An abnormal reason positioning method and device based on 5G private network behavior log backtracking

Abstract

The application discloses a kind of based on 5G private network behavior log backtracking abnormal reason positioning method and device, the method of the present application includes obtaining based on 5G behavior log flow log to be analyzed;The abnormal log marked in the log to be analyzed is paired with the log to be analyzed, to output service flow log sequence according to the configuration information of corresponding log History backtracking of log;Deep learning LSTM model is trained based on service flow log sequence to identify and output abnormal log;Get the fault data of the service flow with newly identified abnormal log in the corresponding time period is not all located to reason, and the neural network prediction model is trained using newly identified abnormal log to identify the association between newly identified abnormal log and fault data.The present application can effectively identify and locate the abnormality not defined in advance.

Description

Technical Field

[0001] This invention relates to the field of core network technology, and in particular to a method and apparatus for locating the cause of anomalies based on 5G private network behavior log backtracking. Background Technology

[0002] With the expansion of China's 5G commercial market, 5G industry virtual private networks (VPNs) are developing rapidly. The cloud-network convergence model has led to the gradual prosperity and enrichment of applications, but it has also resulted in more dynamic and complex services, significantly increasing the difficulty of network management. For example, with the introduction of microservice architecture technology and on-demand network deployment, anomaly localization and delimitation in 5G private network operation and maintenance have become extremely difficult. Currently, the industry has proposed a large number of solutions to the anomaly localization problem in the 5G network environment. For example, the patent document "CN113762978A 5G Slice User Complaint Delimitation Method, Device and Computing Equipment" utilizes a complaint delimitation model based on a hybrid graph network. It jointly learns the graph network that processes the slice instance topology and the convolutional neural network that processes the slice user complaint text to predict the delimitation result, so as to accurately determine the source node of the slice user complaint, thereby facilitating subsequent targeted complaint processing.

[0003] Existing anomaly location solutions based on user complaints are outdated, unable to solve real-time anomaly location, and due to the sporadic nature of complaints, it is difficult to form targeted anomaly location.

[0004] In practical management activities, maintenance personnel mainly rely on the 5G private network behavior log backtracking function to track terminal behavior logs in real time or back to historical records, thereby discovering abnormal terminal behavior and promptly addressing it. Currently, the industry's 5G private network behavior log backtracking function is based on UPF traffic probes, which can filter all behavior records within a user-selected tracking time and identify abnormal records. However, the problem with existing technology is that only pre-defined anomalies are identified; that is, the cause of anomalies is currently located and confirmed by looking up manually defined anomalies in a table. Unknown faults cannot be identified or located. Summary of the Invention

[0005] The present invention aims to at least partially solve one of the technical problems in the related art.

[0006] To address this, the present invention proposes an anomaly cause localization method based on 5G private network behavior log backtracking. By using big data analysis to identify related behaviors in the logs, and then starting from the logs of the abnormal behaviors, it is possible to trace the associated abnormal logs, thereby enabling the identification of unknown abnormal faults and solving the problem that existing technologies cannot identify or locate unknown faults.

[0007] Another objective of this invention is to propose an anomaly cause location device based on 5G private network behavior log backtracking.

[0008] To achieve the above objectives, this invention proposes a method for locating the causes of anomalies based on 5G private network behavior log backtracking, comprising:

[0009] Obtain the logs to be analyzed based on 5G behavior log streams;

[0010] The marked abnormal logs in the log to be analyzed are paired with the log to be analyzed, so as to output the business flow log sequence by backtracking the log history according to the configuration information of the corresponding log;

[0011] A deep learning LSTM model is trained based on the business flow log sequence to identify and output abnormal logs;

[0012] Obtain all fault data of business flows with newly identified abnormal logs within the corresponding time period for which the cause could not be located, and use the newly identified abnormal logs to train a neural network prediction model to identify the correlation between the newly identified abnormal logs and the fault data.

[0013] The anomaly cause localization method based on 5G private network behavior log backtracking in this embodiment of the invention may also have the following additional technical features:

[0014] In one embodiment of the present invention, acquiring the log to be analyzed based on a 5G behavior log stream includes:

[0015] Acquire 5G behavior log stream;

[0016] Filter the whitelisted logs and logs marked as abnormal in the 5G behavior log stream, and mark the unfiltered logs in the 5G behavior log stream as logs to be analyzed.

