Service-based network anomaly detection methods, systems, devices, and media

Abstract

This application discloses a service-based network anomaly detection method, system, device, and storage medium. The method involves acquiring standard process information corresponding to a predetermined service; determining the participating devices involved in executing the predetermined service based on the standard process information; acquiring multiple historical time-series data corresponding to the participating devices under normal network conditions during historical periods; performing pairwise correlation analysis on each historical time-series data to obtain a reference data model; acquiring multiple first time-series data corresponding to the participating devices at the current time point; performing pairwise correlation analysis on each first time-series data to obtain a network data model; and performing difference detection on the reference data model and the network data model, determining the detection result based on the difference detection results. This method can improve the accuracy and efficiency of network anomaly detection. This application can be widely applied in the field of computer network technology.

Description

Technical Field

[0001] This application relates to the field of computer network technology, and in particular to a service-based network anomaly detection method, system, device, and storage medium. Background Technology

[0002] Currently, when network anomalies occur due to reasons such as equipment hardware failure, deterioration of transmission quality, human error, or security attacks, a large amount of abnormal data will be generated in an instant due to the diversification of services and the complexity of network architecture. For example, work indicators such as alarms, traffic, call volume, and number of online users may all show abnormalities.

[0003] To detect network anomalies, the analytical approaches used in related technologies generally include: traditional manual maintenance methods, which are inefficient due to the difficulty for operations and maintenance personnel to simultaneously monitor and analyze large amounts of data for anomaly detection; digital network anomaly detection methods, which often only analyze certain types of data, making them prone to omissions and failing to detect and respond effectively; and time-series anomaly prediction methods, which generally predict future data using historical data. These methods heavily rely on the accuracy and standardization of the acquired historical data, but the continuous development of network services means that networks are constantly changing, requiring continuous updates and adjustments, resulting in a narrow scope of application and high costs.

[0004] In summary, the problems with the relevant technologies urgently need to be addressed. Summary of the Invention

[0005] The purpose of this application is to at least partially solve one of the technical problems existing in the related art.

[0006] Therefore, one objective of this application is to provide a service-based network anomaly detection method, system, device, and storage medium.

[0007] To achieve the above-mentioned technical objectives, the technical solutions adopted in the embodiments of this application include:

[0008] On the one hand, embodiments of this application provide a service-based network anomaly detection method, the method comprising:

[0009] Obtain standard process information corresponding to the reservation service;

[0010] Based on the standard process information, the participating devices involved in executing the predetermined service are determined, and multiple historical time series data corresponding to the participating devices under normal network conditions during historical periods are obtained; wherein, each historical time series data is used to record the working index parameters of the participating devices during historical periods, and the historical time series data corresponding to each participating device has the same length;

[0011] A pairwise correlation analysis was performed on each of the aforementioned historical time series data to obtain a reference data model;

[0012] Multiple first time series data corresponding to the participating devices at the current time node are obtained, and pairwise correlation analysis is performed on each of the first time series data to obtain a network data model; wherein, each of the first time series data is used to record the working index parameters of the participating devices at the current time node and the predetermined period before the current time node, and the length of the first time series data corresponding to each participating device is the same.

[0013] The reference data model and the network data model are subjected to difference detection, and the detection result is determined based on the difference detection result.

[0014] In addition, the service-based network anomaly detection method according to the above embodiments of this application may also have the following additional technical features:

[0015] Furthermore, in one embodiment of this application, the participating devices include at least one of routers, switches, core network elements, call centers, firewalls, and deep packet inspection devices; the working performance parameters include at least one of device alarm parameters, port traffic parameters, device CPU parameters, memory parameters, number of online users parameters, number of registered users parameters, call success rate parameters, complaint volume parameters, complaint service parameters, firewall session count parameters, and packet inspection count parameters.

[0016] Furthermore, in one embodiment of this application, obtaining multiple historical time series data corresponding to the participating devices under normal network conditions during historical periods includes:

[0017] For the target device, determine the type of parameter for which the operating performance parameters of the target device need to be acquired; the target device can be any of the participating devices.

[0018] Based on the parameter type, obtain the working indicator parameters corresponding to the target device under normal network conditions at multiple historical nodes;

[0019] Based on the chronological order, the working indicator parameters of each parameter type are integrated to obtain the corresponding historical time series data for each parameter type.

[0020] Furthermore, in one embodiment of this application, the method further includes:

[0021] Obtain the amount of available computing resources;

[0022] Based on the amount of computing resources, determine the number of parameter types of the work indicator parameters contained in the acquired historical time series data and the first time series data.

[0023] Furthermore, in one embodiment of this application, the step of performing pairwise correlation analysis on each of the historical time series data to obtain a reference data model includes:

[0024] Perform pairwise correlation analysis on each of the aforementioned historical time series data to obtain correlation values;

[0025] The correlation values ​​are quantified and arranged in a matrix to obtain the reference data model.

[0026] Furthermore, in one embodiment of this application, the step of performing difference detection on the reference data model and the network data model, and determining the network anomaly detection result based on the difference detection result, includes:

[0027] Calculate the paradigm distance between the reference data model and the network data model;

[0028] If the paradigm distance is greater than a preset threshold, the network anomaly detection result is determined to be that the network has an anomaly; or, if the paradigm distance is less than or equal to the preset threshold, the network anomaly detection result is determined to be that the network does not have an anomaly.

[0029] Furthermore, in one embodiment of this application, the step of performing difference detection on the reference data model and the network data model, and determining the network anomaly detection result based on the difference detection result, further includes:

[0030] If the network anomaly detection result indicates that there is an anomaly in the network, calculate the difference between the correlation values ​​at each corresponding position in the reference data model and the network data model.

[0031] Based on the maximum value of the difference, the participating device that caused the predetermined service network anomaly is determined.

[0032] On the other hand, embodiments of this application provide a service-based network anomaly detection system, the system comprising:

[0033] The acquisition unit is used to acquire standard process information corresponding to the pre-defined business.

