Network management log analysis method and device, electronic equipment and storage medium

Abstract

The present disclosure relates to the technical field of computer, and particularly relates to a network management log analysis method and device, electronic equipment and storage medium. The network management log analysis method comprises the following steps: obtaining a network management log to be analyzed and an operation information set corresponding to the network management log to be analyzed, wherein the operation information set comprises operation account information, operation time information and operation cell performance information; constructing a change operation feature set according to the operation content information corresponding to the network management log to be analyzed and the operation information set, wherein the change operation feature set comprises time features, account attribute features, account time features, operation command features and operation cell performance features; inputting the change operation feature set into a target network management log analysis model for feature fusion recognition to obtain an analysis result corresponding to the network management log to be analyzed. The present disclosure can reduce the negative impact of network change operations on the network.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the technical field of computer technology, and particularly relates to a network management log analysis method and device, electronic equipment and storage medium. BACKGROUND

[0002] With the development of science and technology, more and more services are carried by communication networks. Due to factors such as complex network coverage scenarios and multiple parameters, network change requirements are gradually increasing. In the related art, a network change operation is provided by a demand party with a demand work order, and after manual auditing of the demand work order, an Operation and Maintenance Center (OMC) executor executes the network change operation and generates a wireless base station operation change record (i.e., a network management log). However, the accuracy of manual auditing of the demand work order is low, and after a network problem occurs, the historical network management log corresponding to the network is manually analyzed to find the root cause of the problem, resulting in a large number of cases in which the network change operation has a negative impact on the network. SUMMARY

[0003] The present disclosure provides a network management log analysis method and device, electronic equipment and storage medium to at least solve the technical problem that the network change operation has a negative impact on the network in the related art. The technical solutions of the present disclosure are as follows:

[0004] According to a first aspect of an embodiment of the present disclosure, a network management log analysis method is provided, comprising:

[0005] obtaining a network management log to be analyzed and an operation information set corresponding to the network management log to be analyzed, wherein the operation information set comprises operation account information, operation time information and operation cell performance information;

[0006] constructing a change operation feature set according to operation content information corresponding to the network management log to be analyzed and the operation information set, wherein the change operation feature set comprises time features, account attribute features, account time features, operation command features and operation cell performance features;

[0007] inputting the change operation feature set into a target network management log analysis model for feature fusion recognition to obtain an analysis result corresponding to the network management log to be analyzed, wherein the analysis result comprises a probability of a violation operation corresponding to the network management log to be analyzed.

[0008] Optionally, before the change operation feature set is constructed according to the operation content information corresponding to the network management log to be analyzed and the operation information set, the method further comprises:

[0009] inputting the network management log to be analyzed into a target named entity recognition model for named entity recognition, to obtain operation content information corresponding to the network management log to be analyzed, wherein the operation content information comprises an operation command, a cell name, an adjustment parameter, and an adjustment value.

[0010] Optionally, before the inputting the network management log to be analyzed into the target named entity recognition model for named entity recognition, the method further comprises:

[0011] obtaining a network management log training sample set, and labeling any network management log training sample in the network management log training sample set to obtain a labeled network management log training sample set;

[0012] updating model parameters of a named entity recognition pre-training model according to the labeled network management log training sample set, to obtain a target named entity recognition model.

[0013] Optionally, the constructing a change operation feature set according to the operation content information corresponding to the network management log to be analyzed and the operation information set comprises:

[0014] constructing an operation command feature according to the operation content information, constructing a time feature according to the operation time information, and constructing an account attribute feature according to the operation account information;

[0015] constructing an account time feature according to the operation account information and the operation time information;

[0016] constructing an operation cell performance feature according to the operation content information, the operation cell performance information, and the operation time information.

[0017] Optionally, before the inputting the change operation feature set into the target network management log analysis model for feature fusion recognition to obtain an analysis result corresponding to the network management log to be analyzed, the method further comprises:

[0018] obtaining a change operation feature data set, and performing label data matching on the change operation feature data set to obtain a labeled change operation feature data set, wherein the labeled change operation feature data set comprises a training set and a test set;

[0019] training at least one decision tree according to the training set in sequence until a training pause condition is met, to obtain a gradient boosting decision tree classification training model;

[0020] performing iterative training on the gradient boosting decision tree classification training model according to the test set until a test pause condition is met, to obtain a target network management log analysis model, wherein the target network management log analysis model comprises at least one target gradient boosting decision tree.

[0021] Optionally, the sequentially training at least one decision tree according to the training set comprises:

[0022] obtaining a test timestamp corresponding to the test set and a training timestamp corresponding to any training sample in the training set;

[0023] determining a time length between the training timestamp and the test timestamp, determining a weight corresponding to the any training sample according to the time length, and obtaining a weight set corresponding to the training set;

[0024] sequentially training at least one decision tree according to the training set and the weight set.

[0025] Optionally, the sequentially training at least one decision tree according to the training set comprises:

[0026] in a first round of training, taking a real value of a probability of a violation operation corresponding to the training set as a learning goal, constructing a first decision tree according to the training set, and determining a first residual error corresponding to the first decision tree, wherein the first residual error is determined by the real value of the probability of the violation operation and a predicted value of the probability of the violation operation output by the first decision tree;

[0027] in an M+1th round of training, taking an Mth residual error corresponding to an Mth decision tree as a learning goal, constructing an M+1th decision tree according to the training set, and determining an M+1th residual error corresponding to the M+1th decision tree, wherein M is a positive integer, and the M+1th residual error is determined by the Mth residual error and a predicted value of the probability of the violation operation output by the M+1th decision tree.

[0028] Optionally, the step of constructing the decision tree comprises:

[0029] determining a weighted Gini coefficient corresponding to at least one feature of a change operation in the training set, and recursively dividing the training set by selecting a feature of a change operation with the minimum weighted Gini coefficient, until a division stop condition is met, to obtain the decision tree.

[0030] Optionally, the determining the weighted Gini coefficient corresponding to at least one feature of a change operation in the training set comprises:

[0031] determining at least two feature category subsets corresponding to any feature of a change operation in the at least one feature of a change operation according to the training set;

[0032] if any feature category sample in the feature category sample subset includes a violation operation label, the feature category sample subset is put into a first sample set, and a division proportion value corresponding to the first sample set is determined;

[0033] If all the feature category samples in the feature category sample subset do not include the illegal operation label, the feature category sample subset is put into a second sample set, and a division proportion value corresponding to the second sample set is determined;

[0034] The sample set with a high division proportion value is set as a left child, and a first Gini coefficient corresponding to the left child is determined;

[0035] The sample set with a low division proportion value is set as a right child, and a second Gini coefficient corresponding to the right child is determined;

[0036] According to the first Gini coefficient and the second Gini coefficient, a weighted Gini coefficient corresponding to any change operation feature is determined, to obtain a weighted Gini coefficient corresponding to at least one change operation feature.

[0037] Optionally, the analysis result corresponding to the to-be-analyzed network management log is obtained by inputting the change operation feature set into a target network management log analysis model for feature fusion recognition, including:

[0038] The change operation feature set is input into each target gradient boosting decision tree in the target network management log analysis model, to obtain an illegal operation probability prediction value output by the at least one target gradient boosting decision tree;

[0039] The illegal operation probability prediction values output by the at least one target gradient boosting decision tree are accumulated, to obtain an illegal operation probability corresponding to the to-be-analyzed network management log.

[0040] Optionally, the inputting of the change operation feature set into each target gradient boosting decision tree in the target network management log analysis model includes:

[0041] If the feature category of any change operation feature in the change operation feature set is a category type, the any change operation feature is subjected to one-hot encoding, to obtain an encoded change operation feature set;

[0042] All the change operation features in the encoded change operation feature set are spliced, to obtain a feature vector corresponding to the encoded change operation feature set;

[0043] The feature vector is input into each target gradient boosting decision tree in the target network management log analysis model.

[0044] According to a second aspect of the embodiments of the present disclosure, a network management log analysis device is provided, including:

[0045] The information acquisition unit is configured to acquire a network management log to be analyzed and a set of operation information corresponding to the network management log to be analyzed, wherein the set of operation information comprises operation account information, operation time information, and operation cell performance information.

[0046] The feature construction unit is configured to construct a set of change operation features according to the operation content information corresponding to the network management log to be analyzed and the set of operation information, wherein the set of change operation features comprises time features, account attribute features, account time features, operation command features, and operation cell performance features.

[0047] The feature recognition unit is configured to input the set of change operation features into a target network management log analysis model for feature fusion recognition to obtain an analysis result corresponding to the network management log to be analyzed, wherein the analysis result comprises a probability of a violation operation corresponding to the network management log to be analyzed.

[0048] Optionally, the apparatus further comprises an entity recognition unit configured to, before the set of change operation features is constructed according to the operation content information corresponding to the network management log to be analyzed and the set of operation information, specifically:

[0049] input the network management log to be analyzed into a target named entity recognition model for named entity recognition to obtain the operation content information corresponding to the network management log to be analyzed, wherein the operation content information comprises an operation command, a cell name, an adjustment parameter, and an adjustment value.

