Network management method, device, equipment and storage medium based on artificial intelligence

Abstract

The present invention discloses a network management method, device, equipment and storage medium based on artificial intelligence, the method comprising: obtaining the current network status data in the network system; extracting features of the current network status data to obtain network status features; inputting the network status features into a network traffic prediction model based on LSTM and combined with an attention mechanism to predict future traffic trends; inputting the network status features into a pre-trained network traffic anomaly recognition model to identify network traffic anomalies; and determining the network optimization strategy of the network system according to the future traffic trend and the type of network traffic anomaly to dynamically adjust and optimize the network system. The present invention can accurately predict network traffic and timely adjust and optimize the entire network system when network traffic anomalies occur, thereby improving the network management effect and ultimately improving the overall performance of the network.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to an artificial intelligence-based network management method, device, equipment and storage medium. Background Art

[0002] Traditional network management systems usually rely on static thresholds and rules when dealing with network traffic prediction and anomaly detection. These rules are often set based on historical experience. For example, in terms of traffic management, network administrators may set time-based rules to allocate bandwidth, such as reserving more bandwidth for critical services during peak hours during the day, while allowing non-critical services to use more network resources at night. Similarly, in terms of anomaly detection, the system may determine whether network performance indicators exceed the normal range based on preset thresholds, such as packet loss rate, latency, etc. Once these thresholds are exceeded, an alarm will be triggered.

[0003] However, these methods have obvious limitations. First, they cannot adapt to the dynamic changes of network traffic, especially in modern network environments, where traffic patterns may change rapidly due to various unforeseen factors. Second, anomaly detection based on fixed thresholds often produces a large number of false positives or false negatives, because the real-world network environment is complex and changeable, and fixed thresholds are difficult to accurately reflect all possible abnormal situations. Finally, traditional network optimization strategies are often passive, that is, they respond only after problems occur, rather than predicting and preventing potential network problems in advance.

[0004] Therefore, the main technical problem of existing network management technical solutions when facing a dynamically changing network environment is that they cannot accurately predict network traffic and timely adjust and optimize the entire network system when network traffic anomalies occur, resulting in poor network management effects and ultimately affecting the overall performance of the network. Summary of the invention

[0005] The embodiments of the present invention provide a network management method, device, equipment and storage medium based on artificial intelligence, which can accurately predict network traffic and timely adjust and optimize the entire network system when network traffic is abnormal, thereby improving network management effects and ultimately improving the overall performance of the network.

[0006] An embodiment of the present invention provides a network management method based on artificial intelligence, including:

[0007] Get the current network status data in the network system;

[0008] Extracting features from the current network status data to obtain network status features;

[0009] Inputting the network status features into a network traffic prediction model based on LSTM and combined with an attention mechanism to predict future traffic trends;

[0010] Inputting the network status feature into a pre-trained network traffic anomaly recognition model to identify network traffic anomalies;

[0011] According to the future traffic trend and the type of network traffic anomaly, a network optimization strategy of the network system is determined to dynamically adjust and optimize the network system.

[0012] As an improvement of the above solution, the network status data includes data packet count, session information, delay, packet loss rate and throughput.

[0013] As an improvement of the above solution, the network traffic prediction model based on LSTM and combined with the attention mechanism includes:

[0014] Input layer: receives network status features;

[0015] Position encoding layer: adds position encoding to the input features to provide temporal information; the position encoding is generated using sine and cosine functions to ensure that the model can distinguish positions in the sequence;

[0016] Bidirectional LSTM layer: It combines the forward-to-backward and backward-to-forward LSTM units, and can process the input sequence from both the forward and backward directions, thereby capturing the bidirectional temporal dependencies and helping the model better understand the contextual information of the time series.

[0017] Multi-head attention layer: allows the model to focus on information from different representation subspaces in parallel, enhancing the model's ability to handle complex dependencies; the attention calculation of each head is based on the Q, K, and V matrices, obtained from the input through linear transformation; the results of multi-head attention are integrated through concatenation and additional linear layers;

[0018] Residual connection layer: Residual connection avoids the gradient vanishing problem in deep networks by adding the input and output of the multi-head attention layer, ensuring the smooth flow of information and enhancing the stability and performance of the model;

[0019] Dropout layer: used to reduce overfitting and randomly discard the output of some neurons;

[0020] Fully connected layer: used to convert the output of LSTM into the final traffic prediction value; this layer compresses the features of the time series into the dimension of the prediction target and generates a prediction of the traffic at the next or next few time points;

[0021] The inputting the network status features into a network traffic prediction model based on LSTM and combined with an attention mechanism to predict future traffic trends includes:

[0022] Send the network state feature sequence to the position encoding layer to obtain the position encoding feature with time information;

[0023] The position encoding features with time information are sent to the bidirectional LSTM layer to further process the previous and next associations of the time series;

[0024] Through the multi-head attention mechanism, the model weights the relevance of the features at each time point output by the bidirectional LSTM layer and extracts the most valuable information for prediction;

[0025] The input and output of the multi-head attention layer are added through residual connections to maintain the integrity of the information flow;

[0026] The Dropout layer randomly discards the output of some neurons in the residual connection layer to reduce overfitting;

[0027] Finally, the features processed by the Dropout layer are mapped to the traffic prediction value through the fully connected layer, and the prediction results of future traffic trends are output.

[0028] As an improvement of the above solution, the inputting of the network status feature into a pre-trained network traffic anomaly recognition model to identify network traffic anomalies includes:

[0029] Step 30, input the network status feature into a pre-trained network traffic anomaly recognition model, sort the features according to their importance and randomly select a feature from the network status feature through the segmentation rule of the decision tree of the isolation forest algorithm, and use the feature value of the selected feature as the segmentation point, so as to divide the feature value set of the network status feature into two subsets, namely, a subset with a feature value less than the segmentation point and a subset with a feature value greater than or equal to the segmentation point; wherein the isolation forest algorithm constructs multiple decision trees based on the network status feature, and each decision tree corresponds to a network status feature; the importance of the feature is measured according to the following calculation formula: ; As information gain, it is used to measure the improvement of the classification ability of the feature set S of the network state feature by the feature A in the network state feature, and represents the entropy of the data set S; is a subset of feature A whose value is v; are all possible values ​​of feature A; and Represent the feature set S and subset respectively The number of samples; It represents the entropy of the feature set S, which measures the uncertainty of the feature set. The entropy calculation formula is: ; It is a feature The probability of appearing in the data set S;

