Abnormality detection method and device, program product and storage medium

Abstract

The invention provides an exception detection method and device, a program product and a storage medium, relates to the technical field of communication, and is used for solving the technical problem that exception reasons of a small number of exception problems cannot be determined. The anomaly detection method comprises the following steps: acquiring service plane data of a user side; determining abnormal business plane data based on the business plane index threshold; determining abnormal signaling plane data associated with the abnormal service plane data; and determining an abnormal device in the network side based on the abnormal signaling plane data.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to an anomaly detection method, device, program product and storage medium. Background Art

[0002] Traditional anomaly detection methods generally look for the proportion of abnormal indicators step by step according to the hierarchical relationship of network equipment, for example, from the entire network to the core network element, and then analyze the indicators of the wireless side cells that interact with the core network element to find out the abnormal indicators, and then extract the original call records and signaling to determine the cause of the abnormality.

[0003] However, the anomaly index is the result of comprehensive calculation of a large number of samples and is not sensitive enough to a small number of anomalies. Summary of the invention

[0004] The present application provides an anomaly detection method, device, program product and storage medium, which are used to solve the technical problem that the cause of anomalies of a small number of abnormal problems cannot be determined.

[0005] In order to achieve the above objectives, this application adopts the following technical solutions:

[0006] In a first aspect, an anomaly detection method is provided, comprising: obtaining service plane data on a user side; determining abnormal service plane data based on a service plane indicator threshold; determining abnormal signaling plane data associated with the abnormal service plane data; and determining abnormal equipment on a network side based on the abnormal signaling plane data.

[0007] Optionally, determining abnormal business plane data based on a business plane indicator domain value includes: determining business types associated with different business plane data; and determining abnormal business plane data in the business plane data based on business plane indicator thresholds corresponding to different business types.

[0008] Optionally, the method further includes: determining service surface indicator thresholds corresponding to different types of services based on a genetic algorithm.

[0009] Optionally, the service plane data includes quality of experience (QOE) data and key quality indicators (KQI) data, the signaling plane data includes key performance indicators (KPI) data, and determining abnormal signaling plane data associated with the abnormal service plane data includes: determining a first mapping relationship between the QOE data and the KQI data, and a second mapping relationship between the QOE data and the KPI data; determining abnormal QOE data in the QOE data based on the first mapping relationship and the KQI data; and determining abnormal KPI data based on the abnormal QOE data and the second mapping relationship.

[0010] Optionally, the method further includes: determining an abnormal device on the user side based on the abnormal QOE data.

[0011] Optionally, the service plane indicator includes at least one of the following: delay, jitter, and packet loss.

[0012] In a second aspect, an anomaly detection device is provided, comprising: an acquisition unit and a determination unit; the acquisition unit is used to acquire service plane data on the user side; the determination unit is used to determine abnormal service plane data based on a service plane indicator threshold; the determination unit is also used to determine abnormal signaling plane data associated with the abnormal service plane data; the determination unit is also used to determine abnormal equipment on the network side based on the abnormal signaling plane data.

[0013] Optionally, the determination unit is specifically used to: determine the business types associated with different business plane data; and determine abnormal business plane data in the business plane data based on business plane indicator thresholds corresponding to different business types.

[0014] Optionally, the determination unit is further configured to determine service plane indicator thresholds corresponding to different types of services based on a genetic algorithm.

[0015] Optionally, the determination unit is specifically used to: determine a first mapping relationship between the QOE data and the KQI data, and a second mapping relationship between the QOE data and the KPI data; determine abnormal QOE data in the QOE data based on the first mapping relationship and the KQI data; and determine abnormal KPI data based on the abnormal QOE data and the second mapping relationship.

[0016] Optionally, the determination unit is further used to determine the abnormal device on the user side based on the abnormal QOE data.

[0017] Optionally, the service plane indicator includes at least one of the following: delay, jitter, and packet loss.

[0018] In a third aspect, an anomaly detection device is provided, comprising a memory and a processor; the memory is used to store computer execution instructions, and the processor is connected to the memory through a bus; when the anomaly detection device is running, the processor executes the computer execution instructions stored in the memory, so that the anomaly detection device performs the anomaly detection method described in the first aspect.

[0019] The anomaly detection device may be a network device, or a part of a device in a network device, such as a chip system in a network device. The chip system is used to support the network device to implement the functions involved in the first aspect and any possible implementation thereof, for example, to obtain, determine, and send the data and / or information involved in the above-mentioned anomaly detection method. The chip system includes a chip, and may also include other discrete devices or circuit structures.