[0017] In one embodiment of the present invention, the marked abnormal logs existing in the log to be analyzed are paired with the log to be analyzed, so as to output the business flow log sequence by log history backtracking according to the configuration information of the corresponding logs, including:

[0018] Extract the log slices to be analyzed;

[0019] Obtain the marked abnormal logs in the log slice to be analyzed, and pair the log to be analyzed with each abnormal log to perform log history backtracking based on the configuration information of the two paired logs.

[0020] Based on the log history backtracking results, all log data within the first preset time period is obtained, and log sequences under the same business process are aggregated according to the business identifiers marked by the log system to output the business flow log sequence.

[0021] In one embodiment of the present invention, training a deep learning LSTM model based on the business flow log sequence to identify and output abnormal logs includes:

[0022] The training sample data of the business flow log sequence is extracted using a sliding window;

[0023] The training sample data is used to train a deep learning LSTM model so that the model has the ability to identify abnormal logs in the log sequence, thus obtaining a well-trained deep learning LSTM model.

[0024] The trained deep learning LSTM model is used to identify and output anomaly logs.

[0025] In one embodiment of the present invention, acquiring all fault data of service flows with newly identified abnormal logs within a corresponding time period for which the cause could not be located, and using the newly identified abnormal logs to train a neural network prediction model to identify the correlation between the newly identified abnormal logs and the fault data, includes:

[0026] Call the exception log of the new identifier;

[0027] Obtain the service flow with the new identifier in the abnormal log, and extract all fault data of the service flow whose cause cannot be located within the second preset time period;

[0028] The distribution information, log sequence information, and log variable information of the newly identified abnormal logs in the business flow are input into the neural network prediction model to obtain a trained neural network prediction model based on the model output results.

[0029] The trained neural network prediction model is used to identify the correlation between the newly identified abnormal logs and the fault data.

[0030] To achieve the above objectives, another aspect of the present invention proposes an anomaly cause localization device based on 5G private network behavior log backtracking, comprising:

[0031] The module for acquiring logs to be analyzed is used to acquire logs to be analyzed based on 5G behavior log streams;

[0032] The log history backtracking module is used to pair the marked abnormal logs in the log to be analyzed with the log to be analyzed, so as to output the business flow log sequence by performing log history backtracking according to the configuration information of the corresponding logs;

[0033] An anomaly log identification module is used to train a deep learning LSTM model based on the business flow log sequence to identify and output anomaly logs.

[0034] The correlation positioning module is used to obtain all fault data of business flows with newly identified abnormal logs within the corresponding time period for which the cause cannot be located, and to use the newly identified abnormal logs to train a neural network prediction model to identify the correlation between the newly identified abnormal logs and the fault data.

[0035] The present invention relates to an anomaly cause localization method and apparatus based on 5G private network behavior log backtracking. By associating logs that are unknown whether they cause an anomaly with logs that are known to cause an anomaly, and by tracking the contextual relationships between logs across the entire business process based on the logs, the anomalies in the logs when both occur simultaneously are identified. For the identified anomaly logs, a neural network model is then trained to determine whether they are associated with faults, thereby enabling the model to predict faults. This achieves a solution for mining undefined anomaly logs and associating them with faults.

[0036] Additional aspects and advantages of the invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. Attached Figure Description

[0037] The above and / or additional aspects and advantages of the present invention will become apparent and readily understood from the following description of the embodiments taken in conjunction with the accompanying drawings, wherein:

[0038] Figure 1 This is a flowchart of an anomaly cause localization method based on 5G private network behavior log backtracking according to an embodiment of the present invention;

[0039] Figure 2 This is a logic diagram of an anomaly cause localization method based on 5G private network behavior log backtracking according to an embodiment of the present invention;

[0040] Figure 3 This is a flowchart of the pairing and historical backtracking of logs to be analyzed and abnormal logs according to an embodiment of the present invention;