[0030] Step 31, randomly select a characteristic value of a network state characteristic from the network state characteristic as a test data point, and start from the root node of the decision tree corresponding to the network state characteristic, initialize the path length of the test data point in the decision tree is 0;

[0031] Step 32, at the current node of the decision tree, check the feature value of the test data point and the segmentation feature and segmentation point of the node; if the feature value is less than the segmentation point, move to the left subtree; if the feature value is greater than or equal to the segmentation point, move to the right subtree; each time it moves, the path length of the test data point in the decision tree is Increase by 1;

[0032] Step 33, when the leaf node of the decision tree is reached, the traversal ends, and the calculated As the path length of the test data point in the decision tree;

[0033] Step 34, for each decision tree in the isolation forest algorithm, repeat steps 31 to 33 until all decision trees are processed, thereby calculating the path length of each network state feature isolated in the corresponding decision tree ;

[0034] Step 35, using the following expected value calculation formula, the path length isolated in the corresponding decision tree according to each network state feature Calculate the expected value: ; N is the total number of decision trees built in the isolation forest; It is The path length of each network state feature in the corresponding decision tree;

[0035] Step 36, using the following anomaly score calculation formula, based on the expected value and the average path length of the decision tree Calculate network traffic anomaly score: ; is the average path length when there are n nodes in the decision tree; ; is the harmonic series item;

[0036] Step 37, comparing the network traffic anomaly score with the predicted network traffic anomaly score threshold to obtain a network traffic anomaly identification result.

[0037] Another embodiment of the present invention provides a network management device based on artificial intelligence, including:

[0038] An acquisition module is used to obtain current network status data in the network system;

[0039] A feature extraction module is used to extract features from the current network status data to obtain network status features;

[0040] A prediction module, used for inputting the network status features into a network traffic prediction model based on LSTM and combined with an attention mechanism to predict future traffic trends;

[0041] An identification module, used for inputting the network status feature into a pre-trained network traffic anomaly identification model to identify network traffic anomalies;

[0042] The management module is used to determine the network optimization strategy of the network system according to the future traffic trend and the network traffic anomaly type, so as to dynamically adjust and optimize the network system.

[0043] As an improvement of the above solution, the network status data includes data packet count, session information, delay, packet loss rate and throughput.

[0044] As an improvement of the above solution, the network traffic prediction model based on LSTM and combined with the attention mechanism includes:

[0045] Input layer: receives network status features;

[0046] Position encoding layer: adds position encoding to the input features to provide temporal information; the position encoding is generated using sine and cosine functions to ensure that the model can distinguish positions in the sequence;

[0047] Bidirectional LSTM layer: It combines the forward-to-backward and backward-to-forward LSTM units, and can process the input sequence from both the forward and backward directions, thereby capturing the bidirectional temporal dependencies and helping the model better understand the contextual information of the time series.

[0048] Multi-head attention layer: allows the model to focus on information from different representation subspaces in parallel (that is, allows the model to extract information from different representation subspaces), enhancing the model's ability to handle complex dependencies; the attention calculation of each head is based on the Q, K and V matrices, obtained from the input through linear transformation; the results of multi-head attention are integrated through concatenation and additional linear layers;

[0049] Residual connection layer: Residual connection avoids the gradient vanishing problem in deep networks by adding the input and output of the multi-head attention layer, ensuring the smooth flow of information and enhancing the stability and performance of the model;

[0050] Dropout layer: used to reduce overfitting and randomly discard the output of some neurons;

[0051] Fully connected layer: used to convert the output of LSTM into the final traffic prediction value; this layer compresses the features of the time series into the dimension of the prediction target and generates a prediction of the traffic at the next or next few time points;

[0052] The prediction module is specifically used for:

[0053] Send the network state feature sequence to the position encoding layer to obtain the position encoding feature with time information;

[0054] The position encoding features with time information are sent to the bidirectional LSTM layer to further process the previous and next associations of the time series;

[0055] Through the multi-head attention mechanism, the model weights the relevance of the features at each time point output by the bidirectional LSTM layer and extracts the most valuable information for prediction;

[0056] The input and output of the multi-head attention layer are added through residual connections to maintain the integrity of the information flow;

[0057] The Dropout layer randomly discards the output of some neurons in the residual connection layer to reduce overfitting;

[0058] Finally, the features processed by the Dropout layer are mapped to the traffic prediction value through the fully connected layer, and the prediction results of future traffic trends are output.

[0059] As an improvement of the above solution, the identification module includes:

[0060] A construction submodule is used to input the network status feature into a pre-trained network traffic anomaly recognition model, sort the features according to their importance and randomly select a feature from the network status feature through the segmentation rule of the decision tree of the isolation forest algorithm, and use the feature value of the selected feature as the segmentation point, so as to divide the feature value set of the network status feature into two subsets, namely, a subset with a feature value less than the segmentation point and a subset with a feature value greater than or equal to the segmentation point; wherein the isolation forest algorithm constructs multiple decision trees based on the network status feature, and each decision tree corresponds to a network status feature; the importance of the feature is measured according to the following calculation formula: ; As information gain, it is used to measure the improvement of the classification ability of the feature set S of the network state feature by the feature A in the network state feature, and represents the entropy of the data set S; is a subset of feature A whose value is v; are all possible values ​​of feature A; and Represent the feature set S and subset respectively The number of samples; It represents the entropy of the feature set S, which measures the uncertainty of the feature set. The entropy calculation formula is: ; It is a feature The probability of appearing in the data set S;

[0061] An initialization submodule is used to randomly select a characteristic value of a network state characteristic from the network state characteristic as a test data point, and initialize the path length of the test data point in the decision tree starting from the root node of the decision tree corresponding to the network state characteristic. is 0;

[0062] The checking submodule is used to check the feature value of the test data point and the segmentation feature and segmentation point of the node at the current node of the decision tree; if the feature value is less than the segmentation point, move to the left subtree; if the feature value is greater than or equal to the segmentation point, move to the right subtree; each time the test data point moves, the path length in the decision tree is Increase by 1;

[0063] The traversal submodule is used to end the traversal when the leaf node of the decision tree is reached. As the path length of the test data point in the decision tree;

[0064] The repeating submodule is used to repeatedly execute the initialization submodule to the traversal submodule for each decision tree in the isolation forest algorithm until all decision trees are processed, thereby calculating the path length of each network state feature isolated in the corresponding decision tree ;

[0065] The first calculation submodule is used to calculate the expected value according to the path length isolated in the corresponding decision tree of each network state feature through the following expected value calculation formula: Calculate the expected value: ; N is the total number of decision trees built in the isolation forest; It is The path length of each network state feature in the corresponding decision tree;

[0066] The second calculation submodule is used to calculate the anomaly score according to the expected value and the average path length of the decision tree using the following anomaly score calculation formula Calculate network traffic anomaly score: ; is the average path length when there are n nodes in the decision tree; ; is the harmonic series item;

[0067] The comparison submodule is used to compare the network traffic anomaly score with the predicted network traffic anomaly score threshold to obtain the network traffic anomaly identification result.

