A threshold configuration and constellation fault determination method, device, equipment and medium
By utilizing Markov chain prediction models and trend analysis methods in a three-dimensional elastic communication network, a fault history detection threshold baseline is generated, solving the challenges of threshold configuration and constellation fault judgment. This enables the identification of faults in single and multiple constellations, improving the comprehensiveness and accuracy of network security situational awareness.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- CHINA TELECOM DIGITAL INTELLIGENCE TECH CO LTD
- Filing Date
- 2023-07-28
- Publication Date
- 2026-06-26
AI Technical Summary
In a three-dimensional, flexible communication network integrating air, space, and ground, existing technologies struggle to effectively configure thresholds and diagnose constellation faults, leading to incomplete network security situational awareness information.
By acquiring a data set from the logs categorized by fault type, a Markov chain prediction model is used to train the detection threshold, generating a historical fault detection threshold baseline. Weighted averaging and trend analysis are then used to determine whether the threshold baseline has changed, ultimately determining whether the constellation is faulty.
It enables the identification of single and multiple constellation faults, dynamically configures threshold baselines, and improves the comprehensiveness and accuracy of network security situational awareness.
Smart Images
Figure CN116938696B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of space-ground integrated technology, and in particular to a threshold configuration and constellation fault judgment method, device, equipment and medium. Background Technology
[0002] In a three-dimensional, resilient communication network integrating air, space, and ground, real-time acquisition of various network operation status information from multiple channels and dimensions is performed. This multi-source, multi-dimensional information fusion triggers an OODA (Out-of-Home, Out-of-Home) dynamic cognitive loop, ultimately generating and executing decisions. Network security incident prediction primarily refers to using scientific theories, methods, and existing experience to judge and predict the development trend and severity of major security incidents discovered in the network system. It is a crucial stage of network security situation awareness, and its main objective is to predict network security incidents. Today's network systems have numerous services and continuously expanding network functions, resulting in an increasing number of security factors affecting network security. The complex interrelationships between these factors make it difficult to obtain comprehensive awareness information, a problem that needs to be addressed in the field of resilient communication networks. Currently, there are no solutions for threshold configuration and constellation fault diagnosis. Summary of the Invention
[0003] To address the aforementioned issues, this invention provides a threshold configuration and constellation fault judgment method, apparatus, device, and medium.
[0004] In a first aspect, embodiments of the present invention provide a threshold configuration and constellation fault judgment method, including:
[0005] Obtain all the detection threshold values set in the data set divided by fault type in the log, and generate the corresponding historical detection threshold baseline by weighted averaging of all the detection threshold values;
[0006] Predict the short-term fluctuation trend of the detection threshold baseline based on the data set categorized by fault type in the logs;
[0007] Predict the medium-term fluctuation trend of the detection threshold baseline based on the data set categorized by fault type in the log and the historical detection threshold baseline;
[0008] Based on the data set categorized by fault type in the log and the historical detection threshold baseline, predict the long-term fluctuation trend of the detection threshold baseline;
[0009] Determine whether the short-term threshold baseline should be changed based on the short-term fluctuation trend of the detection threshold baseline and the trend of short-term alarm quantity;
[0010] Determine whether the intermediate threshold baseline should be changed based on the intermediate fluctuation trend of the detection threshold baseline and the intermediate alarm number trend.
[0011] Determine whether the long-term threshold baseline should be changed based on the long-term fluctuation trend of the detection threshold baseline and the long-term alarm number trend.
[0012] Determine if the constellation is faulty based on the changed threshold baseline.
[0013] Furthermore, in the aforementioned threshold configuration and constellation fault judgment method, predicting the short-term fluctuation trend of the detection threshold baseline based on the data set categorized by fault type in the log includes:
[0014] A Markov chain prediction model is used to train a dataset in the logs divided by fault type. The probability of an anomaly occurring at the detection threshold at time T+1 is predicted using data at time T.
[0015] The formula for the Markov chain prediction model is X(k+1)=X(k)×P
[0016] Where X(k) represents the state vector of the trend analysis and prediction object at time t = k, P represents the one-step transition probability matrix, and X(k+1) represents the state vector of the trend analysis and prediction object at time t = k+1.