[0041] Figure 4 This is a schematic diagram of training a deep learning LSTM model according to an embodiment of the present invention;

[0042] Figure 5 This is a flowchart of the exception log identification process according to an embodiment of the present invention;

[0043] Figure 6 This is a schematic diagram of training a neural network using training sample data according to an embodiment of the present invention;

[0044] Figure 7 This is a flowchart for locating the cause of a fault according to an embodiment of the present invention;

[0045] Figure 8 This is a schematic diagram of the anomaly cause location device for 5G private network behavior log backtracking according to an embodiment of the present invention. Detailed Implementation

[0046] It should be noted that, unless otherwise specified, the embodiments and features described in the present invention can be combined with each other. The present invention will now be described in detail with reference to the accompanying drawings and embodiments.

[0047] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0048] The following describes, with reference to the accompanying drawings, an anomaly cause localization method and apparatus based on 5G private network behavior log backtracking according to an embodiment of the present invention.

[0049] Figure 1 This is a flowchart of an anomaly cause localization method based on 5G private network behavior log backtracking according to an embodiment of the present invention, as follows: Figure 1 As shown, the method includes, but is not limited to, the following steps:

[0050] S1, Obtain the logs to be analyzed based on the 5G behavior log stream;

[0051] S2, pair the marked abnormal logs in the log to be analyzed with the log to be analyzed, so as to output the business flow log sequence by backtracking the log history according to the configuration information of the corresponding log;

[0052] S3, train a deep learning LSTM model based on business flow log sequences to identify and output abnormal logs;

[0053] S4. Obtain all fault data of the business flow with the new identifier that has no cause within the corresponding time period, and use the new identifier to train a neural network prediction model to identify the correlation between the new identifier's abnormal logs and the fault data.

[0054] It is understood that this invention predefines a log-event template, enabling the correlation processing of logs and events based on UPF soft probe monitoring information. This involves filtering whitelisted events and identifying abnormal log events, and locating the causes of abnormal events. In terms of log event detection, the located faults are provided for real-time fault location output. Simultaneously, in real-time log processing, logs are sliced ​​during real-time anomaly detection. These slices are filtered by anomaly detection to remove whitelisted events and already identifiable abnormal events, leaving only the logs to be analyzed. This unseen logs are then correlated with abnormal logs to further link them to fault events occurring at corresponding times, thus forming an anomaly event location system that links non-abnormal logs to fault events. Figure 2 As shown.

[0055] Specifically, Figure 3 This is a flowchart illustrating the pairing of logs to be analyzed and abnormal logs, as well as the historical backtracking process implemented in this invention. Figure 3 As shown, the process includes:

[0056] S301, obtain real-time log stream;

[0057] S302, filters whitelisted logs and logs marked as abnormal through a log anomaly detection template;

[0058] S303 marks the unfiltered logs as logs to be analyzed and extracts each log slice to be analyzed;

[0059] S304, There are other marked abnormal logs in the log slice to be analyzed. Pair the log to be analyzed with each abnormal log separately.

[0060] S305, perform log history backtracking based on the configuration information of the two paired logs; configuration information: status and parameter information of the terminal devices associated with both logs; log history backtracking: retrieve all log data within a preset time period (i.e., the first preset time period in this embodiment of the invention) within the historical log database, such as one hour, for the associated terminal devices where these two logs occurred;

[0061] S306, This slice contains paired logs with unrecovered log data;

[0062] S307, For all extracted log data, aggregate the log sequences under the same business process according to the business identifiers already marked in the log system;

[0063] S308, There are unmatched log slices to be analyzed;

[0064] S309, output the business flow log sequence.

[0065] In one embodiment of the present invention, real-time historical log backtracking is performed based on the configuration information of the log to be analyzed input by the user and the abnormal logs in the same slice. The configuration information is then passed to the UPF soft probe module of the UPF soft probe interface. The UPF soft probe module filters out the relevant UPF signaling, i.e., the associated historical log information, based on the text and time parameters of the configuration information, and then sends it back. UPF (User Plane Function) is the user plane function.