[0020] In a fourth aspect, a computer-readable storage medium is provided, the computer-readable storage medium comprising computer execution instructions, and when the computer execution instructions are executed on a computer, the computer executes the anomaly detection method described in the first aspect.

[0021] In a fifth aspect, a computer program product is also provided, which includes computer instructions. When the computer instructions are executed on an anomaly detection device, the anomaly detection device executes the anomaly detection method as described in the first aspect above.

[0022] It should be noted that the above-mentioned computer instructions may be stored in whole or in part on a computer-readable storage medium. The computer-readable storage medium may be packaged together with the processor of the anomaly detection device, or may be packaged separately from the processor of the anomaly detection device, which is not limited in the embodiments of the present application.

[0023] The description of the second, third, fourth and fifth aspects of this application can refer to the detailed description of the first aspect.

[0024] In the embodiments of the present application, the name of the above-mentioned abnormality detection device does not limit the device or functional module itself. In actual implementation, these devices or functional modules may appear with other names. For example, the receiving unit may also be called a receiving module, a receiver, etc. As long as the functions of each device or functional module are similar to those of the present application, they fall within the scope of the claims of the present application and their equivalent technologies.

[0025] The technical solution provided by this application brings at least the following beneficial effects:

[0026] Based on any of the above aspects, the present application provides an abnormality detection method, including: obtaining service plane data on the user side. Afterwards, the abnormal service plane data can be determined based on the service plane indicator threshold. Then, the abnormal signaling plane data associated with the abnormal service plane data can be determined. Subsequently, the abnormal device on the network side can be determined based on the abnormal signaling plane data.

[0027] As can be seen from the above, since the abnormal service plane data is the service plane data on the user side, the associated abnormal signaling plane data can be determined through the abnormal service plane data, and the abnormal device on the network side can be further determined.

[0028] The beneficial effects of the first, second, third, fourth and fifth aspects of the present application can all be referred to the analysis of the above beneficial effects, which will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Figure 1 A schematic diagram of the structure of an anomaly detection system provided in an embodiment of the present application;

[0030] Figure 2 A schematic diagram of the structure of another anomaly detection system provided in an embodiment of the present application;

[0031] Figure 3 A schematic diagram of the hardware structure of an abnormality detection device provided in an embodiment of the present application;

[0032] Figure 4 A schematic diagram of a method for detecting anomalies provided in an embodiment of the present application Figure 1 ;

[0033] Figure 5 A schematic diagram of a method for detecting anomalies provided in an embodiment of the present application Figure 2 ;

[0034] Figure 6 A schematic diagram of an indicator for determining abnormal business provided in an embodiment of the present application;

[0035] Figure 7 A schematic diagram of a method for detecting anomalies provided in an embodiment of the present application Figure 3 ;

[0036] Figure 8 A schematic diagram of a method for detecting anomalies provided in an embodiment of the present application Figure 4 ;

[0037] Fig. 9 A schematic diagram of a business indicator threshold provided in an embodiment of the present application;

[0038] Fig.10A schematic diagram of the structure of an anomaly detection device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0039] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0040] It should be noted that, in the embodiments of the present application, words such as "exemplary" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a specific way.

[0041] In order to facilitate a clear description of the technical solutions of the embodiments of the present application, in the embodiments of the present application, words such as "first" and "second" are used to distinguish between identical or similar items with substantially the same functions and effects. Those skilled in the art can understand that words such as "first" and "second" do not limit the quantity and order of execution.

[0042] Traditional anomaly detection methods generally look for the proportion of abnormal indicators step by step according to the hierarchical relationship of network equipment, for example, from the entire network to the core network source, and then analyze the indicators of the wireless side cells that interact with the core network elements to find out the abnormal indicators, and then extract the original call records and signaling to determine the cause of the abnormality.

[0043] However, the anomaly index is the result of comprehensive calculation of a large number of samples and is not sensitive enough to a small number of anomalies. In addition, the top-down analysis method relies heavily on the existence of isolated points, that is, when the gap between samples is not obvious, the method is often not accurate enough.

[0044] Nowadays, networks are flat and resource pooled, and the hierarchical relationship between devices is no longer obvious and has become more complicated. It is difficult to find problems step by step using a top-down analysis method. Moreover, traditional methods only show abnormal indicators without evaluating the quality of the service. It takes a lot of manpower to locate and analyze, which is troublesome.

