Communication network anomaly detection method and apparatus

Abstract

The application discloses a communication network anomaly detection method and device. The method comprises the following steps: periodically collecting the running state parameters of a target communication network; determining a plurality of groups of historical running state parameters in a preset time period before each collection time, and inputting the historical running state parameters into a pre-trained network access rate prediction model to obtain a target network access rate. The network access rate prediction model extracts a plurality of time sequence features corresponding to the plurality of groups of historical running state parameters through an iterative dilated convolutional neural network, learns the correlation between the plurality of time sequence features through a multi-head attention mechanism, and predicts the target network access rate according to the correlation. The target network access rate is used as a safety threshold of the collection time, and whether the target communication network is abnormal is determined according to the comparison result of the first network access rate of the current collection time and the safety threshold. The application solves the technical problem that the network access rate safety threshold set by relying on artificial experience in the related art is difficult to accurately determine whether the network is abnormal.

Description

Technical Field

[0001] This application relates to the field of communication technology, and more specifically, to a method and apparatus for detecting anomalies in communication networks. Background Technology

[0002] The stability of communication networks has a significant impact on people's daily lives. To promptly detect network anomalies, routine network management involves periodically collecting call data over a specific period and calculating the network connection rate at the time of collection. A higher connection rate indicates a higher call success rate and a more normal network condition during that time period; conversely, a lower connection rate indicates a lower call success rate and potential network anomalies.

[0003] Therefore, a network connectivity safety threshold can be set for automated monitoring of communication network quality. When the network connectivity rate falls below the safety threshold, the system will dispatch a task to on-duty personnel for handling. Setting the safety threshold too high will make the system overly sensitive to network stability, resulting in wasted manpower and dispatching tasks even with slight fluctuations in the connectivity rate; setting it too low will prevent the timely detection of network anomalies, leading to delays in troubleshooting. Setting a reasonable network connectivity safety threshold can improve network stability and reduce losses caused by network anomalies.

[0004] Traditional methods for setting network connection rate safety thresholds rely on manual experience and calculate thresholds according to certain rules, which cannot meet the needs of different scenarios. For example, a network monitoring system collects call records every minute to obtain the network connection rate at that collection point. When calculating the safety threshold, it calculates the network connection rate at the same time of day over the past 14 days, removes the two collection points with the lowest values, and takes the average of the remaining 12 collection points as the safety threshold for the current collection point. However, this approach uses a very short data time span, resulting in unstable calculations. When the network experiences a failure for a period of time, communication is easily affected. Furthermore, the calculation method uses an average value and does not consider the temporal dependencies of the data, making it difficult to predict future trends.

[0005] There is currently no effective solution to the above problems. Summary of the Invention

[0006] This application provides a communication network anomaly detection method and apparatus to at least solve the technical problem in related technologies that it is difficult to accurately determine whether a network is abnormal by relying on the network connectivity safety threshold set by human experience.

[0007] According to one aspect of the embodiments of this application, a communication network anomaly detection method is provided, comprising: periodically collecting operating status parameters of a target communication network, wherein the operating status parameters include: network connectivity rate and auxiliary reference data, and the auxiliary reference data includes at least one of the following: collection time, network load rate, network fault level, and total number of calls; for each collection time, determining multiple sets of historical operating status parameters within a preset time period prior to the collection time, and inputting the multiple sets of historical operating status parameters into a pre-trained network connectivity rate prediction model to obtain the target network connectivity rate output by the network connectivity rate prediction model, wherein the network connectivity rate prediction model is used to extract multiple temporal features corresponding to multiple sets of historical operating status parameters through an iterative dilated convolutional neural network, and to learn the correlation between multiple temporal features through a multi-head attention mechanism, and to predict the target network connectivity rate based on the correlation; using the target network connectivity rate as a safety threshold at the collection time, comparing the first network connectivity rate at the collection time with the safety threshold, and determining whether there is an anomaly in the target communication network based on the comparison result.

[0008] Optionally, the training process of the network connectivity prediction model includes: constructing an initial model, wherein the initial model includes at least an iterative dilated convolutional neural network layer, a multi-head attention layer, and an output layer; obtaining multiple sets of training samples and sample labels corresponding to each set of training samples, wherein each set of training samples includes: multiple sets of historical operating state parameters within a preset time period before a historical acquisition time, and the sample labels corresponding to the training samples include: the second network connectivity rate at the historical acquisition time; iteratively training the initial model using multiple sets of training samples and sample labels to obtain the network connectivity prediction model.

