Network anomaly management and control method based on intelligent operation and maintenance

Abstract

The present application belongs to the technical field of intelligent operation and maintenance, and in particular relates to a network anomaly control method based on intelligent operation and maintenance. First, key performance indicators in the network are collected and monitored, and a time window of data to be measured is determined through automatic log alarm based on threshold. An anomaly detection method based on ensemble learning is proposed, the anomaly degree score of KPI indicators is quantified, and a binary decision result of whether abnormal is obtained through analysis. Then, the data to be analyzed is reprocessed and possible root causes are designed, and an improved heuristic anomaly positioning algorithm is used to locate the final root cause of the anomaly in the network topology. Finally, a network anomaly control framework is designed based on anomaly detection and anomaly positioning. The framework can determine whether the network is abnormal using key performance indicators in the network, locate and confirm the root cause of the anomaly, and play a role in intelligent control of network anomalies.

Description

Technical Field

[0001] This invention belongs to the field of intelligent operation and maintenance technology, specifically relating to a network anomaly management method based on intelligent operation and maintenance. Background Technology

[0002] In recent years, the rapid development of computer science has brought about significant changes to various industries. More and more organizations across all sectors are realizing they are evolving into technology and data companies, making the integration of information technology with traditional industries increasingly important. Data-driven methods enable intelligent decision-making, improving industrial efficiency and reducing labor costs. Faced with the explosive growth of massive amounts of data and increasing demands, traditional network architectures and operation and maintenance models can no longer meet the requirements of the new network architectures of 5G+ and 6G mobile communication systems. More specifically, in fields such as IoT, cloud computing, and big data, the primary requirement is for networks to possess greater flexibility, agility, and scalability, while simultaneously addressing the challenges of real-time data monitoring and analysis.

[0003] Regarding the first requirement, Software Defined Networking (SDN), with its advantages of centralized management, component-based development, and clustered deployment, is highly adaptable and has become a widely used network architecture. As for the second point, traditional IT operations and maintenance (O&M) has undergone a long period of development and, with the integration of artificial intelligence (AI) technology, has entered the third stage: Artificial Intelligence for IT Operations (AIOps). This model uses monitoring data as input for AI learning, analyzes its characteristics in conjunction with real-world scenarios, and provides rapid and accurate results. Therefore, integrating SDN network architecture with AIOps technology can realize functions such as log alerting, anomaly detection, and anomaly localization within the SDN network.

[0004] In the field of intelligent operations and maintenance (O&M), anomaly detection aims to accurately determine whether anomalies exist. In SDN network environments, common key performance indicators (KPIs) collected and monitored by controllers include hardware infrastructure status, network throughput, bandwidth utilization, resource utilization, network latency, and packet loss rate. These KPIs are the most common data sources for anomaly detection. When KPIs exhibit abnormalities (such as sharp increases or decreases), they usually indicate anomalies in the entire system (such as abnormal traffic, network overload, or hardware failures).

[0005] Once anomaly detection confirms an anomaly in the entire system, how to locate the anomaly becomes another important issue in intelligent operations and maintenance (O&M). In SDN networks, anomaly location becomes particularly crucial for anomaly management. Quickly identifying the root cause of network failures facilitates the effective implementation of remedial measures. AIOps technology utilizes artificial intelligence algorithms and models, using information collected from the network as input for anomaly location. Through models and specific location algorithms, the final root cause is obtained. Therefore, anomaly detection and location based on the principles of intelligent O&M represents a new approach to network anomaly management. Summary of the Invention

[0006] The purpose of this invention is to collect and monitor key performance indicators in the network, log alarms on link bandwidth utilization based on thresholds, and when high-frequency alarms are present, select a time window to detect data for anomaly detection, determine whether there are abnormal binary results, and then perform subsequent anomaly localization to determine the ultimate root cause of the anomaly. This improves network stability and reliability while promoting the effective implementation of remedial measures and realizing intelligent management and control of network anomalies.

[0007] The technical solution of the network anomaly control method based on intelligent operation and maintenance of the present invention is as follows:

[0008] S1. Build a global view of the network topology, perform real-time performance monitoring of key performance indicators in the network infrastructure equipment carrying services, and periodically collect and store the KPI indicators of each link.