[0034] The first processing unit is configured to determine the participating devices involved in executing the predetermined service based on the standard process information, and to obtain multiple historical time series data corresponding to the participating devices when the network status is normal during a historical period; wherein, each historical time series data is used to record the working index parameters of the participating devices during the historical period, and the historical time series data corresponding to each participating device has the same length;

[0035] The analysis unit is used to perform pairwise correlation analysis on each of the historical time series data to obtain a reference data model;

[0036] The second processing unit is used to acquire multiple first time series data corresponding to the participating devices at the current time node, perform pairwise correlation analysis on each of the first time series data, and obtain a network data model; wherein, each of the first time series data is used to record the working index parameters of the participating devices at the current time node and the predetermined period before the current time node, and the length of the first time series data corresponding to each participating device is the same.

[0037] The discrimination unit is used to perform difference detection on the reference data model and the network data model, and determine the detection result based on the difference detection result.

[0038] On the other hand, embodiments of this application provide an electronic device, including:

[0039] At least one processor;

[0040] At least one memory for storing at least one program;

[0041] When the at least one program is executed by the at least one processor, the at least one processor implements the above-described service-based network anomaly detection method.

[0042] On the other hand, embodiments of this application also provide a computer-readable storage medium storing a processor-executable program, which, when executed by a processor, is used to implement the above-described service-based network anomaly detection method.

[0043] The advantages and beneficial effects of this application will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of this application:

[0044] The network anomaly detection method, system, device, and storage medium based on services disclosed in this application include: The method acquires standard process information corresponding to a predetermined service; based on the standard process information, determines the participating devices involved in executing the predetermined service, and acquires multiple historical time series data corresponding to the participating devices under normal network conditions during historical periods; each historical time series data is used to record the working indicator parameters of the participating devices during historical periods, and the length of the historical time series data corresponding to each participating device is the same; pairwise correlation analysis is performed on each of the historical time series data to obtain a reference data model; multiple first time series data corresponding to the participating devices at the current time node are acquired, and pairwise correlation analysis is performed on each of the first time series data to obtain a network data model; each first time series data is used to record the working indicator parameters of the participating devices at the current time node and during a predetermined period before the current time node, and the length of the first time series data corresponding to each participating device is the same; difference detection is performed on the reference data model and the network data model, and the detection result is determined based on the difference detection result. This method can obtain historical time series data of each participating device involved in the scheduled business based on the standard process information corresponding to the scheduled business and perform correlation analysis. It can make comprehensive use of multiple devices and multiple working index parameters, which is conducive to improving the accuracy of network anomaly detection. Furthermore, when the method is executed, it can quickly compare the network anomaly detection results based on the current first time series data, which is conducive to shortening the fault response time, improving the timeliness of operation and maintenance, and thus improving the stability and reliability of network operation. Attached Figure Description

[0045] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the following description is provided with accompanying drawings of the relevant technical solutions in the embodiments of this application or the prior art. It should be understood that the accompanying drawings described below are only for the purpose of clearly illustrating some embodiments of the technical solutions in this application. For those skilled in the art, other drawings can be obtained based on these drawings without any creative effort.

[0046] Figure 1 This is a schematic diagram of the implementation environment for a service-based network anomaly detection method provided in this application embodiment;

[0047] Figure 2 This is a flowchart illustrating a service-based network anomaly detection method provided in this application embodiment;

[0048] Figure 3 This is a schematic diagram illustrating the standard process information of a network service provided in an embodiment of this application;

[0049] Figure 4 This is a schematic diagram of a process for obtaining a reference data model provided in an embodiment of this application;

[0050] Figure 5 This is a schematic diagram illustrating the implementation principle of a service-based network anomaly detection method provided in this application embodiment;

[0051] Figure 6 This is a flowchart illustrating the sequence of an HSS startup separation procedure provided in an embodiment of this application.

[0052] Figure 7 This is a schematic diagram illustrating the principle of collecting port traffic as provided in an embodiment of this application;

[0053] Figure 8 This is a data traffic trend chart provided in the embodiments of this application;

[0054] Figure 9 This is a schematic diagram of the structure of a service-based network anomaly detection system provided in the embodiments of this application;

[0055] Figure 10 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0056] The present application will be further described below with reference to the accompanying drawings and specific embodiments. The described embodiments should not be considered as limitations on the present application, and all other embodiments obtained by those skilled in the art without inventive effort are within the scope of protection of the present application.

[0057] In the following description, references are made to “some embodiments,” which describe a subset of all possible embodiments. However, it is understood that “some embodiments” may be the same subset or different subsets of all possible embodiments and may be combined with each other without conflict.

[0058] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing embodiments of this application only and is not intended to limit this application.

[0059] Currently, when network anomalies occur due to reasons such as equipment hardware failure, deterioration of transmission quality, human error, or security attacks, a large amount of abnormal data will be generated in an instant due to the diversification of services and the complexity of network architecture. For example, work indicators such as alarms, traffic, call volume, and number of online users may all show abnormalities.

[0060] To detect network anomalies, the analytical approaches used in related technologies generally include: traditional manual maintenance methods, which are inefficient due to the difficulty for operations and maintenance personnel to simultaneously monitor and analyze large amounts of data for anomaly detection; digital network anomaly detection methods, which often only analyze certain types of data, making them prone to omissions and failing to detect and respond effectively; and time-series anomaly prediction methods, which generally predict future data using historical data. These methods heavily rely on the accuracy and standardization of the acquired historical data, but the continuous development of network services means that networks are constantly changing, requiring continuous updates and adjustments, resulting in a narrow scope of application and high costs.

