Network health assessment model training method and network health assessment method

Abstract

The invention discloses a network health assessment model training method and a network health assessment method, which are applied to the field of network security, and comprise the following steps: configuring decision trees for each tip execution server and a central decision server; obtaining historical data of each device collected by each tip execution server and a corresponding data label, and taking the historical data of each device and the corresponding data label as training data of each tip execution server; training decision-making trees of the tip execution servers based on the training data of the tip execution servers, and determining index nodes of the decision-making trees through the central decision-making server; and after training is completed, the trained decision trees jointly construct a network health assessment model. The network health model obtained through training has good objectivity, and the network health state of each device or the whole can be evaluated more accurately; and the evaluation process of the network health result can be given, and the interpretability is higher.

Description

Technical Field

[0001] The present invention relates to the field of network security, and in particular to a network health assessment model training method and a network health assessment method. Background Art

[0002] The traditional network health assessment model assigns weights to each indicator based on experience. This method is too subjective, and as the number of indicators increases, the calculation time will also increase. The entropy weight method can solve the problem of subjective indicator weights, but it is difficult to directly use it for continuous data sets, so it has limitations and is difficult to apply in practice. With the development of artificial intelligence, network health assessment based on neural network deep learning models has also emerged, but because the model is a black box model, it is difficult to explain the process of the health results obtained, which makes it difficult for users to intuitively find the reasons for poor health results.

[0003] Therefore, how to obtain a network health assessment model that is intuitive, interpretable, and accurate is a technical problem that needs to be solved urgently. Summary of the invention

[0004] In view of this, the purpose of the present invention is to provide a network health assessment model training method and a network health assessment method, which solve the problems in the prior art that the assessment results are poorly interpretable, non-intuitive, and inaccurate.

[0005] In order to solve the above technical problems, the present invention provides a network health assessment model training method, comprising:

[0006] Configure decision trees for each peripheral execution server and central decision server;

[0007] Acquire historical data of each device collected by each of the terminal execution servers, and corresponding data labels, and use the historical data of each device and the corresponding data labels as training data for each of the terminal execution servers;

[0008] Training each execution server decision tree based on the training data of each of the terminal execution servers, and determining each indicator node of each of the decision trees through the central decision server;

[0009] After the training is completed, the trained decision trees are jointly constructed to obtain a network health assessment model.

[0010] Optionally, training each of the terminal execution server decision trees based on the training data of each of the terminal execution servers, and determining each indicator node of each of the decision trees through the central decision server, includes:

[0011] Calculate the information gain of the indicator to be calculated based on the training data of each of the terminal execution servers, and use the indicator corresponding to the maximum information gain calculated by each of the terminal execution servers as the indicator to be recommended;

[0012] Determine the indicator nodes of the decision tree of each terminal execution server according to the preset recommendation strategy and the indicator to be recommended through the central decision server;

[0013] After the training of each of the terminal execution server decision trees is completed, federated learning is used to aggregate the trained terminal execution server decision trees, determine the indicator nodes of the central decision server decision tree, and obtain the trained central decision server decision tree.

[0014] Optionally, the central decision server determines the indicator nodes of the decision tree of each terminal execution server according to the preset recommendation strategy and the indicator to be recommended, including:

[0015] Determine the recommended indicator from the indicators to be recommended according to the preset recommendation strategy and the information gain of the indicators to be recommended through the central decision server, and send the recommended indicator to each of the terminal execution servers;

[0016] If the historical data of the first terminal execution server contains the recommended indicator, the recommended indicator is used as an indicator node of the decision tree of the first terminal execution server;

[0017] If the historical data of the first terminal execution server does not contain the recommended indicator, the recommended indicator is ignored; the first terminal execution server is any terminal execution server.

[0018] Optionally, calculating the information gain of the indicator to be calculated based on the training data of each of the terminal execution servers includes:

[0019] Acquire the data of the indicator to be calculated from the training data of the terminal execution server;

[0020] If the data of the indicator to be calculated is enumerated data, the information gain of the indicator to be calculated is calculated according to the data of the indicator to be calculated;

[0021] If the data of the indicator to be calculated is constant or continuous data, the data of the indicator to be calculated is discretized using the equal-width interval method to obtain discrete data, and the information gain of the indicator to be calculated is calculated based on the discrete data.

[0022] The present invention also provides a network health assessment method, comprising:

[0023] Obtain data through each terminal execution server;

[0024] The network health assessment model is a network health assessment model obtained by using the above-mentioned network health assessment model training method to perform network health assessment on the corresponding data through each terminal execution server decision tree to obtain the assessment results corresponding to each terminal execution server.

