to determine whether the network element is abnormal based on the number of abnormal distance values and the total distance value corresponding to each network element.

[0039] According to another aspect of the present disclosure, an electronic device is provided, including: a memory for storing instructions; and a processor for calling the instructions stored in the memory to implement the above-mentioned network element anomaly detection method.

[0040] According to another aspect of the present disclosure, a computer-readable storage medium is provided, on which computer instructions are stored. When the computer instructions are executed by a processor, the above-mentioned network element anomaly detection method is implemented.

[0041] According to another aspect of the present disclosure, a computer program product is provided. The computer program product stores instructions, which, when executed by a computer, enable the computer to implement the above-mentioned network element anomaly detection method.

[0042] According to yet another aspect of the present disclosure, there is provided a chip comprising at least one processor and an interface;

[0043] An interface for providing program instructions or data to at least one processor;

[0044] At least one processor is used to execute program instructions to implement the above-mentioned network element anomaly detection method.

[0045] The network element anomaly detection method, apparatus, device, and medium provided by the embodiments of the present disclosure reduce three-dimensional data to two-dimensional data, and the duration of the second measurement interval is greater than the duration of the first measurement interval, thereby reducing time complexity and making the amount of two-dimensional data smaller than that of three-dimensional data. In anomaly detection, the quartile anomaly detection method is first used to detect the number of abnormal distance values of the network element, and then the number of abnormal distance values corresponding to each network element and the total distance value are used to comprehensively judge whether the network element is abnormal, thereby increasing the detection accuracy.

[0046] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present disclosure and, together with the description, serve to explain the principles of the present disclosure.

[0048] Obviously, the drawings described below are only some embodiments of the present disclosure. A person skilled in the art can obtain other drawings based on these drawings without any creative effort.

[0049] Figure 1 A flow chart of a method for detecting abnormality of a network element according to an embodiment of the present disclosure is shown;

[0050] Figure 2 A schematic diagram showing an original KPI data group according to an embodiment of the present disclosure;

[0051] Figure 3 A schematic diagram showing a comparison process between the OneClassSVM detection method in an embodiment of the present disclosure and the detection method of the present disclosure is shown;

[0052] Figure 4 A schematic diagram showing how three-dimensional data is converted into two-dimensional data in an embodiment of the present disclosure is shown;

[0053] Figure 5a Shows a scatter plot of OneClassSVM;

[0054] Figure 5b A scatter plot showing the detection method of an embodiment of the present disclosure;

[0055] Figure 6a A comparison of the confusion matrices of the detection method according to the present disclosure and the results of sampling 30,000 of the OneClassSVM dataset is shown;

[0056] Figure 6b A comparison of the confusion matrices of the detection method according to the present disclosure and the results of sampling 60,000 of the OneClassSVM dataset is shown;

[0057] Figure 6c A comparison of the confusion matrices of the detection method according to the present disclosure and the results of sampling 90,000 of the OneClassSVM dataset is shown;

[0058] Figure 6d A comparison of the confusion matrices of the detection method according to the present disclosure and the results of sampling 120,000 of the OneClassSVM dataset is shown;

[0059] Figure 6e A comparison of the confusion matrices of the detection method according to the present disclosure and the results of sampling 140,000 of the OneClassSVM dataset is shown;

[0060] Figure 6f A comparison of the confusion matrices of the detection method according to the present disclosure and the results of the OneClassSVM dataset using all samples is shown;

[0061] Figure 7 A comparison chart showing the computation time of the detection method according to the embodiment of the present disclosure and OneClassSVM is shown;

[0062] Figure 8 A schematic diagram of a network element anomaly detection device according to an embodiment of the present disclosure is shown;

[0063] Figure 9 A structural block diagram of an electronic device in an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0064] Example embodiments will be described more fully hereinafter with reference to the accompanying drawings.

[0065] It should be noted that example embodiments may be implemented in many forms and should not be construed as limited to the examples set forth herein.

[0066] Related technologies typically divide networks into regional and cell levels for KPI anomaly detection. Regional-level KPIs typically exhibit relatively stable periodic fluctuations, making KPI anomalies easier to detect. However, at the cell level, due to low traffic volume and a small number of call record samples, KPIs typically exhibit random jitter. Furthermore, the number of cell-level KPIs is typically massive, making cell-level KPI anomaly detection difficult.

[0067] Based on the background technology section, it can be seen that the current anomaly detection in the wireless field is divided into anomaly detection algorithms for a single KPI and anomaly detection methods for multiple KPIs.

[0068] Multi-KPI anomaly detection methods include proximity-based outlier detection, density-based outlier detection, and clustering-based methods. Clustering-based anomaly detection is often ineffective for detecting single-dimensional anomaly data. Furthermore, for large sample datasets with ultra-high dimensions, such methods have high algorithmic complexity, poor interpretability of calculation results, and high recalculation costs after dimensionality transformation.