[0017] Furthermore, in the aforementioned threshold configuration and constellation fault judgment method, the prediction of the mid-term fluctuation trend of the detection threshold baseline based on the data set divided by fault type in the log and the historical detection threshold baseline includes:
[0018] The denominator is the N most recent N changes in the detection threshold set in the log, which are divided by fault type, plus the currently set value. The numerator is the N+1 changes in the historical detection threshold baseline. If the value is higher than the baseline, it is considered abnormal; otherwise, it is considered normal.
[0019] The probability of an anomaly occurring in the mid-term of the detection threshold baseline is determined based on the denominator and numerator.
[0020] Furthermore, in the aforementioned threshold configuration and constellation fault judgment method, the prediction of the long-term fluctuation trend of the detection threshold baseline based on the data set divided by fault type in the log and the historical detection threshold baseline includes:
[0021] The denominator is the sum of the most recent M changes in the detection threshold set set by fault type in the log, plus the currently set value, totaling M+1 changes. This sum is then compared with the historical detection threshold baseline. Values higher than the baseline are considered abnormal, while values lower are considered normal.
[0022] The probability of a long-term abnormality in the detection threshold baseline is determined based on the denominator and numerator.
[0023] Furthermore, in the aforementioned threshold configuration and constellation fault judgment method, determining whether the short-term threshold baseline has changed based on the short-term fluctuation trend of the detection threshold baseline and the short-term alarm quantity trend includes:
[0024] A linked analysis is performed on the trend changes of short-term anomaly probability and short-term alarm quantity of the detection threshold baseline to determine whether the short-term threshold baseline has changed.
[0025] Furthermore, in the aforementioned threshold configuration and constellation fault judgment method, determining whether the intermediate threshold baseline has changed based on the intermediate fluctuation trend of the detection threshold baseline and the intermediate alarm quantity trend includes:
[0026] A linked analysis is performed on the trend changes of the mid-term anomaly probability and the number of mid-term alarms to determine whether the mid-term threshold baseline has changed.
[0027] Furthermore, in the aforementioned threshold configuration and constellation fault judgment method, determining whether the long-term threshold baseline has changed based on the long-term fluctuation trend of the detection threshold baseline and the long-term alarm quantity trend includes:
[0028] A linked analysis is performed on the long-term abnormal probability of the detection threshold baseline and the trend of long-term alarm quantity to determine whether the long-term threshold baseline has changed.
[0029] Secondly, embodiments of the present invention also provide a threshold configuration and constellation fault judgment device, comprising:
[0030] The acquisition module and the generation module are used to acquire all the detection threshold values set in the data set divided by fault type in the log, and generate the historical detection threshold baseline for the corresponding fault type by weighted averaging of all detection threshold values.
[0031] The first prediction module is used to predict the short-term fluctuation trend of the detection threshold baseline based on the data set in the log divided by fault type.
[0032] The second prediction module is used to predict the medium-term fluctuation trend of the detection threshold baseline based on the data set divided by fault type in the log and the historical detection threshold baseline.
[0033] The third prediction module is used to predict the long-term fluctuation trend of the detection threshold baseline based on the data set divided by fault type in the log and the historical detection threshold baseline.
[0034] The first determination module is used to determine whether the short-term threshold baseline has changed based on the short-term fluctuation trend of the detection threshold baseline and the short-term alarm quantity trend.
[0035] The second determination module is used to determine whether the intermediate threshold baseline has changed based on the intermediate fluctuation trend of the detection threshold baseline and the trend of the intermediate alarm quantity.
[0036] The third determination module is used to determine whether the long-term threshold baseline has changed based on the long-term fluctuation trend of the detection threshold baseline and the long-term alarm quantity trend.
[0037] Judgment module: Used to determine whether the constellation is faulty based on the changed threshold baseline.
[0038] Thirdly, embodiments of the present invention also provide an electronic device, including: a processor and a memory;
[0039] The processor executes any of the threshold configuration and constellation fault judgment methods described above by calling the program or instructions stored in the memory.