[0068] Another embodiment of the present invention provides an artificial intelligence-based network management device, comprising a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor implements the artificial intelligence-based network management method described in the above-mentioned embodiment of the invention when executing the computer program.

[0069] Another embodiment of the present invention provides a storage medium, wherein the computer-readable storage medium includes a stored computer program, wherein when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute the artificial intelligence-based network management method described in the above-mentioned embodiment of the invention.

[0070] Compared with the prior art, the embodiments of the present invention have the following advantages:

[0071] First, the system collects network status data in real time and converts it into machine-readable network status features through feature extraction technology; then, these features are input into a model based on LSTM (Long Short-Term Memory Network) and fused with attention mechanism to predict changes in network traffic in the future. At the same time, the pre-trained network traffic anomaly recognition model identifies possible traffic anomalies in the current network. Based on the analysis results of these two aspects, the system intelligently formulates network optimization strategies (such as allocating resources in advance to cope with the upcoming traffic peak, or making immediate adjustments to cope with sudden network traffic anomalies), thereby achieving optimal configuration of network resources and continuous improvement of network performance. The embodiment of the present invention can effectively improve the accuracy of network traffic prediction and network traffic anomaly detection, and timely adjust and optimize the entire network system, thereby improving network management effects and ultimately improving the overall performance of the network. BRIEF DESCRIPTION OF THE DRAWINGS

[0072] Figure 1 It is a flowchart of a network management method based on artificial intelligence provided by one embodiment of the present invention;

[0073] Figure 2 It is a structural diagram of an artificial intelligence-based network management device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0074] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0075] See also Figure 1 , is a flow chart of a network management method based on artificial intelligence provided by an embodiment of the present invention. The network management method based on artificial intelligence includes steps S1 to S5:

[0076] S1, obtaining the current network status data in the network system;

[0077] S2, extracting features from the current network status data to obtain network status features;

[0078] S3, inputting the network status features into a network traffic prediction model based on LSTM and combined with an attention mechanism to predict future traffic trends;

[0079] S4, inputting the network status feature into a pre-trained network traffic anomaly recognition model to identify network traffic anomalies;

[0080] S5, determining a network optimization strategy for the network system according to the future traffic trend and the network traffic anomaly type, so as to dynamically adjust and optimize the network system.

[0081] In the embodiment of the present invention, first, the system collects network status data in real time and converts it into machine-readable network status features through feature extraction technology; then, these features are input into a model based on LSTM (Long Short-Term Memory Network) and fused with attention mechanism to predict network traffic changes in the future. At the same time, the pre-trained network traffic anomaly recognition model identifies possible traffic anomalies in the current network. Based on the analysis results of these two aspects, the system intelligently formulates network optimization strategies (such as allocating resources in advance to cope with the upcoming traffic peak, or adjusting in real time to cope with sudden network traffic anomalies), thereby achieving the optimal configuration of network resources and continuous improvement of network performance. The embodiment of the present invention can effectively improve the accuracy of network traffic prediction and network traffic anomaly detection, and timely adjust and optimize the entire network system, thereby improving the network management effect and ultimately improving the overall performance of the network.

[0082] As an improvement of the above solution, the network status data includes data packet count, session information, delay, packet loss rate and throughput.

[0083] As an improvement of the above solution, the network traffic prediction model based on LSTM and combined with the attention mechanism includes:

[0084] Input layer: receives network status features;

[0085] Position encoding layer: adds position encoding to the input features to provide temporal information; the position encoding is generated using sine and cosine functions to ensure that the model can distinguish positions in the sequence;

[0086] Bidirectional LSTM layer: It combines the forward-to-backward and backward-to-forward LSTM units, and can process the input sequence from both the forward and backward directions, thereby capturing the bidirectional temporal dependencies and helping the model better understand the contextual information of the time series.

[0087] Multi-head attention layer: allows the model to focus on information from different representation subspaces in parallel (that is, allows the model to extract information from different representation subspaces), enhancing the model's ability to handle complex dependencies; the attention calculation of each head is based on the Q, K and V matrices, obtained from the input through linear transformation; the results of multi-head attention are integrated through concatenation and additional linear layers;

[0088] Residual connection layer: Residual connection avoids the gradient vanishing problem in deep networks by adding the input and output of the multi-head attention layer, ensuring the smooth flow of information and enhancing the stability and performance of the model;

[0089] Dropout layer: used to reduce overfitting and randomly discard the output of some neurons;

[0090] Fully connected layer: used to convert the output of LSTM into the final traffic prediction value; this layer compresses the features of the time series into the dimension of the prediction target and generates a prediction of the traffic at the next or next few time points;

[0091] The inputting the network status features into a network traffic prediction model based on LSTM and combined with an attention mechanism to predict future traffic trends includes:

[0092] Send the network state feature sequence to the position encoding layer to obtain the position encoding feature with time information;

[0093] The position encoding features with time information are sent to the bidirectional LSTM layer to further process the previous and next associations of the time series;

[0094] Through the multi-head attention mechanism, the model weights the relevance of the features at each time point output by the bidirectional LSTM layer and extracts the most valuable information for prediction;

[0095] The input and output of the multi-head attention layer are added through residual connections to maintain the integrity of the information flow;

[0096] The Dropout layer randomly discards the output of some neurons in the residual connection layer to reduce overfitting;

[0097] Finally, the features processed by the Dropout layer are mapped to the traffic prediction value through the fully connected layer, and the prediction results of future traffic trends are output.

[0098] In this embodiment, specifically:

[0099] The input layer receives the network state features ; is the input feature sequence, is at the time step The eigenvector of

[0100] The position encoding layer uses sine and cosine functions to add position information to each position in the sequence. The position encoding formula is: , ; Indicates positional encoding; is the position index, i.e., the time step; is the dimension index; is the embedding dimension;

[0101] The bidirectional LSTM layer involves the calculation of forward and backward LSTM, and its output is concatenated to form the final output. The bidirectional LSTM layer involves multiple gating mechanisms, and its output is represented as follows:

[0102]

[0103] in, and Represent the forward and backward LSTM units respectively; and The forward and backward LSTMs are respectively The hidden state of is the final hidden state;

[0104] For the multi-head attention layer, first the output of the bidirectional LSTM layer Convert to query ,key Sum The multi-head attention mechanism involves querying ,key Sum Matrices are calculated by passing the input through different weight matrices , and The calculation formula for multi-head attention is:

[0105] ;

[0106] ;

[0107] ; is a learnable weight matrix; is the dimension of the key vector; is the attention weight matrix; is the context vector;

[0108] Then, the outputs of all heads are concatenated and passed through a linear layer Converted to the final attention output : ; is the number of attention heads.