[0045] In view of the above problems, the present application provides an anomaly detection method, including: obtaining service plane data on the user side. Then, determining abnormal service plane data based on a service plane indicator threshold. Then, determining abnormal signaling plane data associated with the abnormal service plane data. Subsequently, determining abnormal devices on the network side based on the abnormal signaling plane data.

[0046] As can be seen from the above, since the abnormal service plane data is the service plane data on the user side, the associated abnormal signaling plane data can be determined through the abnormal service plane data, and the abnormal device on the network side can be further determined.

[0047] The anomaly detection method is suitable for anomaly detection systems. Figure 1 A structure of the anomaly detection system is shown. Figure 1 As shown, the anomaly detection system includes: an electronic device 101, a user side device 102 and a network side device 103.

[0048] The electronic device 101 is connected to the user side device 102 and the network side device 103 in communication. The user side device 102 is connected to the network side device 103 in communication.

[0049] In the present application, the electronic device 101 can obtain user plane data from the user side device 102, and determine abnormal user plane data based on the service plane indicator threshold. Afterwards, the electronic device 101 can determine abnormal signaling plane data associated with the abnormal user plane data from the network side device 103, and determine the abnormal device on the network side based on the abnormal signaling plane data.

[0050] In one possible implementation, Figure 2 Another structural diagram of anomaly detection system is shown. Figure 2 As shown, the anomaly detection system includes a terminal 201, a base station 202, a user plane function (UPF) 203, a service management function (SMF) 204, an access and mobility management function (AMF) 205, an operation and maintenance center (OMC) 206, and a probe 207.

[0051] The business plane data of the user side of the N3 and N4 interfaces can be collected by deploying the deep packet inspection (DPI) collection function. Probe 207 can collect, identify, and parse the N3 and N4 structures through the DPI collection function, and form corresponding extended data record (xDR) files as required. In addition, the signaling data on the network side is the data for docking with the base station, and does not require a probe. It can be negotiated and docked using a public or private interface. The business plane data of UPF203 can be collected through probe 207 without being restricted by the manufacturer's equipment. The collected business plane data and signaling plane data can be output to the big data platform of the electronic device for data association, clarification, statistical processing, etc.

[0052] After the big data platform of the electronic device collects the service plane and signaling plane data, the two can be associated to generate an end-to-end call record for storage. For example, the user plane data can be as shown in Table 1.

[0053] Table 1

[0054]

[0055]

[0056] The definition of successful video playback is: if the user does not actively give up watching the video after clicking the video play button until the video starts playing, the video is considered to be successfully played.

[0057] It should be pointed out that for each collected original call record, based on the analysis of the business application protocol process and characteristics, the original call record can be converted into business-side indicators of business-side data, which can facilitate the evaluation of business quality and further evaluate whether there are any abnormalities in the business.

[0058] Optionally, the terminal may be a device that provides voice and / or data connectivity to a user, a handheld device with wireless connection function, or other processing device connected to a wireless modem. The terminal may communicate with one or more core networks via a radio access network (RAN). The terminal may be a mobile terminal, such as a mobile phone (or "cellular" phone) and a computer with a mobile terminal, or a portable, pocket-sized, handheld, computer-built-in or vehicle-mounted mobile device that exchanges language and / or data with a radio access network, such as a mobile phone, a tablet computer, a laptop computer, a netbook, a personal digital assistant (PDA).

[0059] The above-mentioned base station can be a base station or base station controller for wireless communication, etc. In the embodiment of the present application, the base station can be a base station (base transceiver station, BTS) in the global system for mobile communication (global system for mobile communication, GSM), code division multiple access (code division multiple access, CDMA), a base station (node ​​B) in wideband code division multiple access (wideband code division multiple access, WCDMA), a base station (eNB) in the Internet of Things (Internet of Things, IoT) or narrowband Internet of Things (narrow band-internet of things, NB-IoT), a base station in the future 5G mobile communication network or the future evolved public land mobile network (publicland mobile network, PLMN), and the embodiment of the present application does not impose any restrictions on this.

[0060] The basic hardware structure of electronic device 101 includes Figure 3 The components included in the abnormality detection device shown in FIG. Figure 3 Taking the abnormality detection device shown as an example, the hardware structure of the electronic device 101 is introduced.