[0061] In view of this, this application provides a service-based network anomaly detection method. The method obtains standard process information corresponding to a predetermined service; determines the participating devices involved in executing the predetermined service based on the standard process information, and obtains multiple historical time series data corresponding to the participating devices under normal network conditions during historical periods; wherein each historical time series data is used to record the working indicator parameters of the participating devices during historical periods, and the length of the historical time series data corresponding to each participating device is the same; performs pairwise correlation analysis on each historical time series data to obtain a reference data model; obtains multiple first time series data corresponding to the participating devices at the current time node, performs pairwise correlation analysis on each first time series data to obtain a network data model; wherein each first time series data is used to record the working indicator parameters of the participating devices at the current time node and during predetermined periods before the current time node, and the length of the first time series data corresponding to each participating device is the same; performs difference detection on the reference data model and the network data model, and determines the detection result based on the difference detection result. This method can obtain historical time series data of each participating device involved in the scheduled business based on the standard process information corresponding to the scheduled business and perform correlation analysis. It can make comprehensive use of multiple devices and multiple working index parameters, which is conducive to improving the accuracy of network anomaly detection. Furthermore, when the method is executed, it can quickly compare the network anomaly detection results based on the current first time series data, which is conducive to shortening the fault response time, improving the timeliness of operation and maintenance, and thus improving the stability and reliability of network operation.

[0062] Please refer to Figure 1 , Figure 1This diagram illustrates the implementation environment of a service-based network anomaly detection method provided in this embodiment. In this implementation environment, the main hardware and software components involved include a terminal device 110 and a backend server 120. The terminal device 110 and the backend server 120 are connected via communication.

[0063] Specifically, the service-based network anomaly detection method provided in this application embodiment can be executed separately on the terminal device 110 side, separately on the backend server 120 side, or based on data interaction between the terminal device 110 and the backend server 120.

[0064] For example, taking the service-based network anomaly detection method provided in this application embodiment, which is executed based on data interaction between terminal device 110 and backend server 120, as an example, its implementation process will be briefly introduced and explained:

[0065] In this embodiment, the terminal device 110 can initiate a network anomaly detection request. This request can specify a predetermined service to be detected and trigger the backend server 120 to execute a specific network anomaly detection method. Upon receiving the network anomaly detection request, the backend server 120 can respond by obtaining standard process information corresponding to the predetermined service; determining the participating devices involved in executing the predetermined service based on the standard process information; and obtaining multiple historical time series data corresponding to the participating devices under normal network conditions in multiple historical periods; performing pairwise correlation analysis on each historical time series data to obtain a reference data model; obtaining multiple first time series data corresponding to the participating devices in multiple current periods; performing pairwise correlation analysis on each first time series data to obtain a network data model; performing difference detection on the reference data model and the network data model; determining the network anomaly detection result based on the difference detection result; and then sending the network anomaly detection result to the terminal device 110, thereby completing the network anomaly detection task.

[0066] The terminal device 110 in the above embodiments may include mobile phones, computers, smart wearable devices, PDA devices, smart voice interaction devices, vehicle terminals, etc., but is not limited to these.

[0067] The backend server 120 can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms.

[0068] The terminal device 110 and the backend server 120 can establish a communication connection via a wireless network or a wired network. This wireless or wired network uses standard communication technologies and / or protocols. The network can be the Internet or any other network, including but not limited to any combination of Local Area Network (LAN), Metropolitan Area Network (MAN), Wide Area Network (WAN), mobile, wired or wireless networks, private networks, or virtual private networks.

[0069] Of course, this is understandable. Figure 1 The implementation environment described in this application is only one of the optional application scenarios for the service-based network anomaly detection method provided in this embodiment. The actual application is not fixed. Figure 1 The software and hardware environment shown.

[0070] Below, in conjunction with the aforementioned implementation environment, a service-based network anomaly detection method provided in this application embodiment will be introduced and explained.

[0071] Please refer to Figure 2 , Figure 2 This is a schematic diagram of a service-based network anomaly detection method provided in an embodiment of this application. The service-based network anomaly detection method includes, but is not limited to:

[0072] Step 210: Obtain the standard process information corresponding to the pre-booked service;

[0073] Step 220: Based on the standard process information, determine the participating devices involved in executing the predetermined service, and obtain multiple historical time series data corresponding to the participating devices when the network status is normal during historical periods; wherein, each historical time series data is used to record the working index parameters of the participating devices during historical periods, and the historical time series data corresponding to each participating device has the same length;

[0074] Step 230: Perform pairwise correlation analysis on each of the historical time series data to obtain a reference data model;

[0075] Step 240: Obtain multiple first time series data corresponding to the participating devices at the current time node, perform pairwise correlation analysis on each of the first time series data to obtain a network data model; wherein, each of the first time series data is used to record the working index parameters of the participating devices at the current time node and the predetermined period before the current time node, and the length of the first time series data corresponding to each participating device is the same.

[0076] Step 250: Perform difference detection on the reference data model and the network data model, and determine the network anomaly detection result based on the difference detection result.

[0077] This application provides a service-based network anomaly detection method. This method can detect network anomalies according to specific service types. These services can be various network services, and this application does not limit their types. When executing the method in this application, the service to be analyzed can be identified, recorded as a predetermined service, and the corresponding standard process information can be obtained. In this application, network services generally follow technical specifications such as 3GPP and RFC. Therefore, for various services, the corresponding standard process information can be obtained through standard end-to-end service processes in technical specifications such as 3GPP and RFC, such as mobile internet access, mobile voice, and broadband internet access. The standard process information specifies the steps required to execute a complete predetermined service and the participating devices involved in each step. In this application, participating devices refer to network devices and network elements in the network service, and their specific types are not limited. For example, in some embodiments, participating devices may include at least one of routers, switches, core network elements, call centers, firewalls, and deep packet inspection devices.