[0050] Optionally, the entity recognition unit is further configured to, before the network management log to be analyzed is input into the target named entity recognition model for named entity recognition, specifically:

[0051] acquire a set of network management log training samples, and label any network management log training sample in the set of network management log training samples to obtain a set of labeled network management log training samples;

[0052] update model parameters of a named entity recognition pre-training model according to the set of labeled network management log training samples to obtain the target named entity recognition model.

[0053] Optionally, the feature construction unit is configured to, when the set of change operation features is constructed according to the operation content information corresponding to the network management log to be analyzed and the set of operation information, specifically:

[0054] construct operation command features according to the operation content information, construct time features according to the operation time information, and construct account attribute features according to the operation account information.

[0055] construct an account time feature according to the operation account information and the operation time information;

[0056] construct an operation cell performance feature according to the operation content information, the operation cell performance information and the operation time information.

[0057] Optionally, the apparatus further includes a model training unit, configured to, before the inputting of the change operation feature set into the target network management log analysis model and the obtaining of the analysis result corresponding to the network management log to be analyzed, specifically configured to:

[0058] obtain a change operation feature dataset, and perform label data matching on the change operation feature dataset to obtain a labeled change operation feature dataset, wherein the labeled change operation feature dataset includes a training set and a test set;

[0059] train at least one decision tree according to the training set in sequence until a training pause condition is met, to obtain a gradient boosting decision tree classification training model;

[0060] perform iterative training on the gradient boosting decision tree classification training model according to the test set until a test pause condition is met, to obtain a target network management log analysis model, wherein the target network management log analysis model includes at least one target gradient boosting decision tree.

[0061] Optionally, the model training unit is specifically configured to, when training at least one decision tree according to the training set in sequence:

[0062] obtain a test timestamp corresponding to the test set and a training timestamp corresponding to any training sample in the training set;

[0063] determine a time length between the training timestamp and the test timestamp, determine a weight corresponding to the any training sample according to the time length, and obtain a weight set corresponding to the training set;

[0064] train at least one decision tree according to the training set and the weight set in sequence.

[0065] Optionally, the model training unit is specifically configured to, when training at least one decision tree according to the training set in sequence:

[0066] in a first round of training, take a true value of a rule violation operation probability corresponding to the training set as a learning target, construct a first decision tree according to the training set, and determine a first residual error corresponding to the first decision tree, wherein the first residual error is determined by the true value of the rule violation operation probability and a rule violation operation probability prediction value output by the first decision tree;

[0067] In the M+1th training process, a Mth residual corresponding to a Mth decision tree is taken as a learning target, a M+1th decision tree is constructed according to the training set, and a M+1th residual corresponding to the M+1th decision tree is determined, wherein M is a positive integer, and the M+1th residual is determined by the Mth residual and a rule violation probability prediction value output by the M+1th decision tree.

[0068] Optionally, the model training unit is configured to construct the decision tree, and specifically configured to:

[0069] determine a weighted Gini coefficient corresponding to at least one change operation feature in the training set, take the training set as a root node, select a change operation feature with the minimum weighted Gini coefficient, and recursively divide the training set until a division stop condition is met, so as to obtain the decision tree.

[0070] Optionally, the model training unit is configured to determine the weighted Gini coefficient corresponding to the at least one change operation feature in the training set, and specifically configured to:

[0071] determine at least two feature category subsets corresponding to any change operation feature in the at least one change operation feature according to the training set;

[0072] if any feature category sample in the feature category sample subset includes a rule violation label, put the feature category sample subset into a first sample set, and determine a division proportion value corresponding to the first sample set;

[0073] if all feature category samples in the feature category sample subset do not include a rule violation label, put the feature category sample subset into a second sample set, and determine a division proportion value corresponding to the second sample set;

[0074] set the sample set with a high division proportion value as a left child, and determine a first Gini coefficient corresponding to the left child;

[0075] set the sample set with a low division proportion value as a right child, and determine a second Gini coefficient corresponding to the right child;

[0076] determine the weighted Gini coefficient corresponding to the any change operation feature according to the first Gini coefficient and the second Gini coefficient, so as to obtain the weighted Gini coefficient corresponding to the at least one change operation feature.

[0077] Optionally, the feature recognition unit is configured to input the change operation feature set into a target network management log analysis model for feature fusion recognition, so as to obtain an analysis result corresponding to the network management log to be analyzed, and specifically configured to:

[0078] input the change operation feature set into each target gradient boosting decision tree in the target network management log analysis model, to obtain a violation operation probability prediction value output by the at least one target gradient boosting decision tree;

[0079] accumulate the violation operation probability prediction value output by the at least one target gradient boosting decision tree, to obtain a violation operation probability corresponding to the network management log to be analyzed.

[0080] Optionally, when the feature recognition unit inputs the change operation feature set into each target gradient boosting decision tree in the target network management log analysis model, the feature recognition unit is specifically configured to:

[0081] if a feature category of any change operation feature in the change operation feature set is a category type, the any change operation feature is subjected to one-hot encoding, to obtain an encoded change operation feature set;

[0082] all change operation features in the encoded change operation feature set are spliced, to obtain a feature vector corresponding to the encoded change operation feature set;

[0083] the feature vector is input into each target gradient boosting decision tree in the target network management log analysis model.

[0084] According to a third aspect of the embodiments of the present disclosure, an electronic device is provided, comprising:

[0085] a processor;

[0086] a memory for storing instructions executable by the processor;

[0087] The processor is configured to execute the instructions to implement the network management log analysis method according to any one of the preceding aspects.

[0088] According to a fourth aspect of the present application, a storage medium is provided, when instructions in the storage medium are executed by a processor of an electronic device, the electronic device can execute the network management log analysis method according to any one of the preceding aspects.

[0089] According to a fifth aspect of the present application, a computer program product is provided, comprising a computer program, which, when executed by a processor, implements the method according to any one of the preceding aspects.

[0090] In summary, the method provided by the embodiments of the present disclosure comprises the following steps: obtaining a network management log to be analyzed and an operation information set corresponding to the network management log to be analyzed, wherein the operation information set comprises operation account information, operation time information and operation cell performance information; constructing a change operation feature set according to the operation content information corresponding to the network management log to be analyzed and the operation information set, wherein the change operation feature set comprises time features, account attribute features, account time features, operation command features and operation cell performance features; inputting the change operation feature set into a target network management log analysis model for feature fusion recognition to obtain an analysis result corresponding to the network management log to be analyzed, wherein the analysis result comprises a probability of illegal operation corresponding to the network management log to be analyzed. Therefore, by constructing the change operation feature set corresponding to the network management log to be analyzed and controlling the target network management log analysis model to recognize the change operation feature set, the network management log to be analyzed can be recognized as a network management log with illegal operation, so that the network change operator can perform the operation according to the specification requirements, thereby ensuring the smooth operation of the network and reducing the negative impact of the network change operation on the network.

[0091] It should be understood that the foregoing general description and the following detailed description are only exemplary and explanatory, and are not limiting to the present disclosure. BRIEF DESCRIPTION OF DRAWINGS

[0092] The accompanying drawings, which are incorporated into and form part of the specification, illustrate embodiments consistent with the present disclosure and, together with the specification, serve to explain the principles of the present disclosure, and do not constitute an undue limitation on the present disclosure.

[0093] Figure 1 A flowchart of a network management log analysis method provided by the embodiments of the present disclosure is shown;

[0094] Figure 2 A flowchart of another network management log analysis method provided by the embodiments of the present disclosure is shown;

[0095] Figure 3 A display diagram of a network management log training sample set provided by the embodiments of the present disclosure is shown;

[0096] Figure 4 A flowchart of feature construction provided by the embodiments of the present disclosure is shown;

[0097] Figure 5 A training flowchart of a gradient boosting decision tree classification training model provided by the embodiments of the present disclosure is shown;

[0098] Figure 6 A structural diagram of a network management log analysis device provided by the embodiments of the present disclosure is shown;

[0099] Figure 7is a block diagram of an electronic device according to an exemplary embodiment. DETAILED DESCRIPTION

[0100] In order for the ordinary person in the art to better understand the technical solutions of the present disclosure, the technical solutions in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the drawings.

[0101] It should be noted that the terms "first", "second", and the like in the specification and claims of the present disclosure and the above-described drawings are used to distinguish similar objects, and do not necessarily have to describe a specific order or sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments of the present disclosure described herein can be implemented in an order other than those illustrated or described herein. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present disclosure. Rather, they are merely examples of devices and methods consistent with some aspects of the present disclosure as detailed in the appended claims.

[0102] With the rapid development of 5G networks, the services carried by communication networks are increasing, the types of services are increasing, the scenarios are becoming more complex, and the services are becoming more important. This requires strict review of any change operation of the communication network, and operation specification to ensure stable and healthy operation of the communication network.