[0009] S2. Use a threshold-based log alarm method to automatically alarm the bandwidth utilization of the entire network link, and count the time period and frequency of alarm occurrences to determine the time window of the data to be tested.

[0010] S3. Define different anomaly types, determine the KPI indicators of the anomalies to be tested, select a time window, and use the generalized Bagging algorithm based on ensemble learning to make a binary judgment on whether it is an anomaly.

[0011] S4. Establish an anomaly localization model, determine the anomaly type, and use an improved heuristic anomaly localization algorithm to locate the anomaly based on the anomaly detection results, thereby obtaining the ultimate root cause of the anomaly.

[0012] Through the above-mentioned anomaly detection and anomaly localization, this invention can ensure the stability and reliability of the network system when facing different abnormal scenarios or unknown business scenarios, and even if anomalies are found and the root cause is identified, it can improve the efficiency of subsequent solutions.

[0013] Real-time performance monitoring is the foundation of automated log alerting. To implement a threshold-based log alerting method, this invention selects bandwidth utilization as the alerting criterion and determines the time window for the data to be tested by statistically analyzing the time periods and frequencies of alert occurrences. The specific steps are as follows:

[0014] S21. Utilize key performance indicators monitored in real time by the network system and print them in real time as operation and maintenance logs.

[0015] S22. After calculating the bandwidth utilization of the link through the control plane, log alarms of two levels, namely congestion and anomaly, can be generated based on the preset thresholds δ1 and δ2. When the maximum threshold alarm occurs frequently, more accurate anomaly detection is required.

[0016] Threshold-based link occupancy alerts:

[0017] S23. Based on the real-time bandwidth utilization of each link, generate threshold-based log alarms and record the alarm time and the frequency of alarms occurring on that link.

[0018] Network anomalies can be summarized as measurements that differ significantly from other measurements, or behaviors that do not conform to expectations. The goal of anomaly detection is to identify the presence of such objects in a data-driven manner, while anomaly localization requires determining the specific root cause of the problem after the anomaly occurs.

[0019] To measure and evaluate system or service performance, this invention selects key performance indicators (KPIs) as the raw data for anomaly control. By further processing and calculating the collected and stored data, KPIs reflecting different network status information are obtained. Then, a time window is determined, and anomaly detection is performed after preprocessing. The specific anomaly detection steps are as follows:

[0020] S31. Determine the key performance indicators of the network, including link rate, bandwidth utilization, latency, and packet loss rate, and calculate them as follows:

[0021] (1) Link speed:

[0022] Where, m Send and m Receive These represent the number of sent and received messages at the source port p, respectively. src and destination port p dst Increment within the same time interval T;

[0023] (2) Bandwidth utilization:

[0024] Wherein, parameter B represents the rated bandwidth of the link;

[0025] (3) Delay: LinkDelay = t d -t s

[0026] Wherein, parameter t d and t s These represent the time of arrival at the destination port and the time of departure from the source port, respectively.

[0027] (4) Packet loss rate:

[0028] Packet loss rate refers to the ratio of the number of packets not received at the destination port to the number of packets sent at the source port. The number of packets not received can be obtained by subtracting the number of packets sent from the number of packets received.

[0029] S32. Select individual learners for the generalized Bagging algorithm, including five traditional anomaly detection methods: K-Nearest Neighbors (KNN), Principal Component Analysis (PCA), One-Class Support Vector Machine (OC-SVM), Local Outlier Factor (LOF), and Empirical Cumulative Outlier Detection (ECOD), and two deep learning methods: Autoencoder (AE) and Deep Support Vector Data Description (DSVDD).

[0030] S33. Define the Anomaly Score (AS) as an indicator, representing the ratio of the algorithm's anomaly detection rate to the original anomaly rate. Theoretically, it should be distributed between 0 and 1, representing the output AS of each anomaly detection algorithm. i (x) should all be within the range of R(0,1). If it exceeds the upper limit of 1, it means that a misjudgment has occurred.