[0078] The standard process information will indicate the collaboration between the participating devices involved in each step. For example, please refer to... Figure 3 , Figure 3This illustration shows a standard process information diagram of a network service provided in an embodiment of this application. In this embodiment, the standard process information can represent the interaction process between various devices when executing a predetermined service in a time sequence diagram. In a standard process, each step uses the resources of the corresponding participating devices, and the execution of each step causes various types of data to fluctuate over time. Furthermore, the steps in a standard process are closely related, and in a complete standard process, the various types of data of the participating devices caused by the execution of each step are temporally correlated. Therefore, in this embodiment, the participating devices involved in executing the predetermined service can be determined based on the standard process information, and multiple historical time series data corresponding to the participating devices under normal network conditions during historical periods can be obtained. Here, historical time series data is used to record the data of participating devices during historical periods. These historical periods can be divided into multiple historical cycles, and a working indicator parameter can be collected in each historical cycle to obtain historical time series data. For example, for a certain working indicator parameter, its specific value can be recorded 5 times within a historical period. These 5 values ​​can be arranged according to the recording time to form the historical time series data corresponding to the working indicator parameter within that historical period. In this application embodiment, the working indicator parameters can be set according to different participating devices. For example, in some embodiments, the working indicator parameters may include at least one of the following: device alarm parameters, port traffic parameters, device CPU parameters, memory parameters, number of online users parameters, number of registered users parameters, call success rate parameters, complaint volume parameters, complaint service parameters, firewall session count parameters, and packet detection count parameters.

[0079] In this embodiment, the length of each historical time series data collected by each parameter device is the same. For example, the length of each historical time series data can be n, where n ≥ 1 and n is a positive integer. Different participating devices can correspond to one or more working indicator parameters. Therefore, the total number of data dimensions of the working indicator parameters in the historical time series data can be denoted as m, where m is greater than or equal to 2 and is a positive integer, i.e., the number of historical time series data. It is understood that the larger the data dimension of the working indicator parameters, the higher the accuracy of subsequent anomaly detection and the more detectable situations, but the higher the computational power requirement. When computational power is limited, it will affect the efficiency of anomaly detection. Therefore, in this embodiment, the data dimension of the working indicator parameters can be comprehensively determined according to the requirements, and this application does not impose any restrictions on this. Figure 3 As shown, the dataset used in the calculation should include the operating parameters of participating devices: Device 1, Device 2, Device 3, and Device 4. The number of different types of operating parameters used by each participating device can be flexibly selected.

[0080] In this embodiment of the application, after obtaining multiple historical time series data, pairwise correlation analysis can be performed on each historical time series data to obtain a reference data model. Specifically, the reference... Figure 4 The step of performing pairwise correlation analysis on each of the historical time series data to obtain a reference data model includes:

[0081] Perform pairwise correlation analysis on each of the aforementioned historical time series data to obtain correlation values;

[0082] The correlation values ​​are quantified and arranged in a matrix to obtain the reference data model.

[0083] In this embodiment of the application, the correlation value between two historical time series data can be calculated using the following formula:

[0084]

[0085] In the formula, i and j represent the serial numbers of the historical time series data, and k i Let k represent the i-th historical time series data. j Let r represent the j-th historical time series data. ij This represents the correlation value between two historical time series data, where n represents the total length of the historical time series data and m represents the number of historical time series data.

[0086] After obtaining the correlation values ​​between every two historical time series data, they can be quantified and arranged in a matrix to obtain a reference data model, which is specifically represented as follows:

[0087]

[0088] In the formula, PD represents the reference data model, where the value in the i-th row and j-th column represents the quantified correlation between the i-th and j-th historical time series data. The quantified correlation result is a natural number in the interval [-1, 1], where less than 0 indicates a negative correlation, greater than 0 indicates a positive correlation, the closer to -1 indicates a strong negative correlation between the two historical time series data, and the closer to 1 indicates a strong positive correlation between the two historical time series data.

[0089] In this embodiment of the application, for practical analysis applications, multiple first time series data corresponding to the participating devices at the current time node can be obtained. These first time series data can record the working indicator parameters of the participating devices at the current time node and for a predetermined period prior to the current time node. That is, working indicator parameters at the current time node and some time nodes prior to the current time node can be collected and arranged in chronological order to obtain the first time series data. Then, pairwise correlation analysis can be performed on each of the first time series data to obtain the network data model. The above implementation process is similar to the process of obtaining the reference data model and will not be elaborated here.

[0090] It is understood that in this embodiment, the reference data model is collected and analyzed under the condition that the participating devices are in a normal network state. If the participating devices are still in a normal network state at the current time point, the difference between the reference data model and the network data model should be relatively small. Conversely, if the difference between the reference data model and the network data model is large, it indicates that a network anomaly may have occurred. Therefore, in this embodiment, a difference detection can be performed on the reference data model and the network data model, and the detection result corresponding to the network can be determined based on the result of the difference detection.

[0091] Specifically, in some embodiments, acquiring multiple historical time series data corresponding to the participating devices under normal network conditions during historical periods includes:

[0092] For the target device, determine the type of parameter for which the operating performance parameters of the target device need to be acquired; the target device can be any of the participating devices.

[0093] Based on the parameter type, obtain the working indicator parameters corresponding to the target device under normal network conditions at multiple historical nodes;

[0094] Based on the chronological order, the working indicator parameters of each parameter type are integrated to obtain the corresponding historical time series data for each parameter type.

[0095] In this embodiment, when collecting historical time-series data, the currently participating device is designated as the target device. For the target device, the parameter types of the target device's operational metrics parameters to be acquired can be determined first. Then, the operational metrics parameters corresponding to the target device under normal network conditions at multiple historical nodes can be acquired. Based on the chronological order, the operational metrics parameters of each parameter type are integrated to obtain the corresponding historical time-series data for each parameter type. In this embodiment, there are no restrictions on the specific types and number of parameter types selected; they can be flexibly selected according to actual needs.

[0096] In some embodiments, the method further includes:

[0097] Obtain the amount of available computing resources;

[0098] Based on the amount of computing resources, determine the number of parameter types of the work indicator parameters contained in the acquired historical time series data and the first time series data.