[0103] In the related art, the network change operation is provided by the demand party with a demand work order, and the corresponding personnel manually review the demand work order according to the work order transfer process. When the demand review is passed, the parameter platform implements script production according to the parameter specification, and then pushes it to the OMC executor to execute the parameter change operation and generate the network management log.

[0104] As can be easily understood, the above scheme has the following disadvantages:

[0105] First, the demand work order is manually reviewed, and errors are inevitable, so the accuracy is low;

[0106] Second, after the network problem occurs, the historical network management log is manually analyzed to find the root cause of the problem, and it is impossible to discover the violation operation in the middle of the operation;

[0107] Third, the network management log is a low readability, complex and unstructured text. There is a lot of redundant information in the log, and relying on manual analysis, in a large number of network management logs, useful information is extracted one by one, the efficiency is low, and it is difficult to form reusable and popularized experience, and it is also difficult to simultaneously focus on other dimension data other than the network management log itself, making it difficult to discover hidden data patterns.

[0108] Fourthly, different cells have different coverage ranges and coverage scenarios, and the number of users and network capacity conditions change over time, showing different distributions at different time points and on weekdays and weekends. The same operation instruction has different impacts on the existing network depending on the time point and the cell in which it is executed, and the existing technical solutions cannot assess the risk from the impact range of the operation.

[0109] The present disclosure will be described in detail below with reference to specific embodiments.

[0110] In a first embodiment, as shown in Figure 1 , Figure 1 shows a flowchart of a network management log analysis method provided by an embodiment of the present disclosure. The method can be implemented by relying on a computer program and can run on a device that performs the network management log analysis method. The method is performed by an electronic device.

[0111] Specifically, the network management log analysis method includes:

[0112] S101, obtaining a network management log to be analyzed and an operation information set corresponding to the network management log to be analyzed;

[0113] According to some embodiments, the network management log to be analyzed refers to a network management log that needs to be analyzed.

[0114] In some embodiments, the operation information set refers to other operation information in addition to the change operation content when the OMC executor generates the network management log to be analyzed. The operation information in the operation information set includes but is not limited to operation account information, operation time information, and operation cell performance information, etc.

[0115] Among them, the operation account information refers to the account information of the operation account when the OMC executor executes the network management log to be analyzed, which can be an operation account field for example. The operation time information refers to the timestamp or timestamp field when the OMC executor executes the network management log to be analyzed. The operation cell performance information refers to the hourly granularity capacity data of the operation cell when the OMC executor executes the network management log to be analyzed.

[0116] It is easy to understand that when the electronic device performs network management log analysis, the electronic device can obtain the network management log to be analyzed and the operation information set corresponding to the network management log to be analyzed.

[0117] S102, constructing a change operation feature set according to the operation content information of the network management log to be analyzed and the operation information set;

[0118] According to some embodiments, the operation content information refers to the key information in the network management log to be analyzed. The operation content information is structured information.

[0119] In some embodiments, the change operation feature refers to a feature used to determine whether the change operation corresponding to the network management log to be analyzed is a violation operation. The change operation feature includes, but is not limited to, a time feature, an account attribute feature, an account time feature, an operation command feature, and an operation cell performance feature.

[0120] In some embodiments, the change operation feature set refers to a set aggregated by at least one change operation feature.

[0121] It is easy to understand that when the electronic device obtains the network management log to be analyzed and the operation information set corresponding to the network management log to be analyzed, the electronic device can construct the change operation feature set according to the operation content information corresponding to the network management log to be analyzed and the operation information set.

[0122] S103, inputting the change operation feature set into the target network management log analysis model for feature fusion recognition to obtain an analysis result corresponding to the network management log to be analyzed.

[0123] According to some embodiments, the target network management log analysis model refers to a trained model used to recognize the change operation feature set.

[0124] In some embodiments, the analysis result refers to a result obtained by the target network management log analysis model after recognizing the change operation feature set. The analysis result includes a violation operation probability corresponding to the network management log to be analyzed.

[0125] It is easy to understand that when the electronic device obtains the change operation feature set, the electronic device can input the change operation feature set into the target network management log analysis model for feature fusion recognition to obtain the analysis result corresponding to the network management log to be analyzed.

[0126] In summary, the method provided by the embodiments of the present disclosure obtains the network management log to be analyzed and the operation information set corresponding to the network management log to be analyzed, constructs the change operation feature set according to the operation content information corresponding to the network management log to be analyzed and the operation information set, inputs the change operation feature set into the target network management log analysis model for feature fusion recognition, and obtains the analysis result corresponding to the network management log to be analyzed. Therefore, by constructing the change operation feature set corresponding to the network management log to be analyzed and controlling the target network management log analysis model to recognize the change operation feature set, the network management log in which the change operation belongs to a violation operation can be recognized, so that the network change operator can implement the operation according to the specification requirements, thereby ensuring the smooth operation of the network and reducing the negative impact of the network change operation on the network.

[0127] Please refer to Figure 2 , Figure 2A flowchart of a network management log analysis method provided by an embodiment of the present disclosure is shown. The method is performed by an electronic device.

[0128] Specifically, the network management log analysis method comprises:

[0129] S201, obtaining a network management log to be analyzed and a set of operation information corresponding to the network management log to be analyzed;

[0130] The specific steps are as described above, and will not be repeated here.

[0131] S202, obtaining a set of network management log training samples, and labeling any network management log training sample in the set of network management log training samples to obtain a set of labeled network management log training samples;

[0132] According to some embodiments, the set of network management log training samples refers to a set formed by at least one network management log training sample. The network management log training sample refers to a network management log sample used for training the named entity recognition pre-training model.

[0133] In some embodiments, since the network management log contains knowledge in a specific field, the named entity recognition pre-training model trained only using public corpus such as news cannot achieve the best effect. Therefore, the named entity recognition pre-training model needs to be trained using the set of network management log training samples to improve the recognition effect on the network management log.

[0134] According to some embodiments, when the set of network management log training samples is used to train the named entity recognition pre-training model, the key information in each network management log training sample in the set of network management log training samples needs to be labeled, and the labeled set of network management log training samples is used to fine-tune the named entity recognition pre-training model.

[0135] In some embodiments, Figure 3 A display diagram of a set of network management log training samples provided by an embodiment of the present disclosure is shown. As shown in Figure 3 The set of network management log training samples includes three network management log training samples in total, and the entities to be labeled from the unstructured network management log training samples include the following:

[0136] The first element: operation command, such as "MOD PDSCH CFG" in the second network management log training sample for modifying the cell reference signal power, which is the operation command; "MOD INTERFREQ HOGROUP" in the third network management log training sample for modifying the inter-frequency handover parameter group, which is the operation command;

[0137] The second element: cell name, such as the cell name in the first newly added cell in the network management log training sample, "[D-HRH]D-HRH-1";

[0138] The third element: parameter name, such as the parameter name in the second network management log training sample for modifying the cell reference signal power, "REFERENCESIGNALPWR";

[0139] The fourth element: adjustment value, such as the adjustment value in the second network management log training sample for modifying the cell reference signal power, "-21".

[0140] In some embodiments, the labeling process actually assigns a classification label to each type of element entity in the string, and the entity start, entity internal, entity end, and non-entity are marked with "B I E O" respectively, to form the label of the network management log training sample.

[0141] For example, for the cell name "[D-HRH]D-HRH-1", its label is: [CELLNAME_B, CELLNAME_I, CELLNAME_I,..., CELLNAME_E], and the remaining non-entity characters in the network management log training sample are marked as "O".

[0142] S203, updating the model parameters of the named entity recognition pre-training model according to the labeled network management log training sample set to obtain a target named entity recognition model;

[0143] As can be easily understood, after fine-tuning the named entity recognition pre-training model using the labeled network management log training sample set, the target named entity recognition model obtained can recognize various entities in the network management log to be analyzed, can extract key information from a large amount of irregular and unstructured network management logs, and is highly applicable in the network management log analysis and recognition scenario, and the recognition effect is more ideal.

[0144] S204, inputting the network management log to be analyzed into the target named entity recognition model for named entity recognition to obtain operation content information corresponding to the network management log to be analyzed;

[0145] According to some embodiments, the operation content information includes but is not limited to operation commands, cell names, adjustment parameters, and adjustment values.

[0146] It is easy to understand that by using the named entity recognition (NER) technology in the natural language field, key information such as operation commands, cell names, adjustment parameters and adjustment values can be extracted from complex and large amounts of unstructured historical analysis network logs to form structured data. At the same time, the key information is automatically and efficiently extracted, and the efficiency of extracting key information from a large number of network logs with extremely low readability is greatly improved.