[0009] Optionally, an initial model is constructed, including: constructing an iterative dilated convolutional neural network layer, a multi-head attention layer, a multi-layer fully connected layer, and an output layer connected in sequence. The multi-layer fully connected layer is used to perform non-linear transformation on the high-dimensional features output by the multi-head attention layer, and the output layer includes a softmax network for predicting the network connectivity rate.

[0010] Optionally, the initial model is iteratively trained using multiple sets of training samples and sample labels, including: for each training batch, inputting each set of training samples in the training batch into the initial model in sequence to obtain multiple third network connectivity rates output by the initial model; constructing a mean squared error loss function based on the multiple third network connectivity rates and the second network connectivity rates in the sample labels corresponding to each set of training samples; and adjusting the model parameters of the initial model based on the mean squared error loss function through backpropagation to complete one round of iteration.

[0011] Optionally, when the number of iterations reaches a first preset threshold or the mean squared error loss function is less than a second preset threshold, the initial model training is considered complete, and a network connectivity prediction model is obtained.

[0012] Optionally, determining whether the target communication network is abnormal based on the comparison results includes: if the first network connection rate is less than a security threshold, determining that the target communication network is abnormal; if the first network connection rate is not less than a security threshold, determining that the target communication network is not abnormal.

[0013] Optionally, after determining that there is an anomaly in the target communication network, the method further includes: issuing a network anomaly alarm message; and / or generating a fault work order in the communication network management system, which is used by the communication network management system to arrange maintenance personnel to conduct anomaly checks on the target communication network based on the fault work order.

[0014] According to another aspect of the embodiments of this application, a communication network anomaly detection device is also provided, comprising: a collection module, used to periodically collect operating status parameters of a target communication network, wherein the operating status parameters include: network connectivity rate and auxiliary reference data, the auxiliary reference data including at least one of the following: collection time, network load rate, network fault level, and total number of calls; a determination module, used to determine, for each collection time, multiple sets of historical operating status parameters within a preset time period prior to the collection time, and input the multiple sets of historical operating status parameters into a pre-trained network connectivity rate prediction model to obtain the target network connectivity rate output by the network connectivity rate prediction model, wherein the network connectivity rate prediction model is used to extract multiple temporal features corresponding to multiple sets of historical operating status parameters through an iterative dilated convolutional neural network, and learn the correlation between multiple temporal features through a multi-head attention mechanism, and predict the target network connectivity rate based on the correlation; and an anomaly detection module, used to use the target network connectivity rate as a safety threshold at the collection time, compare the first network connectivity rate at the collection time with the safety threshold, and determine whether there is an anomaly in the target communication network based on the comparison result.

[0015] According to another aspect of the embodiments of this application, a non-volatile storage medium is also provided, the non-volatile storage medium including a stored computer program, wherein the device where the non-volatile storage medium is located executes the above-described communication network anomaly detection method by running the computer program.

[0016] According to another aspect of the embodiments of this application, an electronic device is also provided, the electronic device including: a memory and a processor, wherein the memory stores a computer program, and the processor is configured to execute the above-described communication network anomaly detection method through the computer program.

[0017] In this embodiment, the operating status parameters of the target communication network are periodically collected. These parameters include network connectivity rate and auxiliary reference data, which include at least one of the following: collection time, network load rate, network fault level, and total number of calls. For each collection time, multiple sets of historical operating status parameters within a preset time period prior to the collection time are determined, and these parameters are input into a pre-trained network connectivity rate prediction model to obtain the target network connectivity rate output by the model. The target network connectivity rate is used as a safety threshold at the collection time. The first network connectivity rate at the collection time is compared with the safety threshold, and the comparison result determines whether the target communication network is abnormal. This method utilizes historically accumulated network monitoring big data to predict the network connectivity rate safety threshold. By introducing an iterative dilated convolutional neural network, more historical data and network features can be utilized. The introduction of a multi-head attention mechanism improves the accuracy of prediction, effectively solving the technical problem in related technologies where relying on manually set network connectivity rate safety thresholds makes it difficult to accurately determine whether the network is abnormal. Attached Figure Description