[0025] The present invention also provides a network health assessment model training device, comprising:

[0026] A decision tree configuration module is used to configure decision trees for each peripheral execution server and the central decision server;

[0027] A training data acquisition module, used to acquire the historical data of each device collected by each of the terminal execution servers, and the corresponding data labels, and use the historical data of each device and the corresponding data labels as training data for each of the terminal execution servers;

[0028] A decision tree training module, used to train the decision trees of each terminal execution server based on the training data of each terminal execution server, and determine each indicator node of each decision tree through the central decision server;

[0029] The network health assessment model construction module is used to construct the network health assessment model by combining the trained decision trees after the training is completed.

[0030] The present invention also provides a network health assessment device, comprising:

[0031] The data acquisition module is used to acquire data through various terminal execution servers;

[0032] The health assessment module is used to perform network health assessment on the corresponding data through each terminal execution server decision tree in the network health assessment model to obtain the assessment results corresponding to each terminal execution server; the network health assessment model is a network health assessment model obtained by using the above-mentioned network health assessment model training method.

[0033] The present invention also provides an electronic device, comprising:

[0034] Memory for storing computer programs;

[0035] A processor is used to execute the computer program to implement the steps of the above method.

[0036] The present invention also provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the steps of the above method are implemented.

[0037] The present invention also provides a computer program product, comprising a computer program or instructions, wherein the steps of the above method are implemented when the computer program or instructions are executed by a processor.

[0038] It can be seen that the present invention configures a decision tree for each peripheral execution server and a central decision server;

[0039] The historical data of each device collected by each terminal execution server and the corresponding data labels are obtained, and the historical data of each device and the corresponding data labels are used as the training data of each terminal execution server; the decision trees of each terminal execution server are trained based on the training data of each terminal execution server, and each indicator node of each decision tree is determined through the central decision server; after the training is completed, the trained decision trees are jointly constructed to obtain a network health assessment model. The present invention uses training data containing historical data and data labels to train the model and determine the indicators of each node of the decision tree. Compared with the traditional method of manually defining indicator weights, it has good objectivity; and, a decision tree is configured for each terminal execution server, and each decision tree is trained based on the training data obtained by each terminal execution server. During the training process, the central decision server makes decisions on the nodes (for storing indicators) of the decision trees of each terminal execution server. Therefore, the decision trees of each terminal execution server affect each other during the training process. In this way, the network health model trained as a whole can more accurately evaluate the network health status of each device, and further can also accurately evaluate the overall network health status; and all data will fall step by step on each node of the decision tree according to the decision tree rules. Compared with the black box neural network model, the network health assessment model trained by this method can give the assessment process of the network health results and can display the status of each node of each decision tree, so it is more interpretable.

[0040] In addition, the present invention also provides a network health assessment model training device, a network health assessment method, a device, a equipment, a computer-readable storage medium and a computer program product, which also have the above-mentioned beneficial effects. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0042] Figure 1 A flowchart of a network health assessment model training method provided by an embodiment of the present invention;

[0043] Figure 2 A schematic diagram of a network health assessment platform deployment architecture provided by an embodiment of the present invention;

[0044] Figure 3 A flowchart of a network health assessment method provided by an embodiment of the present invention;

[0045] Figure 4 A schematic diagram of a network health assessment platform business architecture provided by an embodiment of the present invention;

[0046] Figure 5 A schematic diagram of the structure of a network health assessment model training device provided by an embodiment of the present invention;

[0047] Figure 6 A schematic diagram of the structure of a network health assessment device provided by an embodiment of the present invention;

[0048] Figure 7 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0049] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0050] The following first explains the networks and terms used in the present invention:

[0051] Random forest: Random forest is a classifier with multiple unrelated decision trees. The Bootstrap method is used for sampling. For each training set, a decision tree is constructed and then further split until the entropy gain is too small or some other overfitting conditions are met. After the training is completed, when the test sample is input, each random forest can classify the test sample and use voting to decide the final classification result of the test sample.

[0052] Federated learning: Federated learning is a distributed machine learning technology that allows multiple participants to build artificial intelligence models without sharing or aggregating local data. The core idea is to allow each participant to train the model locally, and then upload the updated model to the cloud or other participants for aggregation and integration to form a common model. In the current context of complex network topology and data explosion, federated learning provides a new idea for the construction of health assessment models for large network systems.

[0053] Telemetry: A protocol for remote data collection and transmission of network devices.

[0054] Bootstrap: Generate multiple sub-datasets by repeatedly sampling the original dataset.

[0055] Netconf: A standardized protocol for remote configuration and management of network devices.

[0056] CPU: Central Processing Unit, the main processing unit of the computer, responsible for executing instructions and processing data.

[0057] BGP: Border Gateway Protocol, a standard routing protocol between autonomous systems, used for routing exchange.

[0058] BGP-LS: Border Gateway Protocol - Link State, used to obtain information such as link status through the BGP protocol.

