Operation and maintenance sensing method and system based on IP / E1 network

Abstract

The invention relates to the technical field of network monitoring, in particular to an operation and maintenance sensing method and system based on an IP / E1 network, and the method comprises the following steps: building a basic connection diagram of the IP / E1 network by capturing topological data of the initialized IP / E1 network, inputting node and connection data, combining geographic position information, and matching and associating the data. According to the method, the connection strength between the nodes is calculated by combining geographic positions and network topology data and adopting a data matching technology, the visualization and understanding of a network structure are remarkably improved, time and network behaviors are synchronized by utilizing a sliding window technology, the timeliness and accuracy of data analysis are guaranteed, and node feature changes are analyzed by introducing a graph convolution framework. The network monitoring can dynamically reflect the state, the sensitivity and accuracy of anomaly detection are enhanced, the false alarm and the missing alarm are effectively reduced by accurately classifying the event types and applying the threshold technology, meanwhile, the risk assessment and the pressure test are performed on the key nodes, and the stability and the maintenance efficiency of the network are improved.

Description

Technical Field

[0001] The present invention relates to the field of network monitoring technology, and in particular to an operation and maintenance perception method and system based on an IP / E1 network. Background Art

[0002] The field of network monitoring technology involves the use of various tools and methods to monitor, analyze and manage the performance and security of computer networks in real time. The core functions of the field include traffic analysis, fault diagnosis, network performance optimization, security threat detection and response, and effective configuration of network resources. Network monitoring can provide key data and alarms to help network administrators identify potential network bottlenecks, failure points or security vulnerabilities, thereby ensuring the stable operation of the network and data security. With the popularization of cloud computing and Internet of Things technologies, network monitoring is also increasingly focusing on cross-platform data integration and multi-network management strategies to adapt to more complex and decentralized network architectures.

[0003] Among them, the operation and maintenance awareness method refers to enhancing the ability to perceive the operation and maintenance activities of information technology infrastructure, and improving the speed of identifying system status, performance changes and potential problems. The methods include collecting various network data, such as performance indicators, log files, and user activity information, and analyzing data to predict system behavior, identify anomalies, and promote fault recovery. The purpose of operation and maintenance awareness is to improve the reliability and availability of IT systems, reduce system downtime, optimize resource allocation, and improve service quality, thereby supporting business continuity and information security.

[0004] In the existing technology, network monitoring focuses on real-time data collection and alarm generation, but has obvious deficiencies in cross-platform data integration and processing of large-scale decentralized network structures. The lack of in-depth analysis of geographic location and network topology makes network management strategies inefficient when dealing with complex network architectures. Existing methods cannot effectively synchronize network behavior with time changes when processing time series data, resulting in delayed or inaccurate data analysis results. In a dynamic network environment, traditional monitoring tools are difficult to accurately analyze and predict node feature changes, affecting the accuracy and timeliness of fault prediction. For the identification and response of network events, existing technologies often rely on simple threshold judgments, which are prone to misjudgment under complex or cyclically changing network conditions. Risk assessment of key network components mostly relies on past experience and static data, lacking a dynamic and real-time risk assessment mechanism, causing the network to react slowly when encountering unknown threats or emerging risks. Summary of the invention

[0005] The purpose of the present invention is to solve the shortcomings existing in the prior art and to propose an operation and maintenance perception method and system based on IP / E1 network.

[0006] In order to achieve the above object, the present invention adopts the following technical solution, an operation and maintenance perception method based on IP / E1 network, comprising the following steps:

[0007] S1: Capture and initialize the topology data of the IP / E1 network, input node and connection data, combine geographic location information, match and associate data, and build a basic connection diagram of the IP / E1 network;

[0008] S2: Based on the basic connection diagram of the IP / E1 network, the original traffic and status data of the integrated node, the time series data is processed by the sliding window technology, the time label and the network behavior data are aligned, and the network behavior time series is obtained;

[0009] S3: Input the network behavior time series into the graph convolution framework, analyze the changes in the characteristics of the IP / E1 network nodes, update the node characteristics and reflect the spatiotemporal correlation, and establish a spatiotemporal dependency feature model;

[0010] S4: Based on the spatiotemporal dependency feature model, perform event recognition, analyze model output, use threshold judgment to identify traffic anomalies and potential security threats, and generate event response strategies;

[0011] S5: Identify key nodes and connections of the IP / E1 network from the incident response strategy, assess network impact and stability risks, predict failure points through simulation analysis, and construct key component analysis results;

[0012] S6: Utilize the analysis results of the key components to optimize the network configuration of risk nodes and connections, optimize network stability through parameter adjustment and route update, and establish operation and maintenance awareness enhancement results.

[0013] As a further solution of the present invention, the basic connection diagram includes a connection data table, a geographic location index, and a node interconnection strength; the network behavior time series includes time label alignment, network status update, and a behavior data set; the spatiotemporal dependency feature model includes a node feature matrix, a spatiotemporal correlation diagram, and feature change dynamics; the event response strategy includes event type classification, pattern deviation detection, and sensitive event thresholds; the key component analysis results include influence scores, stability risk levels, and potential failure points; and the operation and maintenance perception enhancement results include parameter adjustment plans, routing update lists, and test feedback results.

[0014] As a further solution of the present invention, by capturing and initializing the topological data of the IP / E1 network, inputting the node and connection data, combining the geographical location information, matching and associating the data, the steps of constructing the basic connection diagram of the IP / E1 network are specifically as follows:

[0015] S101: Capturing and initializing the topology data of the IP / E1 network, including a list of network nodes and inter-node connection data, and using a data entry tool to perform data standardization to generate a node connection data table;

[0016] S102: According to the node connection data table, the geographical location information of each node is integrated, the location of each node is checked, and the corresponding relationship between the node location and the connection data is analyzed through data integration processing to construct a node geographical location association map;

[0017] S103: Calculate the connection strength between nodes using the node geographic location association diagram, analyze the geographic distance and network traffic data, and generate a basic connection diagram of the IP / E1 network through analysis.