[0147] S205, constructing a change operation feature set according to operation content information corresponding to the analysis network log and the operation information set;

[0148] It should be noted that for the illegal operation in the change operation, the following several cases can be used for judgment:

[0149] The first case: executing a high-risk change operation instruction in a non-allowed operation time period will affect the performance of the cell; therefore, the performance indicators of the operation cell in the same time period last week are compared to determine whether the change operation instruction executed in the non-allowed operation time period will cause the performance of the cell to deteriorate;

[0150] For example, the high-risk instruction RST S1 INTERFACE reset S1 interface is executed at 8:00, which will cause all users carried by the S1 interface to be released, and the radio resource control (RRC) reestablishment to fail. After executing the instruction, the number of successful RRC reestablishments in the same time period last week is compared to decrease, and therefore the operation is an illegal operation.

[0151] The second case: from the operation frequency and operation command of the operation account to the network element, the same operation command is executed on the same operation object at the same time by the same account, which is determined as an illegal operation;

[0152] For example, the user with account sgs_cx executed the MOD INTERFREQHOGROUP command to modify the inter-frequency handover parameter group at 14:12 and 14:13 on July 16, 2022, and executed the same operation on the same operation object in a short period of time, which is an illegal operation.

[0153] The third case: when a certain type of account without corresponding permission modifies a parameter of a certain level, it is also determined as an illegal operation;

[0154] For example, the user of the account sgs_gz performs an operation of adjusting the parameter NRDUCELLCSIRS (NR DU cell CSI-RS configuration), which belongs to the A-type parameter and is only allowed to be operated by the account sgs_cx, and thus the operation of sgs_gz is a violation operation.

[0155] Therefore, from the above aspects, the time feature, the account attribute feature, the account time feature, the operation command feature, and the operation cell performance feature can be constructed according to the operation content information and the operation information set corresponding to the network management log to be analyzed.

[0156] According to some embodiments, when constructing the change operation feature set according to the operation content information and the operation information set corresponding to the network management log to be analyzed, the operation command feature can be constructed according to the operation content information, the time feature can be constructed according to the operation time information, the account attribute feature can be constructed according to the operation account information, the account time feature can be constructed according to the operation account information and the operation time information, and the operation cell performance feature can be constructed according to the operation content information, the operation cell performance information, and the operation time information.

[0157] In some embodiments, Figure 4 A flowchart of feature construction provided by an embodiment of the present disclosure is shown. As shown in Figure 4 When performing named entity recognition on the wireless base station cell change operation record (network management log), the wireless base station cell change operation record key information extracted by NER is obtained, and at this time, the operation content information can be directly used as the operation command feature. The operation command feature is an attribute of the operation itself, including but not limited to the operation command (string, enumerable), the cell name, the operation type, the parameter name, the adjustment value, and whether the operation command is a high-risk command.

[0158] In some embodiments, as shown in Figure 4 The operation account field and the operation account attribute data table corresponding to the network management log to be analyzed can be matched to obtain the account attribute feature (i.e., the operation account attribute feature), which includes but is not limited to the account type (such as an executor account or a city account) and the account creation time.

[0159] In some embodiments, as shown in Figure 4 The time feature (i.e., the time and date feature) can be generated according to the timestamp field corresponding to the network management log to be analyzed, which includes but is not limited to the basic information such as the hour, the day of the week, and whether it is a holiday, and the time and date derived features obtained by matching external information such as whether the network is closed.

[0160] In some embodiments, as shown in Figure 4As shown, a time window can be generated based on the operation account information and operation time information, and the logs can be aggregated and calculated according to the operation account to obtain the account time characteristics. These account time characteristics include, but are not limited to, the number of operations performed, the number of base stations performing the operations, and the proportion of historical violations.

[0161] The number of times an operation is executed indicates the frequency of account operations, specifically the number of times an account performs the same operation on the same object within a time window. More specifically, it refers to the number of times an operating account executes the current operation command on the current object within a time threshold. This time threshold is determined according to the OMC network management operation specifications, and for example, it can be 5 minutes.

[0162] In some embodiments, such as Figure 4 As shown, based on hourly granular capacity data, operation content information, and operation time information, the average value of the hourly granular capacity data over the past 7 days can be calculated by aggregating the data by cell / time point to obtain the performance characteristics of the operating cell (i.e., the statistical characteristics of the operating target cell). These performance characteristics include, but are not limited to, the number of effective RRC connections in the operating cell (i.e., the average number of RRC connections), the number of successful RRC reconstructions in the operating cell, the success rate of establishing the Evolved Radio Access Bearer (E-RAB) in the operating cell, the utilization rate of Physical Resource Blocks (Physical RBs, PRBs), the average uplink PRB utilization rate in the operating cell, the average downlink PRB utilization rate in the operating cell, the uplink traffic in the operating cell, the downlink traffic in the operating cell, the average traffic, the radio connection success rate in the operating cell, the radio drop rate in the operating cell, and the number of handover failures in the operating cell.

[0163] It should be noted that the feature types of change operation features in the change operation feature set include numerical (continuous) and categorical types. The names, types, and detailed calculation methods of each change operation feature in the change operation feature set are shown in Table (1):

[0164]

[0165]

[0166] Table (1)

[0167] The number of valid RRC connections in the operating cell can be determined by the following formula, where h is the time point in the network management log to be analyzed:

[0168]

[0169] The uplink PRB utilization rate of the operating cell can be determined according to the following formula:

[0170]

[0171] The operation cell downlink PRB utilization rate can be determined according to the following formula:

[0172]

[0173] The operation cell uplink traffic can be determined according to the following formula:

[0174]

[0175] The operation cell downlink traffic can be determined according to the following formula:

[0176]

[0177] It is easy to understand that, from the perspective of the influence of network change operation on cell performance, operation account attribute, operation frequency of account, attribute of operation itself, the construction of operation cell performance index, whether it is a holiday, time point, number of same operations performed on the same cell within a time window, operation account type, executed command, adjusted parameter, parameter type and adjustment value, etc. Features can improve the recognition effect of network management logs.

[0178] S206, obtain the change operation feature data set, and perform label data matching on the change operation feature data set to obtain the labeled change operation feature data set;

[0179] According to some embodiments, the change operation feature data set refers to a set formed by at least one network management log sample and a change operation feature set corresponding to the network management log sample.

[0180] It should be noted that in a large number of network management log samples, the network management log sample of the irregular operation is a rare event as a positive sample. Therefore, in addition to the above three situations for judging irregular operation, the network management log sample obtained by other detection and auditing means for judging irregular operation can also be used to generate labels to increase the concentration of positive samples in the change operation feature data set.

[0181] In some embodiments, the network management log sample of the irregular operation is marked as 1 as a positive sample. The remaining normal network management log sample that is not irregularly operated is marked as 0 as a negative sample. By performing label data matching on the change operation feature data set, the positive and negative sample label data of whether the operation is irregular can be matched.

[0182] For example, there are 100 network management log samples in the change operation feature data set, and the training label can be represented as a vector Y, Y = [y1, y2, y3, …, y100], where y1, y2, y3, …, y100 represent the labels of the first, second, third, …, and 100th network management log samples, respectively. 100 ] TWhen the network management log sample belongs to the network management log sample of the illegal operation, y is 1; when the network management log sample belongs to the network management log sample of the normal operation, y is 0.

[0183] According to some embodiments, the labeled change operation feature data set can be divided into a training set and a test set. The division ratio can be set according to the actual application scenario. For example, the data in the last 30 days in the labeled change operation feature data set can be taken as the training set, and the data in the last 1 day can be taken as the test set.

[0184] S207, training at least one decision tree in turn according to the training set until the training pause condition is met, and obtaining a gradient boosting decision tree classification training model;

[0185] According to some embodiments, since each network management log sample has a timestamp, when training at least one decision tree in turn according to the training set, first, the test timestamp corresponding to the test set and the training timestamp corresponding to any training sample in the training set can be obtained. Then, the duration between the training timestamp and the test timestamp can be determined, the weight corresponding to any training sample is determined according to the duration, and the weight set corresponding to the training set is obtained. Finally, at least one decision tree can be trained in turn according to the training set and the weight set.

[0186] In some embodiments, when the weight of each training sample is generated by the timestamp, the closer the time distance of a certain training sample to the test set, the greater the weight of the training sample. Therefore, training the model in the sample weighting manner can enable the model to learn the latest illegal operation mode, better fit the production practice, and improve the recognition effect of the target network management log analysis model.

[0187] In some embodiments, the weight corresponding to any training sample can be determined according to the following formula:

[0188] sample_weight = 1 / [log(test_date-train_sample_date)+1]

[0189] Wherein, log is the natural logarithm. test_date is the date of the test set, i.e. the test timestamp. train_sample_date is the date of any training sample, i.e. the training timestamp.

[0190] For example, test_date is 2022-05-01, train_sample_date is 2022-04-30, and sample_weight is 1. For the training sample with the date of 2022-04-30, the weight is 1. For the training sample with the date of 2022-04-26, the weight is 0.383.