[0109] After the multi-head attention and LSTM layers, residual connections are applied, which helps alleviate the gradient vanishing problem. The formula for residual connections is: ; is the output of the bidirectional LSTM layer;

[0110] Next, the Dropout layer is used to output the residual connection layer. The random drop ratio is The node outputs of the remaining nodes are scaled to keep the overall expected value unchanged: ;

[0111] Finally, the output of the LSTM is passed to one or more fully connected layers to produce the final traffic prediction value; the output formula of the fully connected layer is as follows:

[0112] ; is the weight matrix; is the bias vector.

[0113] It is understandable that the position encoding layer can make up for the lack of sequential information perception of the model itself when processing time series data. In the network traffic prediction model of this embodiment, the position encoding layer enables the model to understand and utilize the relative or absolute position information of the elements in the sequence. Specifically, in the network traffic prediction model of this embodiment, position encoding is a method of adding position information to the input vector, which is achieved by adding a fixed or learnable vector to each position in the sequence. In this way, no matter how the length of the sequence changes, the position encoding can dynamically adapt and provide a unique identifier for each position, so that the model can distinguish feature vectors at different positions in the sequence, even under the self-attention mechanism. In the scenario of network traffic prediction, the position encoding layer enables the model to understand the time series pattern in the network traffic data. For example, it can help the model identify the difference between the traffic pattern of a specific time period of the day (such as midnight to early morning) and another time period (such as the afternoon peak period), even if the traffic data of these time periods may be very similar in value. In this way, position encoding enhances the model's understanding and prediction ability of time series data, enabling it to more accurately predict future network traffic trends.

[0114] In this embodiment, a deep learning model based on a long short-term memory network (LSTM) combined with an attention mechanism is constructed for accurate prediction of network traffic. The model first receives network status features including packet counts, session information, delays, packet loss rates, and throughput through the input layer, and then adds time information to the input features in the position encoding layer to ensure that the model understands the relative positions of each time point in the sequence. The position encoding is generated using sine and cosine functions to provide a unique identifier for each position in the sequence, so that the model can effectively capture the periodicity and trend of the time series. The core part of the model uses a bidirectional LSTM layer, which processes the input sequence from front to back and from back to front, enhancing the model's ability to understand the dependencies between the time series data before and after, thereby improving the capture of long-term dependencies on network traffic. The introduced multi-head attention mechanism allows the model to pay attention to information from multiple representation subspaces in parallel, significantly enhancing the model's ability to handle complex dependencies, especially for nonlinear relationships and high-dimensional features that may exist in network traffic data. Through the residual connection layer, the model can effectively avoid the gradient vanishing problem in the deep network, keep the information flow unblocked, and further improve the stability and prediction accuracy of the model. The use of the Dropout layer helps prevent overfitting and improves the generalization ability of the model. Finally, the output of the LSTM is converted into a predicted value of future traffic trends through the fully connected layer, achieving accurate prediction of network traffic.

[0115] Therefore, this embodiment, by adopting an improved deep learning model, can not only fully utilize the time series characteristics of network status data, but also effectively solve the complexity and uncertainty problems in network traffic prediction by combining LSTM and attention mechanism, improve the accuracy of prediction, and provide support for the reasonable planning and scheduling of network resources. Especially when processing large-scale, high-frequency network traffic data, the improved network traffic prediction model of this embodiment can quickly and accurately predict future traffic trends, help network managers make decisions in advance to cope with traffic peaks, ensure network service quality, and optimize resource allocation.

[0116] As an improvement of the above solution, the inputting of the network status feature into a pre-trained network traffic anomaly recognition model to identify network traffic anomalies includes:

[0117] Step 30, input the network status feature into a pre-trained network traffic anomaly recognition model, sort the features according to their importance and randomly select a feature from the network status feature through the segmentation rule of the decision tree of the isolation forest algorithm, and use the feature value of the selected feature as the segmentation point, so as to divide the feature value set of the network status feature into two subsets, namely, a subset with a feature value less than the segmentation point and a subset with a feature value greater than or equal to the segmentation point; wherein the isolation forest algorithm constructs multiple decision trees based on the network status feature, and each decision tree corresponds to a network status feature; the importance of the feature is measured according to the following calculation formula: ; As information gain, it is used to measure the improvement of the classification ability of the feature set S of the network state feature by the feature A in the network state feature, and represents the entropy of the data set S; is a subset of feature A whose value is v; are all possible values ​​of feature A; and Represent the feature set S and subset respectively The number of samples; It represents the entropy of the feature set S, which measures the uncertainty of the feature set. The entropy calculation formula is: ; It is a feature The probability of appearing in the data set S;

[0118] Step 31, randomly select a characteristic value of a network state characteristic from the network state characteristic as a test data point, and start from the root node of the decision tree corresponding to the network state characteristic, initialize the path length of the test data point in the decision tree is 0;

[0119] Step 32, at the current node of the decision tree, check the feature value of the test data point and the segmentation feature and segmentation point of the node; if the feature value is less than the segmentation point, move to the left subtree; if the feature value is greater than or equal to the segmentation point, move to the right subtree; each time it moves, the path length of the test data point in the decision tree is Increase by 1;

[0120] Step 33, when the leaf node of the decision tree is reached, the traversal ends, and the calculated As the path length of the test data point in the decision tree;

[0121] Step 34, for each decision tree in the isolation forest algorithm, repeat steps 31 to 33 until all decision trees are processed, thereby calculating the path length of each network state feature isolated in the corresponding decision tree ;

[0122] Step 35, using the following expected value calculation formula, the path length isolated in the corresponding decision tree according to each network state feature Calculate the expected value: ; N is the total number of decision trees built in the isolation forest; It is The path length of each network state feature in the corresponding decision tree;

[0123] Step 36, using the following anomaly score calculation formula, based on the expected value and the average path length of the decision tree Calculate network traffic anomaly score: ; is the average path length when there are n nodes in the decision tree; ; is the harmonic series item;

[0124] Step 37, comparing the network traffic anomaly score with the predicted network traffic anomaly score threshold to obtain a network traffic anomaly identification result.