[0018] As a further solution of the present invention, according to the basic connection diagram of the IP / E1 network, the original traffic and status data of the integrated node, the time series data is processed by the sliding window technology, the time label and the network behavior data are aligned, and the steps of obtaining the network behavior time series are specifically as follows:

[0019] S201: According to the data of the basic connection diagram of the IP / E1 network, the traffic and status information of the nodes are sorted, the data format is unified, the data from different sources are merged into a complete record, and a network data set is generated;

[0020] S202: Based on the network data set, set sliding window parameters including time range and step size, perform time series segmentation on the data so that each data segment reflects the network status at the target time, and generate a time series segmentation set;

[0021] S203: According to the time series segment set, match and align the data and time tags in each time period, correct the consistency of the data time points, and generate a network behavior time series.

[0022] As a further solution of the present invention, the network behavior time series is input into the graph convolution framework, the changes in the IP / E1 network node characteristics are analyzed, the node characteristics are updated and the spatiotemporal association is reflected, and the steps of establishing the spatiotemporal dependency feature model are specifically as follows:

[0023] S301: Activate the data import interface, select the data source file of the network behavior time series, upload the data and verify the timestamp, convert the original data into a unified format through a data formatting tool, and generate a time series data set;

[0024] S302: According to the time series data set, a multi-node behavior analysis window is set in the data processing interface, the data in each time window is separated, the behavior changes of the nodes in the multiple time windows are marked, and key activities and behavior patterns are identified to obtain a time window feature change table;

[0025] S303: Using the time window feature change table and a convolutional neural network algorithm, the spatial connection data between nodes is adjusted and applied in the feature update tool, the relationship between the connection status of the nodes and the feature changes is analyzed, and the node characteristics are updated by combining the node spatiotemporal data, the data is integrated, and a spatiotemporal dependency feature model is established.

[0026] As a further solution of the present invention, the formula of the convolutional neural network algorithm is as follows:

[0027] y=f((W*x+b)·α+d·β)

[0028] Among them, y represents the spatiotemporal feature dependency model of the node, x is the input node feature data, W is the convolution kernel parameter, b is the bias term, * represents the convolution operation, f is the activation function, α is the feature enhancement coefficient, d is the additional feature dimension, and β is the weight coefficient of the additional feature.

[0029] As a further solution of the present invention, based on the spatiotemporal dependency feature model, event recognition is performed, model output is analyzed, and threshold judgment is used to identify traffic anomalies and potential security threats, and the steps of generating an event response strategy are specifically as follows:

[0030] S401: According to the spatiotemporal dependency feature model, the behavior data in the IP / E1 network is captured, the behavior data is classified, including flow data and access logs, the data points are marked by nodes and time, and a collated event data set is generated;

[0031] S402: Based on the collated event data set, review the data to identify unusual patterns in the data, including traffic at atypical access times, indicating potential security threats and abnormal events, and generate an abnormal behavior pattern set;

[0032] S403: Using the abnormal behavior pattern set, evaluate whether each abnormal pattern exceeds a preset sensitivity threshold, formulate targeted response measures for patterns that exceed the threshold, including isolating threats and adjusting security policies, and generating an event response strategy.

[0033] As a further solution of the present invention, the steps of identifying key nodes and connections of the IP / E1 network from the event response strategy, evaluating network influence and stability risks, predicting failure points through simulation analysis, and constructing key component analysis results are specifically as follows:

[0034] S501: Analyze the data recorded in the incident response strategy, identify key nodes and connections in the IP / E1 network, record the location, type and key operating indicators of each component, including data flow and response time, and generate a network core component diagram;

[0035] S502: Based on the network core component diagram, quantitatively analyze the influence and stability of key nodes and connections, evaluate indicators including the communication frequency of nodes, the load capacity of connections, and fault response, determine the criticality and risk level of each component, and generate criticality and risk level analysis results;

[0036] S503: Using the criticality and risk level analysis results, perform network stress testing and simulated fault analysis, simulate differentiated network loads and potential breakpoints, monitor network performance under extreme conditions, evaluate network reliability and identify potential weaknesses, and generate key component analysis results.

[0037] As a further solution of the present invention, the steps of optimizing the network configuration of risk nodes and connections by using the analysis results of the key components, optimizing network stability by adjusting parameters and updating routes, and establishing the operation and maintenance perception enhancement results are as follows:

[0038] S601: Based on the analysis results of the key components, review the risk nodes and connections identified in the IP / E1 network, identify the problems of each node and connection, including low bandwidth and route congestion, set optimization measures for the nodes, and generate a node and connection optimization list;

[0039] S602: Using the node and connection optimization list, adjusting network parameters and updating routing settings, including adjusting traffic routing algorithms and data processing capabilities, optimizing network stability and risk resistance, and generating configuration adjustment execution records;

[0040] S603: Based on the configuration adjustment execution record, the network is tested, and the network performance monitoring tool is used to detect the network stability and response speed of the new configuration, the test data is analyzed and the optimization effect of the network configuration is determined, and the effectiveness of the configuration adjustment is verified through testing to generate operation and maintenance perception enhancement results.

[0041] An operation and maintenance perception system based on IP / E1 network, the operation and maintenance perception system based on IP / E1 network is used to execute the above-mentioned operation and maintenance perception method based on IP / E1 network, and the system comprises:

[0042] The topology data capture module captures the topology data of the initialized IP / E1 network, locates the nodes in combination with their geographic coordinates, quantitatively calculates the connection strength between nodes, and uses the association algorithm to associate the topology data with the geographic location to obtain the basic connection diagram;

[0043] The behavior data synchronization module uses the basic connection graph to monitor node traffic and status, applies a sliding window to integrate data, synchronizes time tags and behaviors, and obtains network behavior time series;

[0044] The graph convolution feature analysis module analyzes the time window changes of node features through the graph convolution network according to the network behavior time series, updates the node features and maps the spatiotemporal relationship to obtain the spatiotemporal dependency feature model;

[0045] The event recognition and response module uses the spatiotemporal dependency feature model to analyze abnormal events, perform deviation detection and threshold classification, and obtain event response strategies;

[0046] The network optimization configuration module analyzes the network influence and stability risk of the nodes based on the key nodes and connections identified in the event response strategy, optimizes the network by adjusting network parameters and updating routing strategies, and predicts and tests potential failure points to obtain enhanced operation and maintenance perception results.