[0018] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0019] Figure 1 This is a schematic diagram of the structure of an optional computer terminal according to an embodiment of this application;

[0020] Figure 2 This is a flowchart illustrating an optional communication network anomaly detection method according to an embodiment of this application;

[0021] Figure 3 This is a schematic diagram of the structure of an optional network connectivity prediction model according to an embodiment of this application;

[0022] Figure 4 This is a schematic diagram of an optional iterative dilated convolutional neural network layer according to an embodiment of this application;

[0023] Figure 5 This is a schematic diagram of an optional multi-head attention layer according to an embodiment of this application;

[0024] Figure 6 This is a schematic diagram of an optional multilayer fully connected layer according to an embodiment of this application;

[0025] Figure 7 This is a schematic diagram of an optional communication network anomaly detection device according to an embodiment of this application. Detailed Implementation

[0026] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0027] It should be noted that the terms "first," "second," etc., used in the specification, claims, and drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0028] To better understand the embodiments of this application, the following is a translation and explanation of some nouns or terms that appear in the description of the embodiments of this application:

[0029] Network connection rate: refers to the ratio of the total number of call calls answered within a specified time period to the total number of call calls received within the same time period.

[0030] Iterated Dilated Convolutional Neural Network (IDCNN): This is a deep learning model that increases the receptive field by applying dilated convolutions multiple times. It can be used for image processing and computer vision tasks.

[0031] Multi-head Self-attention (MSA) is a commonly used attention mechanism in natural language processing tasks. It improves the model's expressiveness and generalization ability by applying the attention mechanism to multiple independent attention heads and linearly transforming and concatenating their results.

[0032] Example 1

[0033] According to an embodiment of this application, a communication network anomaly detection method is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0034] The method embodiments provided in this application can be executed on a mobile terminal, computer terminal, or similar computing device. Figure 1 A hardware block diagram of a computer terminal (or mobile device) for implementing a communication network anomaly detection method is shown. Figure 1 As shown, the computer terminal 10 (or mobile device 10) may include one or more processors 102 (shown as 102a, 102b, ..., 102n in the figure) 102 (processor 102 may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.), a memory 104 for storing data, and a transmission device 106 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of a BUS bus), a network interface, a power supply, and / or a camera. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the aforementioned electronic device. For example, computer terminal 10 may also include... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0035] It should be noted that the aforementioned one or more processors 102 and / or other data processing circuits are generally referred to herein as "data processing circuits". These data processing circuits may be embodied, in whole or in part, in software, hardware, firmware, or any other combination thereof. Furthermore, the data processing circuits may be a single, independent processing module, or may be integrated, in whole or in part, into any other element within the computer terminal 10 (or mobile device). As involved in the embodiments of this application, the data processing circuits serve as a processor control mechanism (e.g., selection of a variable resistor termination path connected to an interface).

[0036] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the communication network anomaly detection method in this embodiment. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, thereby implementing the above-mentioned application vulnerability detection method. The memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the computer terminal 10 via a network. Examples of the above-mentioned networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0037] The transmission device 106 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by the communication provider of the computer terminal 10. In one example, the transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 106 may be a Radio Frequency (RF) module, used for wireless communication with the Internet.

[0038] The display can be, for example, a touchscreen liquid crystal display (LCD) that allows the user to interact with the user interface of the computer terminal 10 (or mobile device).

[0039] Under the above operating environment, embodiments of this application provide a method for detecting communication network anomalies, such as... Figure 2 As shown, the method includes the following steps:

[0040] Step S202: Periodically collect the operating status parameters of the target communication network. The operating status parameters include: network connection rate and auxiliary reference data. The auxiliary reference data includes at least one of the following: collection time, network load rate, network fault level, and total number of calls.

[0041] Step S204: For each acquisition time, determine multiple sets of historical operating state parameters within a preset time period before the acquisition time, and input the multiple sets of historical operating state parameters into the pre-trained network connectivity prediction model to obtain the target network connectivity rate output by the network connectivity prediction model. The network connectivity prediction model is used to extract multiple temporal features corresponding to multiple sets of historical operating state parameters through an iterative dilated convolutional neural network, and learn the correlation between multiple temporal features through a multi-head attention mechanism, and predict the target network connectivity rate based on the correlation.