[0069] To solve the above problems, the embodiments of the present disclosure provide a network element anomaly detection method, apparatus, device and medium, which can reduce the time complexity of the multi-KPI anomaly detection method on high-dimensional data and improve detection accuracy.

[0070] This exemplary implementation is described in detail below with reference to the accompanying drawings and examples.

[0071] Figure 1 A flow chart of a method for detecting abnormality of a network element according to an embodiment of the present disclosure is shown as follows: Figure 1 As shown, the network element anomaly detection method provided in the embodiment of the present disclosure includes steps S102-S112.

[0072] In S102, original KPI data groups corresponding to multiple key performance indicators KPIs of the network element are obtained. Each original KPI data group is three-dimensional data including time dimension, network element dimension and KPI dimension. The original KPI data in the original KPI data group is used to represent the KPI of the first measurement interval of the network element in each cycle in the first time period.

[0073] The embodiment of the present disclosure may be used to monitor whether multiple network elements are abnormal. In S102 , data may be obtained for each network element separately.

[0074] In the embodiment of the present disclosure, each network element may have multiple KPIs. Here, each original KPI data group in S102 may correspond to one KPI, and each of the multiple KPIs may correspond to one original KPI data group.

[0075] In some embodiments, the KPI of the first metric interval may be one or more of the following data:

[0076] PDCP (Packet Data Convergence Protocol) traffic, RRC (Radio Resource Control) connection times, wireless initial connection success rate, S1 signaling connection establishment failure times, RRC connection establishment failure times, E-RAB (Evolved Radio Access Bearer) establishment failure times, UE context abnormal release times, UE context drop rate, E-RAB abnormal release times, E-RAB drop rate, RRC connection reestablishment ratio, RRC reestablishment request times, intra-frequency handover success rate, intra-frequency handover failure times, inter-frequency handover success rate, inter-frequency handover failure times, CQI (Channel Quality Indicator) good to good ratio, air interface uplink user plane packet loss number, air interface uplink user plane packet loss rate, air interface downlink user plane packet loss number, air interface downlink user plane packet loss rate.

[0077] In the present disclosure, the original KPI data group is three-dimensional data including a time dimension, a network element dimension, and a KPI dimension. Figure 2 A schematic diagram of an original KPI data group is shown, wherein the time dimension corresponding to 0.3 is 2022-01-01 00:00:00, the network element dimension is network element A, and the KPI dimension is KPI1.

[0078] In some embodiments, the first time period may be one week, the cycle may be one day, and the first measurement interval may be one hour. The original KPI data in the original KPI data group is used to represent the KPI of the network element in the first measurement interval within each cycle in the first time period. That is, 0.3 can be used to represent the KPI value of network element A every hour of every day in a week. For KPI1, network element A has 7×24 data in a week, that is, 168 data points.

[0079] In S104, the original KPI data group is converted into a target KPI data group by performing statistical analysis on multiple original KPI data in the original KPI data group. The target KPI data group is two-dimensional data including network element dimension and KPI dimension. The target KPI data in the target KPI data group is used to represent the statistical value of the second measurement interval of the network element in each cycle in the first time period, wherein each cycle includes multiple second measurement intervals, and the duration of the second measurement interval is greater than the duration of the first measurement interval.

[0080] To convert the original KPI data group into the target KPI data group, the three-dimensional data can be converted into two-dimensional data first, and then the time granularity is adjusted, that is, the duration of the measurement interval is adjusted so that the duration of the second measurement interval is greater than the duration of the first measurement interval, and then statistical analysis is performed to obtain the target KPI data group.

[0081] In some embodiments, the first time period may be one week, the cycle may be one day, and the first measurement interval may be one hour. For KPI1, network element A has 7×24 data points in one week, or 168 data points. When converted into two-dimensional data, the second measurement interval may be six hours. In this case, for KPI1, network element A has 7×4 data points in one week, or 28 data points.

[0082] In some embodiments, the statistical values of the second metric interval may include multiple types of statistical values. As an example, when there are six types of statistical values and the second metric interval is six hours, when converted into two-dimensional data, for KPI 1, network element A has 7×4×6 data in a week, that is, 168 data points.

[0083] In some embodiments, the statistical value of the second measurement interval includes one or more of the following types of statistical values: maximum value, minimum value, mean, ratio of standard deviation to sample number, kurtosis, and skewness; wherein kurtosis is a statistic that measures the steepness of the distribution of all values in the population, and skewness is the symmetry of the distribution of the population values. In actual production environments, the problem of partial data missing often occurs. When data is missing, the standard deviation of the period with severe missing data will be small. In the disclosed embodiments, using the ratio of standard deviation to sample number as a statistical value can reduce the impact of missing data on the test results.

[0084] In some embodiments, the kurtosis can be calculated using the following formula:

[0085]

[0086] Among them, Kurtosis represents kurtosis, x i represents, μ represents, and σ represents.

[0087] In some embodiments, the skewness can be calculated using the following formula:

[0088]

[0089] Among them, Skewness represents skewness.