[0047] Compared with the prior art, the advantages and positive effects of the present invention are:

[0048] In the present invention, by integrating geographic location information and network topology data, and using data matching and association technology to calculate the connection strength between nodes, not only the visualization of the network structure is enhanced, but also the overall and local understanding of the network is improved. When processing time series data, the time label is aligned through the sliding window technology to effectively synchronize time and network behavior, ensure the timeliness and accuracy of data analysis, introduce the graph convolution framework to analyze node feature changes, break through the limitations of traditional monitoring technology in spatiotemporal data analysis, and make network monitoring not only limited to static analysis, but can dynamically reflect the network status, improve the sensitivity and accuracy of anomaly detection. By carefully classifying event types and applying threshold technology, network events can be more accurately identified and responded to, thereby reducing false alarm rates and missed alarm rates, risk assessment and stress testing of key nodes and connections, further enhancing the stability and risk resistance of the network, and improving the reliability and maintenance efficiency of the network. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] Figure 1 It is a schematic diagram of the workflow of the present invention;

[0050] Figure 2 This is a detailed flow chart of S1 of the present invention;

[0051] Figure 3 This is a detailed flow chart of S2 of the present invention;

[0052] Figure 4 This is a detailed flow chart of S3 of the present invention;

[0053] Figure 5This is a detailed flow chart of S4 of the present invention;

[0054] Figure 6 This is a detailed flow chart of S5 of the present invention;

[0055] Figure 7 This is a detailed flow chart of S6 of the present invention;

[0056] Figure 8 It is a system flow chart of the present invention. DETAILED DESCRIPTION

[0057] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0058] In the description of the present invention, it should be understood that the terms "length", "width", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside" and the like indicate positions or positional relationships based on the positions or positional relationships shown in the drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as limiting the present invention. In addition, in the description of the present invention, the meaning of "multiple" is two or more, unless otherwise specified.

[0059] See also Figure 1 The present invention provides a technical solution, an operation and maintenance perception method based on IP / E1 network, comprising the following steps:

[0060] S1: By capturing and initializing the topological data of the IP / E1 network, inputting the network node and connection data, combining the geographic location information, and applying data matching and association technology, the connection strength between nodes is calculated to build the basic connection diagram of the IP / E1 network;

[0061] S2: Based on the basic connection diagram of the IP / E1 network, the original traffic and status data of the IP / E1 network nodes are integrated, and the time series data is processed through the sliding window technology to align the time tags with the network behavior data to obtain the network behavior time series;

[0062] S3: Input the network behavior time series into the graph convolution framework, analyze the changes in IP / E1 network node features within each time window, refer to the spatial connection of the nodes, apply the graph convolution kernel to update the node features, reflect the spatiotemporal correlation characteristics, and establish a spatiotemporal dependency feature model;

[0063] S4: Based on the spatiotemporal dependency feature model, perform event identification, target IP / E1 network event types, including traffic anomalies and potential security threats, analyze model output and identify pattern deviations, use threshold judgment to determine sensitive events, and generate event response strategies;

[0064] S5: Identify key nodes and connections of IP / E1 network from incident response strategies, use statistical analysis techniques to evaluate network impact and stability risks of components, predict failure points through stress testing and simulation analysis, and construct analysis results of key components;

[0065] S6: Utilize the analysis results of key components to optimize the configuration of risky nodes and connections in the IP / E1 network. Optimize the stability and risk resistance of the network through parameter adjustment and route update. Perform effect test after adjustment to establish enhanced operation and maintenance perception results.

[0066] The basic connection diagram includes the connection data table, geographic location index, and node interconnection strength. The network behavior time series includes time label alignment, network status update, and behavior data set. The spatiotemporal dependency feature model includes the node feature matrix, spatiotemporal correlation diagram, and feature change dynamics. The event response strategy includes event type classification, pattern deviation detection, and sensitive event threshold. The key component analysis results include impact score, stability risk level, and potential failure points. The operation and maintenance perception enhancement results include parameter adjustment plans, routing update lists, and test feedback results.

[0067] Specifically, if Figure 2 As shown, by capturing and initializing the topology data of the IP / E1 network, inputting the node and connection data, combining the geographic location information, matching and associating the data, the steps of constructing the basic connection diagram of the IP / E1 network are as follows:

[0068] S101: by capturing the topology data of the initial IP / E1 network, including the list of network nodes and the connection data between nodes, using the data entry tool to perform data standardization, the execution flow of generating the node connection data table is as follows;

[0069] By capturing the topological data of the initialized IP / E1 network, including a list of network nodes and the connection data between nodes, using the data acquisition system to scan all devices in the network, recording the IP address of each device and the physical port number to which it is connected, the preliminary data is input into the data standardization tool. The tool can identify and eliminate abnormal or duplicate entries in the data according to the preset data format rules. The data of each node will be converted into a unified format to ensure the accuracy and consistency of the data. Connectivity tests are performed on each pair of connected nodes to verify that each connection recorded in the data is active and valid. A node connection data table is generated, which lists the detailed information of each node in the network and its connected nodes, such as node identifier, connection type and status. This data table provides basic data support for subsequent network analysis and management.