[0066] Understandably, the User Plane Function (UPF) is a key component of the 5G core network (5GC), primarily responsible for processing and forwarding user plane data. In the 5G network architecture, the Control Plane (CP) and User Plane (UP) are separated (CUPS). This design improves flexibility and efficiency, enabling the network to better support diverse service requirements, especially for scenarios where low latency and high bandwidth are crucial. The core responsibilities of the UPF include: Packet routing and forwarding: The UPF is responsible for determining the routing of user packets according to policies and efficiently forwarding data from one network node to another, including terminal devices, base stations, or other network function entities. Session and data management: Working in conjunction with the SMF (Session Management Function) of the control plane, the UPF participates in the establishment, modification, and release of user sessions, managing the context of user data flows. Policy enforcement: Based on the policies and rules provided by the Policy Control Function (PCF), the UPF executes packet processing decisions, such as QoS (Quality of Service) guarantees, billing, and packet inspection. Edge Computing and Network Slicing: As a key interface for 5G network slicing and edge computing, UPF can be deployed closer to users, such as edge data centers, to reduce latency and improve user experience. Security and Billing: UPF also participates in secure data processing, such as encryption and decryption, and reports billing information for user data traffic, ensuring service providers can accurately measure and bill data.

[0067] It is understandable that the log data of the operation and maintenance system records various status and parameter information of the terminal device. Compared with other components of the 5G private network, the terminal device has a wider range and greater identifiability. Therefore, this invention uses the information of the terminal device as the association node to match the log data of unknown abnormality to the log data of known abnormality, thereby finding the logs that can be associated with abnormal logs in the complex log data of unknown abnormality and mining the undefined abnormal logs.

[0068] This invention extracts all abnormal logs from the segment containing the log to be analyzed, as well as from the two adjacent segments. Using the terminal devices associated with these logs (all abnormal logs) as the association standard, it identifies logs with business flow associations to the log to be analyzed. Log history is then traced back by pairwise matching of the log to be analyzed and its associated logs. Specifically, logs under the same business process are aggregated according to business identifiers. Then, business flows that are simultaneously associated with both logs within a set time period are filtered out, thereby identifying historical log information where both are associated. A business flow log sequence related to the log to be analyzed is output, allowing abnormal logs to be identified through the log sequence.

[0069] Furthermore, Figure 4 This is a flowchart illustrating the exception log identification process implemented in this invention, as follows: Figure 4 As shown, the process includes:

[0070] S401, Extract the business flow log sequence;

[0071] S402, extract training sample data of log sequences through a sliding window;

[0072] S403 uses training sample data to train a neural network with algorithms such as gradient descent, so that it can identify abnormal logs in the log sequence, in order to obtain a trained deep learning LSTM model.

[0073] S404, an anomaly log based on a trained deep learning LSTM model;

[0074] S405, determine if there is a business flow log sequence with unidentified abnormal logs;

[0075] S406, output exception log.

[0076] Specifically, embodiments of the present invention require extracting the associated log sequences of two logs: the already identifiable log anomaly events and the log to be analyzed, in order to train a deep learning LSTM model to identify the anomaly logs. LSTM (Long Short-Term Memory Networks) is a neural network.

[0077] Understandably, LSTM introduces a memory cell and three gates: the input gate, the forget gate, and the output gate. These gates function as follows: The forget gate determines which information is discarded from the memory cell, calculated using a sigmoid function to obtain a value between 0 and 1, where 0 represents complete forgetting and 1 represents complete retention. The input gate determines which new information should be added to the memory cell, also calculated using a sigmoid function, and a tanH function processes the new information (called the candidate value of the input gate). The cell state updates the state of the memory cell by combining the outputs of the forget and input gates, handling both the forgetting of old information and the addition of new information. The output gate controls which information from the memory cell will be used for the output at the current time step, determined by a sigmoid function and then processed by a tanH function to obtain the final output. Its applications: Due to its advantages in handling long-term dependencies, LSTM is widely used in various sequence data processing tasks, including: Natural Language Processing: machine translation, sentiment analysis, text generation, and speech recognition. Speech recognition: Recognition and transcription of long-sequence speech signals. Video analytics: Action recognition and scene understanding. Image recognition: Image classification and generation combining sequence information. Time series forecasting: Stock market forecasting, weather forecasting, etc.