[0061] like Figure 3 , which is a schematic diagram of a hardware structure of an abnormality detection device provided in an embodiment of the present application. The abnormality detection device includes a processor 21, a memory 22, a communication interface 23, and a bus 24. The processor 21, the memory 22, and the communication interface 23 can be connected through a bus 24.

[0062] The processor 21 is the control center of the abnormality detection device, which can be a processor or a general term for multiple processing elements. For example, the processor 21 can be a general-purpose central processing unit (CPU) or other general-purpose processors. Among them, the general-purpose processor can be a microprocessor or any conventional processor.

[0063] As an embodiment, the processor 21 may include one or more CPUs, such as Figure 3 CPU 0 and CPU 1 are shown in .

[0064] The memory 22 may be a read-only memory (ROM) or other type of static storage device that can store static information and instructions, a random access memory (RAM) or other type of dynamic storage device that can store information and instructions, an electrically erasable programmable read-only memory (EEPROM), a disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto.

[0065] In a possible implementation, the memory 22 may exist independently of the processor 21, and the memory 22 may be connected to the processor 21 via a bus 24 to store instructions or program codes. When the processor 21 calls and executes the instructions or program codes stored in the memory 22, the anomaly detection method provided in the following embodiments of the present application can be implemented.

[0066] In the embodiment of the present application, for the electronic device 101, the software programs stored in the memory 22 are different, so the functions implemented by the electronic device 101 are different. The functions performed by each device will be described in conjunction with the following flowchart.

[0067] In another possible implementation, the memory 22 may also be integrated with the processor 21 .

[0068] The communication interface 23 is used to connect the abnormality detection device to other devices through a communication network, and the communication network may be Ethernet, wireless access network, wireless local area network (WLAN), etc. The communication interface 23 may include a receiving unit for receiving data and a sending unit for sending data.

[0069] The bus 24 may be an industry standard architecture (ISA) bus, a peripheral component interconnect (PCI) bus, or an extended industry standard architecture (EISA) bus. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 3 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0070] It should be pointed out that Figure 3 The structure shown in the figure does not constitute a limitation on the abnormality detection device. Figure 3 In addition to the components shown, the abnormality detection device may include more or fewer components than shown, or combine certain components, or arrange the components differently.

[0071] The anomaly detection method provided in the embodiments of the present application is described in detail below with reference to the accompanying drawings.

[0072] The anomaly detection method provided in the embodiment of the present application is applied to Figure 1 The electronic device 101 in the abnormality detection system shown in FIG. Figure 4 As shown, the anomaly detection method provided in the embodiment of the present application includes:

[0073] S401: The electronic device obtains service plane data on the user side.

[0074] Specifically, the electronic device can obtain service data on the user side, that is, data related to the user's service, such as network speed, latency, etc.

[0075] S402: The electronic device determines abnormal business plane data based on the business plane indicator threshold.

[0076] Specifically, since the business plane data may be an acquired business plane indicator, the electronic device may determine a threshold value of the business plane indicator corresponding to each business plane data. Afterwards, the electronic device may determine abnormal business plane data based on the business plane indicator threshold value. For example, when the network speed is less than a preset network speed threshold value, the business plane data may be determined to be abnormal business plane data.

[0077] S403: The electronic device determines abnormal signaling plane data associated with the abnormal service plane data.

[0078] Specifically, since the user-side service is implemented through the network-side device, when the user-side service is abnormal, it can be determined that it is caused by the abnormality of the network-side device. Therefore, the electronic device can determine the abnormal signaling plane data associated with the abnormal service plane data, that is, the signaling data of the network-side device that provides services to the user corresponding to the abnormal service plane data.

[0079] S404: The electronic device determines an abnormal device on the network side based on the abnormal signaling plane data.

[0080] Specifically, after determining the abnormal signaling plane data, since the device corresponding to the abnormal signaling plane data is a device that provides services for abnormal users (i.e., users to whom the abnormal business plane data belongs), the electronic device can determine that the network side device associated with the abnormal signaling plane data is an abnormal device, thereby determining the cause of the abnormality, and since the business plane data is lower-level data, the abnormal cause of each abnormal user can be determined, thereby determining the abnormal cause of a small number of abnormal users.

[0081] In a possible implementation manner, if the electronic device fails to determine the associated abnormal signaling plane data based on the abnormal service plane data, the electronic device may determine that the abnormal device is a device on the user side.