[0070] S102: According to the node connection data table, the geographical location information of each node is integrated, the location of each node is checked, and the corresponding relationship between the node location and the connection data is analyzed through data integration processing, and the execution process of constructing the node geographical location association map is as follows;

[0071] According to the node connection data table, the geographic location information of each node is integrated. The geographic location data of each node is imported and matched with the node connection data using the geographic information system (GIS) software. For nodes with incomplete geographic location information, the missing information is supplemented by querying the database of the network service provider. For nodes with questionable geographic location data, on-site verification is carried out or the GPS information of the remote access device is checked. The steps ensure that the location information of each node is accurate. On this basis, the data integration and processing technology is used to analyze the correspondence between the node location and the connection data. By comparing the physical distance between the nodes with the network design diagram, potential data errors or network structure problems are detected, and a node geographic location association diagram is constructed. The diagram shows the geographical distribution of each node in the network and their mutual connection relationship, providing a visual tool for further network optimization and fault diagnosis.

[0072] S103: Calculate the connection strength between nodes using the node geographic location association diagram, analyze the geographic distance and network traffic data, and generate the basic connection diagram of the IP / E1 network through analysis. The execution process is as follows;

[0073] The node geographic location association diagram is used to calculate the connection strength between nodes. The connection strength between nodes is defined as a function of the effective data transmission rate between nodes and their geographical distance. For each pair of connected nodes, the average data transmission rate is calculated based on the real-time data flow records provided by the network monitoring system. Next, the actual physical distance between nodes is calculated using the geographic information system and the data is input into the connection strength calculation model. The model refers to the relationship between data transmission rate and distance and is calculated according to the following formula:

[0074]

[0075] Among them, C ij represents the connection strength between nodes i and j, V ij is the average data transmission rate between nodes i and j, D ij is the geographical distance between two nodes, and k is an adjustment factor used to balance the impact of distance on connection strength.

[0076] Specifically, if Figure 3 As shown in the figure, according to the basic connection diagram of the IP / E1 network, the original traffic and status data of the integrated node, the time series data is processed by the sliding window technology, the time label and the network behavior data are aligned, and the steps for obtaining the network behavior time series are as follows:

[0077] S201: According to the data of the basic connection diagram of the IP / E1 network, the traffic and status information of the nodes are sorted, the data format is unified, and the data from different sources are merged into a complete record. The execution process of generating a network data set is as follows;

[0078] According to the data of the basic connection diagram of the IP / E1 network, the traffic and status information of the nodes are sorted. This step first involves classifying the data collected in the network monitoring system, including traffic data, equipment status data, and network event logs. For traffic data, the size of the data packet, the sending and receiving time, and the source and destination of the data packet are checked through network analysis tools to ensure the integrity and accuracy of the data. The equipment status data includes the online / offline status of the equipment, the interface rate and error rate, etc. The data is directly collected through the management interface of the network equipment, and the information is standardized into a unified data format, especially the unification of timestamps and geographic tags, so as to facilitate subsequent data processing. For data with differentiated sources, such as equipment data from differentiated suppliers, the data format is converted by developing adapters or middleware so that it can be integrated into the main data stream. The processed data is merged into a complete record to generate a network data set, which records the real-time operation status and historical performance of the network in detail, providing a basis for further data analysis.

[0079] S202: Based on the network data set, set the sliding window parameters including the time range and step size, perform time series segmentation on the data so that each data segment reflects the network status at the target time, and the execution flow of generating the time series segment set is as follows;

[0080] Based on the network data set, the sliding window parameters including time range and step size are set, and the data is cut into time series. First, the size of the sliding window is determined, which needs to be set according to the activity cycle of the network and the needs of data analysis. The common setting is one data window every 5 minutes or every hour. The choice of step size depends on the accuracy requirements of the analysis. A smaller step size can capture the changes in network status more finely, but it will increase the complexity of data processing. The data in the sliding window is automatically extracted from the data set through programming scripts. Each window contains all network activity records within the period, such as data traffic peaks, node failure events and their duration. After each data segment is standardized by the data processing algorithm, it reflects the network status within the target time, effectively supporting network performance monitoring and anomaly detection. The generated time series segment set is arranged in chronological order, providing a data basis for further time series analysis and network prediction.

[0081] S203: According to the time series segment set, the data and time tags in each time period are matched and aligned, the consistency of the data time points is corrected, and the execution process of generating the network behavior time series is as follows;

[0082] According to the time series segment set, match and align the data and time tags in each time period. First, use the time synchronization algorithm to check and correct the timestamp of each record in the data set to ensure that the time of the data record is accurate. Use the following formula to perform consistency correction of the time point:

[0083] T adj =T orig +ΔT

[0084] Among them, T adj represents the corrected time point, T orig is the time point of the original data recording, ΔT is the time deviation calculated by comparing the server time and the data recording time. The correction process ensures the time consistency between differentiated data sources and records, which is crucial for the analysis and fault tracing of network behavior. The generated network behavior time series can accurately reflect the actual behavior and status of the network at each time point, providing strong data support for network management and optimization decisions.

[0085] Specifically, if Figure 4 As shown in the figure, the network behavior time series is input into the graph convolution framework, the changes in the characteristics of the IP / E1 network nodes are analyzed, the node characteristics are updated and the spatiotemporal correlation is reflected, and the steps for establishing the spatiotemporal dependency feature model are as follows:

[0086] S301: By activating the data import interface, selecting the data source file of the network behavior time series, uploading the data and verifying the timestamp, and converting the original data into a unified format through the data formatting tool, the execution process of generating the time series data set is as follows;

[0087] By activating the data import interface, selecting the data source file of the network behavior time series, uploading the data and verifying the timestamp, when starting the data import process, the user first selects the time series file to be imported on the interface. The file includes the behavior data of the network node in the specified time period. After the file is selected, the system automatically executes the data upload process, and checks the timestamp of each data point at the same time to ensure that the time information of all data points is accurate and conforms to the preset time format. If the timestamp format is inconsistent or there is an error, the user will be prompted to manually correct it or automatically adjust it to the appropriate format. The uploaded raw data is processed using the data formatting tool and converted into a unified data format. The formatting process includes standardization of field names, conversion of data types, and range adjustment of data values, etc., to ensure the consistency and accuracy of subsequent data processing, generate a time series data set, and provide standardized input data for further data analysis and model training.