[0078] LSTM, through its unique gating mechanism, enables the learning of long-term dependencies, overcoming the limitations of traditional RNNs in processing long sequence data, and represents a significant advancement in sequence learning. With the advancement of deep learning research, LSTM has been continuously optimized and expanded, combined with other techniques such as attention mechanisms and bidirectional LSTM to further improve model performance and application scope.

[0079] like Figure 5 As shown, this invention takes virtual machine mapping service flow as an example, and associates the log sequence Sn={E10, E12, E26, E32, E20}:

[0080] E10, Auditing locally available compute resources for node xxxx;

[0081] E12. Compute_service record updated for xxx:xxx;

[0082] E26. Final resource view: name=xxx phys_ram=385384MB used_ram=90112MB phys_disk=339GB used_disk=0GB total_vcpus=40used_vcpus=20pci_stats=[];

[0083] E32, Total usable vcpus:40, total allocated vcpus:20;

[0084] E20. compute.metrics.update is not a versioned notification and notwhitelisted.See. / doc / source / notification.rst.

[0085] For example, this invention sets the window length h of the deep learning LSTM model (with h=3 as an example) and the step size s=1, and sequentially extracts training sample data for each sequence using a sliding window. The training sample data is then used to train the neural network using algorithms such as gradient descent to identify abnormal logs in the log sequence. Figure 6 As shown.

[0086] Specifically, during training, the Poisson probability P(Tn|Sn-1) distribution is obtained using Sn-1. Based on the probability distribution of each log Tn obtained during training, the TopN probability distributions of each log Tn are recorded. For example, given the log sequence to be detected: E10, E12, E26, E32, E35, the Sn-1 of log Tn in this log sequence is E12, E26, E32, E35, and E35 is not within the TopN interval of log Tn. Therefore, log E35 is marked as an abnormal log.

[0087] Therefore, this invention filters logs that are close to the time of the abnormal log occurrence in real time and cannot be analyzed to determine whether they are related to the fault. It uses terminal devices that are associated with both the log to be analyzed and the abnormal log as associated nodes, filters business flows that are associated with both logs within a set time period, and identifies the abnormal logs in the filtered business flows by training a deep learning LSTM model, thereby realizing the identification and location of abnormal logs that have not been predefined.

[0088] Furthermore, Figure 7 This is a flowchart illustrating the fault location process of this invention, as shown below. Figure 7 As shown, the process includes:

[0089] S701, invoke the exception log of the new identifier;

[0090] S702, for all service flows with the new identifier in the abnormal log, extract all fault data for which the cause cannot be located within the second preset time period (this time period can be any time period). In this embodiment of the invention, fault data of the device terminal is taken first.

[0091] S703, taking the log's distribution information in the business flow, its log sequence information, and log variable information as input, and whether various faults occur as output, trains a neural network prediction model that can identify whether a certain type of fault is related to the log.

[0092] S704 uses a trained neural network prediction model to identify the correlation between abnormal logs and device terminal fault data for each newly identified identifier, thereby realizing the correlation between abnormal logs and terminal device faults.

[0093] Specifically, in this embodiment of the invention, all faults for which no cause has been located are matched with relevant historical log information within the corresponding time period. For each fault, the association between it and the log marked as abnormal is analyzed, and a neural network prediction model is established for prediction. Specifically, the distribution information, sequence information, and variable state information of the log are used as inputs, and whether the fault occurs is used as the output, so as to realize the association identification of abnormal behaviors in the behavior log that may cause faults.

[0094] Therefore, this invention establishes a neural network prediction model for the identified abnormal logs, taking multiple configuration information as input and whether an unknown terminal device failure occurs when it occurs as output, to obtain the identification capability of distinguishing whether the abnormal logs are associated with a fault, thereby realizing the fault association of undefined abnormal logs, that is, locating the log abnormality corresponding to the terminal device failure.

[0095] The abnormal cause localization method based on 5G private network behavior log backtracking according to the present invention identifies related behaviors in the logs through big data analysis, and then traces the abnormal logs associated with the abnormal behavior from the logs in which the abnormal behavior occurred, thereby realizing the identification of unknown abnormal faults and solving the problem that the prior art cannot identify or locate unknown faults.