[0082] In some embodiments, Figure 5 A schematic diagram of the process of an anomaly detection method is shown Figure 2 . Combined Figure 4 ,like Figure 5 As shown, in the above S402, the electronic device determines the abnormal business plane data based on the business plane indicator threshold value specifically including:

[0083] S501. The electronic device determines the service type associated with different service plane data.

[0084] Optionally, the electronic device can distinguish different service types through XDR.

[0085] Specifically, the service plane data includes not only service plane data of different users, but also service plane data of different types of services. Therefore, the electronic device can determine the service plane data associated with different service types.

[0086] S502: The electronic device determines abnormal business plane data in the business plane data based on business plane indicator thresholds corresponding to different business types.

[0087] Specifically, different types of services have different standards for abnormalities. For example, game users require lower latency, and video users require higher network speeds. Therefore, different types of services have different service surface indicator thresholds when determining abnormal service surface data. In this way, the electronic device determines the service surface indicator thresholds corresponding to different service types, and determines the abnormal service surface data corresponding to different types of services by determining different service surface indicator thresholds.

[0088] In a possible implementation, different types of services may include 5G live broadcast services. Figure 6As shown in the figure, the abnormality criteria for determining abnormality of a service (such as 5G live broadcast service) may include network availability and accessibility that are not related to the service, as well as indicators related to service integrity (or accessibility, retention) that are related to the service. Among them, accessibility is further divided into network accessibility (network access), IP service accessibility (IP service access), and Internet access (Internet access) that are related to the service, and different stages have different impacts on service quality.

[0089] It should be pointed out that whether a service is abnormal can be determined by business indicators related to the user's perception of service quality, such as the QoS indicator of the service, so it is necessary to obtain the QoS indicator. However, since there are too many Internet applications and Internet protocols, and they are constantly changing, and the cost of mining and managing the business process of each transaction on the network side is relatively high, it can be determined that the business indicators include at least one of the following: delay, jitter, packet loss (Information Loss, including packet loss and information loss introduced by encoding and decoding). In this way, the abnormal business data corresponding to different business types can be determined through business indicators.

[0090] In some embodiments, Figure 7 A schematic diagram of the process of an anomaly detection method is shown Figure 3 . Combined Figure 4 ,like Figure 7 As shown, the service plane data includes experience quality QOE data and key quality indicator KQI data, and the signaling plane data includes KPI data. In the above S403, the electronic device determines that the abnormal signaling plane data associated with the abnormal service plane data specifically includes:

[0091] S701: The electronic device determines a first mapping relationship between QOE data and KQI data, and a second mapping relationship between QOE data and KPI data.

[0092] Specifically, since there is an association relationship between the business plane data and the signaling plane data, the electronic device can determine the second mapping relationship between the QOE data and the KPI data. And since the KQI data can be used to describe the quality of the QOE data, the electronic device can also determine the first mapping relationship between the QOE data and the KQI data.

[0093] S702: The electronic device determines abnormal QOE data in the QOE data based on the first mapping relationship and the KQI data.

[0094] Specifically, since the KQI data of the electronic device can be used to describe the quality of the QOE data, the electronic device can determine the abnormal QOE data in the QOE data, that is, the abnormal service plane data, based on the first mapping relationship.

[0095] S703: The electronic device determines abnormal KPI data based on the abnormal QOE data and the second mapping relationship.

[0096] Among them, the abnormal KPI data is abnormal signaling plane data.

[0097] In a possible implementation manner, the electronic device determines an abnormal device on the user side based on abnormal QOE data.

[0098] Abnormal business plane data may also be determined by abnormal devices on the user side. Therefore, the electronic device can determine that the user side device associated with the data is an abnormal device based on the abnormal QOE data, thereby determining the cause of the abnormality and the cause of the abnormality of a small number of abnormal users.

[0099] In a possible implementation, the electronic device may generate a perception evaluation model through QOE, KQI, and KPI, and determine abnormal KPI data based on the model, or score the QOE data or KPI data through the model, thereby determining abnormal data through the score.

[0100] In some embodiments, Figure 8 A schematic diagram of the process of an anomaly detection method is shown Figure 4 . Combined Figure 4 ,like Figure 8 As shown, the method provided in the embodiment of the present application also includes:

[0101] S801. The electronic device determines service plane indicator thresholds corresponding to different types of services based on a genetic algorithm.

