A pair-based BRAS configuration anomaly identification method and device

Abstract

The application discloses a pair of BRAS configuration abnormality identification method and device, wherein the method comprises the following steps: cutting a pair of BRAS configuration training file into multiple command blocks according to a separator; extracting the command blocks as a structure by using a regular expression according to service configuration, and using a digital index to represent; comparing and finding the relationship between the structures in the pair of BRAS configuration training file, and generating an abnormal type identification model in combination with defined abnormal types; and predicting the abnormality in a pair of BRAS configuration prediction file through the abnormal type identification model. The method and device mainly identify the abnormality of the pair of BRAS configuration file, and first need to define the abnormal type according to the business requirement, and output the abnormal information of the pair of BRAS configuration file according to the defined abnormal type.

Description

Technical Field

[0001] This invention relates to the field of anomaly identification technology, and in particular to an anomaly identification method and apparatus based on paired BRAS configuration. Background Technology

[0002] Existing technical solutions primarily focus on anomaly identification for single files, lacking methods and technical implementations for anomaly identification in paired configuration files, especially paired BRAS configuration files. Paired BRAS configuration files are those where BRAS devices are paired; their configuration files can be considered as paired BRAS configuration files. These paired BRAS configuration files may have identical configuration parameters or mutual references. Business personnel may make errors when editing these configuration files, necessitating algorithms to automatically identify abnormal paired configurations. Summary of the Invention

[0003] To address the aforementioned problems in existing technologies, this invention provides a method and apparatus for identifying anomalies in paired BRAS configurations. Targeting paired BRAS devices, this method can learn configuration rules that conform to actual network operation through extensive learning of standard configuration file samples in an unsupervised manner. The learned configuration rules can be applied to different production stages to accumulate network configuration experience, save manual auditing costs, and improve the available time for stable network operation.

[0004] To achieve the above objectives, the present invention adopts the following technical solution:

[0005] In one embodiment of the present invention, a method for identifying anomalies in paired BRAS configurations is proposed, the method comprising:

[0006] The pairwise BRAS configuration training file is split into multiple command blocks according to the delimiter;

[0007] Based on the business configuration, use regular expressions to extract command blocks as a structure and represent them using numeric indexes;

[0008] By comparing and finding the relationships between structures in the paired BRAS configuration training files, and combining them with the defined anomaly types, an anomaly type recognition model is generated.

[0009] Anomalies in paired BRAS configuration prediction files are predicted using an anomaly type identification model.

[0010] Furthermore, the relationships between structures in the paired BRAS configuration training files are compared and found, including:

[0011] Check whether there are reference relationships between different types of structures in the paired BRAS configuration training files. If there are reference relationships, use multidimensional indexing to record the position of parameters in the structure and the proportion of reference relationships.

[0012] Compare whether each type of structure in the paired BRAS configuration training files is completely identical. If they are completely identical, use an index to record the structure position and the proportion of identical structures.

[0013] The system checks if a specified keyword appears in the paired BRAS configuration training files. If the specified keyword appears, a multidimensional index is used to record the command line positions in the structure, and the proportion of the specified keyword appearing is also recorded to determine the master-slave relationship.

[0014] Furthermore, the logical functions of the anomaly type identification model are as follows:

[0015] Call the preprocessing script to obtain the paths to the paired BRAS configuration training files and the paths to all paired BRAS configuration training files;

[0016] After splitting the paired BRAS configuration training files according to the path using the delimiter, the command block details and the corresponding lines of each paired BRAS configuration training file are obtained. Each paired BRAS configuration training file corresponds to a two-dimensional list.

[0017] Using preset or user-provided structure regular expressions and parameter matching regular expressions, each segmented pair of BRAS configuration training files is parsed into a two-dimensional matrix composed of the parameters in the file. The two-dimensional matrices of all the segmented pair of BRAS configuration training files are concatenated into a large matrix. Each row of the large matrix contains: parameter value, structure index, command block index, compressed command line index, parameter position index, file name index, group number, and file number.

[0018] Statistical analysis of the large matrix reveals the relationships between parameters and command block rules in the paired BRAS configuration training files after all segments.

[0019] Furthermore, statistical analysis of the large matrix reveals the relationships between parameters and command block rules in all the paired BRAS configuration training files after the splitting, including:

[0020] Statistical analysis is performed on all the segmented pairwise BRAS configuration training files to generate a command block rule file;

[0021] The system analyzes the consistency and inconsistency of parameters at the same and different positions in the group analysis command block rule file, as well as the reference relationships, and outputs the results as a model file for storage. This model file is then used for subsequent anomaly prediction of paired BRAS configuration prediction files.