[0031] Anomaly score:

[0032] S34. Using a weighted voting method, evaluate the results h of the individual learners. i (x), including anomaly score, accuracy, etc., are used as inputs to the combination strategy to obtain a binary judgment result of whether it is anomaly.

[0033] After identifying an anomaly in the network, it is necessary to locate the anomaly using the anomaly localization framework and specific anomaly localization model. This determines the root cause of the anomaly. To invoke the localization algorithm, it is necessary to determine the KPI indicators and possible combinations of root causes, analyze the anomaly propagation type, and implement the localization model, as shown in the figure. The specific steps are as follows:

[0034] S41. Establish an anomaly localization model, define basic concepts, analyze anomaly propagation types, and determine key performance indicators and root cause selection.

[0035] S42. Design an anomaly localization framework and clarify the input information;

[0036] Anomaly location input: E i ={(real,predict,src_Id,src_Port,dst_Id,src_Port)}

[0037] Where real represents the KPI value actually collected by the system monitoring, predict represents the KPI prediction value obtained by the algorithm, src_Id and src_Port represent the source switch Id and its port number respectively, and dst_Id and dst_Port represent the destination switch Id and its port number respectively.

[0038] S43. By collecting and storing key performance indicators, and selecting a time window, an improved heuristic anomaly localization algorithm is invoked for anomaly localization. Specifically:

[0039] S431. The anomaly localization algorithm analyzes the root cause attributes based on the input, including: source switch Id, source port, destination switch Id, and destination port, and calculates the sum of the actual value and the predicted value of the KPI indicator.

[0040] S432. Generate a root cause candidate set based on different attribute combinations for the anomaly localization input;

[0041] S433. Evaluate the probability of all candidate sets and cluster the root cause sets that cause the same type of anomaly.

[0042] S4331. Calculate the influence score for each combination, using the following method:

[0043] Link speed:

[0044] In the formula, v(S) and f(S) are the actual and predicted KPI values ​​of the candidate set S, respectively, and their difference represents the change in KPI values. Based on the threshold, attribute combinations are filtered in advance.

[0045] S4332. Based on the influence scores, cluster the combinations with similar scores to obtain the anomalous clusters representing different root causes.

[0046] S4333. All outliers within each cluster are caused by the same reason, so we only need to select the root cause within each cluster.

[0047] S434. Intra-cluster localization is performed using an anomaly localization search scheme. A potential score is calculated for each combination, as follows:

[0048] Link speed:

[0049] In the formula, To calculate vectors The distance between them; the subscripts ab and n represent abnormal leaf combinations and normal leaf combinations respectively, and λ is a custom parameter to adjust the variable distance;

[0050] S435. Sort all results in descending order, and the attribute combination with the highest potential score is the final root cause.

[0051] The above method improves the latent score in traditional heuristic algorithms by optimizing the latent score calculation method and designing a search scheme based on influence scores. It optimizes the Euclidean distance into a variable self-defined distance to calculate new latent scores. The influence score search scheme is designed to make preliminary judgments on all attribute combinations. When the threshold is not met, the attribute combination will be filtered in advance, which can effectively reduce the search space and improve the localization efficiency. Based on the influence scores, combinations with similar scores are clustered to obtain anomaly clusters representing different root causes.

[0052] In summary, due to the adoption of the above technical solution, the beneficial effects of the present invention are:

[0053] (1) Identify key performance indicators in the network for real-time performance monitoring and enable log alerts based on link occupancy.

[0054] (2) By collecting and storing KPI indicators, a binary judgment is made on whether there are any abnormalities within a selected time window, which can be applied to different abnormal scenarios.

[0055] (3) Use an improved heuristic anomaly localization algorithm to quickly locate the root cause of the anomaly and achieve network anomaly control to a certain extent. Attached Figure Description

[0056] Figure 1 The experimental topology is shown in the example.

[0057] Figure 2 In this example, the controller log is based on bandwidth utilization alarms.

[0058] Figure 3 This is the anomaly detection and judgment process in the embodiment.

[0059] Figure 4 The example illustrates the process for anomaly localization.

[0060] Figure 5 In this embodiment, the accuracy of different anomaly detection algorithms is compared under different anomaly scenarios.