[0090] In some embodiments, missing data may be supplemented by sliding a time window.

[0091] It should be noted that in the embodiment of the present disclosure, statistical values are regarded as new KPIs. When the statistical values include multiple types, each type of statistical value can be regarded as a new KPI. To simplify the description, the statistical values hereinafter are statistical values of each type, that is, a new KPI, and the number of statistical value types will no longer be discussed in detail.

[0092] In S106 , the statistical value of the network element and the distance value between the statistical value and the mean value corresponding to the statistical value are calculated to obtain a distance value set of the network element.

[0093] In some embodiments, the distance value between the calculated statistical value of the network element and the mean value corresponding to the statistical value may be the Manhattan distance value between the calculated statistical value of the network element and the mean value corresponding to the statistical value.

[0094] In some embodiments, the average value corresponding to the statistical value may be an average value of multiple statistical values of the network element in the first time period.

[0095] In S108 , quartile anomaly detection is performed on the distance value set of each network element to obtain the number of abnormal distance values of the network element.

[0096] Quartile anomaly detection, also known as the interquartile range method, is a statistical method based on box plots. It divides the data by defining three data distribution sites and calculates the statistical boundary values.

[0097] The first quartile (Q1), also known as the "lower quartile", is equal to the 25th percentile of all values in the sample arranged from small to large.

[0098] The second quartile (Q2), also known as the "median", is equal to the 50th percentile of all values in the sample arranged from small to large.

[0099] The third quartile (Q3), also known as the "upper quartile", is equal to the 75th percentile of all values in the sample arranged from small to large.

[0100] The difference between the third quartile and the first quartile is also called the interquartile range (IQR). IQR is the range between Q1 and Q3: IQR = Q3 - Q1.

[0101] In the related art, a value lower than the data point Q1-k*IQR or higher than Q3+k*IQR is generally defined as an outlier.

[0102] In some embodiments, quartile anomaly detection is performed on the distance value set of each network element to obtain the number of abnormal distance values of the network element, including performing the following processing on the distance value set of each network element:

[0103] Arrange all distance values in the distance value set of the network element from small to large, and determine the first quartile Q1 and the third quartile Q3;

[0104] According to the first quartile Q1 and the third quartile Q3, the interquartile range IQR is calculated;

[0105] Determine a distance threshold based on the first quartile Q1, the third quartile Q3, the interquartile range IQR, and the minimum distance value in the distance value set of the network element;

[0106] Based on the distance value set of the network element and the distance threshold, the number of abnormal distance values of the network element is determined, where the abnormal distance is a distance value in the distance value set of the network element that is greater than the distance threshold.

[0107] In some embodiments, determining the distance threshold based on the first quartile Q1, the third quartile Q3, the interquartile range IQR, and the minimum distance value in the set of distance values of the network element includes determining the distance threshold by the following formula:

[0108] D min =Q1-k*(Q3-Q1) (3)

[0109] D t =Q3+k*(Q3-Q1) (4)

[0110] Among them, D t Denotes the distance threshold, D min Represents the minimum distance value in the distance value set of the network element. By simplifying the above two formulas, the distance threshold formula can be obtained as follows:

[0111] D t =Q3+Q1-D min (5)

[0112] In S110 , based on the distance value set of the network element, a total distance value of the network element is obtained by statistics.

[0113] The total distance value is the sum of all distance values in the distance value set of the network element.

[0114] In S112 , based on the number of abnormal distance values corresponding to each network element and the total distance value, it is determined whether the network element is abnormal.

[0115] In some embodiments, determining whether a network element is abnormal based on the number of abnormal distance values and the total distance value corresponding to each network element includes:

[0116] If the number of abnormal distance values of the network element is greater than a preset number threshold and the total distance value is less than or equal to the preset distance threshold, the network element is determined as a potential fault network element;

[0117] If the number of abnormal distance values of the network element is greater than a preset number threshold and the total distance value is greater than a preset distance threshold, the network element is determined to be a faulty network element;

[0118] When the number of abnormal distance values of the network element is less than or equal to the preset number threshold and the total distance value is greater than the preset distance threshold, the relevant information of the network element is sent to the manual review office.

[0119] The network element anomaly detection method provided by the embodiment of the present disclosure reduces three-dimensional data to two-dimensional data, and the duration of the second measurement interval is greater than the duration of the first measurement interval, thereby reducing time complexity and making the data volume of two-dimensional data smaller than that of three-dimensional data. In anomaly detection, the quartile anomaly detection method is first used to detect the number of abnormal distance values of the network element, and then the number of abnormal distance values corresponding to each network element and the total distance value are used to comprehensively judge whether the network element is abnormal, thereby increasing the detection accuracy.

[0120] The table below shows the feedback results of experts from provinces A, B, and C on the OneClassSVM detection method and the detection method of the embodiment of the present disclosure.