[0125] In this embodiment, by using the isolation forest algorithm to identify network traffic anomalies, abnormal traffic behavior in the network can be efficiently detected. By constructing multiple decision trees to evaluate the degree of abnormality of network state features, each tree corresponds to a network state feature, and a "forest" structure is formed by randomly selecting features and split points to isolate and identify abnormal data points. The isolation forest algorithm can efficiently identify abnormal points in high-dimensional data sets in linear time, and can process large amounts of data without prior knowledge. It is particularly suitable for network monitoring scenarios, where abnormal situations are often rare but have a significant impact on the system. Specifically, the contribution of network state features to classification capabilities is measured by information gain, ensuring that the construction of decision trees gives priority to the most discriminating features, thereby improving the accuracy of anomaly detection. When constructing a decision tree, randomly selecting features and their split points increases the diversity of the model, can examine data from different angles, and improves the robustness of anomaly detection. By calculating the path length of the test data point in each decision tree, the degree of isolation of the data point is quantified. The shorter the path means the more isolated the data point is, which may be an abnormal point. The calculation of the anomaly score based on the expected value of the path length and the average path length of the decision tree provides a method for quantitatively evaluating the degree of abnormality of data points, making anomaly detection more objective and accurate. In addition, by comparing the network traffic anomaly score with the preset anomaly score threshold, abnormal behavior in network traffic is automatically identified, realizing automated anomaly detection.

[0126] To sum up, this embodiment can realize real-time and efficient network traffic anomaly detection, and has the ability to respond quickly to abnormal situations such as network attacks and equipment failures, which helps to take timely measures to ensure the stable operation of the network and improve the level of network security protection. At the same time, it also provides data support for the optimal configuration of network resources and enhances the intelligent management level of the network system.

[0127] It is understandable that network traffic anomalies refer to behaviors that do not conform to normal patterns in network data transmission, which may be caused by a variety of reasons, including but not limited to malicious activities, system failures, configuration errors, or sudden user behaviors. In this embodiment, network traffic anomalies can be subdivided into multiple types based on network status characteristics such as packet counts, session information, delays, packet loss rates, and throughput, which may include:

[0128] Abnormal traffic peak: Network traffic increases sharply within a short period of time, exceeding the normal range. This may be caused by a distributed denial of service (DDoS) attack, virus propagation, or other large-scale network activities.

[0129] Unusual session patterns: Anomalies in the duration, frequency, or destination of network sessions, such as a sudden increase in session requests from a certain IP address or an increase in sessions from unknown sources compared to the past, may indicate the presence of scanning, intrusion attempts, or data leakage risks.

[0130] Increased latency: A sudden increase in network latency that exceeds normal thresholds may be a sign of network congestion, link failure, or router problems.

[0131] Abnormal packet loss rate: The proportion of packet loss is abnormally high, which may be caused by network device overload, link quality degradation, or hardware failure.

[0132] Throughput anomaly: Network bandwidth utilization is abnormally high or low, beyond the expected range, which may be caused by network device bottlenecks, configuration errors, or improper traffic management.

[0133] As an improvement of the above solution, determining the network optimization strategy of the network system according to the future traffic trend and the network traffic anomaly type to dynamically adjust and optimize the network system includes:

[0134] Step 40: setting the objective function of network optimization of the network system :

[0135] ; It is a set of parameters for network optimization strategies, which may include but are not limited to bandwidth allocation, route selection, quality of service (QoS) parameters, etc. It is a network performance indicator based on future traffic trends, reflecting the impact of traffic forecasts on the network; It is a network performance impact indicator based on the type of network traffic anomaly, reflecting the impact of anomaly detection on the network; It is a cost function that reflects the cost required to implement the strategy, including network system regulation, hardware upgrade, network reconstruction, etc. is the weight coefficient, which is used to balance the relationship between the three objectives;

[0136] Step 41: Initialize network optimization strategy parameters ;

[0137] Step 42, calculate three key indicators related to network performance: performance indicators based on predicted traffic trends , Performance impact indicators based on anomaly detection results and the cost function ;

[0138] in, ; It's time point The weights reflect the importance of different time periods to network performance; It's at the time The predicted flow rate; It's at the time The actual flow rate; is the total number of time points in the forecasted time range;

[0139] ; is the set of detected anomaly types; Is an exception type the severity weight of It’s a strategy For exception types The impact indicator can be a quantitative assessment of reducing the probability of anomaly occurrence or reducing the impact of anomaly;

[0140] ; It is a collection of all cost factors, such as system control cost, maintenance cost, etc. It is the cost factor Unit cost; It’s a strategy In terms of cost factors the amount of use or consumption on

[0141] Step 43: Update network optimization strategy parameters , find the optimal network optimization strategy parameters , so that the objective function Reach a minimum; the goal of the algorithm is to minimize the objective function , which can be solved by various optimization algorithms, such as gradient descent method, genetic algorithm, particle swarm optimization, etc. (the specific optimization process of step 43 can refer to these prior arts); repeat the above steps until the convergence condition is met or the maximum number of iterations is reached.

[0142] In this embodiment, the network optimization strategy parameters are first initialized to lay the foundation for the subsequent optimization process. Subsequently, three key indicators closely related to network performance are calculated: performance indicators based on predicted traffic trends, performance impact indicators based on anomaly detection results, and cost functions. These indicators comprehensively reflect the network's responsiveness and economy in the face of future traffic changes and abnormal situations. On this basis, the network optimization strategy parameters are continuously adjusted through iterative optimization algorithms (such as gradient descent, genetic algorithm, or particle swarm optimization) until the optimal strategy that minimizes the objective function is found. This embodiment dynamically optimizes the network strategy, combines future traffic trend prediction with network traffic anomaly detection, and realizes intelligent management of the network system and efficient resource utilization. An optimization objective function that comprehensively considers network performance, abnormal response, and cost control is constructed, which can seek the best balance between the three, dynamically adjust the network strategy, and improve the overall efficiency of the network.

[0143] See also Figure 2, is a schematic diagram of a network management device based on artificial intelligence provided by an embodiment of the present invention. The network management device based on artificial intelligence includes:

[0144] Acquisition module 1, used to acquire current network status data in the network system;

[0145] Feature extraction module 2, used for extracting features from the current network status data to obtain network status features;

[0146] Prediction module 3, used for inputting the network status features into a network traffic prediction model based on LSTM and combined with an attention mechanism to predict future traffic trends;

[0147] Identification module 4, used for inputting the network status feature into a pre-trained network traffic anomaly identification model to identify network traffic anomalies;

[0148] The management module 5 is used to determine the network optimization strategy of the network system according to the future traffic trend and the network traffic anomaly type, so as to dynamically adjust and optimize the network system.