[0088] S302: According to the time series data set, a multi-node behavior analysis window is set in the data processing interface, the data in each time window is separated, the behavior changes of the nodes in multiple time windows are marked, and key activities and behavior patterns are identified to obtain the time window feature change table. The execution process is as follows;

[0089] According to the time series data set, a multi-node behavior analysis window is set in the data processing interface. The user can set the specific parameters of the analysis through the interface, such as the length and step of the time window, and select which nodes' data to analyze. The time series data set will be automatically cut into specified time windows. Each window contains all the activity data of the selected node in that time period. Through special data analysis tools, the system further conducts in-depth analysis of the node behavior in each time window, identifies the key changes and activity patterns of node behavior, such as communication peaks, data flow anomalies, etc. The behavior changes are marked and recorded in the time window feature change table, which describes in detail the key features and abnormal events of node behavior in each time window, providing data support for long-term monitoring and immediate response of network behavior.

[0090] S303: Using the time window feature change table, adopting the convolutional neural network algorithm, adjusting and applying the spatial connection data between nodes in the feature update tool, analyzing the relationship between the connection state of the node and the feature change, and updating the node characteristics by combining the node spatiotemporal data, integrating the data, and establishing the spatiotemporal dependency feature model. The execution process is as follows;

[0091] Using the time window feature change table and the convolutional neural network (CNN) algorithm, the spatial connection data between nodes is adjusted and applied in the feature update tool. According to the data in the time window feature change table, the spatial connection features between nodes are defined. The features express the interaction mode and connection strength between nodes in the differentiated time window. In the feature update tool, the spatial connection data is fused with the node features, and the node feature representation is optimized according to the historical and current connection data to improve the spatiotemporal resolution of the features. By combining the node spatiotemporal data, updating the node characteristics, integrating the data, and establishing the spatiotemporal dependency feature model, the model can dynamically capture the spatiotemporal changes in the network, which is of great significance to network management and optimization, and provides strong data support for the dynamic adjustment and prediction of the network.

[0092] The formula of the convolutional neural network algorithm is as follows:

[0093] y=f((W*x+b)·α+d·β)

[0094] Among them, y represents the spatiotemporal feature dependency model of the node, x is the input node feature data, W is the convolution kernel parameter, b is the bias term, * represents the convolution operation, f is the activation function, α is the feature enhancement coefficient, d is the additional feature dimension, and β is the weight coefficient of the additional feature.

[0095] The execution process is as follows:

[0096] The input node feature data x is convolved with the convolution kernel W to obtain a preliminary feature map, and then the bias term b is added. The result is multiplied by the feature enhancement coefficient α to enhance the expression of the main features. At the same time, an additional feature dimension d is introduced and multiplied by its weight coefficient β to refer to the relevant but less feature dimensions. In this way, more information is integrated and finally converted through the activation function f to obtain the final output y, which is used to form a more accurate spatiotemporal feature dependency model of the node. The specific values ​​of the weight coefficients α and β can be determined by cross-validation or optimization algorithms to ensure the optimal performance of the model.

[0097] Specifically, if Figure 5 As shown in the figure, based on the spatiotemporal dependency feature model, event recognition is performed, model output is analyzed, and threshold judgment is used to identify traffic anomalies and potential security threats. The specific steps of generating an event response strategy are as follows:

[0098] S401: According to the spatiotemporal dependency feature model, the behavior data in the IP / E1 network is captured, the behavior data is classified, including traffic data and access logs, the data points are marked by nodes and time, and the execution flow of generating the sorted event data set is as follows;

[0099] According to the spatiotemporal dependency feature model, the behavior data in the IP / E1 network is captured. The behavior data of each node in the network is automatically collected through the network monitoring system, including the flow information of the data packet and various access logs. The flow data covers the size of the data packet, the timestamps of sending and receiving, and the source and destination addresses, while the access log records the access details, such as the visitor IP, access time, access duration, etc. After preliminary screening, the data is eliminated from invalid or damaged data records, and the spatiotemporal dependency feature model is used to further process the data, marking each data point by node and time. This mark includes the unique identifier of the node and the specific time when the data is generated, ensuring the traceability and analyzability of the data. In this way, a collated event data set is generated, which not only contains all valid behavior data, but also is organized in detail according to the node and time dimensions, providing a clear data foundation for subsequent data analysis and event response.

[0100] S402: Based on the collated event data set, review the data to identify unusual patterns in the data, including traffic at atypical access times, indicating potential security threats and abnormal events, and generate an abnormal behavior pattern set. The execution process is as follows;

[0101] Based on the collated event data set, the data is reviewed and data analysts use complex data pattern recognition techniques, such as machine learning classification algorithms, to conduct in-depth analysis of the behavior patterns in the data set. Special attention is paid to atypical access time and traffic patterns, such as high traffic activities during low traffic periods or a large number of data requests during non-working hours, indicating potential security threats or abnormal events. Through this analysis, uncommon patterns in the data are identified and recorded in detail in the abnormal behavior pattern set. This set not only includes a detailed description of the abnormal pattern, but also indicates the specific time when the pattern occurs and the nodes involved, providing key information for further security analysis and response measures.