[0022] In one embodiment of the present invention, an anomaly detection device based on paired BRAS configuration is also proposed, the device comprising:

[0023] The preprocessing module is used to split the pairwise BRAS configuration training files into multiple command blocks according to the delimiter;

[0024] The training module is used to extract command blocks as structures using regular expressions based on business configurations and represent them using numeric indexes; compare and find the relationships between structures in paired BRAS configuration training files, and combine them with defined exception types to generate an exception type recognition model.

[0025] The prediction module is used to predict anomalies in the paired BRAS configuration prediction files using an anomaly type identification model.

[0026] Furthermore, the relationships between structures in the paired BRAS configuration training files are compared and found, including:

[0027] Check whether there are reference relationships between different types of structures in the paired BRAS configuration training files. If there are reference relationships, use multidimensional indexing to record the position of parameters in the structure and the proportion of reference relationships.

[0028] Compare whether each type of structure in the paired BRAS configuration training files is completely identical. If they are completely identical, use an index to record the structure position and the proportion of identical structures.

[0029] The system checks if a specified keyword appears in the paired BRAS configuration training files. If the specified keyword appears, a multidimensional index is used to record the command line positions in the structure, and the proportion of the specified keyword appearing is also recorded to determine the master-slave relationship.

[0030] Furthermore, the logical functions of the anomaly type identification model are as follows:

[0031] Call the preprocessing script to obtain the paths to the paired BRAS configuration training files and the paths to all paired BRAS configuration training files;

[0032] After splitting the paired BRAS configuration training files according to the path using the delimiter, the command block details and the corresponding lines of each paired BRAS configuration training file are obtained. Each paired BRAS configuration training file corresponds to a two-dimensional list.

[0033] Using preset or user-provided structure regular expressions and parameter matching regular expressions, each segmented pair of BRAS configuration training files is parsed into a two-dimensional matrix composed of the parameters in the file. The two-dimensional matrices of all the segmented pair of BRAS configuration training files are concatenated into a large matrix. Each row of the large matrix contains: parameter value, structure index, command block index, compressed command line index, parameter position index, file name index, group number, and file number.

[0034] Statistical analysis of the large matrix reveals the relationships between parameters and command block rules in the paired BRAS configuration training files after all segments.

[0035] Furthermore, statistical analysis of the large matrix reveals the relationships between parameters and command block rules in all the paired BRAS configuration training files after the splitting, including:

[0036] Statistical analysis is performed on all the segmented pairwise BRAS configuration training files to generate a command block rule file;

[0037] The system analyzes the consistency and inconsistency of parameters at the same and different positions in the group analysis command block rule file, as well as the reference relationships, and outputs the results as a model file for storage. This model file is then used for subsequent anomaly prediction of paired BRAS configuration prediction files.

[0038] In one embodiment of the present invention, a computer device is also proposed, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the aforementioned method for identifying anomalies in paired BRAS configurations.

[0039] In one embodiment of the present invention, a computer-readable storage medium is also provided, which stores a computer program that executes a method for identifying anomalies in a pairwise BRAS configuration.

[0040] Beneficial effects:

[0041] This invention mainly identifies anomalies in paired BRAS configuration files. First, it is necessary to define anomaly types according to business requirements, and then output the anomaly information of paired BRAS configuration files according to the defined anomaly types. Attached Figure Description

[0042] Figure 1 This is a general block diagram of the method for identifying anomalies in paired BRAS configurations according to the present invention;

[0043] Figure 2 This is a schematic diagram of the process for identifying anomalies in paired BRAS configurations according to the present invention;

[0044] Figure 3This is a schematic diagram of the structure of the anomaly identification device based on paired BRAS configuration of the present invention;

[0045] Figure 4 This is a schematic diagram of the computer device structure of the present invention. Detailed Implementation

[0046] The principles and spirit of the present invention will now be described with reference to several exemplary embodiments. It should be understood that these embodiments are provided merely to enable those skilled in the art to better understand and implement the present invention, and are not intended to limit the scope of the present invention in any way. Rather, these embodiments are provided to make this disclosure more thorough and complete, and to fully convey the scope of this disclosure to those skilled in the art.

[0047] Those skilled in the art will recognize that embodiments of the present invention can be implemented as a system, apparatus, device, method, or computer program product. Therefore, this disclosure can be specifically implemented in the following forms: entirely hardware, entirely software (including firmware, resident software, microcode, etc.), or a combination of hardware and software.

[0048] According to an embodiment of the present invention, a method for identifying anomalies in paired BRAS configurations is proposed, comprising: preprocessing paired BRAS configuration training files; defining anomaly types according to business requirements and generating anomaly type identification models; and predicting anomaly information of paired BRAS configuration files based on the anomaly identification models. The present invention, based on custom anomaly types, outputs configuration anomaly information of paired BRAS configuration files for core services such as VPN services, address pool configuration, dual-machine hot standby, BDF, authentication domains, and IMS sub-interfaces, for input paired BRAS configuration files to be detected.