[0121] Table 1 Comparison of test results

[0122]

[0123] The table above compares expert feedback from provinces A, B, and C on different algorithms. The OneClassSVM method and the disclosed method each received three weeks of feedback. Expert feedback from the three provinces showed that the disclosed method achieved better anomaly detection results than the traditional OneClassSVM method.

[0124] Figure 3 The comparison process of OneClassSVM detection method and the detection method disclosed in the present invention is shown in FIG. Figure 3 As shown, the left side is OneClassSVM anomaly detection, and the right side is the anomaly detection method of the embodiment of the present disclosure.

[0125] The core process of network element anomaly detection provided by the present disclosure mainly includes data dimension conversion and Manhattan distance quartile anomaly detection.

[0126] The following description assumes that the length of the first time period is one week, the cycle is one day, the first measurement interval is one hour, and the second measurement interval is six hours.

[0127] Data dimension conversion: The data span is one week and the granularity is hourly. 7*24 KPI data is converted into statistical values (maximum value, minimum value, mean value, standard deviation / sample number, kurtosis, and skewness) for the time periods 0-5, 6-11, 12-17, and 18-23 of the seven days of the week. Taking RRC as an example, 168 rows and 1 column of data are converted into 1 row and 24 columns (4 time periods and 6 statistical values).

[0128] Manhattan distance quartile anomaly detection: The dimension conversion in the previous step converts each network element into a row of multiple columns. The mean of each dimension is calculated. The Manhattan distance between the mean and each data point is then calculated and quartile anomaly detection is performed on the distance. Network elements with a value greater than the estimated maximum value are marked as anomalies, and network elements with a value less than or equal to the estimated maximum value are marked as normal.

[0129] After acquiring data from the data source, the difficulty of detecting anomalies in network elements lies in both the spatial dimension (multiple network elements) and the temporal dimension (data spanning a week with hourly granularity, meaning each network element contains 7 / 24 hours of data). Furthermore, each network element also contains multiple KPIs every hour. This data spanning three dimensions creates a high level of difficulty.

[0130] The method disclosed in this paper is to first convert the data dimension, such as Figure 3 , convert the 7*24 KPI data into statistical values (maximum value, minimum value, mean value, standard deviation / sample number, kurtosis, skewness) for the 0-5, 6-11, 12-17, and 18-23 periods of the 7 days of the week. Taking KPI1 as an example, convert the 168 rows*1 column data into 1 row*24 columns (4 periods*6 statistical values) data as follows Figure 4 Because there are cases of missing data, the standard deviation will be small in periods with serious missing data, so the standard deviation is divided by the number of samples.

[0131] Kurtosis is a statistic that describes the steepness of the distribution of all values in a population, as shown in formula (1) above.

[0132] Skewness describes the symmetry of the distribution of values in a population, as shown in formula (2) above.

[0133] After dimension conversion, each converted feature is regarded as a new KPI and the mean m is calculated. i ,i∈[1, total number of KPI dimensions N].

[0134] Calculate the mean m i With network element c j ,j∈[1, total number of network elements C] each KPI: k i Manhattan distance

[0135]

[0136] According to the Manhattan distance set Dis j, j∈[1,C], perform quartile anomaly detection. First, calculate Q1: the 25th percentile number after all distance values are arranged from smallest to largest, and Q3: the 75th percentile number after all distance values are arranged from smallest to largest. Then, use the minimum estimate = Q1 - k(Q3 - Q1). Because shorter distances represent more normal network elements, no distance should be less than the minimum estimate. This step determines the range of k values. Substituting k for the maximum estimate = Q3 + k(Q3 - Q1). Network elements with distances exceeding the maximum estimate are considered anomalies.

[0137] Because each KPI can be analyzed for quartile anomalies, we can determine the number of times each network element's KPI exceeds the upper quartile limit and perform a double ranking based on the number and the final distance (the total distance value mentioned above).

[0138] If a network element has multiple KPI distances exceeding the upper quartile limit but the final distance does not exceed the upper quartile limit of the total distance, it is considered a potential faulty network element.

[0139] If multiple KPI distances for a network element exceed the upper quartile limit and the final distance exceeds the upper quartile limit of the total distance, this problem should be addressed first.

[0140] If only a few KPI distances of a network element exceed the upper quartile limit but the final distance exceeds the upper quartile limit of the total distance, submit the KPIs that exceed the upper quartile limit to experts to quickly locate the fault.

[0141] The dimensionality transformation disclosed in the present invention can reduce the impact of missing data on the overall situation to a certain extent: if a network element is only missing data for a few hours, the maximum value, minimum value, mean, standard deviation / sample number, kurtosis, and skewness of the network element will be less affected, and its effect is better than filling the missing data with the previous and next values or the mean.