[0099] In this embodiment, when acquiring historical time-series data and first time-series data, as mentioned earlier, the larger the data dimension of the working indicator parameters, the higher the accuracy of subsequent anomaly detection and the more detectable situations, but the higher the computational power requirement. Therefore, in this embodiment, the available computing resources can be obtained, and then the number of parameter types of the working indicator parameters contained in the acquired historical time-series data and first time-series data can be determined based on the available computing resources. The larger the available computing resources, the more parameter types of the working indicator parameters can be obtained. This application does not limit the specific functional relationship between the two.

[0100] In some embodiments, the step of performing difference detection on the reference data model and the network data model, and determining the network anomaly detection result based on the difference detection result, includes:

[0101] Calculate the paradigm distance between the reference data model and the network data model;

[0102] If the paradigm distance is greater than a preset threshold, the network anomaly detection result is determined to be that the network has an anomaly; or, if the paradigm distance is less than or equal to the preset threshold, the network anomaly detection result is determined to be that the network does not have an anomaly.

[0103] In this embodiment, when performing difference detection on the reference data model and the network data model, the paradigm distance between the reference data model and the network data model can be calculated. The larger the paradigm distance, the greater the difference between the two models, indicating that the current trend of network data change does not conform to the standard process defined by 3GPP and RFC specifications. In this embodiment, a difference threshold can be preset. If the threshold is exceeded, it indicates that the current trend of network data change does not conform to the standard process defined by 3GPP and RFC specifications, resulting in an abnormal situation in the network, and this abnormality may cause service impairment. In this embodiment, the size of the preset threshold can be set according to the detection accuracy and network reliability. The higher the detection accuracy of the service requirements, the smaller the preset threshold value; the weaker the network reliability, the smaller the preset threshold value. Specifically, it can be determined through continuous experimentation and comparison based on the current network status. This application does not limit its size. Here, the formula for calculating the paradigm distance is as follows:

[0104]

[0105] In the formula, PD represents the reference data model, MD represents the network data model, d(PD,MD) represents the normal distance between the reference data model and the network data model, and x ij This represents the value in the i-th row and j-th column of the reference data model, y. ij This represents the value in the i-th row and j-th column of the network data model.

[0106] In some embodiments, the step of performing difference detection on the reference data model and the network data model, and determining the network anomaly detection result based on the difference detection result, further includes:

[0107] If the network anomaly detection result indicates that there is an anomaly in the network, calculate the difference between the correlation values ​​at each corresponding position in the reference data model and the network data model.

[0108] Based on the maximum value of the difference, the participating device that caused the predetermined service network anomaly is determined.

[0109] In this embodiment, if the calculated paradigm distance does not exceed a preset threshold, the network anomaly detection result is determined to be that the network does not have anomalies, and no further processing is required. If the preset threshold is exceeded, the network anomaly detection result is determined to be that the network has anomalies. In this embodiment, the difference between the correlation values ​​at various corresponding positions in the reference data model and the network data model can be further calculated, and the specific formula is as follows:

[0110]

[0111] Through the above calculations, the differences between various correlation values ​​can be determined. In this embodiment, the maximum difference between the correlation values ​​in the reference data model and the network data model can be found. It is understood that the maximum difference indicates the largest deviation between the two, which is likely due to a problem with the relevant participating equipment, leading to network anomalies. Therefore, in this embodiment, the maximum difference can be used to determine the abnormal steps in the business process and identify the participating equipment causing the predetermined business network anomaly. Find the relationship with the largest difference, max(diff). mm The formula is as follows.

[0112] max(diff mm = max|Diff(PD,MD)|

[0113] The following section, using a specific implementation case, introduces and explains the implementation process of a service-based network anomaly detection method provided in this application embodiment.

[0114] Reference Figure 5 , Figure 5 This illustration shows a schematic diagram illustrating the implementation principle of a service-based network anomaly detection method provided in this application embodiment. This application embodiment utilizes section 5.3.8.4 of 3GPP TS23.401 version 8.2.0 Release 8, as shown below. Figure 6 The flowchart shown illustrates the sequence of the HSS startup separation procedure, and the outflow traffic data of the corresponding ports of the MME device in steps 2 and 3 are collected via SNMP. The specific process of this application includes the following steps:

[0115] Step 1: Determine the dataset to be used in the computation. Determine the MME device in... Figure 6 The ports used in steps 2 and 3 are shown below. The ports used in step 2 are: 4 / 0 / 7, 3 / 0 / 3, 3 / 0 / 2, 3 / 0 / 0, 2 / 0 / 3, 2 / 0 / 2; and the ports used in step 3 are: 3 / 0 / 1, 2 / 0 / 1.

[0116] Step 2: Data Acquisition. Use SNMP to collect port traffic of the MME, referring to... Figure 7 , Figure 7 This illustration shows a schematic diagram of the principle of collecting port traffic according to an embodiment of this application. In this embodiment, the start and end time of the outflow traffic data for each port is from 0:01:55 on February 8, 2024 to 14:56:58 on February 23, 2024. This embodiment uses live network data, and the live network management system collects data every 5 minutes. A total of 4257 cycles were collected for each port, resulting in 4257 data points per port. The faulty port is 4 / 0 / 7, and the occurrence time is 17:26:54 on February 22, 2024 (the 4000th cycle); the recovery time is 18:21:54 on February 22, 2024 (the 4011th cycle). (Refer to...) Figure 8 , Figure 8 This is a data traffic trend chart provided in the embodiments of this application, where the horizontal axis is the collection period and the vertical axis is the traffic value collected in that period.

[0117] Step 3: Determine the length of the time series data for the indicators to be analyzed, i.e., how many time periods need to be calculated. Considering the computing power of the host available in this embodiment, the length of the time series data to be analyzed is set to 100. Sampling is performed at 5 minutes per period, and each calculation involves 100 periods of outflow traffic data from a single port, i.e., outflow traffic data from that port within 500 minutes.