[0042] Step S206: Use the target network connectivity rate as the safety threshold at the time of data collection, compare the first network connectivity rate at the time of data collection with the safety threshold, and determine whether there is an anomaly in the target communication network based on the comparison result.

[0043] The following describes each step of the communication network anomaly detection method according to the embodiments of this application, with reference to specific implementation processes.

[0044] To address the problem that traditional methods for setting network connectivity safety thresholds cannot accurately predict network connectivity rates, this application provides a network connectivity prediction model.

[0045] As an optional implementation, an initial model is first constructed, which includes at least an iterative dilated convolutional neural network layer, a multi-head attention layer, and an output layer. Multiple sets of training samples and corresponding sample labels for each set of training samples are obtained. Each set of training samples includes multiple sets of historical operating state parameters within a preset time period before a historical acquisition time. The sample labels corresponding to the training samples include the second network connectivity rate at the historical acquisition time. The initial model is iteratively trained using multiple sets of training samples and sample labels to obtain a network connectivity rate prediction model.

[0046] Considering that traditional methods use a single data type, only the actual network connection rate at the recent sampling time point, without taking into account other influencing factors such as network load rate, it is impossible to accurately predict the future trend of network connection rate. The embodiments of this application add auxiliary reference data to the network connection rate. This data includes: collection time, network load rate, network fault level, and total number of calls. The operating status parameters of the target communication network of the network connection rate and auxiliary reference data are periodically collected and used as input data for the initial model of network connection rate prediction.

[0047] In order to more accurately detect anomalies in the target communication network, the latest operating status parameters of the network can be collected every minute to obtain the latest operating status of the network in a timely manner.

[0048] Among them, the network connection rate is the combination of the actual connection rate of the total number of calls at the current collection time. The network fault level can be identified by numbers 0 to 3, where 0 indicates no fault, 1 indicates a minor fault, 2 indicates a medium fault, and 3 indicates a major fault.

[0049] It should be noted that the preset time period can be set to 365 days. Specifically, the running status parameters of all collected samples of the target communication network from the current moment to the previous 365 days can be used as the features of the training samples, that is, as the input data of the initial model.

[0050] The specific process of building the initial model is as follows: constructing an iterative dilated convolutional neural network layer, a multi-head attention layer, a multi-layer fully connected layer, and an output layer connected in sequence. The multi-layer fully connected layer is used to perform nonlinear transformation on the high-dimensional features output by the multi-head attention layer, and the output layer includes a softmax network to predict the network connectivity rate.

[0051] Since network connectivity is a time-varying metric, and the IDCNN network maintains nearly constant performance while extracting long-range temporal features and boasts fast parallel computation speed, the dilated convolutional neural network layer uses the IDCNN network to extract temporal features from historical operating parameters. The IDCNN network structure is as follows: Figure 4 As shown, specifically, the IDCNN network mainly increases the receptive field of view by iterating through multiple dilated convolutions and utilizing the characteristics of the dilation factor in the dilated convolution, without adding any additional parameters, and finally outputs the temporal features corresponding to the historical running parameters.

[0052] Given the periodicity and burstiness of network connection rates, the influence weight of historical features on the current input varies at different time intervals. Therefore, after extracting temporal features using IDCNN, the influence of inputs at different times on the current time is learned through the multi-head attention mechanism in the multi-head attention layer. Figure 5 The diagram illustrates the specific structure of a multi-head attention model. A multi-head attention model can be viewed as establishing the interaction relationships, or weight influences, between different components of the input vector within a linear projection space. Multi-head attention involves establishing different projection information in multiple different projection spaces. By projecting the input matrix into various ways and obtaining numerous output matrices, these matrices are concatenated, allowing the model to understand the input sequence from different perspectives. Therefore, by inputting the temporal features corresponding to the historical operating parameters output by the dilated convolutional neural network layer into the multi-head attention layer, the multi-head attention layer can output features that fuse attention weights from multiple perspectives.

[0053] Subsequently, two fully connected layers (1024-dimensional and 128-dimensional) are used to perform a nonlinear transformation on the high-dimensional vector features of the multi-head attention layer output, which fuses attention weights from multiple angles, to further extract global features. Finally, a softmax prediction layer is used to predict the network connectivity. A schematic diagram of the multi-layer fully connected layer structure is shown below. Figure 6 As shown.