[0142] The detection method disclosed in this paper has a lower algorithm time complexity when the labeling results are close to those of OneClassSVM:

[0143] Compare the scatter plot (sampled data), confusion matrix, and computation time of OneClassSVM and this disclosure. The final results will be submitted to the reviewer for confirmation. Figure 5a and Figure 5b This is a comparison of the data scatter plots after randomly sampling 30,000 network elements in a province and performing OneClassSVM and Manhattan distance quartile anomaly tests disclosed in this paper. The original high-dimensional KPI was converted to a two-dimensional t-SNE dimension. Gray represents normal network elements, and black represents abnormal network elements.

[0144] Figure 6a-6fThis is a comparison of the confusion matrices of the results of OneClassSVM and the detection method disclosed in this paper. The data sets are sampled at 30,000, 60,000, 90,000, 120,000, 140,000, and the confusion matrices of the full sample.

[0145] Figure 7 Comparing the computation time of OneClassSVM and the disclosed detection method: the disclosed method has a labeling result close to that of OneClassSVM while also having a lower time complexity.

[0146] In the embodiments of the present disclosure, the terms “first,” “second,” and “third” are used for descriptive purposes only and should not be understood as indicating or implying relative importance.

[0147] In this disclosure, the term "and / or" simply describes an association relationship between related objects, indicating that three possible relationships exist. For example, A and / or B can represent: A exists alone, A and B exist simultaneously, and B exists alone. In addition, the character " / " in this document generally indicates that the related objects are in an "or" relationship.

[0148] Furthermore, although the steps of the methods of the present disclosure are depicted in a particular order in the drawings, this does not require or imply that the steps must be performed in this particular order, or that all illustrated steps must be performed to achieve desired results.

[0149] In some embodiments, certain steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps.

[0150] Based on the same inventive concept, the present disclosure also provides a network element anomaly detection device, as described in the following embodiments. Since the principle of solving the problem in the device embodiment is similar to that in the above method embodiment, the implementation of the device embodiment can refer to the implementation of the above method embodiment, and the repeated parts will not be repeated.

[0151] Figure 8 A schematic diagram of a network element anomaly detection device according to an embodiment of the present disclosure is shown. Figure 8 As shown, the network element anomaly detection device 800 includes:

[0152] A data acquisition module 802 is configured to acquire original KPI data groups corresponding to multiple key performance indicators (KPIs) of a network element, where each original KPI data group is three-dimensional data including a time dimension, a network element dimension, and a KPI dimension. The original KPI data in the original KPI data group represents the KPI of the network element in a first metric interval within each cycle in a first time period.

[0153] A data processing module 804 is configured to convert the original KPI data group into a target KPI data group by performing statistical analysis on multiple original KPI data in the original KPI data group, where the target KPI data group is two-dimensional data including a network element dimension and a KPI dimension, and the target KPI data in the target KPI data group is used to represent the statistical value of the second metric interval of the network element in each cycle in the first time period, wherein each cycle includes multiple second metric intervals, and the duration of the second metric interval is longer than the duration of the first metric interval;

[0154] The distance calculation module 806 is used to calculate the statistical value of the network element and the distance value between the statistical value and the mean value corresponding to the statistical value to obtain a distance value set of the network element;

[0155] A first detection module 808 is configured to perform quartile anomaly detection on a set of distance values of each network element to obtain the number of abnormal distance values of the network element;

[0156] A distance statistics module 810 is configured to obtain a total distance value of the network elements based on a set of distance values of the network elements;

[0157] The second detection module 812 is configured to determine whether a network element is abnormal based on the number of abnormal distance values and the total distance value corresponding to each network element.

[0158] In some embodiments, the first detection module 808 is specifically used to arrange all distance values in the distance value set of the network element from small to large, and then determine the first quartile Q1 and the third quartile Q3; calculate the interquartile range IQR based on the first quartile Q1 and the third quartile Q3; determine the distance threshold based on the first quartile Q1, the third quartile Q3, the interquartile range IQR and the minimum distance value in the distance value set of the network element; determine the number of abnormal distance values of the network element based on the distance value set of the network element and the distance threshold, where the abnormal distance is the distance value in the distance value set of the network element that is greater than the distance threshold.

[0159] In some embodiments, determining the distance threshold based on the first quartile Q1, the third quartile Q3, the interquartile range IQR, and the minimum distance value in the set of distance values of the network element includes determining the distance threshold by the following formula:

[0160] D t =Q3+Q1-D min

[0161] Among them, D t Denotes the distance threshold, D min Indicates the minimum distance value in the distance value set of the network element.

[0162] In some embodiments, the statistical value of the second metric interval includes one or more of the following types of statistical values:

[0163] Maximum value, minimum value, mean, ratio of standard deviation to sample number, kurtosis, skewness;

[0164] Among them, kurtosis is a statistic that measures the steepness of the distribution of all values in the population, and skewness is the symmetry of the distribution of the population values.

[0165] In some embodiments, the first time period is one week in length, the period is one day, the first measurement interval is one hour, and the second measurement interval is six hours.

[0166] In some embodiments, the distance calculation module 806 is configured to calculate the Manhattan distance between the statistical value of the network element and the mean value corresponding to the statistical value, and obtain a distance value set of the network element.