[0061] Figure 6 In this embodiment, the anomaly scores of three ensemble learning anomaly detection algorithms are compared in outlier scenarios.

[0062] Figure 7 In this example, the F1 scores of different anomaly localization algorithms are compared under various prediction biases in the dataset.

[0063] Figure 8 In this example, the F1 scores of different anomaly localization algorithms are compared on the derived metric dataset. Detailed Implementation

[0064] The present invention will now be described in further detail with reference to the embodiments and accompanying drawings.

[0065] Example

[0066] This embodiment selects ONOS as the network controller. An SDN network environment is simulated using Mininet (a network emulator composed of virtual network infrastructure connected by switches, routers, hosts, etc.). The Mininet topology remote connection controller generates, for example... Figure 1 The experimental topology is shown.

[0067] A total of 12 switches, 15 hosts, and 30 links were configured (15 unidirectional links, but this experiment requires bidirectional links, so a total of 30 links were used). The bandwidth, latency, and packet loss rate of each link were configured when creating a custom topology using Mininet. The rated bandwidth for each link was set to 100Mbps, the latency to within 20ms, and the packet loss rate to 0-2%.

[0068] The experiment used the iperf tool to simulate background traffic transmission. At the same time, according to different abnormal scenario requirements, the source host, destination host, bandwidth, and packet transmission time were freely defined using the iperf tool to construct different abnormal situations.

[0069] This embodiment uses common abnormal scenarios as examples. The specific scenario's service traffic is shown in the table below:

[0070] Table 1: Traffic Flow Table for Abnormal KPI Scenarios

[0071]

[0072]

[0073] Connect the ONOS controller to the created topology, and obtain link data from the topology through this SDN controller. Log alerts based on bandwidth utilization thresholds are also generated. Figure 2 As shown.

[0074] The process of anomaly detection and judgment based on key performance indicators of data acquisition and storage is as follows: Figure 3 As shown, the specific steps include:

[0075] S1. The fixed acquisition cycle is 5 seconds, and a total of 10,000 network link information entries are stored. The controller calculates the data according to the formula... Calculate real-time link bandwidth utilization;

[0076] S2. When the link occupancy rate (linkBandwidthUtilization) > δ2 threshold, a log alarm is issued. After abnormal log alarms are collected, and the number of alarms occurs frequently within a short period of time, data within the time period in which the abnormality occurs is selected for subsequent abnormal detection.

[0077] S3. Based on the designed ensemble learning method, call the generalized Bagging algorithm and perform anomaly detection on the stored data to be detected based on different individual learners (IF, KNN, PCA, OC-SVM, LOF, ECOD, DSVDD, AE).

[0078] S4. Each individual learner performs testing on the complete test data. After all rounds, each algorithm provides a judgment on whether there are any anomalies and calculates its anomaly score.

[0079] S5. Each individual anomaly detection algorithm will provide its judgment result h for this set of abnormal data. i (x) represents the statistical results of all anomaly detection algorithms. These results are then used as input to a combined strategy for the final integrated decision.

[0080] S6. Finally, according to the weighted voting method A binary determination result indicating whether an anomaly exists is obtained and passed to the controller for subsequent anomaly localization.

[0081] This embodiment provides an improved anomaly localization method in SDN networks, such as... Figure 4 As shown, it can specifically include the following steps:

[0082] S1. Construct cascaded and distributed faults. After the controller detects and confirms that an anomaly has occurred within a certain period of time, it collects and stores all the data within that period of time for anomaly localization.

[0083] S2. Select data collected in different time windows and segment them according to timestamps;

[0084] S3. Perform preprocessing, taking the derived metrics such as link rate, latency, jitter, and packet loss rate as the metric values ​​of the finest-grained attribute combination, and using them as the true values ​​of the corresponding attribute combination. Then, use the moving average algorithm to generate the predicted value of each attribute combination, and combine it with the switch ID and its port number as the input of the root cause analysis algorithm.