[0118] Step 4: Calculate the reference data model. In this embodiment, the data from the first 100 periods of the dataset is used as the historical fault-free dataset to calculate the reference data model. It is calculated that the outflow traffic data of the ports used in steps 2 and 3 are strongly correlated under fault-free conditions. Between steps 2 and 3, due to the sequential nature of the process, the outflow traffic data of the ports used also have a weak correlation. Therefore, combined with the description in step 1, the reference data model PD in this case is determined as shown in Table 1:

[0119] Table 1

[0120] PD 4 / 0 / 7 3 / 0 / 3 3 / 0 / 2 3 / 0 / 0 2 / 0 / 3 2 / 0 / 2 3 / 0 / 1 2 / 0 / 1 4 / 0 / 7 0 0.9 0.8 0.9 0.9 1 0.6 0.6 3 / 0 / 3 0.9 0 0.9 0.9 0.8 0.9 0.6 0.6 3 / 0 / 2 0.8 0.9 0 1 0.9 0.9 0.6 0.6 3 / 0 / 0 0.9 0.9 1 0 1 0.9 0.6 0.6 2 / 0 / 3 0.9 0.8 0.9 1 0 1 0.6 0.6 2 / 0 / 2 1 0.9 0.9 0.9 1 0 0.6 0.6 3 / 0 / 1 0.6 0.6 0.6 0.6 0.6 0.6 0 1 2 / 0 / 1 0.6 0.6 0.6 0.6 0.6 0.6 1 0

[0121] Step 5: Calculate the network data model. Each calculation is updated in real time, ultimately using the outflow traffic from multiple ports, with each port representing 100 cycles, as the dataset for anomaly detection calculations. Referring to Step 2, taking the outflow traffic data collected from MME port 3 / 0 / 1 as an example, the data used for calculation at each time for this port is as follows: Figure 7 As shown. The data used in the calculations by other ports are consistent with those used by MME ports 3 / 0 / 1.

[0122] Step 6: Perform feature extraction and normalization on the time series data to make the data features more obvious and facilitate subsequent calculations.

[0123] Step 7: Use the sequence correlation algorithm to calculate the correlation between pairs of indicators to obtain the network data model. Based on the fault phenomena and data fluctuations described in Step 2, the calculation results of the network data model under fault-free conditions (Table 2) and the calculation results of the network data model under fault conditions (Table 2) are explained below.

[0124] When there are no faults: the period is taken as 1000-1100, during which the network is normal. The correlation between each pair of ports is calculated, and the network data model for this period is shown in Table 2.

[0125] Table 2

[0126] MD 4 / 0 / 7 3 / 0 / 3 3 / 0 / 2 3 / 0 / 0 2 / 0 / 3 2 / 0 / 2 3 / 0 / 1 2 / 0 / 1 4 / 0 / 7 1.00000 0.95148 0.95380 0.95278 0.95279 0.95246 0.82382 0.82937 3 / 0 / 3 0.95148 1.00000 0.96184 0.94987 0.95208 0.95173 0.83042 0.82557 3 / 0 / 2 0.95380 0.96184 1.00000 0.95184 0.95311 0.95110 0.83284 0.82690 3 / 0 / 0 0.95278 0.94987 0.95184 1.00000 0.95243 0.95137 0.82747 0.82307 2 / 0 / 3 0.95279 0.95208 0.95311 0.95243 1.00000 0.95204 0.82209 0.83498 2 / 0 / 2 0.95246 0.95173 0.95110 0.95137 0.95204 1.00000 0.82105 0.82687 3 / 0 / 1 0.82382 0.83042 0.93284 0.92747 0.92209 0.92105 1.00000 0.94904 2 / 0 / 1 0.82937 0.82557 0.92690 0.92307 0.93498 0.92687 0.94904 1.00000

[0127] During a fault: A period of 4000–4100 seconds is used. When the network is in a fault state, the correlation between each pair of ports is calculated. The resulting network data model for this period is shown in Table 3.

[0128] Table 3

[0129] MD 4 / 0 / 7 3 / 0 / 3 3 / 0 / 2 3 / 0 / 0 2 / 0 / 3 2 / 0 / 2 3 / 0 / 1 2 / 0 / 1 4 / 0 / 7 1.0000 -0.1105 -0.1129 -0.1052 -0.1152 -0.1038 0.28140 0.26580 3 / 0 / 3 -0.1105 1.0000 0.88567 0.86016 0.87114 0.87112 0.69694 0.68595 3 / 0 / 2 -0.1129 0.88567 1.0000 0.85924 0.86860 0.86812 0.69143 0.67852 3 / 0 / 0 -0.1052 0.86016 0.85924 1.0000 0.86351 0.86878 0.69410 0.69146 2 / 0 / 3 -0.1152 0.87114 0.86860 0.86351 1.0000 0.87194 0.6895 0.70578 2 / 0 / 2 -0.1038 0.87112 0.86812 0.86878 0.87194 1.0000 0.68781 0.68526 3 / 0 / 1 0.28140 0.69694 0.69143 0.69410 0.6895 0.68781 1.0000 0.82999 2 / 0 / 1 0.26580 0.68595 0.67852 0.69146 0.70578 0.68526 0.82999 1.0000

[0130] Step 8: Calculate the normative distance between the reference data model (PD) and the network data model (MD) to determine the differences between the two models. In this embodiment, based on the current network situation, real experimental data is used to continuously debug and test to determine the required detection accuracy of the MME, ultimately achieving a detection threshold of 1. That is, if the normative distance between the reference data model and the network data model is greater than or equal to 1, it indicates that a fault has occurred in the network; if it is less than 1, the network is fault-free. The detection results when there is no fault and the detection results when there is a fault are described below:

[0131] When there is no fault, the normal distance calculated by comparing the reference data model in Table 1 with the network data model when there is no fault in Table 2 is 0.6, which does not exceed the detection threshold of 1. Therefore, the network is judged to be fault-free at this time.