[0040] Fourthly, embodiments of the present invention also provide a computer-readable storage medium storing a program or instructions that cause a computer to execute any of the threshold configuration and constellation fault judgment methods described above.
[0041] The advantages of this invention are as follows: This invention obtains all detection threshold values set in the log data set categorized by fault type, and generates a historical detection threshold baseline for the corresponding fault type by weighted averaging of all detection threshold values; it predicts the short-term fluctuation trend of the detection threshold baseline based on the log data set categorized by fault type; it predicts the medium-term fluctuation trend of the detection threshold baseline based on the log data set categorized by fault type and the historical detection threshold baseline; it predicts the long-term fluctuation trend of the detection threshold baseline based on the log data set categorized by fault type and the historical detection threshold baseline; it determines whether the short-term threshold baseline has changed based on the short-term fluctuation trend and the short-term alarm number trend; it determines whether the medium-term threshold baseline has changed based on the medium-term fluctuation trend and the medium-term alarm number trend; it determines whether the long-term threshold baseline has changed based on the long-term fluctuation trend and the long-term alarm number trend; and it determines whether the constellation is faulty based on the changed threshold baseline. This invention, through dynamic configuration of the threshold baseline, can identify not only single-satellite faults but also multi-satellite faults. Attached Figure Description
[0042] To more clearly illustrate the technical solutions in the embodiments of the present invention or the conventional technology, the drawings used in the description of the embodiments or the conventional technology will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0043] Figure 1 This is a schematic diagram of a threshold configuration and constellation fault judgment method provided in an embodiment of the present invention;
[0044] Figure 2 This is a schematic diagram of a threshold configuration and constellation fault judgment device provided in an embodiment of the present invention;
[0045] Figure 3 This is a schematic block diagram of an electronic device provided in an embodiment of this disclosure. Detailed Implementation
[0046] To make the above-mentioned objects, features, and advantages of the present invention more apparent and understandable, specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. Many specific details are set forth in the following description to provide a thorough understanding of the present invention. However, the present invention can be practiced in many other ways different from those described herein, and those skilled in the art can make similar modifications without departing from the spirit of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.
[0047] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains. The terminology used herein in the description of the invention is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. The term "and / or" as used herein includes any and all combinations of one or more of the associated listed items.
[0048] Figure 1 A schematic diagram of a threshold configuration and constellation fault judgment method provided in an embodiment of the present invention. Figure 1 .
[0049] In a first aspect, embodiments of the present invention provide a threshold configuration and constellation fault judgment method, combined with Figure 1 It includes eight steps, S101 to S108:
[0050] S101: Obtain all detection threshold values set in the data set divided by fault type in the log, and generate the corresponding fault historical detection threshold baseline by weighted averaging of all detection threshold values.
[0051] S102: Predict the short-term fluctuation trend of the detection threshold baseline based on the data set divided by fault type in the log.
[0052] Specifically, in this embodiment of the invention, the method for predicting the short-term fluctuation trend of the detection threshold baseline based on the data set divided by fault type in the log is described in detail below.
[0053] S103: Predict the mid-term fluctuation trend of the detection threshold baseline based on the data set divided by fault type in the log and the historical detection threshold baseline.
[0054] Specifically, in this embodiment of the invention, the method for predicting the medium-term fluctuation trend of the detection threshold baseline based on the data set divided by fault type in the log and the historical detection threshold baseline is described in detail below.
[0055] S104: Based on the data set divided by fault type in the log and the historical detection threshold baseline, predict the long-term fluctuation trend of the detection threshold baseline.
[0056] Specifically, in this embodiment of the invention, the method for predicting the long-term fluctuation trend of the detection threshold baseline based on the data set divided by fault type in the log and the historical detection threshold baseline is described in detail below.
[0057] S105: Determine whether the short-term threshold baseline should be changed based on the short-term fluctuation trend of the detection threshold baseline and the short-term alarm number trend.
[0058] Specifically, in this embodiment of the invention, the method for determining whether the short-term threshold baseline has changed based on the short-term fluctuation trend of the detection threshold baseline and the short-term alarm number trend is described in detail below.