[0054] When iteratively training the initial model using multiple sets of training samples and sample labels, for each training batch, the training samples from each batch are sequentially input into the initial model to obtain multiple third network connectivity rates output by the initial model. A mean squared error loss function is constructed based on these multiple third network connectivity rates and the second network connectivity rates in the sample labels corresponding to each set of training samples. The model parameters of the initial model are adjusted according to the mean squared error loss function through backpropagation to complete one iteration. The specific formula for the mean squared error loss function is as follows: n represents the number of training samples in each training batch during iterative training, and y represents the actual second network connectivity rate in the training samples. This represents the model's predicted value.

[0055] Optionally, when the number of iterations reaches a first preset threshold or the mean squared error loss function is less than a second preset threshold, the initial model training is considered complete, and a network connectivity prediction model is obtained.

[0056] Figure 3 A schematic diagram of the structure of a network connectivity prediction model according to an embodiment of this application is shown.

[0057] After obtaining the network connectivity prediction model, the operating status parameters of all collected samples of the target communication network from the current time to the previous 365 days are used as input data and re-inputted into the prediction model. The predicted value of the network connectivity at the current time output by the model is used as the safety threshold at the time of collection.

[0058] Based on the comparison results, determine whether there is an anomaly in the target communication network. If the first network connection rate is less than the safety threshold, determine that the target communication network is anomaly; if the first network connection rate is not less than the safety threshold, determine that the target communication network is not anomaly.

[0059] Optionally, after determining that there is an anomaly in the target communication network, a network anomaly alarm message is issued.

[0060] Optionally, a fault work order can be generated in the communication network management system, which can then arrange maintenance personnel to perform anomaly checks on the target communication network based on the fault work order.

[0061] In this embodiment, the operating status parameters of the target communication network are periodically collected. These parameters include network connectivity rate and auxiliary reference data, which include at least one of the following: collection time, network load rate, network fault level, and total number of calls. For each collection time, multiple sets of historical operating status parameters within a preset time period prior to the collection time are determined, and these parameters are input into a pre-trained network connectivity rate prediction model to obtain the target network connectivity rate output by the model. The target network connectivity rate is used as a safety threshold at the collection time. The first network connectivity rate at the collection time is compared with the safety threshold, and the comparison result determines whether the target communication network is abnormal. This method utilizes historically accumulated network monitoring big data to predict the network connectivity rate safety threshold. By introducing an iterative dilated convolutional neural network, more historical data and network features can be utilized. The introduction of a multi-head attention mechanism improves the accuracy of prediction, effectively solving the technical problem in related technologies where relying on manually set network connectivity rate safety thresholds makes it difficult to accurately determine whether the network is abnormal.

[0062] Example 2

[0063] According to an embodiment of this application, a communication network anomaly detection device for implementing the communication network anomaly detection method in Embodiment 1 is also provided, such as... Figure 7 As shown, the communication network anomaly detection device includes at least a data acquisition module 71, a determination module 72, and an anomaly detection module 73, wherein:

[0064] The acquisition module 71 is used to periodically acquire the operating status parameters of the target communication network. The operating status parameters include network connection rate and auxiliary reference data. The auxiliary reference data includes at least one of the following: acquisition time, network load rate, network fault level, and total number of calls.

[0065] The determination module 72 is used to determine multiple sets of historical operating state parameters within a preset time period before each acquisition time, and input the multiple sets of historical operating state parameters into a pre-trained network connectivity prediction model to obtain the target network connectivity rate output by the network connectivity prediction model. The network connectivity prediction model is used to extract multiple temporal features corresponding to multiple sets of historical operating state parameters through an iterative dilated convolutional neural network, and learn the correlation between multiple temporal features through a multi-head attention mechanism, and predict the target network connectivity rate based on the correlation.

[0066] The anomaly detection module 73 is used to use the target network connectivity rate as a safety threshold at the time of data collection, compare the first network connectivity rate at the time of data collection with the safety threshold, and determine whether there is an anomaly in the target communication network based on the comparison result.