[0096] To achieve the above embodiments, such as Figure 8 As shown, this embodiment also provides an anomaly cause location device 10 based on 5G private network behavior log backtracking. The device 10 includes:

[0097] The log acquisition module 100 is used to acquire logs to be analyzed based on 5G behavior log streams;

[0098] The log history backtracking module 200 is used to pair the marked abnormal logs in the logs to be analyzed with the logs to be analyzed, so as to output the business flow log sequence by backtracking the log history according to the configuration information of the corresponding logs;

[0099] The abnormal log identification module 300 is used to train a deep learning LSTM model based on the business flow log sequence to identify and output abnormal logs.

[0100] The correlation positioning module 400 is used to acquire all fault data of business flows with newly identified abnormal logs within the corresponding time period for which the cause has not been located, and to train a neural network prediction model using the newly identified abnormal logs to identify the correlation between the newly identified abnormal logs and the fault data.

[0101] Furthermore, the log acquisition module 100 is also used for:

[0102] Acquire 5G behavior log stream;

[0103] Filter whitelisted logs and logs marked as abnormal in the 5G behavior log stream, and mark the unfiltered logs in the 5G behavior log stream as logs to be analyzed.

[0104] Furthermore, the aforementioned log history backtracking module 200 is also used for:

[0105] Extract the log slices to be analyzed;

[0106] Obtain the marked abnormal logs in the log slice to be analyzed, and pair the log to be analyzed with each abnormal log to perform log history backtracking based on the configuration information of the two paired logs.

[0107] Based on the log history backtracking results, all log data within the first preset time period is obtained, and log sequences under the same business process are aggregated according to the business identifiers marked by the log system to output the business flow log sequence.

[0108] Furthermore, the aforementioned exception log identification module 300 is also used for:

[0109] The training sample data of the business flow log sequence is extracted using a sliding window;

[0110] The training sample data is used to train a deep learning LSTM model so that the model has the ability to identify abnormal logs in the log sequence, thus obtaining a well-trained deep learning LSTM model.

[0111] The trained deep learning LSTM model is used to identify and output anomaly logs.

[0112] Furthermore, the aforementioned relationship locating module 400 is also used for:

[0113] Call the exception log of the new identifier;

[0114] Obtain the business flow with the new identifier in the abnormal log, and extract all fault data of the business flow whose cause cannot be located within the second preset time period;

[0115] The distribution information, log sequence information, and log variable information of the newly identified abnormal logs in the business flow are input into the neural network prediction model to obtain a trained neural network prediction model based on the model output results.

[0116] A trained neural network prediction model is used to identify the correlation between newly identified abnormal logs and fault data.

[0117] The anomaly cause localization device based on 5G private network behavior log backtracking according to an embodiment of the present invention identifies related behaviors in the logs through big data analysis, and then traces the associated anomaly logs from the logs where the anomaly behavior occurred, thereby realizing the identification of unknown anomaly faults and solving the problem that the prior art cannot identify or locate unknown faults.

[0118] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0119] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this invention, "a plurality of" means at least two, such as two, three, etc., unless otherwise explicitly specified.

Claims

1. A method for locating the cause of anomalies based on 5G private network behavior log backtracking, characterized in that, include: Obtain the logs to be analyzed based on 5G behavior log streams; The marked abnormal logs in the log to be analyzed are paired with the log to be analyzed, so as to output the business flow log sequence by backtracking the log history according to the configuration information of the corresponding log; A deep learning LSTM model is trained based on the business flow log sequence to identify and output abnormal logs; Obtain all fault data of business flows with newly identified abnormal logs within the corresponding time period for which the cause could not be located, and use the newly identified abnormal logs to train a neural network prediction model to identify the correlation between the newly identified abnormal logs and the fault data.

2. The method according to claim 1, characterized in that, Obtain the logs to be analyzed based on the 5G behavior log stream, including: Acquire 5G behavior log stream; Filter the whitelisted logs and logs marked as abnormal in the 5G behavior log stream, and mark the unfiltered logs in the 5G behavior log stream as logs to be analyzed.