[0059] S106: Determine whether the intermediate threshold baseline has been changed based on the intermediate fluctuation trend of the detection threshold baseline and the intermediate alarm number trend.
[0060] Specifically, in this embodiment of the invention, the method for determining whether the intermediate threshold baseline has changed based on the changes in the intermediate fluctuation trend of the detection threshold baseline and the intermediate alarm number trend is described in detail below.
[0061] S107: Determine whether the long-term threshold baseline has been changed based on the long-term fluctuation trend of the detection threshold baseline and the long-term alarm quantity trend.
[0062] Specifically, in this embodiment of the invention, the method for determining whether the long-term threshold baseline has changed based on the long-term fluctuation trend of the detection threshold baseline and the long-term alarm quantity trend is described in detail below.
[0063] S108: Determine if the constellation is faulty based on the changed threshold baseline.
[0064] Specifically, in this embodiment of the invention, if the distance between all subset solutions and the global solution is less than or equal to a threshold, i.e., the modified threshold baseline, then the currently visible satellite is considered to be fault-free; otherwise, a faulty satellite is considered to exist. This also demonstrates that it can identify not only single-satellite faults but also multi-satellite faults.
[0065] Furthermore, in the aforementioned threshold configuration and constellation fault judgment method, predicting the short-term fluctuation trend of the detection threshold baseline based on the data set categorized by fault type in the log includes:
[0066] A Markov chain prediction model is used to train a dataset in the logs divided by fault type. The probability of an anomaly occurring at the detection threshold at time T+1 is predicted using data at time T.
[0067] The formula for the Markov chain prediction model is X(k+1)=X(k)×P
[0068] Where X(k) represents the state vector of the trend analysis and prediction object at time t = k, P represents the one-step transition probability matrix, and X(k+1) represents the state vector of the trend analysis and prediction object at time t = k+1.
[0069] Specifically, for example, the following rectangular data analysis calculations yielded the following results.
[0070] The probability of detecting anomalies at the threshold in the previous time period is [0.3, 0.7].
[0071] The probability of an abnormal threshold transition to normal during the current time period is [0.6, 0.4].
[0072] The probability of a normal transition to an abnormal threshold during the current time period is [0.3, 0.7].
[0073] The probability of detecting anomalies in the threshold during the next time period:
[0074] 0.3 x 0.6 + 0.3 x 0.7 = 0.39
[0075] Probability of normal threshold detection in the next time period:
[0076] 0.3 x 0.4 + 7 x 0.7 = 0.61
[0077] Finally, the detection threshold probability for the next time period was 39% abnormal and 61% normal [0.39 0.61].
[0078] Furthermore, in the aforementioned threshold configuration and constellation fault judgment method, the prediction of the mid-term fluctuation trend of the detection threshold baseline based on the data set divided by fault type in the log and the historical detection threshold baseline includes:
[0079] The denominator is the N most recent N changes in the detection threshold set in the log, which are divided by fault type, plus the currently set value. The numerator is the N+1 changes in the historical detection threshold baseline. If the value is higher than the baseline, it is considered abnormal; otherwise, it is considered normal.
[0080] The probability of an anomaly occurring in the mid-term of the detection threshold baseline is determined based on the denominator and numerator.
[0081] Specifically, for example, N is set to 9. The denominator is the sum of the nine most recent changes in the detection threshold set (divided by fault type) in the log data set, plus the currently set value, totaling ten values. This sum is then compared with the historical detection threshold baseline. Values above the baseline are considered abnormal, while values below are considered normal. The numerator is the probability of an abnormality occurring in the middle of the detection threshold baseline, based on the denominator and numerator.
[0082] Furthermore, in the aforementioned threshold configuration and constellation fault judgment method, the prediction of the long-term fluctuation trend of the detection threshold baseline based on the data set divided by fault type in the log and the historical detection threshold baseline includes:
[0083] The denominator is the M+1 times that the most recent detection thresholds in the log set divided by fault type have changed, plus the currently set value. The numerator is the value that has changed the most recent M detection thresholds. The values that are higher than the baseline are judged as abnormal, and the values that are lower than the baseline are normal.