[0167] In some embodiments, the second detection module 812 is specifically used to determine the network element as a potential faulty network element when the number of abnormal distance values of the network element is greater than a preset number threshold and the total distance value is less than or equal to the preset distance threshold; determine the network element as a faulty network element when the number of abnormal distance values of the network element is greater than the preset number threshold and the total distance value is greater than the preset distance threshold; and send relevant information of the network element to manual review when the number of abnormal distance values of the network element is less than or equal to the preset number threshold and the total distance value is greater than the preset distance threshold.

[0168] The concepts of "first" and "second" mentioned in this disclosure are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0169] Regarding the network element anomaly detection device in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the network element anomaly detection method, and will not be elaborated here.

[0170] It should be noted that although several modules or units of the device for action execution are mentioned in the above detailed description, such division is not mandatory.

[0171] In fact, according to the embodiment of the present disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided into multiple modules or units to be embodied.

[0172] Some of the blocks shown in the accompanying drawings are functional entities that do not necessarily correspond to physically or logically independent entities. These functional entities may be implemented in software, in one or more hardware modules or integrated circuits, or in different networks and / or processor devices and / or microcontroller devices.

[0173] Refer to the following Figure 9 To describe the electronic device provided by the embodiment of the present disclosure. Figure 9 The electronic device 900 shown is merely an example and should not limit the functions and scope of use of the embodiments of the present disclosure.

[0174] Figure 9 FIG. 1 shows a schematic diagram of the architecture of an electronic device 900 provided by an embodiment of the present invention. Figure 9 As shown, the electronic device 900 includes but is not limited to: at least one processor 910 and at least one memory 920.

[0175] The memory 920 is used to store instructions.

[0176] In some embodiments, the memory 920 may include a readable medium in the form of a volatile storage unit, such as a random access memory unit (RAM) 9201 and / or a cache memory unit 9202 , and may further include a read-only memory unit (ROM) 9203 .

[0177] In some embodiments, the memory 920 may also include a program / utility 9204 having a set (at least one) of program modules 9205, such program modules 9205 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0178] In some embodiments, the memory 920 may store an operating system, which may be a real-time operating system (RTX), LINUX, UNIX, WINDOWS, or OS X.

[0179] In some embodiments, data may also be stored in the memory 920 .

[0180] As an example, the processor 910 may read data stored in the memory 920 . The data may be stored at the same storage address as the instruction, or the data may be stored at a different storage address than the instruction.

[0181] The processor 910 is configured to call instructions stored in the memory 920 to implement the steps described in the "Exemplary Method" section above according to various exemplary embodiments of the present disclosure. For example, the processor 910 may perform the following steps of the aforementioned method embodiment:

[0182] Obtaining original KPI data groups corresponding to multiple key performance indicators (KPIs) of the network element, where each original KPI data group is three-dimensional data including a time dimension, a network element dimension, and a KPI dimension, and the original KPI data in the original KPI data group is used to represent the KPI of the network element in a first metric interval in each cycle in a first time period;

[0183] By performing statistical analysis on multiple original KPI data in the original KPI data group, the original KPI data group is converted into a target KPI data group, where the target KPI data group is two-dimensional data including a network element dimension and a KPI dimension, and the target KPI data in the target KPI data group is used to represent a statistical value of a second metric interval of the network element in each cycle in the first time period, wherein each cycle includes multiple second metric intervals, and the duration of the second metric interval is greater than the duration of the first metric interval;

[0184] Calculate the statistical value of the network element and the distance value between the statistical value and the mean value corresponding to the statistical value to obtain a distance value set of the network element;

[0185] For each network element's distance value set, perform quartile anomaly detection to obtain the number of abnormal distance values of the network element;

[0186] Based on the distance value set of the network elements, the total distance value of the network elements is obtained by statistics;

[0187] The number of abnormal distance values and the total distance value corresponding to each network element are used to determine whether the network element is abnormal.

[0188] It should be noted that the processor 910 may be a general-purpose processor or a dedicated processor. The processor 910 may include one or more processing cores, and the processor 910 executes various functional applications and data processing by running instructions.

[0189] In some embodiments, the processor 910 may include a central processing unit (CPU) and / or a baseband processor.

[0190] In some embodiments, the processor 910 may determine an instruction according to the priority identifier and / or function category information carried in each control instruction.

[0191] In the present disclosure, the processor 910 and the memory 920 may be provided separately or integrated together.

[0192] As an example, the processor 910 and the memory 920 may be integrated on a single board or a system on chip (SOC).

[0193] like Figure 9 As shown, the electronic device 900 is implemented as a general-purpose computing device. The electronic device 900 may further include a bus 930 .

[0194] Bus 930 may represent one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, a processor, or a local bus using any of a variety of bus architectures.