[0191] According to some embodiments, the gradient boost decision tree classification training model is a process of integrating and building a series of gradient boost decision trees (GBDT). By continuously dividing the training set according to a certain feature or a certain split point, second-order or even higher-order crossover of features can be achieved.

[0192] For example, hour=14 AND=last_5min_account_object_operation_count=3 means that if an account has executed the same command on the same base station 3 times in the past 5 minutes at 2 PM, then the current operation is a violation of the rule and can be learned by the model.

[0193] In some embodiments, the structure of the gradient boosting decision tree classification training model is shown in the following equation:

[0194] H0(x)=0

[0195] H1(x) = H0(x) + T1(x; Θ)

[0196] H2(x) = H1(x) + T2(x; Θ)

[0197] H m (x)=H m-1 (x)+T m (x;Θ)

[0198] Among them, H m Let x be the input feature of the GBDT model in the m-th round, and T be the input feature. m Let θ be the decision tree to be added in the m-th round, and let θ be the structure of the tree to be learned, including the feature splitting points and the output of the leaf nodes.

[0199] According to some embodiments, in the first round of training, the true value of the violation operation probability corresponding to the training set is used as the learning target. A first decision tree is constructed based on the training set, and a first residual corresponding to the first decision tree is determined. The first residual is determined by the true value of the violation operation probability and the predicted value of the violation operation probability output by the first decision tree. In the (M+1)th round of training, the Mth residual corresponding to the Mth decision tree is used as the learning target. A (M+1)th decision tree is constructed based on the training set, and a (M+1)th residual corresponding to the (M+1)th decision tree is determined. M is a positive integer, and the (M+1)th residual is determined by the Mth residual and the predicted value of the violation operation probability output by the (M+1)th decision tree.

[0200] In some embodiments, each decision tree is fitted to the difference between the sum of the prediction results of all decision trees in the previous rounds and the true value, i.e., the residual. In the case of a loss function in the form of mean square error (mse), the learning objective L of the mth round can be written as:

[0201] L(y (i) , H m-1 (x (i) )+T m (x (i) ; Θ)) = (y (i) - H m-1 (x (i) )-T m (x (i) ) 2

[0202] = (residual-T m (x (i) )) 2

[0203] where the learning objective of the mth round is to find a tree structure that minimizes the overall loss.

[0204] In some embodiments, the gradient boosting decision tree classification training model adds up the prediction values of all base models as the final prediction value, which can be recursively represented as:

[0205]

[0206] Taking a scenario as an example, Figure 5 a training flowchart of a gradient boosting decision tree classification training model provided by an embodiment of the present disclosure is shown. As Figure 5 shown, a decision tree is constructed in each round, and the label of whether the operation is in violation is taken as the learning objective in the first round (such as the distribution [0.1, 0.9] in the black box); the difference between the output of the decision tree and the true value is called the residual, and the residual of the previous round is taken as the learning objective to start the second round, and this way is iterated m times to generate m decision trees; finally, the outputs of the m decision trees are added up as the final output, i.e., the probability distribution [0.2, 0.8] of whether the operation is in violation predicted by the gradient boosting decision tree classification training model.

[0207] According to some embodiments, the construction steps of a single decision tree are as follows: determining the weighted Gini coefficient corresponding to at least one change operation feature in the training set, and recursively dividing the training set by selecting the change operation feature with the smallest weighted Gini coefficient, until the division stopping condition is met, to obtain the decision tree.

[0208] It's important to note that the key to selecting splitting features and categories is to reduce the "chaos" of the classification or regression targets in the training set. Therefore, for classification problems, the Gini coefficient is used as the criterion for selecting splitting features and categories. For regression problems, the variance of y is used as the criterion for selecting splitting features and categories.

[0209] In some embodiments, the stopping condition for partitioning, i.e. the stopping condition for tree growth, can be, for example, the tree depth reaching a depth threshold, or the number of child node samples being less than a sample data threshold.

[0210] In some embodiments, when determining the weighted Gini coefficient corresponding to at least one change operation feature in the training set, firstly, at least two feature category subsets corresponding to any change operation feature can be determined based on the training set. Next, if any feature category sample in the feature category sample subset includes a violation operation label, the feature category sample subset is placed into a first sample set, and the partition ratio corresponding to the first sample set is determined; if all feature category samples in the feature category sample subset do not include a violation operation label, the feature category sample subset is placed into a second sample set, and the partition ratio corresponding to the second sample set is determined. Secondly, the sample set with the higher partition ratio is set as the left child, and the first Gini coefficient corresponding to the left child is determined; the sample set with the lower partition ratio is set as the right child, and the second Gini coefficient corresponding to the right child is determined. Finally, based on the first and second Gini coefficients, the weighted Gini coefficient corresponding to any change operation feature is determined, thus obtaining the weighted Gini coefficient corresponding to at least one change operation feature.

[0211] For example, suppose there are only two features in the training set: the account type and the parameter type, as shown in Table (2):

[0212]

[0213] Table (2)

[0214] In some embodiments, it is necessary to determine the features to be segmented and their segmentation categories, calculate the weighted Gini coefficient of the features and the Gini coefficient of the segmentation categories, as shown in Table (3) and Table (4), wherein Table (3) is segmented by operating account type and Table (4) is segmented by parameter type;

[0215]

[0216] Table (3)

[0217]

[0218]

[0219] Table (4)

[0220] wherein the Gini coefficient of each split category, i.e. the Gini coefficient of left children and right children ginii, can be determined according to the following formula:

[0221]

[0222] wherein K is the number of categories in the label, for example, in Table (2) only contains two categories of FALSE and TRUE, so K is 2. k The probability of each category in the label can be simplified as the proportion in the training set, i.e. the proportion of training samples belonging to the violation operation and the proportion of training samples belonging to the normal operation.

[0223] wherein the weighted Gini gini(D, x, v) can be determined according to the following formula:

[0224]

[0225] wherein D is the training set, D l is the left child, D r is the right child, x is the feature for splitting, and v is the split category of the feature x. |D| means the modulus, indicating the size of the training set, i.e. the number of samples in the training set.

[0226] It is easy to understand that according to Table (2) and Table (3), the operation account type feature with smaller weighted Gini should be selected for splitting at present, and the samples with operation account type as executor are taken as left children, and the samples with operation account type as city are taken as right children. According to this logic, after several times of recursive splitting, each sample in the training set will fall into a leaf node. Thus, the gradient boosting decision tree classification training model can fuse all features and take the violation operation probability distribution of the leaf node as the output.

[0227] S208, iteratively training the gradient boosting decision tree classification training model according to the test set until the test pause condition is met, obtaining a target network log analysis model;

[0228] According to some embodiments, the gradient boosting decision tree classification training model needs to evaluate the effect on the test set, and when the effect on the test set does not improve for a threshold number of iterations, the training is ended in advance, so that overfitting can be avoided. Wherein the number of iterations threshold does not refer to a fixed threshold, for example, the number of iterations threshold can be 20.

[0229] In some embodiments, model hyperparameters in the gradient boosting decision tree classification training model can also be set, for example, the maximum depth of the tree and the minimum sample size of the leaf node are limited, the maximum depth of the tree is limited to 7, and the minimum sample size of the leaf node is limited to 10, which can reduce the complexity of the model, avoid overfitting, and improve the training speed of the model.

[0230] According to some embodiments, the target network management log analysis model includes at least one target gradient boosting decision tree. The target network management log analysis model can automatically perform risk assessment on the network management log to be analyzed after deployment, and output the probability that the network management log to be analyzed belongs to a risk operation or a violation operation.

[0231] S209, inputting the change operation feature set into each target gradient boosting decision tree in the target network management log analysis model to obtain a violation operation probability prediction value output by the at least one target gradient boosting decision tree;

[0232] According to some embodiments, when the change operation feature set is input into each target gradient boosting decision tree in the target network management log analysis model, if the feature category of any change operation feature in the change operation feature set is a category type, the oneHot encoding is performed on any change operation feature to obtain an encoded change operation feature set; all change operation features in the encoded change operation feature set are spliced to obtain a feature vector corresponding to the encoded change operation feature set; and the feature vector is input into each target gradient boosting decision tree in the target network management log analysis model.

[0233] In some embodiments, assuming that the possible values of a category type feature are an enumerable set with n elements, such as {a, b, c, d}, the feature can be represented by a vector with a length of n. Assuming that there are 2 samples, the first sample takes value a and the second sample takes value d, the vectors corresponding to the two samples are [1, 0, 0, 0] and [0, 0, 0, 1] respectively, indicating that only the element representing the index of the current value in the feature vector is 1 and the rest are 0, so it is called "oneHot encoding".

[0234] In some embodiments, taking the category type feature adjusted_param_type as an example, which is an enumerable set feature_value_set: adjusted_param_type = {type_1, type_2, …, type_n}, then for a change operation feature set, the vector corresponding to adjusted_param_type can be represented as [v1, v2, v3, …, vn], where vi represents the index of the current value in the feature_value_set. n ],

[0235]

[0236] wherein n is the length of the feature_value_set.