[0084] The probability of a long-term abnormality in the detection threshold baseline is determined based on the denominator and numerator.
[0085] Specifically, in this embodiment of the invention, M is greater than N, and for example, M is 99. The denominator is the sum of the 99 most recent changes in the detection threshold set in the data set divided by fault type in the log, plus the currently set value, totaling one hundred times. This is then compared one by one with the historical detection threshold baseline. Values higher than the baseline are judged as abnormal, while those lower are normal. The numerator is the probability of the detection threshold baseline being abnormal over a long period, determined based on the denominator and numerator.
[0086] Furthermore, in the aforementioned threshold configuration and constellation fault judgment method, determining whether the short-term threshold baseline has changed based on the short-term fluctuation trend of the detection threshold baseline and the short-term alarm quantity trend includes:
[0087] A linked analysis is performed on the trend changes of short-term anomaly probability and short-term alarm quantity of the detection threshold baseline to determine whether the short-term threshold baseline has changed.
[0088] Specifically, in this embodiment of the invention, if the short-term anomaly probability of the detection threshold baseline is 50%, the short-term alarm number trend changes from 10 to 15, and the alarm trend is rising, then the short-term threshold baseline is determined to remain unchanged.
[0089] Furthermore, in the aforementioned threshold configuration and constellation fault judgment method, determining whether the intermediate threshold baseline has changed based on the intermediate fluctuation trend of the detection threshold baseline and the intermediate alarm quantity trend includes:
[0090] A linked analysis is performed on the trend changes of the mid-term anomaly probability and the number of mid-term alarms to determine whether the mid-term threshold baseline has changed.
[0091] Specifically, in this embodiment of the invention, if the probability of anomaly in the mid-term detection threshold baseline is 40%, and the trend of the number of mid-term alarms changes from 25 to 15, and the alarm trend decreases, then the mid-term threshold baseline is adjusted downward.
[0092] Furthermore, in the aforementioned threshold configuration and constellation fault judgment method, determining whether the long-term threshold baseline has changed based on the long-term fluctuation trend of the detection threshold baseline and the long-term alarm quantity trend includes:
[0093] A linked analysis is performed on the long-term abnormal probability of the detection threshold baseline and the trend of long-term alarm quantity to determine whether the long-term threshold baseline has changed.
[0094] Specifically, in this embodiment of the invention, if the long-term abnormality probability of the detection threshold baseline is 30%, and the long-term alarm number trend changes from 35 to 55, indicating an upward trend in alarms, then the long-term threshold baseline is adjusted upward.
[0095] Figure 2 This is a schematic diagram of a threshold configuration and constellation fault judgment device provided in an embodiment of the present invention.
[0096] Secondly, embodiments of the present invention also provide a threshold configuration and constellation fault judgment device, combined with Figure 2 ,include:
[0097] The acquisition module 201 and the generation module 202 are used to acquire all the detection threshold values set in the data set divided by fault type in the log, and generate the corresponding type of fault historical detection threshold baseline by weighted averaging of all detection threshold values.
[0098] Specifically, in this embodiment of the invention, the acquisition module 201 is used to acquire all the detection threshold values set in the data set divided by fault type in the log, and the generation module 202 generates the corresponding type of fault historical detection threshold baseline by performing a weighted average of all the detection threshold values.
[0099] First prediction module 203: used to predict the short-term fluctuation trend of the detection threshold baseline based on the data set divided by fault type in the log.
[0100] Specifically, in this embodiment of the invention, the method by which the first prediction module 203 predicts the short-term fluctuation trend of the detection threshold baseline based on the data set divided by fault type in the log has been described in detail above.
[0101] The second prediction module 204 is used to predict the medium-term fluctuation trend of the detection threshold baseline based on the data set divided by fault type in the log and the historical detection threshold baseline.
[0102] Specifically, in this embodiment of the invention, the method for the second prediction module 204 to predict the mid-term fluctuation trend of the detection threshold baseline based on the data set divided by fault type in the log and the historical detection threshold baseline has been described in detail above.