[0049] The principles and spirit of the present invention will be explained in detail below with reference to several representative embodiments.

[0050] Figure 1 This is a general block diagram of the pairwise BRAS configuration anomaly identification method of the present invention. Figure 1 As shown, the method includes:

[0051] 1. Divide the pairwise BRAS configuration training file into multiple command blocks according to the delimiter; according to the business configuration, use regular expressions to extract the command blocks as structures and use numeric indexes to represent them; compare and find the relationship between the structures in the pairwise BRAS configuration training file, and combine them with the defined exception types as shown in Table 1 below to generate an exception type recognition model.

[0052] Table 1

[0053]

[0054]

[0055] 2. Anomalies in the paired BRAS configuration prediction files are predicted using an anomaly type identification model.

[0056] It should be noted that although the operation of the method of the present invention has been described in a specific order in the above embodiments and figures, this does not require or imply that the operations must be performed in that specific order, or that all the operations shown must be performed to achieve the desired result. Additionally or alternatively, certain steps may be omitted, multiple steps may be combined into one step, and / or one step may be broken down into multiple steps.

[0057] To provide a clearer explanation of the above-described method for identifying anomalies in paired BRAS configurations, a specific embodiment will be used for illustration below. However, it is worth noting that this embodiment is only intended to better illustrate the present invention and does not constitute an improper limitation of the present invention.

[0058] Example:

[0059] like Figure 2 As shown, the paired BRAS configuration files are first preprocessed. Huawei's paired BRAS configuration files are separated by #, and the top-level separator can divide the paired BRAS configuration files into command blocks. At the same time, different types of command blocks can correspond to different service configurations.

[0060] After splitting the paired BRAS configuration files according to the delimiter, the parameters are replaced with regular expressions.

[0061] At the same time, the concept of a structure is introduced to distinguish different business configurations, as shown in Table 2 below:

[0062] Table 2

[0063]

[0064] Structures are represented using numeric indices for easy comparison.

[0065] Based on user-provided rules (these rules have different characteristics for different business configurations, as shown in Table 2 above; for example, hot standby tunnel configurations must begin with the characters "tunnel-policy" followed by parameters. OLT management VPN configurations require command configurations starting with "ip vpn-instance". All command blocks are shown in Table 2 above), regular expressions are used to extract command blocks as structures. During the training process, the structure information in paired BRAS configuration files is compared to extract the parameters in the structure (these parameters will vary depending on the device, such as an IP address, device name, etc.; in the configuration example below, the grayed-out parameters are variable parameters) from four dimensions (these four dimensions represent the structure index, command block index, line index, and parameter position index. For example, 7_11_3_0 indicates that the parameter position is the 7th structure, the 11th command block, the 3rd line, and the 0th position). Note: When looking for reference relationships, relationships between different types of structures should be sought; there are no reference relationships between structures of the same type.

[0066] Here's an example configuration to help you understand:

[0067] #

[0068] sysname LNBEX-MA-CMNET-BAS13-DMPSME60X

[0069] #

[0070] undo FTP server-source all-interface

[0071] undo FTP ipv6 server-source all-interface

[0072] #

[0073] FTP client-source-a 111.45.233.64

[0074] #

[0075] info-center channel 6name lnlog

[0076] info-center filter-id bymodule-alias pim NBR_DOWN

[0077] info-center filter-id bymodule-alias pim NBR_UP

[0078] info-center source default channel 4log level debugging

[0079] info-center source cli channel 6

[0080] info-center source ssh channel 6

[0081] undo info-center source default channel 6

[0082] info-center loghost source LoopBack0

[0083] info-center loghost 111.63.84.248level informational

[0084] info-center loghost 117.128.5.1facility local1

[0085] info-center loghost 117.132.185.11facility local1

[0086] info-center loghost 117.134.47.81facility local1

[0087] info-center loghost 211.137.3.149channel 6

[0088] info-center loghost 221.180.171.69level informational facility local1

[0089] info-center loghost 221.180.191.28channel 6

[0090] info-center loghost 223.92.1.184level informational

[0091] info-center logbuffer size 1024

[0092] #

[0093] A pair of BRAS configuration files means that there are two BRAS configuration files, one of which is the local end, and the other is the peer end.

[0094] (1) Are there any reference relationships in the local context?