[0102] S403: Using the abnormal behavior pattern set, evaluate whether each abnormal pattern exceeds a preset sensitivity threshold, formulate targeted response measures for patterns that exceed the threshold, including isolating threats and adjusting security policies, and generate the execution process of the incident response strategy as follows;

[0103] Using the abnormal behavior pattern set, evaluate whether each abnormal pattern exceeds the preset sensitivity threshold. Security analysts set a quantitative sensitivity threshold to define what level of behavior pattern should be considered a security threat. The threshold is preset based on historical data analysis and security requirements, and can be adjusted according to actual conditions. The following formula is used to determine whether the threshold is exceeded:

[0104]

[0105] Among them, Rd represents the danger rating percentage of abnormal behavior, Ad is the number of abnormal activities of the behavior pattern, and Nd is the total number of observations. If R exceeds the preset threshold, it indicates that the abnormal pattern poses a potential threat and targeted response measures need to be taken. The measures include isolating the network nodes involved to avoid the spread of threats, adjusting security policies to enhance the overall security of the network, generating incident response strategies, and determining and listing specific response measures corresponding to each over-threshold abnormal pattern, providing guidance and basis for actual security management operations.

[0106] Specifically, if Figure 6 As shown in the figure, the steps to identify the key nodes and connections of the IP / E1 network from the incident response strategy, evaluate the network influence and stability risks, predict the failure points through simulation analysis, and build the key component analysis results are as follows:

[0107] S501: Analyze the data recorded in the incident response strategy, identify key nodes and connections in the IP / E1 network, record the location, type and key operating indicators of each component, including data flow and response time, and generate the network core component diagram. The execution process is as follows;

[0108] Analyze the data recorded in the incident response strategy to identify key nodes and connections in the IP / E1 network. The analysis process uses advanced network analysis tools to scan the activity data of all components in the network, including data traffic, access frequency, and response time. Perform performance evaluation on each node and connection, pay special attention to those nodes with high traffic and critical response time, and record the physical location and type of the nodes to ensure accurate marking on the network map. Through comprehensive analysis of the data, generate a network core component diagram, which not only shows the location and type of each core component, but also marks key operating indicators such as peak traffic and average response time, so that network administrators can intuitively understand the key performance and potential bottleneck areas of the network.

[0109] S502: Based on the network core component diagram, quantitatively analyze the influence and stability of key nodes and connections, evaluate indicators including the communication frequency of nodes, the load capacity of connections, and fault response, determine the criticality and risk level of each component, and generate the criticality and risk level analysis results. The execution process is as follows;

[0110] Based on the network core component diagram, the influence and stability of key nodes and connections are quantitatively analyzed. This analysis relies on special network performance evaluation software, which can calculate indicators such as the communication frequency of nodes, the load capacity of connections and fault response time. Through quantitative analysis of indicators, the criticality and risk level of each component are determined. For nodes with high communication frequency, their impact on the overall performance of the network is evaluated. For connections with low load capacity, their potential risk of becoming a network bottleneck is identified. By simulating various fault scenarios, the response performance of nodes and connections in fault conditions is evaluated, and their stability is further determined. All analysis results are summarized into criticality and risk level analysis results, providing a scientific basis for network optimization and risk management.

[0111] S503: Using the criticality and risk level analysis results, perform network stress testing and simulated fault analysis, simulate differentiated network loads and potential breakpoints, monitor network performance under extreme conditions, evaluate network reliability and identify potential weaknesses, and generate key component analysis results. The execution process is as follows;

[0112] Using the results of criticality and risk level analysis, network stress testing and simulated fault analysis are performed. Network engineers use simulation software to generate and apply differentiated network load scenarios, simulate various potential breakpoints in the network, simulate and refer to differentiated traffic distribution and data transmission behaviors, and try to artificially create extreme conditions in the network, such as sudden increase in traffic or failure of key nodes. Through testing, the performance of the network under extreme conditions is monitored, including the responsiveness of key nodes and connections, and the overall reliability of the network is evaluated using the following formula:

[0113]

[0114] Among them, Rh represents the overall reliability score of the network, r j is the performance score of a single component in a simulated failure, and m is the total number of components evaluated. The score reflects the network's resilience and ability to respond to failures. The evaluation results will be recorded in detail in the key component analysis results, including the network's performance under differentiated loads and failure scenarios, as well as every potential weakness identified. The analysis results provide an important basis for further network reinforcement and risk avoidance measures.

[0115] Specifically, if Figure 7 As shown in the figure, the analysis results of key components are used to optimize the network configuration of risk nodes and connections, and the network stability is optimized through parameter adjustment and route update. The specific steps to establish the operation and maintenance perception enhancement results are as follows:

[0116] S601: Based on the key component analysis results, the risk nodes and connections identified in the IP / E1 network are reviewed, the problems of each node and connection are identified, including low bandwidth and route congestion, and optimization measures are set for the nodes. The execution process of generating the node and connection optimization list is as follows;

[0117] Based on the analysis results of key components, the risk nodes and connections identified in the IP / E1 network are reviewed, and detailed performance data related to each node and connection is collected, with special attention paid to those components that show stability problems or high failure frequency in stress testing, and the performance bottlenecks of the components are analyzed, such as low bandwidth, route congestion, or response time delay. For nodes with low bandwidth, their current bandwidth usage and peak traffic data are recorded. For route congestion problems, the traffic distribution of related routes and the efficiency of routing algorithms are analyzed, and specific optimization measures are set for each problem node and connection, such as bandwidth upgrade, routing algorithm adjustment, or hardware replacement. After the measures are set, a node and connection optimization list is generated, which lists in detail all components that need to be optimized and their specific improvement measures, providing an execution blueprint for the implementation team.

[0118] S602: Using the node and connection optimization list, adjusting network parameters and updating routing settings, including adjusting traffic routing algorithms and data processing capabilities, optimizing network stability and risk resistance, and generating configuration adjustment execution records. The execution process is as follows;

[0119] Using the node and connection optimization list, adjusting network parameters and updating routing settings, network engineers adjust the configuration of designated nodes and connections through the network management system, including adjusting the traffic routing algorithm to more efficiently distribute network load, reduce congestion and increase the data transmission rate, while improving data processing capabilities to ensure that the network's response speed is not affected under high load conditions. Each configuration adjustment will be automatically recorded by the system in the configuration adjustment execution record, which details the time of each adjustment, the network components involved, the parameter values ​​before and after the adjustment, and the expected effect. The record not only serves as direct evidence of execution, but also provides a basis for subsequent effect evaluation and problem tracking.