[0103] The third prediction module 205 is used to predict the long-term fluctuation trend of the detection threshold baseline based on the data set divided by fault type in the log and the historical detection threshold baseline.
[0104] Specifically, in this embodiment of the invention, the method by which the third prediction module 205 predicts the long-term fluctuation trend of the detection threshold baseline based on the data set divided by fault type in the log and the historical detection threshold baseline has been described in detail above.
[0105] First determination module 206: used to determine whether the short-term threshold baseline has changed based on the short-term fluctuation trend of the detection threshold baseline and the short-term alarm number trend.
[0106] Specifically, in this embodiment of the invention, the method for determining whether the short-term threshold baseline has changed based on the short-term fluctuation trend of the detection threshold baseline and the short-term alarm number trend has been described in detail above.
[0107] The second determination module 207 is used to determine whether the intermediate threshold baseline has changed based on the intermediate fluctuation trend of the detection threshold baseline and the intermediate alarm number trend.
[0108] Specifically, in this embodiment of the invention, the method for determining whether the intermediate threshold baseline has changed based on the intermediate fluctuation trend of the detection threshold baseline and the intermediate alarm number trend has been described in detail above.
[0109] The third determination module 208 is used to determine whether the long-term threshold baseline has changed based on the long-term fluctuation trend of the detection threshold baseline and the long-term alarm quantity trend.
[0110] Specifically, in this embodiment of the invention, the method for the third determining module 208 to determine whether the long-term threshold baseline has changed based on the long-term fluctuation trend of the detection threshold baseline and the long-term alarm quantity trend has been described in detail above.
[0111] Judgment module 209: Used to determine whether the constellation is faulty based on the changed threshold baseline.
[0112] Specifically, in this embodiment of the invention, the judgment module determines whether there is a fault in the currently visible satellite by measuring the distance between all subset solutions and the global solution and the size of the changed threshold baseline. It can be seen that it can not only identify single satellite faults, but also multiple satellite faults.
[0113] Thirdly, embodiments of the present invention also provide an electronic device, including: a processor and a memory;
[0114] The processor executes any of the threshold configuration and constellation fault judgment methods described above by calling the program or instructions stored in the memory.
[0115] Fourthly, embodiments of the present invention also provide a computer-readable storage medium storing a program or instructions that cause a computer to execute any of the threshold configuration and constellation fault judgment methods described above.
[0116] Figure 3 This is a schematic block diagram of an electronic device provided in an embodiment of this disclosure.
[0117] like Figure 3 As shown, the electronic device includes at least one processor 301, at least one memory 302, and at least one communication interface 303. The various components of the electronic device are coupled together via a bus system 304. The communication interface 303 is used for information transmission with external devices. It is understood that the bus system 304 is used to implement communication between these components. In addition to a data bus, the bus system 304 also includes a power bus, a control bus, and a status signal bus. However, for clarity, ... Figure 3 The general designated all buses as Bus System 304.
[0118] It is understood that the memory 302 in this embodiment may be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory.
[0119] In some implementations, memory 302 stores elements such as executable units or data structures, or subsets thereof, or extended sets thereof: operating systems and applications.
[0120] The operating system includes various system programs, such as the framework layer, core library layer, and driver layer, used to implement various basic business functions and handle hardware-based tasks. The application programs include various applications, such as media players and browsers, used to implement various application functions. A program implementing any method in the threshold configuration and constellation fault judgment method provided in this embodiment of the invention can be included in the application programs.
[0121] In this embodiment of the invention, the processor 301 executes the steps of various embodiments of the threshold configuration and constellation fault judgment method provided in this embodiment of the invention by calling the program or instructions stored in the memory 302, specifically, the program or instructions stored in the application program.