[0067] As an optional implementation, the determination module first constructs an initial model, which includes at least an iterative dilated convolutional neural network layer, a multi-head attention layer, and an output layer; it obtains multiple sets of training samples and corresponding sample labels for each set of training samples, wherein each set of training samples includes: multiple sets of historical operating state parameters within a preset time period before a historical acquisition time, and the sample labels corresponding to the training samples include: the second network connectivity rate at the historical acquisition time; iteratively trains the initial model using multiple sets of training samples and sample labels to obtain a network connectivity rate prediction model.

[0068] Considering that traditional methods use a single data type, only the actual network connection rate at the recent sampling time point, without taking into account other influencing factors such as network load rate, it is impossible to accurately predict the future trend of network connection rate. The embodiments of this application add auxiliary reference data to the network connection rate. This data includes: collection time, network load rate, network fault level, and total number of calls. The operating status parameters of the target communication network of the network connection rate and auxiliary reference data are periodically collected and used as input data for the initial model of network connection rate prediction.

[0069] In order to more accurately detect anomalies in the target communication network, the acquisition module can collect the latest operating status parameters of the network every minute to obtain the latest operating status of the network in a timely manner.

[0070] Among them, the network connection rate is the combination of the actual connection rate of the total number of calls at the current collection time. The network fault level can be identified by numbers 0 to 3, where 0 indicates no fault, 1 indicates a minor fault, 2 indicates a medium fault, and 3 indicates a major fault.

[0071] It should be noted that the preset time period can be set to 365 days. Specifically, the running status parameters of all collected samples of the target communication network from the current moment to the previous 365 days can be used as the features of the training samples, that is, as the input data of the initial model.

[0072] The specific process of constructing the initial model for the module is as follows: constructing an iterative dilated convolutional neural network layer, a multi-head attention layer, a multi-layer fully connected layer, and an output layer connected in sequence. The multi-layer fully connected layer is used to perform nonlinear transformation on the high-dimensional features output by the multi-head attention layer, and the output layer includes a softmax network for predicting the network connectivity rate.

[0073] Since network connectivity is a time-varying metric, and the IDCNN network maintains nearly constant performance while extracting long-range temporal features and boasts fast parallel computation speed, the dilated convolutional neural network layer uses the IDCNN network to extract temporal features from historical operating parameters. The IDCNN network structure is as follows: Figure 4As shown, specifically, the IDCNN network mainly increases the receptive field of view by iterating through multiple dilated convolutions and utilizing the characteristics of the dilation factor in the dilated convolution, without adding any additional parameters, and finally outputs the temporal features corresponding to the historical running parameters.

[0074] Given the periodicity and burstiness of network connection rates, the influence weight of historical features on the current input varies at different time intervals. Therefore, after extracting temporal features using IDCNN, the influence of inputs at different times on the current time is learned through the multi-head attention mechanism in the multi-head attention layer. Figure 5 The diagram illustrates the specific structure of a multi-head attention model. A multi-head attention model can be viewed as establishing the interaction relationships, or weight influences, between different components of the input vector within a linear projection space. Multi-head attention involves establishing different projection information in multiple different projection spaces. By projecting the input matrix into various ways and obtaining numerous output matrices, these matrices are concatenated, allowing the model to understand the input sequence from different perspectives. Therefore, by inputting the temporal features corresponding to the historical operating parameters output by the dilated convolutional neural network layer into the multi-head attention layer, the multi-head attention layer can output features that fuse attention weights from multiple perspectives.

[0075] Next, the determination module utilizes two fully connected layers (1024-dimensional and 128-dimensional) in the multi-layer fully connected layer to perform a nonlinear transformation on the high-dimensional vector features of the multi-head attention layer output, which fuses attention weights from multiple angles, to further extract global features. Finally, a softmax prediction layer is used to predict the network connectivity. A schematic diagram of the multi-layer fully connected layer structure is shown below. Figure 6 As shown.

[0076] When the module iteratively trains the initial model using multiple sets of training samples and sample labels, for each training batch, the training samples from each batch are sequentially input into the initial model to obtain multiple third network connectivity rates output by the initial model. A mean squared error loss function is constructed based on these multiple third network connectivity rates and the second network connectivity rates in the sample labels corresponding to each set of training samples. The model parameters of the initial model are adjusted using backpropagation based on the mean squared error loss function to complete one iteration. The specific formula for the mean squared error loss function is as follows: n represents the number of training samples in each training batch during iterative training, and y represents the actual second network connectivity rate in the training samples. This represents the model's predicted value.