[0149] In the embodiment of the present invention, first, the system collects network status data in real time and converts it into machine-readable network status features through feature extraction technology; then, these features are input into a model based on LSTM (Long Short-Term Memory Network) and fused with attention mechanism to predict changes in network traffic in the future. At the same time, the pre-trained network traffic anomaly recognition model identifies possible anomalies in the current network. Based on the analysis results of these two aspects, the system intelligently formulates network optimization strategies (such as allocating resources in advance to cope with the upcoming traffic peak, or making immediate adjustments to cope with sudden network traffic anomalies), thereby achieving the optimal configuration of network resources and continuous improvement of network performance. The embodiment of the present invention can effectively improve the accuracy of network traffic prediction and network traffic anomaly detection, and timely adjust and optimize the entire network system, thereby improving the network management effect and ultimately improving the overall performance of the network.

[0150] As an improvement of the above solution, the network status data includes data packet count, session information, delay, packet loss rate and throughput.

[0151] As an improvement of the above solution, the network traffic prediction model based on LSTM and combined with the attention mechanism includes:

[0152] Input layer: receives network status features;

[0153] Position encoding layer: adds position encoding to the input features to provide temporal information; the position encoding is generated using sine and cosine functions to ensure that the model can distinguish positions in the sequence;

[0154] Bidirectional LSTM layer: It combines the forward-to-backward and backward-to-forward LSTM units, and can process the input sequence from both the forward and backward directions, thereby capturing the bidirectional temporal dependencies and helping the model better understand the contextual information of the time series.

[0155] Multi-head attention layer: allows the model to focus on information from different representation subspaces in parallel (that is, allows the model to extract information from different representation subspaces), enhancing the model's ability to handle complex dependencies; the attention calculation of each head is based on the Q, K and V matrices, obtained from the input through linear transformation; the results of multi-head attention are integrated through concatenation and additional linear layers;

[0156] Residual connection layer: Residual connection avoids the gradient vanishing problem in deep networks by adding the input and output of the multi-head attention layer, ensuring the smooth flow of information and enhancing the stability and performance of the model;

[0157] Dropout layer: used to reduce overfitting and randomly discard the output of some neurons;

[0158] Fully connected layer: used to convert the output of LSTM into the final traffic prediction value; this layer compresses the features of the time series into the dimension of the prediction target and generates a prediction of the traffic at the next or next few time points;

[0159] The prediction module is specifically used for:

[0160] Send the network state feature sequence to the position encoding layer to obtain the position encoding feature with time information;

[0161] The position encoding features with time information are sent to the bidirectional LSTM layer to further process the previous and next associations of the time series;

[0162] Through the multi-head attention mechanism, the model weights the relevance of the features at each time point output by the bidirectional LSTM layer and extracts the most valuable information for prediction;

[0163] The input and output of the multi-head attention layer are added through residual connections to maintain the integrity of the information flow;

[0164] The Dropout layer randomly discards the output of some neurons in the residual connection layer to reduce overfitting;

[0165] Finally, the features processed by the Dropout layer are mapped to the traffic prediction value through the fully connected layer, and the prediction results of future traffic trends are output.

[0166] As an improvement of the above solution, the identification module includes:

[0167] A construction submodule is used to input the network status feature into a pre-trained network traffic anomaly recognition model, sort the features according to their importance and randomly select a feature from the network status feature through the segmentation rule of the decision tree of the isolation forest algorithm, and use the feature value of the selected feature as the segmentation point, so as to divide the feature value set of the network status feature into two subsets, namely, a subset with a feature value less than the segmentation point and a subset with a feature value greater than or equal to the segmentation point; wherein the isolation forest algorithm constructs multiple decision trees based on the network status feature, and each decision tree corresponds to a network status feature; the importance of the feature is measured according to the following calculation formula: ; As information gain, it is used to measure the improvement of the classification ability of the feature set S of the network state feature by the feature A in the network state feature, and represents the entropy of the data set S; is a subset of feature A whose value is v; are all possible values ​​of feature A; and Represent the feature set S and subset respectively The number of samples; It represents the entropy of the feature set S, which measures the uncertainty of the feature set. The entropy calculation formula is: ; It is a feature The probability of appearing in the data set S;

[0168] An initialization submodule is used to randomly select a characteristic value of a network state characteristic from the network state characteristic as a test data point, and initialize the path length of the test data point in the decision tree starting from the root node of the decision tree corresponding to the network state characteristic. is 0;

[0169] The checking submodule is used to check the feature value of the test data point and the segmentation feature and segmentation point of the node at the current node of the decision tree; if the feature value is less than the segmentation point, move to the left subtree; if the feature value is greater than or equal to the segmentation point, move to the right subtree; each time the test data point moves, the path length in the decision tree is Increase by 1;

[0170] The traversal submodule is used to end the traversal when the leaf node of the decision tree is reached. As the path length of the test data point in the decision tree;

[0171] The repeating submodule is used to repeatedly execute the initialization submodule to the traversal submodule for each decision tree in the isolation forest algorithm until all decision trees are processed, thereby calculating the path length of each network state feature isolated in the corresponding decision tree ;

[0172] The first calculation submodule is used to calculate the expected value according to the path length isolated in the corresponding decision tree of each network state feature through the following expected value calculation formula: Calculate the expected value: ; N is the total number of decision trees built in the isolation forest; It is The path length of each network state feature in the corresponding decision tree;

[0173] The second calculation submodule is used to calculate the anomaly score according to the expected value and the average path length of the decision tree using the following anomaly score calculation formula Calculate network traffic anomaly score: ; is the average path length when there are n nodes in the decision tree; ; is the harmonic series item;

[0174] The comparison submodule is used to compare the network traffic anomaly score with the predicted network traffic anomaly score threshold to obtain the network traffic anomaly identification result.

[0175] An embodiment of the present invention provides an artificial intelligence-based network management device. The artificial intelligence-based network management device of this embodiment includes: a processor, a memory, and a computer program stored in the memory and executable on the processor, such as an artificial intelligence-based network management program. When the processor executes the computer program, the steps in the above-mentioned embodiments of the artificial intelligence-based network management method are implemented. Alternatively, when the processor executes the computer program, the functions of each module / unit in the above-mentioned device embodiments are implemented.