[0085] S4. Call the improved anomaly localization algorithm to determine the root cause, specifically:

[0086] S41. For all input combinations, calculate the sum of the actual and predicted values ​​of the KPI indicators;

[0087] S42. Generate a root cause candidate set based on different attribute combinations for the anomaly localization input;

[0088] S43. Evaluate the probability of all candidate sets and cluster the root cause sets that cause the same type of anomaly.

[0089] S44. Perform intra-cluster localization using an anomaly localization search scheme, and score the potential score for each combination;

[0090] S45. Calculate the anomaly score of the root cause candidate set within each cluster. If the score is below the threshold, skip the cluster and proceed to the next cluster. Finally, sort the potential scores of all clusters in descending order, and the attribute combination with the highest value is the final root cause.

[0091] Furthermore, the probability assessment and clustering described in S43 are carried out in the following specific process:

[0092] A. Calculate the impact score for each combination and filter attribute combinations in advance based on the threshold;

[0093] B. Based on the impact scores, cluster the combinations with similar scores to obtain the anomalous clusters representing different root causes;

[0094] C. Since the outliers in each cluster are caused by the same reason, we only need to select the root cause in each cluster.

[0095] To evaluate anomaly detection performance under different anomaly scenarios, this embodiment sets up three different anomaly scenarios: outlier anomalies, spatiotemporal anomalies, and drift point anomalies. To ensure data validity, each learner performs 10 rounds of detection for each anomaly category, and the average of the anomaly score and accuracy is used as the comprehensive decision input for the anomaly detection ensemble learning algorithm. In addition to the generalized Bagging algorithm designed in this paper, this invention also implements two ensemble learning anomaly detection algorithms as references: the traditional Bagging algorithm and the Isolation Forest algorithm. For each type of anomaly, individual learners from the traditional Bagging algorithm, the Isolation Forest algorithm, and the generalized Bagging algorithm designed in this paper are used for anomaly detection, and their accuracy is compared. The detection experimental results for the three types of anomaly scenarios are as follows: Figure 5 and Figure 6 As shown in the figure, the generalized Bagging algorithm implemented in this invention, compared to traditional ensemble learning algorithms, performs well when facing outlier anomalies because the data of outliers differs significantly from normal data. While almost all algorithms perform well in cases of spatiotemporal anomalies where the KPIs of the anomalies still fluctuate within the normal range, traditional anomaly detection algorithms cannot distinguish their characteristics, whereas the method of this invention can still identify the anomalies. Regarding reliability, because it adopts the idea of ​​ensemble learning and obtains a binary judgment result through weighted voting, it has a certain degree of noise resistance and performs well in different scenarios.

[0096] To evaluate the performance of the improved anomaly localization algorithm implemented in this invention under different fault propagation types, this example sets up two different fault propagation scenarios: cascading fault propagation and distributed fault propagation. This invention selects HotSpot, Adtributor, R-Adtributor, and iDice anomaly localization algorithms for F1 score comparison. Performance on public datasets is as follows: Figure 7 and Figure 8 As shown in the figure, the improved anomaly localization algorithm implemented in this invention still outperforms the traditional anomaly localization algorithm when faced with different prediction accuracy rates; at the same time, for derived metrics KPIs in actual business scenarios, it has a better F1 score under the self-defined distance potential score evaluation proposed in this invention.

[0097] In summary, this invention optimizes anomaly detection and anomaly localization from multiple aspects. In scenarios with different anomaly types, it can better identify different types of anomalies compared to traditional anomaly detection ensemble learning algorithms. Under different fault propagation types, it can more accurately and quickly determine the root cause of anomalies compared to traditional anomaly localization algorithms, effectively improving the intelligent management and control of network anomalies.