[0132] In case of failure: Table 1 refers to the data model and Table 3 refers to the network data model in case of failure. The normal distance calculation result is 7, which is far beyond the detection threshold of 1. Therefore, it is judged that the network is faulty.

[0133] Step Nine: When a network fault is detected, calculate the difference between the reference data model in Table 1 and the network data model in Table 3 when a fault occurs, and calculate the relationship pair with the largest value at this time as {(4 / 0 / 7, 3 / 0 / 3), (4 / 0 / 7, 3 / 0 / 2), (4 / 0 / 7, 3 / 0 / 0), (4 / 0 / 7, 2 / 0 / 3), (4 / 0 / 7, 2 / 0 / 2)}. This result can be output to the operation and maintenance personnel for further anomaly localization and handling.

[0134] It can be seen that the method in the embodiments of this application has at least the following beneficial effects:

[0135] 1. Strongly related to business processes: Since 3GPP and RFC are unified standards recognized by the communications industry, this application can use the standard business processes specified in 3GPP and RFC specifications as a theoretical basis to determine the data sources that need to be analyzed for anomaly detection. This reduces the dependence of network anomaly detection on human experience;

[0136] 2. This application can utilize multi-dimensional time-series data currently available in various networks, including multi-directional traffic of each device in the network, alarm count of each device, CPU, memory, number of routing entries, etc., without requiring further expansion of the existing network data acquisition function. It can use various types of network time-series data for anomaly detection, ensuring the accuracy of the detection. Furthermore, it can react quickly and accurately to abnormal events caused by human error leading to network forwarding anomalies, incorrect bandwidth configuration, detailed route hijacking, and other improper business logic.

[0137] 3. This application uses data that can be obtained from the network management system in real time at the current stage, and synchronizes the latest collection period data from the network management system in real time for calculation. It can analyze the latest status of the network in real time and make more accurate and faster decisions.

[0138] Reference Figure 9 This application also provides a service-based network anomaly detection system, including:

[0139] Acquisition unit 910 is used to acquire standard process information corresponding to the pre-ordered business;

[0140] The first processing unit 920 is used to determine the participating devices involved in executing the predetermined service according to the standard process information, and to obtain multiple historical time series data corresponding to the participating devices when the network status is normal during a historical period; wherein, each historical time series data is used to record the working index parameters of the participating devices during the historical period, and the historical time series data corresponding to each participating device has the same length.

[0141] Analysis unit 930 is used to perform pairwise correlation analysis on each of the historical time series data to obtain a reference data model;

[0142] The second processing unit 940 is used to acquire multiple first time series data corresponding to the participating devices at the current time node, perform pairwise correlation analysis on each of the first time series data to obtain a network data model; wherein, each of the first time series data is used to record the working index parameters of the participating devices at the current time node and the predetermined period before the current time node, and the length of the first time series data corresponding to each participating device is the same.

[0143] The discrimination unit 950 is used to perform difference detection on the reference data model and the network data model, and determine the detection result based on the difference detection result.

[0144] It is understood that the content of the above method embodiments is applicable to this system embodiment. The specific functions implemented in this system embodiment are the same as those in the above method embodiments, and the beneficial effects achieved are also the same as those achieved in the above method embodiments.

[0145] Reference Figure 10 This application provides an electronic device, including:

[0146] At least one processor 1010;

[0147] At least one memory 1020 is used to store at least one program;

[0148] When at least one program is executed by at least one processor 1010, the at least one processor 1010 implements the above-described service-based network anomaly detection method.

[0149] Similarly, the content of the above method embodiments is applicable to the embodiments of this electronic device. The specific functions implemented by the embodiments of this electronic device are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0150] This application embodiment also provides a computer-readable storage medium storing a program executable by a processor 1010, which, when executed by the processor 1010, is used to perform the above-described service-based network anomaly detection method.

[0151] Similarly, the content of the above method embodiments is applicable to the present computer-readable storage medium embodiments. The specific functions implemented by the present computer-readable storage medium embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0152] In some alternative embodiments, the functions / operations mentioned in the block diagrams may not occur in the order shown in the operation diagrams. For example, depending on the functions / operations involved, two consecutively shown blocks may actually be executed substantially simultaneously, or the blocks may sometimes be executed in reverse order. Furthermore, the embodiments presented and described in the flowcharts of this application are provided by way of example to provide a more comprehensive understanding of the technology. The disclosed methods are not limited to the operations and logic flows presented herein. Alternative embodiments are contemplated in which the order of various operations is changed and sub-operations described as part of a larger operation are executed independently.

[0153] Furthermore, although this application is described in the context of functional modules, it should be understood that, unless otherwise stated to the contrary, one or more of the functions and / or features may be integrated into a single physical device and / or software module, or one or more functions and / or features may be implemented in a separate physical device or software module. It is also understood that a detailed discussion of the actual implementation of each module is unnecessary for understanding this application. Rather, given the properties, functions, and internal relationships of the various functional modules in the apparatus disclosed herein, the actual implementation of the module will be understood within the scope of conventional technology for an engineer. Therefore, those skilled in the art can implement the application set forth in the claims using ordinary techniques without excessive experimentation. It is also understood that the specific concepts disclosed are merely illustrative and not intended to limit the scope of this application, which is determined by the full scope of the appended claims and their equivalents.

[0154] If a function is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0155] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a processor-included system, or other system that can fetch and execute instructions from, an instruction execution system, apparatus, or device). For the purposes of this specification, "computer-readable medium" can be any means that can contain, store, communicate, propagate, or transmit programs for use by, or in conjunction with, an instruction execution system, apparatus, or device.