[0195] The electronic device 900 may also communicate with one or more external devices 940 (e.g., a keyboard, a pointing device, a Bluetooth device, etc.), one or more devices that enable a user to interact with the electronic device 900, and / or any device that enables the electronic device 900 to communicate with one or more other computing devices (e.g., a router, a modem, etc.). Such communication may be performed through an input / output (I / O) interface 950.

[0196] Furthermore, the electronic device 900 can also communicate with one or more networks (eg, a local area network (LAN), a wide area network (WAN) and / or a public network, such as the Internet) through the network adapter 960 .

[0197] like Figure 9 As shown, the network adapter 960 communicates with other modules of the electronic device 900 via the bus 930 .

[0198] It should be understood that although not shown in the figures, other hardware and / or software modules may be used in conjunction with the electronic device 900, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0199] It is understood that the structure shown in the embodiment of the present disclosure does not constitute a specific limitation on the electronic device 900. In other embodiments of the present disclosure, the electronic device 900 may include Figure 9 More or fewer components may be shown, or some components may be combined or separated, or the components may be arranged differently. Figure 9 The components shown can be implemented in hardware, software, or a combination of software and hardware.

[0200] The present disclosure also provides a computer-readable storage medium having computer instructions stored thereon. When the computer instructions are executed by a processor, the network element anomaly detection method described in the above method embodiment is implemented.

[0201] The computer-readable storage medium in the embodiments of the present disclosure is a computer instruction that can be sent, propagated or transmitted for use by or in conjunction with an instruction execution system, apparatus or device.

[0202] As an example, computer readable storage media are non-volatile storage media.

[0203] In some embodiments, more specific examples of computer-readable storage media in the present disclosure may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, a USB flash drive, a mobile hard disk, or any suitable combination of the foregoing.

[0204] In the embodiments of the present disclosure, the computer-readable storage medium may include a data signal propagated in baseband or as part of a carrier wave, which carries computer instructions (readable program codes).

[0205] Such a propagated data signal may take any of a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof.

[0206] In some examples, computing instructions contained on a computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0207] The embodiments of the present disclosure further provide a computer program product, which stores instructions. When the instructions are executed by a computer, the computer implements the network element anomaly detection method described in the above method embodiment.

[0208] The above instructions may be program codes. In specific implementations, the program codes may be written in any combination of one or more programming languages.

[0209] Programming languages include object-oriented programming languages such as Java, C++, etc., and conventional procedural programming languages such as "C" or similar programming languages.

[0210] The program code may execute entirely on the user's computing device, partly on the user's computing device, as a stand-alone software package, partly on the user's computing device and partly on a remote computing device or entirely on the remote computing device or server.

[0211] Where a remote computing device is involved, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., through the Internet using an Internet service provider).

[0212] The embodiment of the present disclosure further provides a chip, comprising at least one processor and an interface;

[0213] An interface for providing program instructions or data to at least one processor;

[0214] At least one processor is used to execute program instructions to implement the network element anomaly detection method described in the above method embodiment.

[0215] In some embodiments, the chip may further include a memory for storing program instructions and data, and the memory may be located inside or outside the processor.

[0216] Those skilled in the art will appreciate that all or part of the steps for implementing the above embodiments may be implemented in the following forms, namely: a complete hardware implementation, a complete software implementation (including firmware, microcode, etc.), or an implementation combining hardware and software, which may be collectively referred to herein as a "circuit," "module," or "system."

[0217] Other embodiments of the disclosure will be apparent to those skilled in the art from consideration of the specification and practice of the invention disclosed herein.

[0218] This disclosure is intended to cover any variations, uses, or adaptations of the present disclosure that follow the general principles of the present disclosure and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered as exemplary only, with the true scope and spirit of the present disclosure being indicated by the appended claims.

Claims

1. A network element anomaly detection method, characterized in that: include: Obtaining original KPI data groups corresponding to multiple key performance indicators (KPIs) of the network element, where each original KPI data group is three-dimensional data including a time dimension, a network element dimension, and a KPI dimension, and the original KPI data in the original KPI data group is used to represent the KPI of the network element in a first metric interval in each cycle in a first time period; Converting the original KPI data group into a target KPI data group by performing statistical analysis on multiple original KPI data in the original KPI data group, where the target KPI data group is two-dimensional data including a network element dimension and a KPI dimension, and the target KPI data in the target KPI data group is used to represent a statistical value of a second metric interval of the network element in each cycle in the first time period, where each cycle includes multiple second metric intervals, and the duration of the second metric interval is greater than the duration of the first metric interval; Calculating a statistical value of a network element and a distance value between the statistical value and a mean value corresponding to the statistical value to obtain a distance value set of the network element; Perform quartile anomaly detection on the distance value set of each network element to obtain the number of abnormal distance values of the network element; Obtaining a total distance value of the network element based on the distance value set of the network element; Based on the number of abnormal distance values and the total distance value corresponding to each network element, it is determined whether the network element is abnormal.