[0102] Specifically, taking the 5G live broadcast service as an example, there are many types of live broadcast services and network environments. Therefore, different live broadcast services have different requirements for service indicators in different network environments. Therefore, it is necessary to determine the service indicator thresholds corresponding to different types of services. The thresholds of different service indicators can be determined by genetic algorithms. The following will take the live broadcast service as an example to introduce the genetic algorithm.

[0103] 1. Define the solution space and initialize the population to generate a population consisting of a certain number of individual binary trees.

[0104] The solution space is a combination of the operator set involved in the perception evaluation model, the independent variable symbol set, and the business KQI set related to live broadcasting. The operator set includes various function operators such as addition, subtraction, multiplication, and division involved in the model; the independent variable symbol set includes all independent variables that may be involved in the model; and the data set is the maximum value range of various constants involved in the model, such as constant terms, exponential terms, coefficient terms, etc.

[0105] After the solution space is defined, a certain number of binary tree individuals are randomly generated, and the binary tree nodes of each individual will be filled according to the following principles: For internal nodes, a function symbol is randomly selected from the operator set to fill. For terminal points, first randomly select whether it is an independent variable or a data item. If it is an independent variable, a random independent variable is randomly selected from the independent variable symbol set to fill. If it is a data item, a constant is randomly selected from the constant item value range to fill.

[0106] 2. Evaluate the relative fitness of individuals in the population.

[0107] The principle of least squares method is adopted and the residual sum of squares is selected as the individual fitness function.

[0108]

[0109] Where N represents the number of service data (such as service KQI) samples, y i represents the live broadcast perception evaluation score. f(*) represents y i By x 1 ,x 2 ,…,x m The individual function expression represented by x 1 ,x 2 ,…,x m Represents y i The corresponding KQI independent variable. At the same time, since the residual sum of squares is always non-negative, the inverse of the individual fitness is selected as the objective function:

[0110]

[0111] 3. Select a certain number of individuals with high fitness from the current group.

[0112] According to the objective function value, the individuals in the population are arranged from small to large, and the selection probability of each individual is calculated according to Formula 3.

[0113]

[0114] p i is the selection probability of the ith individual. Each individual makes relevant selections under the corresponding probability, and pop_size represents the population size.

[0115] 4. Perform hybridization operation on the selected binary tree individuals.

[0116] The selected individuals are hybridized. The rules of hybridization are as follows:

[0117] The parent individuals are randomly paired in pairs to form a hybrid pairing pool; each pair of parents is hybridized under certain probability conditions.

[0118] For the two parent individuals of the hybrid, a subtree is randomly selected for each of them, and then the subtrees are exchanged to obtain the corresponding offspring individuals.

[0119] For offspring whose root depth is greater than the maximum tree root depth limit, all branches and leaves that exceed the maximum root depth limit are directly pruned; then, the intermediate nodes of the last layer after pruning are changed to terminal points, and the filling method is the same as the population initialization method.

[0120] 5. Perform relevant mutation operations on individuals in the population.

[0121] For individuals that need to be mutated, one of the nodes is randomly selected as the mutation boundary node, and the node and all its branches are mutated.

[0122] For internal nodes, other elements are randomly selected from the operator set for replacement, and the replacement value is different from the original value.

[0123] For the endpoint, a random value is selected from the independent variable symbol set or data set for replacement, and the replacement value is allowed to be equal to the original value. The filling method of the endpoint is the same as the population initialization method.

[0124] 6. Population renewal, that is, the offspring individuals that have completed hybridization and mutation will replace the individuals with low fitness in the parent population.

[0125] Population updating is to replace the worst individuals in the parent generation with the offspring individuals after mutation. In order to ensure that the best individuals in each generation can be retained in the next generation, the best individuals directly replace the worst individuals in the parent generation.

[0126] The termination condition can be set to any one of the following three conditions; or all three conditions can be set, and the process will terminate as long as one of the conditions is met:

[0127] Reached the maximum number of reproductions.

[0128] The maximum time for the algorithm program to run has been reached.

[0129] The sum of squared residuals of the best individual in the population is less than or equal to a given value.

[0130] In this way, the relationship between different types of services and network KQI index values ​​can be output through a genetic algorithm, and the association between KQI and KPI can be combined to generate thresholds for network operation indicators for different coverage scenarios and different live broadcast services.

[0131] For example, Fig. 9 A schematic diagram of a business indicator threshold is shown. Fig. 9 As shown, the service indicators include service jitter, service delay, and service rate. The threshold of service jitter may be 1.2%, the threshold of service delay may be 12 ms, and the threshold of service rate may be 300 Mbps.