[0095] If a relationship exists, the relationship between mutually referencing structures is recorded. This involves serializing the structures and their parameters for easy searching. Multi-dimensional and multi-indexed methods can be used to store these relationships. For example, parameter 2 in row 0 of structure 0 is the same as parameter 3 in row 1 of structure 1, and so on. This is denoted as {0,0,2self1,1,3:num / total}, where num represents the number of times the reference relationship occurs. There are 3 instances of structure 0 and 4 instances of structure 1, and 3 instances with the same parameter. However, there is only one pair of parameters. Therefore, total should be the total number of parameter combinations. For example, structure 0 appears 3 times, structure 1 appears 4 times, and a parameter in both 0 and 1 appears in {0,0,2self1,1,3:3 / 3}. Here, total represents the number of times the structure itself appears in the current file. If calculating globally, the number of times the structure appears in all files is calculated by summing both the numerator (the number of times the structure itself appears in the current file) and the denominator (the number of times the structure appears in all files). The combination {1,1,3self0,0,2:3 / 3} does not need to be counted repeatedly.

[0096] (2) Are there any reference relationships in the peer context?

[0097] If a relationship exists, the relationship between mutually referenced structures is recorded. This involves serializing the structures and their parameters for easy searching. Multi-dimensional and multi-indexed methods can be used to store these relationships. For example, parameter 2 in row 0 of structure 0 is the same as parameter 3 in row 1 of structure 1, and so on. This is denoted as {0,0,2self1,1,3:num / total}, where num represents the number of times the reference relationship occurs. Therefore, total should be the total number of parameter combinations. For example, if structure 0 appears 3 times and structure 1 appears 4 times, a parameter in both 0 and 1 appears in {0,0,2self1,1,3:3 / 3}. Total represents the number of times the structure itself appears in the current file. If calculating globally, the number of times the structure appears in all files is summed, with both the numerator and denominator added together. The combination {1,1,3self0,0,2:3 / 3} does not need to be calculated repeatedly. Since many parameters appear in the peer file, the computational load is relatively large. Therefore, this characteristic of many parameters appearing in the peer file is not currently counted to improve computational efficiency.

[0098] (3) Whether pairs are identical {0:num / total}{i:num / total}

[0099] The expression checks if structures of the same type are completely identical. It means whether structure type 0 on the local end and structure type i on the remote end are completely identical. `total` is the total number of pairs, and `num` is the number of times they are completely identical. It calculates the proportion of identical structures of each type. After removing comments, it matches based on whether the first line is the same.

[0100] (4) Keyword determines primary / secondary relationship {0,0:num / total}

[0101] The primary / secondary relationship of a structure can be determined by specifying a keyword. Here, `num` indicates that the primary / secondary keyword appears in line 0 of structure 0, and `total` is the total number of times structure 0 appears in all training files. The proportion of structures containing the keyword is calculated by dividing the total number of times that structure appears in the training files by the total number of times the keyword appears in the structure; this keyword typically appears in the first line.

[0102] Based on the above approach, the logical functions of the anomaly type identification module are as follows:

[0103] (1) Call the preprocessing script to obtain the path of the paired BRAS configuration training file and the path of all paired BRAS configuration training files.

[0104] (2) After splitting the paired BRAS configuration training files according to the path and the delimiter, the command block details and the corresponding lines of each paired BRAS configuration training file are obtained. Each paired BRAS configuration training file corresponds to a two-dimensional list.

[0105] (3) Using preset or user-input structure regular expressions and parameter matching regular expressions, each segmented pair of BRAS configuration training files is parsed into a two-dimensional matrix composed of parameters in the file. All the two-dimensional matrices of the segmented pair of BRAS configuration training files are concatenated into a large matrix.

[0106] Each row of the large matrix contains:

[0107] Parameter values, structure index, command block index, compressed command line index, parameter position index, file name index (group number_file number), group number and file number;

[0108] All indices below are counted starting from 0.

[0109] Parameter value: The parameter value matched by the command line using the reDict regular expression. For example, route-distinguisher 56044:411100100 will return 56044:411100100 as the parameter value after the regular expression match.

[0110] Structure index: The index obtained by matching the command block with the objectDict regular expression. For example, the command block tunnel-policy bas15-bas31 and tunnel select-seq lsp load-balance-number 1 can match up to index 0.

[0111] Command block index: After performing regular expression matching on all files using the reDict regular expression, a set of command blocks for all files will be obtained. These command blocks are serialized with numbers to obtain the command block index of the command block containing the parameter, for example, 1.

[0112] Compressed command line index: The line number in the command block containing the parameter is recorded as the compressed command line index. For example, if parameter 56044:411100100 is the 3rd line of the command block, then the index is recorded as 2.

[0113] Parameter position index: The position of the parameter in the command block is recorded as the position of the parameter in the specified line. For example, if parameter 56044:411100100 is the first parameter in the third line of the command block, then the index is recorded as 0.

[0114] Filename index: represented by a combination of file name and file number, for example, 0_1.