Claims

1. A network anomaly management method based on intelligent operation and maintenance, characterized in that, Includes the following steps: S1. Build a global view of the network topology, perform real-time performance monitoring of KPI indicators in the network infrastructure equipment carrying services, and periodically collect and store KPI indicators for each link; the KPI indicators include link rate, bandwidth utilization, latency and packet loss rate. S2. Using a threshold-based log alarm method, automatically alarm for the bandwidth utilization of the entire network links, and statistically analyze the time periods and frequencies of alarm occurrences to select the time window for the data to be tested; specifically: S21. For the KPI indicators monitored in S1 in real time, print them in real time through log information as operation and maintenance logs; S22. After calculating the bandwidth utilization of the link through the control plane, log alarms are generated for two levels: congestion and anomaly, based on the preset minimum threshold δ1 and maximum threshold δ2. Threshold-based link occupancy alerts: Wherein, normal means normal, crowded means congested, abnormal means abnormal, and utilization means the bandwidth utilization of the link; S23. Based on the real-time bandwidth utilization of each link, generate threshold-based log alarms and record the alarm time and the frequency of alarms occurring on that link. S3. Define different anomaly types, determine the KPI indicators for the anomalies to be tested, select a time window, and use the generalized Bagging algorithm based on ensemble learning to perform a binary judgment on whether an anomaly exists; specifically: S31. Determine the network's KPI indicators, calculated as follows: Link speed: Bandwidth utilization: Delay: LinkDelay = t d -t s Packet loss rate: Where, m Send and m Receive These represent the increments in the number of sent and received messages, respectively, via source port p. src and destination port p dst Obtained within the same time interval T; parameter B represents the rated bandwidth of the link, parameter t d and t s These represent the time of arrival at the destination port and the time of departure from the source port, respectively. S32. Select individual learners for the generalized Bagging algorithm, including 5 anomaly detection methods: K-nearest neighbor (KNN), principal component analysis, single-class support vector machine, local outlier factor, empirical cumulative distribution function (ECOD) and 2 deep learning methods: autoencoder and deep single-class anomaly detection model. S33. Define an anomaly score, representing the ratio of the algorithm's anomaly rate to the original anomaly rate. For each anomaly detection algorithm, the output AS is... i (x) should all be within the range of R(0,1). If it exceeds the upper limit of 1, it means that a misjudgment has occurred. S34. Statistically analyze the judgment results of all anomaly detection methods in the individual learner, and obtain a binary judgment result of whether an anomaly exists using the weighted voting method. S4. Establish an anomaly localization model, determine the anomaly type, and based on the anomaly detection results, use an improved heuristic anomaly localization algorithm to locate the anomaly and obtain the root cause of the anomaly. Specifically: S41. Establish a conceptual model for locating the root cause of anomalies, including attributes, elements, and leaves, and determine the KPI indicators and root cause selection. S42. Design an anomaly localization framework, specifying the input information as follows: Anomaly location input: E i ={(real,predict,src_Id,src_Port,dst_Id,src_Port)} Where real represents the KPI value actually collected by the system monitoring, predict represents the KPI prediction value obtained by the algorithm, src_Id and src_Port represent the source switch Id and its port number respectively, and dst_Id and dst_Port represent the destination switch Id and its port number respectively. S43. By collecting and storing key performance indicators, and selecting a time window, an improved heuristic anomaly localization algorithm is invoked for anomaly localization. Specifically: S431. The anomaly localization algorithm analyzes the root cause attributes based on the input, including: source switch Id, source port, destination switch Id, and destination port, and calculates the sum of the actual value and the predicted value of the KPI indicator. S432. Generate a root cause candidate set based on different attribute combinations for the anomaly localization input; S433. Evaluate the probability of all candidate sets and cluster the root causes that cause similar anomalies; the specific method is as follows: S4331. Calculate the influence score for each combination, using the following method: Link speed: In the formula, v(S) and f(S) are the actual and predicted KPI values ​​of the candidate set S, respectively, and their difference represents the change in KPI value; based on the threshold, attribute combinations are filtered in advance. S4332. Based on the influence scores, cluster the combinations with similar scores to obtain the anomalous clusters representing different root causes. S4333. The outliers in each cluster are caused by the same reason, so the root cause in each cluster is selected subsequently. S434. Intra-cluster localization is performed using an anomaly localization search scheme. A potential score is calculated for each combination, as follows: Link speed: In the formula, To calculate vectors The distance between them; the subscripts ab and n represent abnormal leaf combinations and normal leaf combinations respectively, and λ is a custom parameter to adjust the variable distance; S435. Sort all results in descending order, and the attribute combination with the highest potential score is the final root cause.

Images