[0132] In a possible implementation, the present application uses a genetic algorithm to establish a perceptual evaluation model. The quantitative relationship was dynamically adaptively modeled and compared with traditional fitting methods such as linear regression equation, exponential regression equation, parabolic regression equation and logarithmic regression equation. The one-dimensional variable relationship fitting results given above show that the genetic algorithm has a good ability to adaptively search for the optimal solution in user perception modeling, and the fitted model is significantly better than the traditional method. Moreover, since the genetic algorithm does not need to give a specific relationship model in advance like the traditional method, it is more suitable for establishing a relationship model of multiple variables that influence each other, which is also more conducive to further research and improvement of the user perception evaluation system, so that operators can improve the user perception management level.

[0133] In summary, this application can obtain the business perception indicators (i.e., business surface indicators) of the complete business at the user level by timely backfilling user information and business attributes, and adopt genetic algorithm to The quantitative relationship is dynamically adaptively modeled (i.e., the perception evaluation model), and the genetic algorithm has a good ability to adaptively search for the optimal solution in user perception modeling. The fitted model is significantly better than the traditional method, and the determined business indicator threshold is more appropriate. Moreover, since the genetic algorithm does not need to give a specific relationship model in advance like the traditional method, it is more suitable for establishing a relationship model of multiple variables that affect each other, thereby improving adaptability.

[0134] The above mainly introduces the solution provided by the embodiment of the present application from the perspective of the method. In order to realize the above functions, it includes hardware structures and / or software modules corresponding to the execution of each function. Those skilled in the art should easily realize that, in combination with the units and algorithm steps of each example described in the embodiments disclosed herein, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of the present application.

[0135] The embodiment of the present application can divide the functional modules of the abnormality detection device according to the above method example. For example, each functional module can be divided according to each function, or two or more functions can be integrated into one processing module. The above integrated module can be implemented in the form of hardware or in the form of software functional modules. Optionally, the division of modules in the embodiment of the present application is schematic and is only a logical function division. There may be other division methods in actual implementation.

[0136] like Fig.10 The figure is a schematic diagram of the structure of an abnormality detection device provided in an embodiment of the present application. The abnormality detection device can be used to perform Figure 4 or Figure 5 or Figure 7 or Figure 8 The anomaly detection method shown. Fig.10 The abnormality detection device shown includes: an acquisition unit 1001 and a determination unit 1002 .

[0137] The acquisition unit 1001 is used to acquire the service plane data of the user side. Figure 4 , the acquisition unit 1001 is used to execute S401.

[0138] The determining unit 1002 is used to determine abnormal business plane data based on the business plane indicator threshold. Figure 4 , determining unit 1002 is used to execute S402.

[0139] The determining unit 1002 is further configured to determine abnormal signaling plane data associated with the abnormal service plane data. Figure 4 , determining unit 1002 is used to execute S403.

[0140] The determining unit 1002 is further configured to determine an abnormal device on the network side based on the abnormal signaling plane data. Figure 4 , determining unit 1002 is used to execute S404.

[0141] Optionally, the determining unit 1002 is specifically configured to:

[0142] Determine the business types associated with different business plane data. For example, Figure 5 , the determination unit 1002 is used to execute S501.

[0143] Based on the service level indicator thresholds corresponding to different service types, abnormal service level data in the service level data is determined. Figure 5 , the determination unit 1002 is used to execute S502.

[0144] Optionally, the determining unit 1002 is further configured to determine the service level indicator thresholds corresponding to different types of services based on a genetic algorithm. Figure 8 , determining unit 1002 is used to execute S801.

[0145] Optionally, the determining unit 1002 is specifically configured to:

[0146] Determine a first mapping relationship between the QOE data and the KQI data, and a second mapping relationship between the QOE data and the KPI data. Figure 7 , the determination unit 1002 is used to execute S701.

[0147] Determine abnormal QOE data in the QOE data based on the first mapping relationship and the KQI data; determine abnormal KPI data based on the abnormal QOE data and the second mapping relationship. Figure 7 , determining unit 1002 is used to execute S702.

[0148] Optionally, the determining unit 1002 is further configured to determine an abnormal device on the user side based on the abnormal QOE data.

[0149] Optionally, the service plane indicator includes at least one of the following: delay, jitter, and packet loss.