3. The method according to claim 2, characterized in that, The marked abnormal logs in the log to be analyzed are paired with the log to be analyzed, so as to output the business flow log sequence by backtracking the log history according to the configuration information of the corresponding log, including: Extract the log slices to be analyzed; Obtain the marked abnormal logs in the log slice to be analyzed, and pair the log to be analyzed with each abnormal log to perform log history backtracking based on the configuration information of the two paired logs. Based on the log history backtracking results, all log data within the first preset time period is obtained, and log sequences under the same business process are aggregated according to the business identifiers marked by the log system to output the business flow log sequence.

4. The method according to claim 1, characterized in that, A deep learning LSTM model is trained based on the aforementioned business flow log sequences to identify and output abnormal logs, including: The training sample data of the business flow log sequence is extracted using a sliding window; The training sample data is used to train a deep learning LSTM model so that the model has the ability to identify abnormal logs in the log sequence, thus obtaining a well-trained deep learning LSTM model. The trained deep learning LSTM model is used to identify and output anomaly logs.

5. The method according to claim 1, characterized in that, Obtain all fault data of business flows with newly identified abnormal logs within the corresponding time period for which the cause cannot be located, and use the newly identified abnormal logs to train a neural network prediction model to identify the correlation between the newly identified abnormal logs and the fault data, including: Call the exception log of the new identifier; Obtain the service flow with the new identifier in the abnormal log, and extract all fault data of the service flow whose cause cannot be located within the second preset time period; The distribution information, log sequence information, and log variable information of the newly identified abnormal logs in the business flow are input into the neural network prediction model to obtain a trained neural network prediction model based on the model output results. The trained neural network prediction model is used to identify the correlation between the newly identified abnormal logs and the fault data.

6. An anomaly cause localization device based on 5G private network behavior log backtracking, characterized in that, include: The module for acquiring logs to be analyzed is used to acquire logs to be analyzed based on 5G behavior log streams; The log history backtracking module is used to pair the marked abnormal logs in the log to be analyzed with the log to be analyzed, so as to output the business flow log sequence by performing log history backtracking according to the configuration information of the corresponding logs; An anomaly log identification module is used to train a deep learning LSTM model based on the business flow log sequence to identify and output anomaly logs. The correlation positioning module is used to obtain all fault data of business flows with newly identified abnormal logs within the corresponding time period for which the cause cannot be located, and to use the newly identified abnormal logs to train a neural network prediction model to identify the correlation between the newly identified abnormal logs and the fault data.

7. The apparatus according to claim 6, characterized in that, The log acquisition module for analysis is also used for: Acquire 5G behavior log stream; Filter the whitelisted logs and logs marked as abnormal in the 5G behavior log stream, and mark the unfiltered logs in the 5G behavior log stream as logs to be analyzed.

8. The apparatus according to claim 7, characterized in that, The log history backtracking module is also used for: Extract the log slices to be analyzed; Obtain the marked abnormal logs in the log slice to be analyzed, and pair the log to be analyzed with each abnormal log to perform log history backtracking based on the configuration information of the two paired logs. Based on the log history backtracking results, all log data within the first preset time period is obtained, and log sequences under the same business process are aggregated according to the business identifiers marked by the log system to output the business flow log sequence.

9. The apparatus according to claim 6, characterized in that, The exception log identification module is also used for: The training sample data of the business flow log sequence is extracted using a sliding window; The training sample data is used to train a deep learning LSTM model so that the model has the ability to identify abnormal logs in the log sequence, thus obtaining a well-trained deep learning LSTM model. The trained deep learning LSTM model is used to identify and output anomaly logs.

10. The apparatus according to claim 6, characterized in that, The relationship locating module is also used for: Call the exception log of the new identifier; Obtain the service flow with the new identifier in the abnormal log, and extract all fault data of the service flow whose cause cannot be located within the second preset time period; The distribution information, log sequence information, and log variable information of the newly identified abnormal logs in the business flow are input into the neural network prediction model to obtain a trained neural network prediction model based on the model output results. The trained neural network prediction model is used to identify the correlation between the newly identified abnormal logs and the fault data.

Images