[0176] Exemplarily, the computer program may be divided into one or more modules / units, which are stored in the memory and executed by the processor to complete the present invention. The one or more modules / units may be a series of computer program instruction segments capable of completing specific functions, which are used to describe the execution process of the computer program in the artificial intelligence-based network management device.

[0177] The network management device based on artificial intelligence can be a computing device such as a desktop computer, a notebook, a PDA, and a cloud server. The network management device based on artificial intelligence can include, but is not limited to, a processor and a memory. Those skilled in the art can understand that the schematic diagram is only an example of a network management device based on artificial intelligence, and does not constitute a limitation on the network management device based on artificial intelligence. It can include more or fewer components than shown in the figure, or combine certain components, or different components. For example, the network management device based on artificial intelligence can also include input and output devices, network access devices, buses, etc.

[0178] The processor may be a central processing unit (CPU), other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor, etc. The processor is the control center of the network management device based on artificial intelligence, and uses various interfaces and lines to connect the various parts of the entire network management device based on artificial intelligence.

[0179] The memory can be used to store the computer program and / or module, and the processor realizes various functions of the network management device based on artificial intelligence by running or executing the computer program and / or module stored in the memory, and calling the data stored in the memory. The memory can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, an application required for at least one function (such as a sound playback function, an image playback function, etc.), etc.; the data storage area can store data created according to the use of the mobile phone (such as audio data, a phone book, etc.), etc. In addition, the memory can include a high-speed random access memory, and can also include a non-volatile memory, such as a hard disk, a memory, a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (SecureDigital, SD) card, a flash card (Flash Card), at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0180] Wherein, if the module / unit integrated in the network management device based on artificial intelligence is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on such an understanding, the present invention implements all or part of the processes in the above-mentioned embodiment method, and can also be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium, and the computer program can implement the steps of the above-mentioned various method embodiments when executed by the processor. Wherein, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form, etc. The computer-readable medium can include: any entity or device capable of carrying the computer program code, recording medium, U disk, mobile hard disk, disk, optical disk, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), electric carrier signal, telecommunication signal and software distribution medium, etc. It should be noted that the content contained in the computer-readable medium can be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media does not include electrical carrier signals and telecommunication signals.

[0181] It should be noted that the device embodiments described above are merely schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. In addition, in the accompanying drawings of the device embodiments provided by the present invention, the connection relationship between the modules indicates that there is a communication connection between them, which may be specifically implemented as one or more communication buses or signal lines. A person of ordinary skill in the art may understand and implement it without paying any creative effort.

[0182] The above is a preferred embodiment of the present invention. It should be pointed out that a person skilled in the art can make several improvements and modifications without departing from the principle of the present invention. These improvements and modifications are also considered to be within the scope of protection of the present invention.

Claims

1. A network management method based on artificial intelligence, characterized in that: include: Acquire current network status data in the network system; the network status data includes data packet count, session information, delay, packet loss rate and throughput; Extracting features from the current network status data to obtain network status features; Inputting the network status features into a network traffic prediction model based on LSTM and combined with an attention mechanism to predict future traffic trends; Inputting the network status feature into a pre-trained network traffic anomaly recognition model to identify network traffic anomalies; Determine the network optimization strategy of the network system according to the future traffic trend and the type of network traffic anomaly, so as to dynamically adjust and optimize the network system; The network traffic prediction model based on LSTM and combined with the attention mechanism includes: Input layer: receives network status features; Position encoding layer: adds position encoding to the input features to provide temporal information; the position encoding is generated using sine and cosine functions to ensure that the model can distinguish positions in the sequence; Bidirectional LSTM layer: It combines the forward-to-backward and backward-to-forward LSTM units, and can process the input sequence from both the forward and backward directions at the same time, thereby capturing the bidirectional temporal dependency and helping the model better understand the contextual information of the time series; Multi-head attention layer: allows the model to focus on information from different representation subspaces in parallel, enhancing the model's ability to handle complex dependencies; the attention calculation of each head is based on the Q, K, and V matrices, obtained from the input through linear transformation; the results of multi-head attention are integrated through concatenation and additional linear layers; Residual connection layer: Residual connection avoids the gradient vanishing problem in deep networks by adding the input and output of the multi-head attention layer, ensuring the smooth flow of information and enhancing the stability and performance of the model; Dropout layer: used to reduce overfitting and randomly discard the output of some neurons; Fully connected layer: used to convert the output of LSTM into the final traffic prediction value; this layer compresses the features of the time series into the dimension of the prediction target and generates a prediction of the traffic at the next or next few time points; The inputting the network status features into a network traffic prediction model based on LSTM and combined with an attention mechanism to predict future traffic trends includes: Send the network state feature sequence to the position encoding layer to obtain the position encoding feature with time information; The position encoding features with time information are sent to the bidirectional LSTM layer to further process the previous and next associations of the time series; Through the multi-head attention mechanism, the model weights the relevance of the features at each time point output by the bidirectional LSTM layer and extracts the most valuable information for prediction; The input and output of the multi-head attention layer are added through residual connections to maintain the integrity of the information flow; The Dropout layer randomly discards the output of some neurons in the residual connection layer to reduce overfitting; Finally, the features processed by the Dropout layer are mapped to the traffic prediction value through the fully connected layer, and the prediction result of future traffic trend is output; The step of inputting the network status feature into a pre-trained network traffic anomaly recognition model to recognize network traffic anomalies includes: Step 30, input the network status feature into a pre-trained network traffic anomaly recognition model, sort the features according to their importance and randomly select a feature from the network status feature through the segmentation rule of the decision tree of the isolation forest algorithm, and use the feature value of the selected feature as the segmentation point, so as to divide the feature value set of the network status feature into two subsets, namely, a subset with a feature value less than the segmentation point and a subset with a feature value greater than or equal to the segmentation point; wherein the isolation forest algorithm constructs multiple decision trees based on the network status feature, and each decision tree corresponds to a network status feature; the importance of the feature is measured according to the following calculation formula: ; As information gain, it is used to measure the improvement of the classification ability of the feature set S of the network state feature by the feature A in the network state feature, and represents the entropy of the data set S; is a subset of feature A whose value is v; are all possible values ​​of feature A; and Represent the feature set S and subset respectively The number of samples; It represents the entropy of the feature set S, which measures the uncertainty of the feature set. The entropy calculation formula is: ; It is a feature The probability of appearing in the data set S; Step 31, randomly select a characteristic value of a network state characteristic from the network state characteristic as a test data point, and start from the root node of the decision tree corresponding to the network state characteristic, initialize the path length of the test data point in the decision tree is 0; Step 32, at the current node of the decision tree, check the feature value of the test data point and the segmentation feature and segmentation point of the node; if the feature value is less than the segmentation point, move to the left subtree; if the feature value is greater than or equal to the segmentation point, move to the right subtree; each time it moves, the path length of the test data point in the decision tree is Increase by 1; Step 33, when the leaf node of the decision tree is reached, the traversal ends, and the calculated As the path length of the test data point in the decision tree; Step 34, for each decision tree in the isolation forest algorithm, repeat steps 31 to 33 until all decision trees are processed, thereby calculating the path length of each network state feature isolated in the corresponding decision tree ; Step 35, using the following expected value calculation formula, the path length isolated in the corresponding decision tree according to each network state feature Calculate the expected value: ; N is the total number of decision trees built in the isolation forest; It is The path length of each network state feature in the corresponding decision tree; Step 36, using the following anomaly score calculation formula, based on the expected value and the average path length of the decision tree Calculate network traffic anomaly score: ; is the average path length when there are n nodes in the decision tree; ; is the harmonic series item; Step 37, comparing the network traffic anomaly score with the predicted network traffic anomaly score threshold to obtain a network traffic anomaly identification result.