[0115] Group number: There are as many groups as there are pairs, and the group number is the number, for example, number 1.

[0116] File number: There are 2 files in a group, represented randomly by 0 and 1.

[0117] For example:

[0118] Parameter values, structure index, command block index, compressed command line index, parameter position index, file name index (group number_file number), group number and file number;

[0119] LNASH_PON_MANAGE_HUAWEI, 1, 240, 0, 0, "0, 0", 0 and 0. The default regular expression for the structure is as follows:

[0120]

[0121]

[0122] A regular expression matching any of the numbers 0-10 represents a structure, and the command block containing a matching regular expression is a structure. Once a structure is matched according to the configuration order, no other structures will be matched.

[0123] The parameter replacement regular expression is as follows:

[0124]

[0125] If the command line is repeated after a regular expression match, the multiple lines of the command block will be merged into one line.

[0126] After preprocessing, a temporary dataframe will be generated from the file for subsequent analysis, as follows:

[0127] varValue,objectIndex,commandIndex,lineIndex,positionIndex,fileIndex,fileGroup,fileName

[0128] LNASH_PON_MANAGE_HUAWEI,1,240,0,0,"0,0",0,0

[0129] 64660:412005001,1,240,2,0,"0,0",0,0

[0130] 64660:4120050001,1,240,4,0,"0,0",0,0

[0131] 64660:4120050001,1,240,5,0,"0,0",0,0

[0132] LNASH_PON_MANAGE_ZTE,1,240,0,0,"0,0",0,0

[0133] 64660:4120050002,1,240,2,0,"0,0",0,0

[0134] 64660:4120050002,1,240,4,0,"0,0",0,0

[0135] 64660:412005002,1,240,5,"0,0",0,0

[0136] LN IMS,1,240,0,0,"0,0",0,0

[0137] 56044:1000301100,1,240,2,0,"0,0",0,0

[0138] 56044:1000301100,1,240,4,0,"0,0",0,0

[0139] 56044:1000301100,1,240,5,0,"0,0",0,0

[0140] In rms,1,192,0,0,"0,0",0,0

[0141] (4) Statistical analysis of the large matrix in (3) reveals the relationship between parameters and command block rules in the paired BRAS configuration training files after all segments.

[0142] First, statistical analysis is performed on all the segmented pairwise BRAS configuration training files to generate a command block rule file, commandDict.json.

[0143] Next, analyze the relationships between parameters in the same and different positions in the command block rule file, as well as their reference relationships, by group.

[0144] The analyzed relationships are output as model files and stored for subsequent pairwise BRAS configuration prediction files to perform anomaly prediction. The model file path is a zip file next to output / models.

[0145] commandRatio represents the proportion of the command block that appears in all files. Command blocks that exceed this set threshold are retained as command block rules.

[0146] The `getSameAndDiff` method is used to retrieve the proportions of identical or different parameters at the same position in pairs of BRAS configuration files. A threshold is set to retain the positions exceeding the thresholds for `sameRatio` (proportion of identical parameters at the same position) and `diffRatio` (proportion of different parameters at the same position).

[0147] The `getSelfQuote` method is used to retrieve the parameter position rules of paired BRAS configuration files that reference themselves. A threshold `selfRatio` (the ratio of parameter self-references) is set to retain the rules.

[0148] The `getOtherQuote` method is used to retrieve the parameter position rules for cross-referencing in paired BRAS configuration files. A threshold `crossRatio` (parameter cross-referencing ratio) is set to retain the rules.

[0149] The resulting model file contains the following four JSON files:

[0150] commandDict.json;

[0151] object.json;

[0152] ruleDict.json;

[0153] varPositionDict.json.

[0154] in:

[0155] <1> The commandDict.json file contains the compressed content of the command block after parameter replacement, as well as numerical indexes.

[0156] {"bfd{PARAMS}bind peer-ip{PARAMS},discriminator local{PARAMS},discriminator remote{PARAMS},min-tx-interval{PARAMS},min-rx-interval{PARAMS}": 1, "interface{PARAMS},statistic enable,user-vlan{PARAMS},remote-backup-profile{PARAMS},bas,access-type{PARAMS}default-domain authentication{PARAMS},authentication-method bind,vpn-instance{PARAMS}":8…}

[0157] Each element corresponds to a rule, where the key represents the compressed command block and the value represents the index value.

[0158] <2> The objectDict.json file contains the structure used for training.

[0159] <3> The ruleDict.json file contains the regular expressions used for parameter replacement during training.