[0237] In some embodiments, all categorical features generate their oneHot vectors in the above manner, and are concatenated with numerical features. For a change operation feature set i, a feature vector can be formed as follows:

[0238] x i = [0, 0, 1, 0, …, 0.8, 0.3, 0.2, 0, 0, 1, 0]

[0239] It should be noted that when training at least one decision tree according to the training set, oneHot encoding also needs to be performed on any training sample in the training set. For example, when there are 100 training samples in the training set, a feature matrix X corresponding to the training set can be obtained, X = [x1, x2, x3, …, x100]. At this time, the supervised violation operation identification model can be trained on the training set with weighted training, taking the vector Y as the output label and the feature matrix X as the input data, and the effect can be evaluated on the test set. 100 ] T At this time, the supervised violation operation identification model can be trained on the training set with weighted training, taking the vector Y as the output label and the feature matrix X as the input data, and the effect can be evaluated on the test set.

[0240] S210, the violation operation probability prediction value output by the at least one target gradient boosting decision tree is accumulated to obtain a violation operation probability corresponding to the network management log to be analyzed.

[0241] According to some embodiments, when the violation operation probability corresponding to the network management log to be analyzed is obtained, the violation operation probability can be compared with a violation operation probability threshold value. If the violation operation probability is greater than the violation operation probability threshold value, it can be determined that the change operation corresponding to the network management log to be analyzed belongs to a violation operation. Conversely, if the violation operation probability is not greater than the violation operation probability threshold value, it can be determined that the change operation corresponding to the network management log to be analyzed does not belong to a violation operation.

[0242] In some embodiments, the violation operation probability threshold value is not a specific fixed threshold value. For example, the violation operation probability threshold value can be 0.5.

[0243] Taking a scenario as an example, the following is a json data in the form of key-value pairs containing feature names and feature values corresponding to a network management log to be analyzed:

[0244]

[0245] The above json data indicates that at 2:00 a.m. on Saturday, a non-working day, the power of a certain community of a certain city account was adjusted, the adjustment value was -21, and the power parameter belongs to the A type parameter; the city account executed the same operation on the same community for 3 times in the past 5 minutes.

[0246] For the above data, in each target gradient boosting decision tree, starting from the root node, the value of the partition feature of the current node in the current data is taken out at each layer node (each node contains a partition feature and a classification category), and the classification category is compared to select the left and right child trees until the leaf node is reached.

[0247] For example, in the first tree, the first layer node has a partition feature is_holiday, the current data is_holiday=true, and the right child tree is entered to reach the second layer. The node in the right child tree has a partition feature account_type, the current data account_type=city enters the right child tree to reach the third layer, and finally reaches the leaf node of the tree to obtain the output of the tree. Thus, the output of the json data in all trees can be obtained: the first target gradient boosting decision tree outputs 0.4, the second target gradient boosting decision tree outputs 0.3, and the third target gradient boosting decision tree outputs 0.1. Finally, the outputs of all target gradient boosting decision trees are accumulated, and the violation operation probability prediction value of the json data is 0.8. The violation operation probability prediction value is 0.8, which is greater than the violation operation probability threshold, so the change operation corresponding to the network management log to be analyzed belongs to a violation operation.

[0248] It should be noted that the electronic device can also provide online services, and output the violation operation probability before the OMC executor executes the parameter change operation, so as to instruct the network change operator to implement the operation according to the specification requirements, and reduce the probability of network accidents.

[0249] In summary, the method provided by the embodiment of the present disclosure first acquires a network management log to be analyzed and an operation information set corresponding to the network management log to be analyzed; acquires a network management log training sample set, and labels any network management log training sample in the network management log training sample set to obtain a network management log training sample set after labeling; updates model parameters of a named entity recognition pre-training model according to the network management log training sample set after labeling to obtain a target named entity recognition model; inputs the network management log to be analyzed into the target named entity recognition model for named entity recognition to obtain operation content information corresponding to the network management log to be analyzed; therefore, the key information in the network management log can be extracted by using the named entity recognition technology, and the analysis efficiency of the network management log can be improved; meanwhile, the named entity recognition pre-training model can be fine-tuned by labeling the network management log training sample set, and the recognition effect of the key information in the network management log to be analyzed can be improved. Then, a change operation feature set is constructed according to the operation content information corresponding to the network management log to be analyzed and the operation information set; a change operation feature data set is acquired, and label data matching is performed on the change operation feature data set to obtain a change operation feature data set after labeling; at least one decision tree is trained in turn according to a training set until a training pause condition is met to obtain a gradient boosting decision tree classification training model; the gradient boosting decision tree classification training model is iteratively trained according to a test set until a test pause condition is met to obtain a target network management log analysis model; therefore, the target network management log analysis model can be trained by using a supervised learning algorithm and a large amount of historical data to construct a training set, and the irregular operation in the network management log can be efficiently and quickly identified. Finally, the change operation feature set is input into each target gradient boosting decision tree in the target network management log analysis model to obtain an irregular operation probability prediction value output by at least one target gradient boosting decision tree; the irregular operation probability prediction values output by the at least one target gradient boosting decision tree are accumulated to obtain an irregular operation probability corresponding to the network management log to be analyzed. Therefore, the change operation feature set can be identified by the target network management log analysis model, and the network management log in which the change operation belongs to an irregular operation can be identified, so that the network change operator can implement the operation according to the specification requirements, thereby ensuring the smooth operation of the network and reducing the negative impact of the network change operation on the network.

[0250] The following is an apparatus embodiment of the present disclosure, which can be used to execute the method embodiments of the present disclosure. For details not disclosed in the apparatus embodiment of the present disclosure, please refer to the method embodiments of the present disclosure.

[0251] Please refer to Figure 6FIG. 6 is a structural schematic diagram of a network management log analysis device according to an example embodiment of the present disclosure. The network management log analysis device can be implemented by software, hardware, or a combination of both to become all or part of the device. The network management log analysis device 600 includes an information acquisition unit 601, a feature construction unit 602, and a feature recognition unit 603, wherein:

[0252] The information acquisition unit 601 is configured to acquire a network management log to be analyzed and an operation information set corresponding to the network management log to be analyzed, wherein the operation information set includes operation account information, operation time information, and operation cell performance information.

[0253] The feature construction unit 602 is configured to construct a change operation feature set according to the operation content information corresponding to the network management log to be analyzed and the operation information set, wherein the change operation feature set includes time features, account attribute features, account time features, operation command features, and operation cell performance features.

[0254] The feature recognition unit 603 is configured to input the change operation feature set into a target network management log analysis model for feature fusion recognition to obtain an analysis result corresponding to the network management log to be analyzed, wherein the analysis result includes a probability of a violation operation corresponding to the network management log to be analyzed.

[0255] Optionally, the network management log analysis device 600 further includes an entity recognition unit 604, configured to, before constructing the change operation feature set according to the operation content information corresponding to the network management log to be analyzed and the operation information set, specifically configured to:

[0256] input the network management log to be analyzed into a target named entity recognition model for named entity recognition to obtain operation content information corresponding to the network management log to be analyzed, wherein the operation content information includes operation commands, cell names, adjustment parameters, and adjustment values.

[0257] Optionally, the entity recognition unit 604 is further configured to, before inputting the network management log to be analyzed into the target named entity recognition model for named entity recognition, specifically configured to:

[0258] acquire a network management log training sample set, and label any network management log training sample in the network management log training sample set to obtain a labeled network management log training sample set;

[0259] update model parameters of a named entity recognition pre-training model according to the labeled network management log training sample set to obtain the target named entity recognition model.

[0260] Optionally, the feature construction unit 602 is configured to, when constructing the change operation feature set according to the operation content information corresponding to the network management log to be analyzed and the operation information set, specifically configured to:

[0261] constructing an operation content feature according to the operation content information, constructing a time feature according to the operation time information, and constructing an account attribute feature according to the operation account information;

[0262] constructing an account time feature according to the operation account information and the operation time information;

[0263] constructing an operation cell performance feature according to the operation content information, the operation cell performance information, and the operation time information.

[0264] Optionally, the network management log analysis apparatus 600 further comprises a model training unit 605, configured to, before inputting the change operation feature set into the target network management log analysis model to perform feature fusion recognition to obtain an analysis result corresponding to the network management log to be analyzed, specifically configured to:

[0265] obtain a change operation feature dataset, and perform label data matching on the change operation feature dataset to obtain a labeled change operation feature dataset, wherein the labeled change operation feature dataset comprises a training set and a test set;

[0266] training at least one decision tree according to the training set until a training suspension condition is met, to obtain a gradient boosting decision tree classification training model;

[0267] performing iterative training on the gradient boosting decision tree classification training model according to the test set until a test suspension condition is met, to obtain a target network management log analysis model, wherein the target network management log analysis model comprises at least one target gradient boosting decision tree.