[0150] An embodiment of the present application further provides a computer-readable storage medium, which includes computer-executable instructions. When the computer-executable instructions are executed on a computer, the computer executes the anomaly detection method provided in the above embodiment.

[0151] An embodiment of the present application also provides a computer program, which can be directly loaded into a memory and contains software code. After being loaded and executed by a computer, the computer program can implement the anomaly detection method provided in the above embodiment.

[0152] Those skilled in the art should be aware that in one or more of the above examples, the functions described in this application can be implemented using hardware, software, firmware, or any combination thereof. When implemented using software, these functions can be stored in a computer-readable medium or transmitted as one or more instructions or codes on a computer-readable medium. Computer-readable media include computer-readable storage media and communication media, wherein communication media include any media that facilitates the transmission of computer programs from one place to another. Storage media can be any available media that can be accessed by general or special-purpose computers.

[0153] Through the description of the above implementation methods, technical personnel in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional modules is used as an example. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above.

[0154] In several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic, for example, the division of the modules or units is only a logical function division, and there may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another device, or some features can be ignored or not executed. Another point is that the coupling or direct coupling or communication connection between each other shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms. The unit described as a separate component may or may not be physically separated, and the component displayed as a unit may be a physical unit or multiple physical units, that is, it may be located in one place, or it may be distributed in multiple different places. Some or all of the units can be selected according to actual needs to achieve the purpose of the scheme of this embodiment.

[0155] In addition, each functional unit in each embodiment of the present application can be integrated into a processing unit, or each unit can exist physically alone, or two or more units can be integrated into one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of a software functional unit. If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a readable storage medium. Based on such an understanding, the technical solution of the embodiment of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium, including several instructions to enable a device (which can be a single-chip microcomputer, chip, etc.) or a processor (processor) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a ROM, a RAM, a magnetic disk or an optical disk.

[0156] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be based on the protection scope of the claims.

Claims

1. An anomaly detection method, characterized in that: The method comprises: Obtain business data on the user side; Determine abnormal business plane data based on business plane indicator thresholds; Determining abnormal signaling plane data associated with the abnormal service plane data; An abnormal device in the network side is determined based on the abnormal signaling plane data.

2. The method according to claim 1, characterized in that The determining of abnormal business plane data based on the business plane indicator domain value includes: Determine the business types associated with different business plane data; Based on the service plane indicator thresholds corresponding to different service types, abnormal service plane data in the service plane data is determined.

3. The method according to claim 2, characterized in that The method further comprises: Determine the service indicator thresholds corresponding to different types of services based on genetic algorithms.

4. The method according to any one of claims 1 to 3, characterized in that: The service plane data includes quality of experience (QOE) data and key quality indicator (KQI) data, the signaling plane data includes key performance indicator (KPI) data, and the determining of abnormal signaling plane data associated with the abnormal service plane data includes: Determine a first mapping relationship between the QOE data and the KQI data, and a second mapping relationship between the QOE data and the KPI data; Determine abnormal QOE data in the QOE data based on the first mapping relationship and the KQI data; Abnormal KPI data is determined based on the abnormal QOE data and the second mapping relationship.

5. The method according to claim 4, characterized in that The method further comprises: An abnormal device on the user side is determined based on the abnormal QOE data.

6. The method according to any one of claims 1 to 3, characterized in that: The service plane indicators include at least one of the following: delay, jitter, and packet loss.

7. An abnormality detection device, characterized in that: include: Get unit and determine unit; The acquisition unit is used to acquire the service plane data of the user side; The determining unit is used to determine abnormal business plane data based on the business plane indicator threshold; The determining unit is further configured to determine abnormal signaling plane data associated with the abnormal service plane data; The determining unit is further configured to determine an abnormal device on the network side based on the abnormal signaling plane data.

8. An abnormality detection device, characterized in that: It includes a memory and a processor; the memory is used to store computer-executable instructions, and the processor is connected to the memory through a bus; when the abnormality detection device is running, the processor executes the computer-executable instructions stored in the memory, so that the abnormality detection device performs the abnormality detection method according to any one of claims 1 to 6.

9. A computer program product, characterized in that The computer program product comprises computer instructions, and when the computer instructions are executed on a computer, the computer is enabled to execute the anomaly detection method according to any one of claims 1 to 6.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes computer-executable instructions, and when the computer-executable instructions are executed on a computer, the computer is enabled to execute the anomaly detection method according to any one of claims 1 to 6.

Images