[0160] <4> The `varPositionDict.json` file contains four parts: `sameDict`, `diffDict`, `selfResultLst`, and `otherResultLst`. An example is shown below. `sameDict` represents the positions and proportions of parameters whose primary and secondary parameters are identical; `diffDict` represents the positions and proportions of parameters whose primary and secondary parameters are inconsistent; `selfResultLst` represents the positions of parameters referenced within a pair of files; and `otherResultLst` represents the positions of parameters referenced within a pair of files. References within a file have higher priority than references to parameters in pairs. For example, `7_11_3_0` indicates that the parameter is located in the 7th structure, the 11th command block, line 3, position 0.

[0161] sameDict:{

[0162] "0_44_0_0":1.0,

[0163] "0_44_1_0":1.0,

[0164] "1_19_1_0":1.0,

[0165] "2_140_0":1.0,

[0166] "2_14_1_0":1.0,

[0167] "2_14_2_0":1.0,

[0168] "214_2_1":1.0}

[0169] diffDict":{

[0170] "2_23_2_0":1.0,

[0171] "223_3_1":1.0,

[0172] "2_23_3_2":1.0,

[0173] "4_1220":1.0,

[0174] "5_37_10":1.0,

[0175] "5_37_1_1":1.0}

[0176] "selfResultLst":[

[0177] ["7_11_3_0","7_16_3_0","7_21_3_0","8_30_2_0"],

[0178] ["10_17_0_5","7_21_7_2","9_8_2_0"],

[0179] ["6_1_0_0","7_11_5_1","7_21_8_1"],

[0180] ["7_11_0_0","7_16_0_0","7_21_0_0","8_30_4_1"],

[0181] ["10_17_0_2","2_40_2_0"]

[0182] ["10_17_0_0","2_40_3_1"] ]

[0184] "otherResultLst:[

[0185] [["7_11_3_1"],["7_21_3_1"]],

[0186] [["6_1_0_1"],["7_21_2_0"]] ]

[0188] The prediction logic functions are as follows:

[0189] (1) Parse the prediction pairwise BRAS configuration files using a method similar to that used for the training files. Parse each pairwise BRAS configuration file into a large matrix according to the position of the parameters in the file. Then, concatenate the matrices from the two files vertically. Each row of the matrix contains:

[0190] Parameter value, structure index (-1 if not present), command block index (-1 if not present), compressed command line index, parameter position index, original content of the command block, starting line number of the command block, index of the line containing the current parameter, primary / backup information of the command block (if primary is 0, it is a backup command block), concatenation string for missing command lines, concatenation string for extra command lines, compressed command block, current line of the parameter.

[0191] Original command block content: The original command block is concatenated line by line using commas;

[0192] Command block start line number: Original command block start line number;

[0193] The current parameter's line index: the original command block line index;

[0194] Command block primary / backup information: If the command block contains the keyword (rui-slave or #LOCAL, etc.), it is a backup command block, which is recorded as 0; otherwise, it is recorded as 1.

[0195] Missing command line concatenation string: obtained by concatenating the missing command line with the trained command block rules;

[0196] Multiple command line concatenation strings: These are obtained by concatenating multiple command lines compared with the command block rules obtained through training.

[0197] Compression command block: The compression command block after the regular expression matching of the command block containing this parameter;

[0198] The current line of the parameter: the actual line where the parameter is located (not matched).

[0199] (2) Obtain the rules in the anomaly type identification model based on the predicted input parameters, group and statistically analyze the matrix in (1), and obtain the anomaly information by combining the rules of the anomaly type identification model.

[0200] An example of the content of the prediction result file is as follows:

[0201] <begin>

[0202] <is_pair>[N]

[0203] <standby> []

[0204] <filename>['LNASH-MA-CMNET-BAS12-XYJSLME60X.cfg']

[0205] <row_num>[[-1,-1]]

[0206] <correct_paragraph>[['^tunnel-policy']]

[0207] <current_paragraph>[]

[0208] <error_reason>['Missing object block']

[0209] <error_info>[['^tunnel-policy']]

[0210] <end>

[0211] explain: <begin>arrive <end>Identify one of the file command blocks,<is_pair> Indicates whether it is a paired command block. <standby>Indicate whether it is the master device: Y for yes, N for no. <filename>Indicates the file name.<row_num> The line representing the command block,<correct_paragraph> This indicates a correct command block.<current_paragraph> Indicates the current command block.<error_reason> Indicates the error type.<error_info> Indicates the detailed reason for the error.

[0212] Based on the same inventive concept, this invention also proposes an anomaly detection device based on paired BRAS configurations. The implementation of this device can refer to the implementation of the method described above, and repeated details will not be elaborated further. The term "module" used below can refer to a combination of software and / or hardware that implements a predetermined function. Although the device described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0213] Figure 3 This is a schematic diagram of the structure of the anomaly identification device based on paired BRAS configuration of the present invention.

[0214] like Figure 3 As shown, the device includes:

[0215] The preprocessing module 101 is used to divide the paired BRAS configuration training files into multiple command blocks according to the delimiter.