[0268] Optionally, the model training unit 605 is configured to, when training at least one decision tree according to the training set, specifically configured to:

[0269] obtain a test timestamp corresponding to the test set and a training timestamp corresponding to any training sample in the training set;

[0270] determining a time length between the training timestamp and the test timestamp, determining a weight corresponding to any training sample according to the time length, and obtaining a weight set corresponding to the training set;

[0271] training at least one decision tree according to the training set and the weight set.

[0272] Optionally, the model training unit 605 is configured to, when training at least one decision tree according to the training set, specifically configured to:

[0273] In the first round of training, the probability of the violation operation true value corresponding to the training set is taken as a learning goal, a first decision tree is constructed according to the training set, and a first residual corresponding to the first decision tree is determined, wherein the first residual is determined by the probability of the violation operation true value and a violation operation probability prediction value output by the first decision tree;

[0274] In the M+1th round of training, the Mth residual corresponding to the Mth decision tree is taken as a learning goal, an M+1th decision tree is constructed according to the training set, and an M+1th residual corresponding to the M+1th decision tree is determined, wherein M is a positive integer, and the M+1th residual is determined by the Mth residual and a violation operation probability prediction value output by the M+1th decision tree.

[0275] Optionally, the model training unit 605 is configured to construct the decision tree, and specifically configured to:

[0276] determine a weighted Gini coefficient corresponding to at least one change operation feature in the training set, take the training set as a root node, select a change operation feature with the minimum weighted Gini coefficient, recursively divide the training set, until a division stop condition is met, and obtain the decision tree.

[0277] Optionally, the model training unit 605 is configured to determine the weighted Gini coefficient corresponding to at least one change operation feature in the training set, and specifically configured to:

[0278] determine at least two feature category subsets corresponding to any change operation feature in the at least one change operation feature according to the training set;

[0279] if any feature category sample in the feature category sample subset includes a violation operation label, the feature category sample subset is put into a first sample set, and a division proportion value corresponding to the first sample set is determined;

[0280] if all feature category samples in the feature category sample subset do not include a violation operation label, the feature category sample subset is put into a second sample set, and a division proportion value corresponding to the second sample set is determined;

[0281] a sample set with a high division proportion value is set as a left child, and a first Gini coefficient corresponding to the left child is determined;

[0282] a sample set with a low division proportion value is set as a right child, and a second Gini coefficient corresponding to the right child is determined;

[0283] the weighted Gini coefficient corresponding to any change operation feature is determined according to the first Gini coefficient and the second Gini coefficient, and the weighted Gini coefficient corresponding to the at least one change operation feature is obtained.

[0284] Optionally, the feature recognition unit 603 is configured to input the change operation feature set into the target network management log analysis model for feature fusion recognition, and obtain an analysis result corresponding to the network management log to be analyzed, and specifically configured to:

[0285] input the change operation feature set into each target gradient boosting decision tree in the target network management log analysis model, and obtain a rule violation operation probability prediction value output by at least one target gradient boosting decision tree;

[0286] accumulate the rule violation operation probability prediction value output by at least one target gradient boosting decision tree, and obtain a rule violation operation probability corresponding to the network management log to be analyzed.

[0287] Optionally, when the feature recognition unit 603 is configured to input the change operation feature set into each target gradient boosting decision tree in the target network management log analysis model, the feature recognition unit 603 is specifically configured to:

[0288] if the feature category of any change operation feature in the change operation feature set is a category type, then the any change operation feature is one-hot encoded to obtain an encoded change operation feature set;

[0289] splicing all change operation features in the encoded change operation feature set to obtain a feature vector corresponding to the encoded change operation feature set;

[0290] input the feature vector into each target gradient boosting decision tree in the target network management log analysis model.

[0291] It should be noted that, as shown in Figure 6 the network management log analysis device 600 must include the modules shown in solid lines, such as the information acquisition unit 601, the feature construction unit 602, and the feature recognition unit 603. The network management log analysis device 600 may or may not include the modules shown in dashed lines, such as the entity recognition unit 604 and the model training unit 605.

[0292] Regarding the device in the above embodiments, the specific manner in which each module performs operations has been described in detail in the embodiments related to the method, and will not be described in detail here.

[0293] In summary, the device provided by the embodiments of the present disclosure acquires the network management log to be analyzed and the operation information set corresponding to the network management log to be analyzed through the information acquisition unit, wherein the operation information set comprises operation account information, operation time information and operation cell performance information; the feature construction unit constructs the change operation feature set according to the operation content information corresponding to the network management log to be analyzed and the operation information set, wherein the change operation feature set comprises time feature, account attribute feature, account time feature, operation command feature and operation cell performance feature; the feature recognition unit inputs the change operation feature set into the target network management log analysis model for feature fusion recognition to obtain the analysis result corresponding to the network management log to be analyzed, wherein the analysis result comprises the probability of illegal operation corresponding to the network management log to be analyzed. Therefore, by constructing the change operation feature set corresponding to the network management log to be analyzed and controlling the target network management log analysis model to recognize the change operation feature set, the network management log in which the change operation belongs to illegal operation can be recognized, so that the network change operator can implement the operation according to the specification requirement, thereby the smooth running of the network can be ensured and the negative influence of the network change operation on the network can be reduced.

[0294] According to the embodiments of the present disclosure, the present disclosure further provides an electronic device, a readable storage medium and a computer program product.

[0295] Figure 7 A schematic block diagram of an example electronic device 700 that can be used to implement embodiments of the present disclosure is shown. The components shown herein, their connections and relationships, and their functions, are meant to be examples only, and are not intended to limit implementations of the present disclosure described and / or claimed in this document.

[0296] As shown in Figure 7 , the electronic device 700 includes a computing unit 701 that can perform various appropriate actions and processes in accordance with a computer program stored in a read-only memory (ROM) 702 or a computer program loaded into a random access memory (RAM) 703 from a storage unit 708. In the RAM 703, various programs and data required for the operation of the electronic device 700 can also be stored. The computing unit 701, the ROM 702, and the RAM 703 are connected to each other through a bus 704. An input / output (I / O) interface 705 is also connected to the bus 704.

[0297] A plurality of components in the electronic device 700 are connected to the I / O interface 705, including: an input unit 706, such as a keyboard, a mouse, etc.; an output unit 707, such as various types of displays, speakers, etc.; a storage unit 708, such as a magnetic disk, an optical disk, etc.; and a communication unit 709, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 709 allows the electronic device 700 to exchange information / data with other devices through a computer network, such as the Internet, and / or various telecommunication networks.

[0298] The computing unit 701 can be various general and / or special-purpose processing components with processing and computing capabilities. Some examples of the computing unit 701 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The computing unit 701 performs various methods and processes described above, such as the network management log analysis method. For example, in some embodiments, the network management log analysis method can be implemented as a computer software program, which is tangibly embodied in a machine-readable medium, such as the storage unit 708. In some embodiments, part or all of the computer program can be loaded and / or installed onto the electronic device 700 via the ROM 702 and / or the communication unit 709. When the computer program is loaded onto the RAM 703 and executed by the computing unit 701, one or more steps of the network management log analysis method described above can be performed. Alternatively, in other embodiments, the computing unit 701 can be configured to perform the network management log analysis method by any other appropriate means, such as by means of firmware.

[0299] Various implementations of the systems and techniques described above herein can be realized in digital electronic circuitry, integrated circuitry, a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), a system on a chip (SOC), a programmable logic device (CPLD), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include implementation in one or more computer programs that are executable and / or interpretable on a programmable system including at least one programmable processor, which can be special or general purpose, coupled to receive data and instructions from, and to transmit data and instructions to, a storage system, at least one input device, and at least one output device.

[0300] Program code for carrying out methods of the present disclosure can be written in any combination of one or more programming languages. The program code can be provided to a processor or controller of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the program code, when executed by the processor or controller, produces the functions / operations specified in the flowcharts and / or block diagrams. The program code can be executed entirely on a machine, partially on a machine, partially on a machine as a standalone software package, or entirely on a remote machine or server.

[0301] In the context of the present disclosure, a machine-readable medium can be a tangible medium that contains or stores a program for use by or in connection with an instruction execution system, apparatus, or device. The machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can include but is not limited to an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples of the machine-readable storage medium will include one or more lines of electrical connections, portable computer disks, hard disk drives, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or Flash memory), optical fibers, portable compact disc read-only memories (CD-ROMs), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0302] To provide for interaction with a user, the systems and techniques described here can be implemented on a computer having a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user and a keyboard and a pointing device (e.g., a mouse or a trackball) by which the user can provide input to the computer. Other kinds of devices can be used to provide for interaction with a user as well; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form, including acoustic, speech, or tactile input.