[0120] S603: Based on the configuration adjustment execution record, the network is tested, the network stability and response speed of the new configuration are detected using a network performance monitoring tool, the test data is analyzed and the optimization effect of the network configuration is determined, the effectiveness of the configuration adjustment is verified through testing, and the execution process of generating the operation and maintenance perception enhancement result is as follows;

[0121] Based on the configuration adjustment execution records, the network is tested. Network engineers use network performance monitoring tools, such as network monitoring software and data analysis platforms, to test the stability and response speed of the newly configured network. The tools can monitor various performance indicators of the network in real time, including latency, bandwidth utilization, and error rate, and evaluate the optimization effect of the network configuration through the following formula:

[0122]

[0123] Among them, Sg represents the improvement score of overall stability, P post,i is the adjusted performance index,

[0124] P pre,i is the performance index before adjustment, n is the total number of evaluated indicators. The actual effect of optimization is quantified by comparing the performance difference before and after adjustment. The test results will be analyzed in detail and compared with the expected improvement effect to determine which adjustment measures have achieved the expected goals and need further optimization. The effectiveness of configuration adjustment is verified through testing and the results of enhanced operation and maintenance perception are generated. The results not only prove the effectiveness of the improvement measures but also provide valuable data support for the continuous optimization of the network.

[0125] like Figure 8 As shown, an operation and maintenance perception system based on IP / E1 network includes:

[0126] The topology data capture module captures the topology data of the initialized IP / E1 network, locates the nodes in combination with their geographic coordinates, quantitatively calculates the connection strength between nodes, and uses the association algorithm to associate the topology data with the geographic location to obtain the basic connection diagram;

[0127] The behavior data synchronization module uses the basic connection graph to collect the traffic and status data of each node, integrates the data through the sliding window technology, synchronizes the time label and network behavior data, and converts the data stream into a sequence to obtain the network behavior time series;

[0128] The graph convolution feature analysis module analyzes the time window changes of node features through the graph convolution network according to the network behavior time series, updates the node features and maps the spatiotemporal relationship to obtain the spatiotemporal dependency feature model;

[0129] The event recognition and response module uses the spatiotemporal dependency feature model to analyze abnormal events in the network, detects deviations in the time series of node features, identifies and classifies potential threats based on set thresholds, and obtains event response strategies;

[0130] The network optimization configuration module analyzes the network influence and stability risks of nodes based on the key nodes and connections identified in the event response strategy, optimizes the network by adjusting network parameters and updating routing strategies, and predicts and tests potential failure points to obtain enhanced operation and maintenance perception results.

[0131] The above are only preferred embodiments of the present invention and are not intended to limit the present invention in other forms. Any technician familiar with the profession may use the technical contents disclosed above to change or modify them into equivalent embodiments with equivalent changes and apply them to other fields. However, any simple modification, equivalent change and modification made to the above embodiments based on the technical essence of the present invention without departing from the technical solution of the present invention still falls within the protection scope of the technical solution of the present invention.

Claims

1. An operation and maintenance perception method based on IP / E1 network, characterized in that: The following steps are involved: By capturing and initializing the topology data of the IP / E1 network, inputting the node and connection data, combining the geographic location information, matching and correlating the data, the basic connection diagram of the IP / E1 network is constructed; According to the basic connection diagram of the IP / E1 network, the original traffic and status data of the integrated node, the time series data is processed by the sliding window technology, the time label and the network behavior data are aligned, and the network behavior time series is obtained; Input the network behavior time series into the graph convolution framework, analyze the changes in the IP / E1 network node characteristics, update the node characteristics and reflect the spatiotemporal correlation, and establish a spatiotemporal dependency feature model; Based on the spatiotemporal dependency feature model, event recognition is performed, model output is analyzed, traffic anomalies and potential security threats are identified using threshold judgments, and event response strategies are generated; Identify key nodes and connections of the IP / E1 network from the incident response strategy, assess network impact and stability risks, predict failure points through simulation analysis, and construct key component analysis results; The analysis results of the key components are used to optimize the network configuration of risk nodes and connections, optimize network stability through parameter adjustment and route update, and establish operation and maintenance awareness enhancement results.

2. The operation and maintenance perception method based on IP / E1 network according to claim 1, characterized in that: The basic connection diagram includes a connection data table, a geographic location index, and node interconnection strength; the network behavior time series includes time label alignment, network status update, and behavior data set; the spatiotemporal dependency feature model includes a node feature matrix, a spatiotemporal correlation diagram, and feature change dynamics; the event response strategy includes event type classification, pattern deviation detection, and sensitive event thresholds; the key component analysis results include influence scores, stability risk levels, and potential failure points; the operation and maintenance perception enhancement results include parameter adjustment plans, routing update lists, and test feedback results.

3. The operation and maintenance perception method based on IP / E1 network according to claim 1, characterized in that: By capturing and initializing the topology data of the IP / E1 network, inputting the node and connection data, combining the geographic location information, matching and associating the data, the steps to construct the basic connection diagram of the IP / E1 network are as follows: By capturing the topological data of the initial IP / E1 network, including the list of network nodes and the connection data between nodes, the data is standardized using data entry tools to generate a node connection data table; According to the node connection data table, the geographical location information of each node is integrated, the location of each node is checked, and the corresponding relationship between the node location and the connection data is analyzed through data integration processing to construct a node geographical location association map; The node geographic location association diagram is used to calculate the connection strength between nodes, analyze the geographic distance and network traffic data, and generate a basic connection diagram of the IP / E1 network through analysis.