2. A network management device based on artificial intelligence, characterized in that: include: An acquisition module is used to acquire current network status data in the network system; the network status data includes data packet count, session information, delay, packet loss rate and throughput; A feature extraction module is used to extract features from the current network status data to obtain network status features; A prediction module, used for inputting the network status features into a network traffic prediction model based on LSTM and combined with an attention mechanism to predict future traffic trends; An identification module, used for inputting the network status feature into a pre-trained network traffic anomaly identification model to identify network traffic anomalies; A management module, used to determine a network optimization strategy of the network system according to the future traffic trend and the type of network traffic anomaly, so as to dynamically adjust and optimize the network system; The network traffic prediction model based on LSTM and combined with the attention mechanism includes: Input layer: receives network status features; Position encoding layer: adds position encoding to the input features to provide temporal information; the position encoding is generated using sine and cosine functions to ensure that the model can distinguish positions in the sequence; Bidirectional LSTM layer: It combines the forward-to-backward and backward-to-forward LSTM units, and can process the input sequence from both the forward and backward directions, thereby capturing the bidirectional temporal dependencies and helping the model better understand the contextual information of the time series. Multi-head attention layer: allows the model to focus on information from different representation subspaces in parallel, enhancing the model's ability to handle complex dependencies; the attention calculation of each head is based on the Q, K, and V matrices, obtained from the input through linear transformation; the results of multi-head attention are integrated through concatenation and additional linear layers; Residual connection layer: Residual connection avoids the gradient vanishing problem in deep networks by adding the input and output of the multi-head attention layer, ensuring the smooth flow of information and enhancing the stability and performance of the model; Dropout layer: used to reduce overfitting and randomly discard the output of some neurons; Fully connected layer: used to convert the output of LSTM into the final traffic prediction value; this layer compresses the features of the time series into the dimension of the prediction target and generates a prediction of the traffic at the next or next few time points; The prediction module is specifically used for: Send the network state feature sequence to the position encoding layer to obtain the position encoding feature with time information; The position encoding features with time information are sent to the bidirectional LSTM layer to further process the previous and next associations of the time series; Through the multi-head attention mechanism, the model weights the relevance of the features at each time point output by the bidirectional LSTM layer and extracts the most valuable information for prediction; The input and output of the multi-head attention layer are added through residual connections to maintain the integrity of the information flow; The Dropout layer randomly discards the output of some neurons in the residual connection layer to reduce overfitting; Finally, the features processed by the Dropout layer are mapped to the traffic prediction value through the fully connected layer, and the prediction result of future traffic trend is output; The identification module comprises: A construction submodule is used to input the network status feature into a pre-trained network traffic anomaly recognition model, sort the features according to their importance and randomly select a feature from the network status feature through the segmentation rule of the decision tree of the isolation forest algorithm, and use the feature value of the selected feature as the segmentation point, so as to divide the feature value set of the network status feature into two subsets, namely, a subset with a feature value less than the segmentation point and a subset with a feature value greater than or equal to the segmentation point; wherein the isolation forest algorithm constructs multiple decision trees based on the network status feature, and each decision tree corresponds to a network status feature; the importance of the feature is measured according to the following calculation formula: ; As information gain, it is used to measure the improvement of the classification ability of the feature set S of the network state feature by the feature A in the network state feature, and represents the entropy of the data set S; is a subset of feature A whose value is v; are all possible values ​​of feature A; and Represent the feature set S and subset respectively The number of samples; It represents the entropy of the feature set S, which measures the uncertainty of the feature set. The entropy calculation formula is: ; It is a feature The probability of appearing in the data set S; An initialization submodule is used to randomly select a characteristic value of a network state characteristic from the network state characteristic as a test data point, and initialize the path length of the test data point in the decision tree starting from the root node of the decision tree corresponding to the network state characteristic. is 0; The checking submodule is used to check the feature value of the test data point and the segmentation feature and segmentation point of the node at the current node of the decision tree; if the feature value is less than the segmentation point, move to the left subtree; if the feature value is greater than or equal to the segmentation point, move to the right subtree; each time the test data point moves, the path length in the decision tree is Increase by 1; The traversal submodule is used to end the traversal when the leaf node of the decision tree is reached. As the path length of the test data point in the decision tree; The repeating submodule is used to repeatedly execute the initialization submodule to the traversal submodule for each decision tree in the isolation forest algorithm until all decision trees are processed, thereby calculating the path length of each network state feature isolated in the corresponding decision tree ; The first calculation submodule is used to calculate the expected value according to the path length isolated in the corresponding decision tree of each network state feature through the following expected value calculation formula: Calculate the expected value: ; N is the total number of decision trees built in the isolation forest; It is The path length of each network state feature in the corresponding decision tree; The second calculation submodule is used to calculate the anomaly score according to the expected value and the average path length of the decision tree using the following anomaly score calculation formula Calculate network traffic anomaly score: ; is the average path length when there are n nodes in the decision tree; ; is the harmonic series item; The comparison submodule is used to compare the network traffic anomaly score with the predicted network traffic anomaly score threshold to obtain the network traffic anomaly identification result.

3. A network management device based on artificial intelligence, characterized in that: The method comprises a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein when the processor executes the computer program, the network management method based on artificial intelligence as claimed in claim 1 is implemented.

4. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes a stored computer program, wherein when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute the artificial intelligence-based network management method as claimed in claim 1.

Images