[0156] More specific examples of computer-readable media (a non-exhaustive list) include: electrical connections (electronic devices) having one or more wires, portable computer disk drives (magnetic devices), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic devices, and portable optical disc read-only memory (CDROM). Furthermore, computer-readable media can even be paper or other suitable media on which programs can be printed, because programs can be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, interpreting, or otherwise processing as necessary, and then stored in computer memory.

[0157] It should be understood that various parts of this application can be implemented using hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented using software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0158] In the foregoing description of this specification, the references to terms such as "one embodiment," "another embodiment," or "some embodiments," etc., indicate that a specific feature, structure, material, or characteristic described in connection with an embodiment or example is included in at least one embodiment or example of this application. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0159] Although embodiments of this application have been shown and described, those skilled in the art will understand that various changes, modifications, substitutions and variations can be made to these embodiments without departing from the principles and spirit of this application, the scope of which is defined by the claims and their equivalents.

[0160] The above is a detailed description of the preferred embodiments of this application, but this application is not limited to the embodiments. Those skilled in the art can make various equivalent modifications or substitutions without departing from the spirit of this application, and these equivalent modifications or substitutions are all included within the scope defined by the claims of this application.

Claims

1. A service-based network anomaly detection method, characterized in that, The method includes: Obtain standard process information corresponding to the reservation service; Based on the standard process information, the participating devices involved in executing the predetermined service are determined, and multiple historical time series data corresponding to the participating devices under normal network conditions during historical periods are obtained; wherein, each historical time series data is used to record the working index parameters of the participating devices during historical periods, and the historical time series data corresponding to each participating device has the same length; A pairwise correlation analysis was performed on each of the aforementioned historical time series data to obtain a reference data model; Multiple first time series data corresponding to the participating devices at the current time node are obtained, and pairwise correlation analysis is performed on each of the first time series data to obtain a network data model; wherein, each of the first time series data is used to record the working index parameters of the participating devices at the current time node and the predetermined period before the current time node, and the length of the first time series data corresponding to each participating device is the same. The reference data model and the network data model are subjected to difference detection, and the detection result is determined based on the difference detection result.

2. The network anomaly detection method based on services according to claim 1, characterized in that, The participating devices include at least one of the following: routers, switches, core network elements, call centers, firewalls, and deep packet inspection devices; the working performance parameters include at least one of the following: device alarm parameters, port traffic parameters, device CPU parameters, memory parameters, number of online users parameters, number of registered users parameters, call success rate parameters, complaint volume parameters, complaint service parameters, firewall session count parameters, and packet inspection count parameters.

3. The network anomaly detection method based on services according to claim 1, characterized in that, The acquisition of multiple historical time series data corresponding to the participating devices under normal network conditions during historical periods includes: For the target device, determine the type of parameter for which the operating performance parameters of the target device need to be acquired; the target device can be any of the participating devices. Based on the parameter type, obtain the working indicator parameters corresponding to the target device under normal network conditions at multiple historical nodes; Based on the chronological order, the working indicator parameters of each parameter type are integrated to obtain the corresponding historical time series data for each parameter type.

4. A service-based network anomaly detection method according to any one of claims 1-3, characterized in that, The method further includes: Obtain the amount of available computing resources; Based on the amount of computing resources, determine the number of parameter types of the work indicator parameters contained in the acquired historical time series data and the first time series data.

5. The network anomaly detection method based on services according to claim 1, characterized in that, The step of performing pairwise correlation analysis on each of the historical time series data to obtain a reference data model includes: Perform pairwise correlation analysis on each of the aforementioned historical time series data to obtain correlation values; The correlation values ​​are quantified and arranged in a matrix to obtain the reference data model.

6. The network anomaly detection method based on services according to claim 5, characterized in that, The step of performing difference detection on the reference data model and the network data model, and determining the network anomaly detection result based on the difference detection result, includes: Calculate the paradigm distance between the reference data model and the network data model; If the paradigm distance is greater than a preset threshold, the network anomaly detection result is determined to be that the network has an anomaly; or, if the paradigm distance is less than or equal to the preset threshold, the network anomaly detection result is determined to be that the network does not have an anomaly.

7. The network anomaly detection method based on services according to claim 6, characterized in that, The step of performing difference detection on the reference data model and the network data model, and determining the network anomaly detection result based on the difference detection result, further includes: If the network anomaly detection result indicates that there is an anomaly in the network, calculate the difference between the correlation values ​​at each corresponding position in the reference data model and the network data model. Based on the maximum value of the difference, the participating device that caused the predetermined service network anomaly is determined.

8. A service-based network anomaly detection system, characterized in that, The system includes: The acquisition unit is used to acquire standard process information corresponding to the pre-defined business. The first processing unit is configured to determine the participating devices involved in executing the predetermined service based on the standard process information, and to obtain multiple historical time series data corresponding to the participating devices when the network status is normal during a historical period; wherein, each historical time series data is used to record the working index parameters of the participating devices during the historical period, and the historical time series data corresponding to each participating device has the same length; The analysis unit is used to perform pairwise correlation analysis on each of the historical time series data to obtain a reference data model; The second processing unit is used to acquire multiple first time series data corresponding to the participating devices at the current time node, perform pairwise correlation analysis on each of the first time series data, and obtain a network data model; wherein, each of the first time series data is used to record the working index parameters of the participating devices at the current time node and the predetermined period before the current time node, and the length of the first time series data corresponding to each participating device is the same. The discrimination unit is used to perform difference detection on the reference data model and the network data model, and determine the detection result based on the difference detection result.

9. An electronic device, characterized in that, include: At least one processor; At least one memory for storing at least one program; When the at least one program is executed by the at least one processor, the at least one processor implements a service-based network anomaly detection method as described in any one of claims 1-7.

10. A computer-readable storage medium storing a processor-executable program, characterized in that, The processor-executable program, when executed by the processor, is used to implement a service-based network anomaly detection method as described in any one of claims 1-7.

Images