2. The method according to claim 1, characterized in that For each network element's distance value set, perform quartile anomaly detection to obtain the number of abnormal distance values of the network element, including performing the following processing for each network element's distance value set: Arrange all distance values in the distance value set of the network element from small to large, and determine the first quartile Q1 and the third quartile Q3; Calculate the interquartile range (IQR) based on the first quartile Q1 and the third quartile Q3; Determine a distance threshold based on the first quartile Q1, the third quartile Q3, the interquartile range IQR, and a minimum distance value in a distance value set of the network element; Based on the distance value set of the network element and the distance threshold, the number of abnormal distance values of the network element is determined, where the abnormal distance is a distance value in the distance value set of the network element that is greater than the distance threshold.

3. The method according to claim 2, characterized in that Determining a distance threshold based on the first quartile Q1, the third quartile Q3, the interquartile range IQR, and a minimum distance value in a distance value set of the network element includes determining the distance threshold by using the following formula: D t =Q3+Q1-D min Among them, D t Denotes the distance threshold, D min Indicates the minimum distance value in the distance value set of the network element.

4. The method according to claim 1, wherein The statistical values of the second metric interval include one or more of the following types of statistical values: Maximum value, minimum value, mean, ratio of standard deviation to sample number, kurtosis, skewness; Among them, kurtosis is a statistic that measures the steepness of the distribution of all values in the population, and skewness is the symmetry of the distribution of the population values.

5. The method according to claim 1, wherein The multiple key performance indicators (KPIs) include one or more of the following KPIs: PDCP traffic, number of RRC connections, wireless initial connection success rate, number of S1 signaling connection establishment failures, number of RRC connection establishment failures, number of E-RAB establishment failures, number of UE context abnormal releases, UE context drop rate, number of E-RAB abnormal releases, E-RAB drop rate, RRC connection re-establishment ratio, number of RRC re-establishment requests, intra-frequency handover success rate, number of intra-frequency handover failures, inter-frequency handover success rate, number of inter-frequency handover failures, CQI good to good ratio, number of air interface uplink user plane packet losses, air interface uplink user plane packet loss rate, number of air interface downlink user plane packet losses, air interface downlink user plane packet loss rate.

6. The method according to claim 1, characterized in that The first time period is one week, the cycle is one day, the first measurement interval is one hour, and the second measurement interval is six hours.

7. The method according to claim 1, characterized in that Calculating a statistical value of a network element and a distance value between the statistical value and a mean value corresponding to the statistical value to obtain a distance value set of the network element, including: Calculate the Manhattan distance between the statistical value of the network element and the mean value corresponding to the statistical value to obtain a distance value set of the network element.

8. The method according to any one of claims 1 to 7, characterized in that: Based on the number of abnormal distance values and the total distance value corresponding to each network element, determine whether the network element is abnormal, including: If the number of abnormal distance values of the network element is greater than a preset number threshold and the total distance value is less than or equal to the preset distance threshold, the network element is determined as a potential faulty network element; If the number of abnormal distance values of the network element is greater than a preset number threshold and the total distance value is greater than a preset distance threshold, the network element is determined to be a faulty network element; When the number of abnormal distance values of the network element is less than or equal to the preset number threshold and the total distance value is greater than the preset distance threshold, the relevant information of the network element is sent to the manual review office.

9. A network element anomaly detection device, characterized in that: include: a data acquisition module, configured to acquire original KPI data groups corresponding to multiple key performance indicators (KPIs) of a network element, each original KPI data group being three-dimensional data including a time dimension, a network element dimension, and a KPI dimension, wherein the original KPI data in the original KPI data group represents the KPI of the network element in a first metric interval within each cycle in a first time period; a data processing module, configured to convert the original KPI data group into a target KPI data group by performing statistical analysis on multiple original KPI data in the original KPI data group, where the target KPI data group is two-dimensional data including a network element dimension and a KPI dimension, and the target KPI data in the target KPI data group is used to represent a statistical value of a second metric interval of the network element in each cycle in a first time period, where each cycle includes multiple second metric intervals, and the duration of the second metric interval is greater than the duration of the first metric interval; a distance calculation module, configured to calculate a statistical value of a network element and a distance value between the statistical value and a mean value corresponding to the statistical value, and obtain a distance value set of the network element; A first detection module is configured to perform quartile anomaly detection on a set of distance values of each network element to obtain the number of abnormal distance values of the network element; A distance statistics module, configured to obtain a total distance value of the network element based on the distance value set of the network element; The second detection module is used to determine whether the network element is abnormal based on the number of abnormal distance values and the total distance value corresponding to each network element.

10. An electronic device, characterized in that: include: a memory for storing instructions; The processor is configured to call the instructions stored in the memory to implement the network element anomaly detection method according to any one of claims 1 to 8.

11. A computer-readable storage medium having computer instructions stored thereon, characterized in that: When the computer instructions are executed by a processor, the network element anomaly detection method according to any one of claims 1 to 8 is implemented.

Images