[0216] Training module 102 is used to extract command blocks as structures using regular expressions based on business configuration and represent them using numeric indexes; compare and find the relationship between structures in the paired BRAS configuration training files, and generate an exception type recognition model by combining the defined exception types.

[0217] Compare and find the relationships between structures in the paired BRAS configuration training files, including:

[0218] Check whether there are reference relationships between different types of structures in the paired BRAS configuration training files. If there are reference relationships, use multidimensional indexing to record the position of parameters in the structure and the proportion of reference relationships.

[0219] Compare whether each type of structure in the paired BRAS configuration training files is completely identical. If they are completely identical, use an index to record the structure position and the proportion of identical structures.

[0220] The system checks if a specified keyword appears in the paired BRAS configuration training files. If the specified keyword appears, a multidimensional index is used to record the command line positions in the structure, and the proportion of the specified keyword appearing is also recorded to determine the master-slave relationship.

[0221] The logical functions of the anomaly type identification model are as follows:

[0222] Call the preprocessing script to obtain the paths to the paired BRAS configuration training files and the paths to all paired BRAS configuration training files;

[0223] After splitting the paired BRAS configuration training files according to the path using the delimiter, the command block details and the corresponding lines of each paired BRAS configuration training file are obtained. Each paired BRAS configuration training file corresponds to a two-dimensional list.

[0224] Using preset or user-provided structure regular expressions and parameter matching regular expressions, each segmented pair of BRAS configuration training files is parsed into a two-dimensional matrix composed of the parameters in the file. The two-dimensional matrices of all the segmented pair of BRAS configuration training files are concatenated into a large matrix. Each row of the large matrix contains: parameter value, structure index, command block index, compressed command line index, parameter position index, file name index, group number, and file number.

[0225] Statistical analysis of the large matrix reveals the relationships between parameters and command block rules in all the paired BRAS configuration training files after complete segmentation, including:

[0226] Statistical analysis is performed on all the segmented pairwise BRAS configuration training files to generate a command block rule file;

[0227] The system analyzes the consistency and inconsistency of parameters at the same and different positions in the group analysis command block rule file, as well as the reference relationships, and outputs the results as a model file for storage. This model file is then used for subsequent anomaly prediction of paired BRAS configuration prediction files.

[0228] The prediction module 103 is used to predict anomalies in the paired BRAS configuration prediction file through an anomaly type identification model.

[0229] It should be noted that although several modules for configuring anomaly detection devices based on paired BRAS have been mentioned in the detailed description above, this division is merely exemplary and not mandatory. In fact, according to embodiments of the present invention, the features and functions of the two or more modules described above can be embodied in a single module. Conversely, the features and functions of a single module described above can be further divided and embodied by multiple modules.

[0230] Based on the aforementioned inventive concept, such as Figure 4 As shown, the present invention also proposes a computer device 200, including a memory 210, a processor 220, and a computer program 230 stored in the memory 210 and executable on the processor 220. When the processor 220 executes the computer program 230, it implements the aforementioned method for identifying anomalies in paired BRAS configurations.

[0231] Based on the aforementioned inventive concept, the present invention also proposes a computer-readable storage medium storing a computer program that executes the aforementioned method for identifying anomalies in paired BRAS configurations.

[0232] The present invention proposes a method and apparatus for identifying anomalies in paired BRAS configuration files. The main purpose is to identify anomalies in paired BRAS configuration files. First, it is necessary to define anomaly types according to business requirements, and then output the anomaly information of paired BRAS configuration files according to the defined anomaly types.

[0233] While the spirit and principles of the invention have been described with reference to several specific embodiments, it should be understood that the invention is not limited to the disclosed specific embodiments, and the division of aspects does not imply that features in these aspects cannot be combined for benefit; such division is merely for ease of description. The invention is intended to cover various modifications and equivalent arrangements included within the spirit and scope of the appended claims.

[0234] Regarding the limitation of the scope of protection of this invention, those skilled in the art should understand that various modifications or variations that can be made by those skilled in the art without creative effort based on the technical solution of this invention are still within the scope of protection of this invention.< / filename> < / standby> < / end> < / begin> < / end> < / filename> < / standby> < / begin>