[0303] The systems and techniques described herein can be implemented in a computing system that includes a back end component, e.g., as a data server, or that includes a middleware component, e.g., an application server, or that includes a front end component, e.g., a user computer having a graphical user interface or a Web browser through which a user can interact with an implementation of the systems and techniques described herein, or any combination of such back end, middleware, or front end components. The components of the system can be interconnected by any form or medium of digital data communication, e.g., a communication network. Examples of communication networks include a local area network (LAN), a wide area network (WAN), the Internet, and a blockchain network.

[0304] The computer system can include clients and servers. A client and server are generally remote from each other and typically interact through a communication network. The relationship of client and server is generally established using computer programs running on the respective computers and having a client-server relationship. A server can be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system, to solve the defects of large management difficulty and weak business scalability in traditional physical host and VPS (Virtual Private Server, or VPS for short) services. The server can also be a server of a distributed system, or a server combined with a blockchain.

[0305] According to an embodiment of the present disclosure, the present disclosure also provides a vehicle. The vehicle includes the electronic device according to any one of the preceding embodiments, or the dual-electric-drive system of the vehicle according to any one of the preceding embodiments.

[0306] It should be understood that the various forms of flow shown above can be reordered, additional or deleted steps added. For example, the steps described in the present disclosure can be executed in parallel, sequentially, or in a different order, as long as the desired results of the technical solutions disclosed in the present disclosure can be achieved, and the present disclosure is not limited herein.

[0307] The specific implementation described above does not constitute a limitation on the protection scope of the present disclosure. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent replacements, and improvements made within the spirit and principles of the present disclosure shall be included in the protection scope of the present disclosure.

Claims

1. A network management log analysis method characterized by comprising: The method comprises the following steps: acquiring a network management log to be analyzed and a set of operation information corresponding to the network management log to be analyzed, wherein the set of operation information comprises operation account information, operation time information and operation cell performance information; constructing a set of change operation features according to the operation content information corresponding to the network management log to be analyzed and the set of operation information, wherein the set of change operation features comprises time features, account attribute features, account time features, operation command features and operation cell performance features; acquiring a set of change operation feature data and performing label data matching on the set of change operation feature data to obtain a set of labeled change operation feature data, wherein the set of labeled change operation feature data comprises a training set and a test set; training at least one decision tree in sequence according to the training set, specifically comprising: acquiring a test timestamp corresponding to the test set and a training timestamp corresponding to any training sample in the training set; determining a time length between the training timestamp and the test timestamp, determining a weight corresponding to the any training sample according to the time length to obtain a set of weights corresponding to the training set; training at least one decision tree in sequence according to the training set and the set of weights; and until a training pause condition is met, a gradient boosting decision tree classification training model is obtained; iteratively training the gradient boosting decision tree classification training model according to the test set until a test pause condition is met to obtain a target network management log analysis model, wherein the target network management log analysis model comprises at least one target gradient boosting decision tree; inputting the set of change operation features into the target network management log analysis model for feature fusion recognition to obtain an analysis result corresponding to the network management log to be analyzed, wherein the analysis result comprises a probability of a violation operation corresponding to the network management log to be analyzed.

2. The method of claim 1, wherein, Before the step of constructing the set of change operation features according to the operation content information corresponding to the network management log to be analyzed and the set of operation information, the method further comprises: inputting the network management log to be analyzed into a target named entity recognition model for named entity recognition to obtain operation content information corresponding to the network management log to be analyzed, wherein the operation content information comprises operation commands, cell names, adjustment parameters and adjustment values.

3. The method of claim 2, wherein, Before the step of inputting the network management log to be analyzed into the target named entity recognition model for named entity recognition, the method further comprises: acquiring a set of network management log training samples and labeling any network management log training sample in the set of network management log training samples to obtain a set of labeled network management log training samples; updating model parameters of a named entity recognition pre-training model according to the set of labeled network management log training samples to obtain a target named entity recognition model.

4. The method of claim 1, wherein, The step of constructing the set of change operation features according to the operation content information corresponding to the network management log to be analyzed and the set of operation information comprises: constructing operation command features according to the operation content information, constructing time features according to the operation time information and constructing account attribute features according to the operation account information; constructing account time features according to the operation account information and the operation time information; constructing operation cell performance features according to the operation content information, the operation cell performance information and the operation time information.

5. The method of claim 1, wherein, The training of the at least one decision tree in sequence according to the training set comprises: In the first round of training, taking the true value of the illegal operation probability corresponding to the training set as a learning target, a first decision tree is constructed according to the training set, and a first residual corresponding to the first decision tree is determined, wherein the first residual is determined by the true value of the illegal operation probability and a predicted value of the illegal operation probability output by the first decision tree; In the M+1th round of training, taking the Mth residual corresponding to the Mth decision tree as a learning target, an M+1th decision tree is constructed according to the training set, and an M+1th residual corresponding to the M+1th decision tree is determined, wherein M is a positive integer, and the M+1th residual is determined by the Mth residual and a predicted value of the illegal operation probability output by the M+1th decision tree.

6. The method of claim 5, wherein, The construction of the decision tree comprises: determining a weighted Gini coefficient corresponding to at least one change operation feature in the training set, and recursively dividing the training set by selecting a change operation feature with the minimum weighted Gini coefficient, until a division stop condition is met, to obtain the decision tree.

7. The method of claim 6, wherein, The determination of the weighted Gini coefficient corresponding to at least one change operation feature in the training set comprises: determining at least two feature category subsets corresponding to any change operation feature in the at least one change operation feature according to the training set; if any feature category sample in the feature category sample subset includes an illegal operation label, the feature category sample subset is put into a first sample set, and a division proportion value corresponding to the first sample set is determined; if all feature category samples in the feature category sample subset do not include an illegal operation label, the feature category sample subset is put into a second sample set, and a division proportion value corresponding to the second sample set is determined; a sample set with a high division proportion value is set as a left child, and a first Gini coefficient corresponding to the left child is determined; a sample set with a low division proportion value is set as a right child, and a second Gini coefficient corresponding to the right child is determined; a weighted Gini coefficient corresponding to the any change operation feature is determined according to the first Gini coefficient and the second Gini coefficient, to obtain the weighted Gini coefficient corresponding to the at least one change operation feature.

8. The method of claim 1, wherein, The feature fusion recognition of the change operation feature set in the target network management log analysis model to obtain the analysis result corresponding to the network management log to be analyzed comprises: the change operation feature set is input into each target gradient boosting decision tree of the target network management log analysis model, to obtain a predicted value of the illegal operation probability output by the at least one target gradient boosting decision tree; the predicted values of the illegal operation probability output by the at least one target gradient boosting decision tree are accumulated, to obtain an illegal operation probability corresponding to the network management log to be analyzed.

9. The method of claim 8, wherein, The inputting of the change operation feature set into each target gradient boosting decision tree in the target network management log analysis model comprises: If a feature category of any change operation feature in the change operation feature set is a category type, the any change operation feature is one-hot encoded to obtain an encoded change operation feature set; All change operation features in the encoded change operation feature set are spliced to obtain a feature vector corresponding to the encoded change operation feature set; The feature vector is input into each target gradient boosting decision tree in the target network management log analysis model.

10. A network management log analysis apparatus characterized by comprising: It comprises: An information acquisition unit is configured to acquire a network management log to be analyzed and an operation information set corresponding to the network management log to be analyzed, wherein the operation information set comprises operation account information, operation time information, and operation cell performance information; A feature construction unit is configured to construct a change operation feature set according to operation content information corresponding to the network management log to be analyzed and the operation information set, wherein the change operation feature set comprises time features, account attribute features, account time features, operation command features, and operation cell performance features; A feature recognition unit is configured to input the change operation feature set into a target network management log analysis model for feature fusion recognition to obtain an analysis result corresponding to the network management log to be analyzed, wherein the analysis result comprises a probability of a violation operation corresponding to the network management log to be analyzed; A model training unit is configured to acquire a change operation feature dataset and perform label data matching on the change operation feature dataset to obtain a labeled change operation feature dataset, wherein the labeled change operation feature dataset comprises a training set and a test set; At least one decision tree is trained in sequence according to the training set, specifically comprising: acquiring a test timestamp corresponding to the test set and a training timestamp corresponding to any training sample in the training set; determining a time length between the training timestamp and the test timestamp, determining a weight corresponding to the any training sample according to the time length to obtain a weight set corresponding to the training set; and training at least one decision tree in sequence according to the training set and the weight set; until a training pause condition is met, a gradient boosting decision tree classification training model is obtained; The gradient boosting decision tree classification training model is iteratively trained according to the test set until a test pause condition is met to obtain a target network management log analysis model, wherein the target network management log analysis model comprises at least one target gradient boosting decision tree.

11. An electronic device, comprising: It comprises: A processor; A memory for storing instructions executable by the processor; The processor is configured to execute the instructions to implement the network management log analysis method of any one of claims 1 to 9.

12. A storage medium, when instructions in the storage medium are executed by a processor of an electronic device, enabling the electronic device to perform the network management log analysis method of any one of claims 1 to 9.

Images