[0122] In a first aspect, embodiments of the present invention provide a threshold configuration and constellation fault judgment method, including:
[0123] Obtain all the detection threshold values set in the data set divided by fault type in the log, and generate the corresponding historical detection threshold baseline by weighted averaging of all the detection threshold values;
[0124] Predict the short-term fluctuation trend of the detection threshold baseline based on the data set categorized by fault type in the logs;
[0125] Predict the medium-term fluctuation trend of the detection threshold baseline based on the data set categorized by fault type in the log and the historical detection threshold baseline;
[0126] Based on the data set categorized by fault type in the log and the historical detection threshold baseline, predict the long-term fluctuation trend of the detection threshold baseline;
[0127] Determine whether the short-term threshold baseline should be changed based on the short-term fluctuation trend of the detection threshold baseline and the trend of short-term alarm quantity;
[0128] Determine whether the intermediate threshold baseline should be changed based on the intermediate fluctuation trend of the detection threshold baseline and the intermediate alarm number trend.
[0129] Determine whether the long-term threshold baseline should be changed based on the long-term fluctuation trend of the detection threshold baseline and the long-term alarm number trend.
[0130] Determine if the constellation is faulty based on the changed threshold baseline.
[0131] Any of the methods in the threshold configuration and constellation fault judgment method provided in this embodiment of the invention can be applied to, or implemented by, the processor 301. The processor 301 can be an integrated circuit chip with signal capabilities. During implementation, each step of the above method can be completed by the integrated logic circuits in the hardware of the processor 301 or by instructions in software form. The processor 301 can be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. The general-purpose processor can be a microprocessor or any conventional device.
[0132] The steps of any method in the threshold configuration and constellation fault judgment method provided in this embodiment of the invention can be directly implemented by a hardware decoding processor, or implemented by a combination of hardware and software units in the decoding processor. The software units can be located in random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other mature storage media in the art. This storage medium is located in memory 302. The processor 301 reads the information in memory 302 and, in conjunction with its hardware, completes the steps of the threshold configuration and constellation fault judgment method.
[0133] Those skilled in the art will understand that although some embodiments described herein include certain features included in other embodiments but not others, combinations of features from different embodiments are meant to be within the scope of the invention and form different embodiments.
[0134] Those skilled in the art will understand that the descriptions of the various embodiments have different focuses, and for parts not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.
[0135] The above are merely specific embodiments of the present invention, but the scope of protection of the present invention is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in the present invention, and these modifications or substitutions should all be covered within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.
Claims
1. A threshold configuration and constellation fault judgment method, characterized in that, include: Obtain all the detection threshold values set in the data set divided by fault type in the log, and generate the corresponding historical detection threshold baseline by weighted averaging of all the detection threshold values; Predict the short-term fluctuation trend of the detection threshold baseline based on the data set categorized by fault type in the log; Based on the data set categorized by fault type in the log and the historical detection threshold baseline, predict the medium-term fluctuation trend of the detection threshold baseline; Based on the data set categorized by fault type in the log and the historical detection threshold baseline, predict the long-term fluctuation trend of the detection threshold baseline; Determine whether the short-term threshold baseline should be changed based on the short-term fluctuation trend of the detection threshold baseline and the trend of short-term alarm quantity; Determine whether the intermediate threshold baseline should be changed based on the intermediate fluctuation trend of the detection threshold baseline and the intermediate alarm number trend. Determine whether the long-term threshold baseline should be changed based on the long-term fluctuation trend of the detection threshold baseline and the long-term alarm number trend. Determine if the constellation is faulty based on the changed threshold baseline; The step of predicting the short-term fluctuation trend of the detection threshold baseline based on the data set divided by fault type in the log includes: A Markov chain prediction model is used to train a dataset in the logs divided by fault type. The probability of an anomaly occurring at the detection threshold at time T+1 is predicted using data at time T. The formula for the Markov chain prediction model is X(k+1) = X(k) × P Where X(k) represents the state vector of the trend analysis and prediction object at time t=k, P represents the one-step transition probability matrix, and X(k+1) represents the state vector of the trend analysis and prediction object at time t=k+1.
2. The threshold configuration and constellation fault judgment method according to claim 1, characterized in that, Based on the data set categorized by fault type in the logs and the historical detection threshold baseline, the predicted mid-term fluctuation trend of the detection threshold baseline includes: The denominator is the total number of N changes in the most recent N detection threshold values in the data set divided by fault type in the log, plus the currently set value. This total number of changes is used as the denominator. The denominator is then compared with the historical detection threshold baseline. Values higher than the baseline are considered abnormal, while values lower than the baseline are considered normal. The probability of an anomaly occurring in the mid-term of the detection threshold baseline is determined based on the denominator and numerator.