Claims

1. A method for identifying anomalies in paired BRAS configurations, characterized in that, The method includes: The pairwise BRAS configuration training file is split into multiple command blocks according to the delimiter; Based on the business configuration, use regular expressions to extract command blocks as a structure and represent them using numeric indexes; By comparing and finding the relationships between structures in the paired BRAS configuration training files, and combining them with the defined anomaly types, an anomaly type recognition model is generated. Compare and find the relationships between structures in the paired BRAS configuration training files, including: Check whether there are reference relationships between different types of structures in the paired BRAS configuration training files. If there are reference relationships, use multidimensional indexing to record the position of parameters in the structure and the proportion of reference relationships. Compare whether each type of structure in the paired BRAS configuration training files is completely identical. If they are completely identical, use an index to record the structure position and the proportion of identical structures. The system searches the paired BRAS configuration training files for a specified keyword. If the keyword is found, a multidimensional index is used to record the command line positions within the structure, and simultaneously records... The proportion of specified keywords is used to determine the primary / secondary relationship; Anomalies in paired BRAS configuration prediction files are predicted using an anomaly type identification model. The logical functions of the anomaly type identification model are as follows: Call the preprocessing script to obtain the paths to the paired BRAS configuration training files and the paths to all paired BRAS configuration training files; After splitting the paired BRAS configuration training files according to the path using the delimiter, the command block details and the corresponding lines of each paired BRAS configuration training file are obtained. Each paired BRAS configuration training file corresponds to a two-dimensional list. Using preset or user-provided structure regular expressions and parameter matching regular expressions, each segmented pair of BRAS configuration training files is parsed into a two-dimensional matrix composed of the parameters in the file. The two-dimensional matrices of all the segmented pair of BRAS configuration training files are concatenated into a large matrix. Each row of the large matrix contains: parameter value, structure index, command block index, compressed command line index, parameter position index, file name index, group number, and file number. Statistical analysis of the large matrix reveals the relationships between parameters and command block rules in the paired BRAS configuration training files after all segments.

2. The method for identifying anomalies in paired BRAS configurations according to claim 1, characterized in that, Statistical analysis of the large matrix reveals the relationships between parameters and command block rules in the paired BRAS configuration training files after all partitions, including: Statistical analysis is performed on all the segmented pairwise BRAS configuration training files to generate a command block rule file; The system analyzes the consistency and inconsistency of parameters at the same and different positions in the group analysis command block rule file, as well as the reference relationships, and outputs the results as a model file for storage. This model file is then used for subsequent anomaly prediction of paired BRAS configuration prediction files.

3. An anomaly detection device based on paired BRAS configuration, characterized in that, The device includes: The preprocessing module is used to split the pairwise BRAS configuration training files into multiple command blocks according to the delimiter; The training module is used to extract command blocks as structures using regular expressions based on business configurations and represent them using numeric indexes; compare and find the relationships between structures in paired BRAS configuration training files, and combine them with defined exception types to generate an exception type recognition model. Compare and find the relationships between structures in the paired BRAS configuration training files, including: Check whether there are reference relationships between different types of structures in the paired BRAS configuration training files. If there are reference relationships, use multidimensional indexing to record the position of parameters in the structure and the proportion of reference relationships. Compare whether each type of structure in the paired BRAS configuration training files is completely identical. If they are completely identical, use an index to record the structure position and the proportion of identical structures. The system searches the paired BRAS configuration training files for a specified keyword. If the keyword is found, a multidimensional index is used to record the command line positions within the structure, and simultaneously records... The proportion of specified keywords is used to determine the primary / secondary relationship; The prediction module is used to predict anomalies in the paired BRAS configuration prediction file using an anomaly type identification model. The logical functions of the anomaly type identification model are as follows: Call the preprocessing script to obtain the paths to the paired BRAS configuration training files and the paths to all paired BRAS configuration training files; After splitting the paired BRAS configuration training files according to the path using the delimiter, the command block details and the corresponding lines of each paired BRAS configuration training file are obtained. Each paired BRAS configuration training file corresponds to a two-dimensional list. Using preset or user-provided structure regular expressions and parameter matching regular expressions, each segmented pair of BRAS configuration training files is parsed into a two-dimensional matrix composed of the parameters in the file. The two-dimensional matrices of all the segmented pair of BRAS configuration training files are concatenated into a large matrix. Each row of the large matrix contains: parameter value, structure index, command block index, compressed command line index, parameter position index, file name index, group number, and file number. Statistical analysis of the large matrix reveals the relationships between parameters and command block rules in the paired BRAS configuration training files after all segments.

4. The anomaly detection device based on paired BRAS configuration according to claim 3, characterized in that, Statistical analysis of the large matrix reveals the relationships between parameters and command block rules in the paired BRAS configuration training files after all partitions, including: Statistical analysis is performed on all the segmented pairwise BRAS configuration training files to generate a command block rule file; The system analyzes the consistency and inconsistency of parameters at the same and different positions in the group analysis command block rule file, as well as the reference relationships, and outputs the results as a model file for storage. This model file is then used for subsequent anomaly prediction of paired BRAS configuration prediction files.

5. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the method according to any one of claims 1-2.

6. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that performs the method according to any one of claims 1-2.

Images