[0077] Optionally, when the number of iterations reaches a first preset threshold or the mean squared error loss function is less than a second preset threshold, the initial model training is considered complete, and a network connectivity prediction model is obtained.

[0078] After obtaining the network connectivity prediction model, the operating status parameters of all collected samples of the target communication network from the current time to the previous 365 days are used as input data and re-inputted into the prediction model. The predicted value of the network connectivity at the current time output by the model is used as the safety threshold at the time of collection.

[0079] The anomaly detection module determines whether there is an anomaly in the target communication network based on the comparison results. If the first network connection rate is less than the safety threshold, it determines that there is an anomaly in the target communication network; if the first network connection rate is not less than the safety threshold, it determines that there is no anomaly in the target communication network.

[0080] Optionally, after determining that there is an anomaly in the target communication network, a network anomaly alarm message is issued.

[0081] Optionally, a fault work order can be generated in the communication network management system, which can then arrange maintenance personnel to perform anomaly checks on the target communication network based on the fault work order.

[0082] It should be noted that each module in the communication network anomaly detection device in this application corresponds one-to-one with each implementation step of the communication network anomaly detection method in Embodiment 1. Since Embodiment 1 has been described in detail, some details not shown in this embodiment can be referred to Embodiment 1, and will not be elaborated further here.

[0083] Example 3

[0084] According to an embodiment of this application, a non-volatile storage medium is also provided, which includes a stored computer program, wherein the device containing the non-volatile storage medium executes the communication network anomaly detection method in Embodiment 1 by running the computer program.

[0085] According to an embodiment of this application, a processor is also provided for running a computer program, wherein the computer program executes the communication network anomaly detection method in Embodiment 1 during runtime.

[0086] According to an embodiment of this application, an electronic device is also provided, comprising: a memory and a processor, wherein the memory stores a computer program, and the processor is configured to execute the communication network anomaly detection method of Embodiment 1 through the computer program.

[0087] Specifically, the processor is configured to execute the following steps via a computer program: periodically collecting operational status parameters of the target communication network, wherein the operational status parameters include: network connectivity rate and auxiliary reference data, wherein the auxiliary reference data includes at least one of the following: collection time, network load rate, network fault level, and total number of calls; for each collection time, determining multiple sets of historical operational status parameters within a preset time period prior to the collection time, and inputting the multiple sets of historical operational status parameters into a pre-trained network connectivity rate prediction model to obtain the target network connectivity rate output by the network connectivity rate prediction model, wherein the network connectivity rate prediction model is used to extract multiple temporal features corresponding to multiple sets of historical operational status parameters through an iterative dilated convolutional neural network, and to learn the correlation between multiple temporal features through a multi-head attention mechanism, and to predict the target network connectivity rate based on the correlation; using the target network connectivity rate as a safety threshold at the collection time, comparing the first network connectivity rate at the collection time with the safety threshold, and determining whether there is an anomaly in the target communication network based on the comparison result.

[0088] The sequence numbers of the above embodiments are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0089] In the above embodiments of this application, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0090] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units can be a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual couplings, direct couplings, or communication connections may be through some interfaces; indirect couplings or communication connections between units or modules may be electrical or other forms.

[0091] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0092] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0093] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard drive, magnetic disk, or optical disk.

[0094] The above are merely preferred embodiments of this application. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A method for detecting anomalies in a communication network, characterized in that, include: Periodically collect the operating status parameters of the target communication network, wherein the operating status parameters include: network connection rate and auxiliary reference data, and the auxiliary reference data includes at least one of the following: collection time, network load rate, network fault level, and total number of calls; For each acquisition time, multiple sets of historical operating state parameters within a preset time period prior to the acquisition time are determined, and the multiple sets of historical operating state parameters are input into a pre-trained network connectivity prediction model to obtain the target network connectivity rate output by the network connectivity prediction model. The network connectivity prediction model is used to extract multiple temporal features corresponding to the multiple sets of historical operating state parameters through an iterative dilated convolutional neural network, and to learn the correlation between the multiple temporal features through a multi-head attention mechanism, and to predict the target network connectivity rate based on the correlation. The target network connectivity rate is used as a safety threshold at the time of data collection. The first network connectivity rate at the time of data collection is compared with the safety threshold. Based on the comparison result, it is determined whether the target communication network is abnormal. The training process of the network connectivity prediction model includes: constructing an initial model, wherein the initial model includes at least an iterative dilated convolutional neural network layer, a multi-head attention layer, and an output layer; obtaining multiple sets of training samples and sample labels corresponding to each set of training samples, wherein each set of training samples includes: multiple sets of historical operating state parameters within a preset time period before a historical acquisition time, and the sample labels corresponding to the training samples include: the second network connectivity rate at the historical acquisition time; and iteratively training the initial model using the multiple sets of training samples and the sample labels to obtain the network connectivity prediction model.