3. The threshold configuration and constellation fault judgment method according to claim 1, characterized in that, Based on the data set categorized by fault type in the logs and the historical detection threshold baseline, the long-term fluctuation trend of the detection threshold baseline is predicted, including: The denominator is the sum of the most recent M changes in the detection threshold set set by fault type in the log, plus the currently set value, totaling M+1 changes. This sum is then compared with the historical detection threshold baseline. Values higher than the baseline are considered abnormal, while values lower are considered normal. The probability of a long-term abnormality in the detection threshold baseline is determined based on the denominator and numerator.
4. The threshold configuration and constellation fault judgment method according to claim 1, characterized in that, The step of determining whether the short-term threshold baseline has changed based on the short-term fluctuation trend of the detection threshold baseline and the short-term alarm quantity trend includes: A linked analysis is performed on the trend changes of short-term anomaly probability and short-term alarm quantity of the detection threshold baseline to determine whether the short-term threshold baseline has changed.
5. The threshold configuration and constellation fault judgment method according to claim 1, characterized in that, The step of determining whether the intermediate threshold baseline has changed based on the intermediate fluctuation trend of the detection threshold baseline and the intermediate alarm quantity trend includes: A linked analysis is performed on the trend changes of the mid-term anomaly probability and the number of mid-term alarms to determine whether the mid-term threshold baseline has changed.
6. The threshold configuration and constellation fault judgment method according to claim 1, characterized in that, The step of determining whether the long-term threshold baseline has changed based on the long-term fluctuation trend of the detection threshold baseline and the long-term alarm quantity trend includes: A linked analysis is performed on the long-term abnormal probability of the detection threshold baseline and the trend of long-term alarm quantity to determine whether the long-term threshold baseline has changed.
7. A threshold configuration and constellation fault judgment device, characterized in that, include: The acquisition module and the generation module are used to acquire all the detection threshold values set in the data set divided by fault type in the log, and generate the corresponding type of fault historical detection threshold baseline by weighted averaging of all the detection threshold values. First prediction module: used to predict the short-term fluctuation trend of the detection threshold baseline based on the data set divided by fault type in the log; The second prediction module is used to predict the medium-term fluctuation trend of the detection threshold baseline based on the data set divided by fault type in the log and the historical detection threshold baseline. The third prediction module is used to predict the long-term fluctuation trend of the detection threshold baseline based on the data set divided by fault type in the log and the historical detection threshold baseline. The first determination module is used to determine whether the short-term threshold baseline has changed based on the short-term fluctuation trend of the detection threshold baseline and the short-term alarm quantity trend. The second determination module is used to determine whether the intermediate threshold baseline has changed based on the intermediate fluctuation trend of the detection threshold baseline and the trend of the intermediate alarm quantity. The third determination module is used to determine whether the long-term threshold baseline has changed based on the long-term fluctuation trend of the detection threshold baseline and the long-term alarm quantity trend. Judgment module: Used to determine whether the constellation is faulty based on the changed threshold baseline; The step of predicting the short-term fluctuation trend of the detection threshold baseline based on the data set divided by fault type in the log includes: A Markov chain prediction model is used to train a dataset in the logs divided by fault type. The probability of an anomaly occurring at the detection threshold at time T+1 is predicted using data at time T. The formula for the Markov chain prediction model is X(k+1) = X(k) × P Where X(k) represents the state vector of the trend analysis and prediction object at time t=k, P represents the one-step transition probability matrix, and X(k+1) represents the state vector of the trend analysis and prediction object at time t=k+1.
8. An electronic device, characterized in that, include: Processor and memory; The processor executes a threshold configuration and constellation fault judgment method as described in any one of claims 1 to 6 by calling the program or instructions stored in the memory.
9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a program or instructions that cause a computer to execute a threshold configuration and constellation fault determination method as described in any one of claims 1 to 6.