4. The operation and maintenance perception method based on IP / E1 network according to claim 1, characterized in that: According to the basic connection diagram of the IP / E1 network, the original traffic and status data of the integrated node, the time series data is processed by the sliding window technology, and the time label and network behavior data are aligned. The steps of obtaining the network behavior time series are as follows: Based on the data of the basic connection diagram of the IP / E1 network, the traffic and status information of the nodes are sorted out, the data format is unified, and the data from different sources are merged into a complete record to generate a network data set; Based on the network data set, sliding window parameters including time range and step size are set, and the data is cut into time series so that each data segment reflects the network status at the target time, thereby generating a time series segment set; According to the time series segment set, the data and time labels in each time period are matched and aligned, the consistency of the data time points is corrected, and the network behavior time series is generated.

5. The operation and maintenance perception method based on IP / E1 network according to claim 1, characterized in that: The network behavior time series is input into the graph convolution framework, the changes in the IP / E1 network node characteristics are analyzed, the node characteristics are updated and the spatiotemporal correlation is reflected, and the steps of establishing the spatiotemporal dependency feature model are as follows: By activating the data import interface, selecting the data source file of the network behavior time series, uploading the data and verifying the timestamp, converting the original data into a unified format through a data formatting tool, and generating a time series data set; According to the time series data set, a multi-node behavior analysis window is set in the data processing interface, the data in each time window is separated, the behavior changes of the nodes in multiple time windows are marked, and key activities and behavior patterns are identified to obtain a time window feature change table; Utilizing the time window feature change table and adopting the convolutional neural network algorithm, the spatial connection data between nodes is adjusted and applied in the feature update tool, the relationship between the connection status of the nodes and the feature changes is analyzed, and the node characteristics are updated by combining the node spatiotemporal data, the data is integrated, and a spatiotemporal dependency feature model is established.

6. The operation and maintenance perception method based on IP / E1 network according to claim 5, characterized in that: The formula of the convolutional neural network algorithm is as follows: y=f((W*x+b)·α+d·β) Among them, y represents the spatiotemporal feature dependency model of the node, x is the input node feature data, W is the convolution kernel parameter, b is the bias term, * represents the convolution operation, f is the activation function, α is the feature enhancement coefficient, d is the additional feature dimension, and β is the weight coefficient of the additional feature.

7. The operation and maintenance perception method based on IP / E1 network according to claim 1, characterized in that: Based on the spatiotemporal dependency feature model, event recognition is performed, model output is analyzed, and threshold judgment is used to identify traffic anomalies and potential security threats. The steps of generating an event response strategy are as follows: According to the spatiotemporal dependency feature model, behavioral data in the IP / E1 network is captured, the behavioral data is classified, including flow data and access logs, data points are marked by nodes and time, and a collated event data set is generated; Based on the collated event data set, review the data to identify unusual patterns in the data, including traffic at atypical access times, indicating potential security threats and abnormal events, and generate an abnormal behavior pattern set; The abnormal behavior pattern set is used to evaluate whether each abnormal pattern exceeds a preset sensitivity threshold. For patterns that exceed the threshold, targeted response measures are formulated, including isolating threats and adjusting security policies, and generating incident response strategies.

8. The operation and maintenance perception method based on IP / E1 network according to claim 1, characterized in that: The steps of identifying the key nodes and connections of the IP / E1 network from the incident response strategy, evaluating the network impact and stability risks, predicting the failure points through simulation analysis, and constructing the key component analysis results are as follows: Analyze the data recorded in the incident response strategy, identify key nodes and connections in the IP / E1 network, record the location, type and key operating indicators of each component, including data flow and response time, and generate a network core component map; Based on the network core component diagram, quantitatively analyze the influence and stability of key nodes and connections, evaluate indicators including node communication frequency, connection load capacity and fault response, determine the criticality and risk level of each component, and generate criticality and risk level analysis results; Using the criticality and risk level analysis results, conduct network stress testing and simulated fault analysis, simulate differentiated network loads and potential breakpoints, monitor network performance under extreme conditions, evaluate network reliability and identify potential weaknesses, and generate key component analysis results.

9. The operation and maintenance perception system based on IP / E1 network according to claim 1, characterized in that: The steps of optimizing the network configuration of risk nodes and connections by using the analysis results of the key components, optimizing network stability through parameter adjustment and route update, and establishing the operation and maintenance perception enhancement results are as follows: Based on the analysis results of the key components, review the risk nodes and connections identified in the IP / E1 network, identify the problems of each node and connection, including low bandwidth and route congestion, set optimization measures for the nodes, and generate a node and connection optimization list; Using the node and connection optimization list, adjusting network parameters and updating routing settings, including adjusting traffic routing algorithms and data processing capabilities, optimizing network stability and risk resistance, and generating configuration adjustment execution records; Based on the configuration adjustment execution record, the network is tested, and the network performance monitoring tool is used to detect the network stability and response speed of the new configuration. The test data is analyzed and the optimization effect of the network configuration is determined. The effectiveness of the configuration adjustment is verified through testing, and the operation and maintenance perception enhancement results are generated.

10. An operation and maintenance perception system based on IP / E1 network, characterized in that: According to any one of claims 1 to 9, the operation and maintenance perception method based on the IP / E1 network comprises: The topology data capture module captures the topology data of the initialized IP / E1 network, locates the nodes in combination with their geographic coordinates, quantitatively calculates the connection strength between nodes, and uses the association algorithm to associate the topology data with the geographic location to obtain the basic connection diagram; The behavior data synchronization module uses the basic connection graph to monitor node traffic and status, applies a sliding window to integrate data, synchronizes time tags and behaviors, and obtains network behavior time series; The graph convolution feature analysis module analyzes the time window changes of node features through the graph convolution network according to the network behavior time series, updates the node features and maps the spatiotemporal relationship to obtain the spatiotemporal dependency feature model; The event recognition and response module uses the spatiotemporal dependency feature model to analyze abnormal events, perform deviation detection and threshold classification, and obtain event response strategies; The network optimization configuration module analyzes the network influence and stability risk of the nodes based on the key nodes and connections identified in the event response strategy, optimizes the network by adjusting network parameters and updating routing strategies, and predicts and tests potential failure points to obtain enhanced operation and maintenance perception results.

Images