2. The method according to claim 1, characterized in that, Constructing the initial model includes: An iterative dilated convolutional neural network layer, a multi-head attention layer, a multi-layer fully connected layer, and an output layer are constructed in sequence. The multi-layer fully connected layer is used to perform nonlinear transformation on the high-dimensional features output by the multi-head attention layer. The output layer includes a softmax network for predicting the network connectivity rate.

3. The method according to claim 2, characterized in that, Iterative training of the initial model using the multiple sets of training samples and the sample labels includes: For each training batch, the training samples in the training batch are sequentially input into the initial model to obtain multiple third network connectivity rates output by the initial model; A mean squared error loss function is constructed based on the multiple third network connectivity rates and the second network connectivity rates in the sample labels corresponding to each group of training samples. The model parameters of the initial model are adjusted according to the mean squared error loss function through backpropagation to complete one iteration.

4. The method according to claim 3, characterized in that, The method further includes: When the number of iterations reaches a first preset threshold, or when the mean squared error loss function is less than a second preset threshold, the initial model training is determined to be complete, and the network connectivity prediction model is obtained.

5. The method according to claim 1, characterized in that, Determining whether the target communication network is abnormal based on the comparison results includes: If the first network connection rate is less than the security threshold, it is determined that the target communication network is abnormal; If the first network connection rate is not less than the security threshold, it is determined that the target communication network is normal.

6. The method according to claim 5, characterized in that, After determining that the target communication network is abnormal, the method further includes: Issue network anomaly alerts; and / or, A fault work order is generated in the communication network management system, which is used to arrange maintenance personnel to perform anomaly checks on the target communication network based on the fault work order.

7. A communication network anomaly detection device, characterized in that, include: The acquisition module is used to periodically acquire the operating status parameters of the target communication network. The operating status parameters include network connection rate and auxiliary reference data. The auxiliary reference data includes at least one of the following: acquisition time, network load rate, network fault level, and total number of calls. A determination module is used to determine multiple sets of historical operating state parameters within a preset time period prior to each acquisition time, and input these multiple sets of historical operating state parameters into a pre-trained network connectivity prediction model to obtain the target network connectivity rate output by the network connectivity prediction model. The network connectivity prediction model is used to extract multiple temporal features corresponding to the multiple sets of historical operating state parameters through an iterative dilated convolutional neural network, and to learn the correlation between these multiple temporal features through a multi-head attention mechanism, predicting the target network connectivity rate based on the correlation. The training process of the network connectivity prediction model includes: constructing an initial model, wherein the initial model includes at least an iterative dilated convolutional neural network layer, a multi-head attention layer, and an output layer; obtaining multiple sets of training samples and sample labels corresponding to each set of training samples, wherein each set of training samples includes: multiple sets of historical operating state parameters within a preset time period prior to a historical acquisition time, and the sample label corresponding to the training sample includes: the second network connectivity rate at the historical acquisition time; and iteratively training the initial model using the multiple sets of training samples and the sample labels to obtain the network connectivity prediction model. An anomaly detection module is used to use the target network connectivity rate as a safety threshold at the time of data collection, compare the first network connectivity rate at the time of data collection with the safety threshold, and determine whether there is an anomaly in the target communication network based on the comparison result.

8. A non-volatile storage medium, characterized in that, The non-volatile storage medium includes a stored computer program, wherein the device containing the non-volatile storage medium executes the communication network anomaly detection method according to any one of claims 1 to 6 by running the computer program.

9. An electronic device, characterized in that, include: A memory and a processor, wherein the memory stores a computer program, and the processor is configured to execute the communication network anomaly detection method according to any one of claims 1 to 6 through the computer program.

Images