[0059] ID3: Iterative Dichotomiser 3, a machine learning algorithm for generating classification decision trees.

[0060] As network services grow and develop, the underlying physical network conditions become more complex. Network health can serve as a window to gain insight into the overall network status, and therefore becomes increasingly important. Network health is a comprehensive assessment of network status based on the collected data, and is a key task for monitoring various states of systems or services. In the field of operation and maintenance, network monitoring collects a wide range of data types, and the network topology is generally complex and includes different roles. Therefore, how to conduct a comprehensive health assessment of the global multi-dimensional data of the network is a very difficult task.

[0061] In recent years, due to the increase in the number of users and the development of fine-grained information collection technologies such as Telemetry, the amount of data collected has exploded, and the network health assessment of multi-dimensional data has become increasingly challenging. In the early stages, by determining the dimensions that affect the health of the network from the various types of data collected, and further determining the corresponding indicator parameters under each dimension, a multi-dimensional health evaluation model is established by combining these dimensions and the indicator parameters of the dimensions. The model is used to measure and quantify the health of the device to obtain a comprehensive health score. The health of the evaluation object is identified by the score, and the higher the score, the better the health. This method is too subjective because the weights of the indicator allocation are set through experience. On the other hand, as the number of indicators increases with the development of technology, the speed of this calculation method will be greatly reduced. With the continuous development of technologies such as artificial intelligence and big data, the analysis of network health has also begun to develop in the direction of intelligence. Through the analysis and mining of network data, intelligent analysis of network health can be achieved. For example: (1) Entropy weight method: Entropy weight method is an objective weighting method based on the concept of information entropy, which is used to determine the weights of multiple indicators. This method uses entropy to measure the disorder of the system. The larger the entropy value, the more disordered the system is and the smaller the amount of information is. In the comprehensive evaluation, the entropy weight method determines the weight of each indicator by calculating the information entropy of each indicator. The indicator with smaller information entropy has a greater impact in the comprehensive evaluation, so its weight is also larger; on the contrary, the indicator with larger information entropy has a smaller role in the comprehensive evaluation and its weight is also smaller. However, the entropy weight method uses the probability of data occurrence to calculate the entropy value to determine the weight, which makes it difficult to directly use it for continuous data sets. (2) Neural network method: Neural network is a deep learning algorithm that can handle complex nonlinear problems. In network health assessment, neural network can automatically adjust model parameters using indicators such as network performance and utilization, so that the model can be used to judge the network health. However, the health results given by the neural network model are difficult to explain, which makes it difficult for users to intuitively find the reasons for poor health results.

[0062] In order to solve the above problems, the present invention proposes a network health assessment model training method, which is based on the concept of random forest. Figure 1 , Figure 1 A flowchart of a network health assessment model training method provided by an embodiment of the present invention. The method may include:

[0063] S101: Configure a decision tree for each peripheral execution server and central decision server.

[0064] The present embodiment includes multiple terminal execution servers and a central decision server. The present embodiment configures a separate decision tree for each terminal execution server, namely, a terminal execution server decision tree, and configures a separate decision tree for the central decision server, namely, a central decision server decision tree, and each decision tree is independent of each other. The present embodiment does not limit the number of decision trees configured for each terminal execution server and the central decision server. For example, multiple decision trees can be configured for each terminal execution server and the central decision server, or one decision tree can be configured for each terminal execution server and the central decision server. In order to simplify the training process and improve the training efficiency while ensuring the accuracy of model training, the present embodiment configures one decision tree for each terminal execution server and the central decision server.

[0065] S102: Acquire historical data of each device collected by each terminal execution server and corresponding data labels, and use the historical data of each device and the corresponding data labels as training data for each terminal execution server.

[0066] In this embodiment, the relationship between the terminal execution server and the device can be one-to-one or one-to-many. In order to better evaluate the network health, the terminal execution server and the device can be matched one-to-one according to the physical location, that is, one terminal execution server can collect data for one device. Figure 2 As shown, Figure 2 The device collection service in the figure is the terminal execution server, PE represents the device, and the SDN controller service is the central decision server. For the terminal execution server, because each terminal execution server decision tree is trained separately, the training data is also the training data collected by each terminal execution server. Among them, the training data includes historical data and data labels. Among them, the historical data may include the historical device information, historical business information, historical protocol information, etc. of the device. It can be understood that the data label is healthy or unhealthy; or the data label can also be a health representation label.

[0067] Furthermore, in order to improve the accuracy of the network health assessment model training, obtaining the historical data of each device collected by each terminal execution server may include the following steps:

[0068] Step 21: Obtain the running status, offline times and virtual network running status of the device through the first link established between the terminal execution server and the device.

[0069] Specifically, Netconf is used to establish a link between the terminal execution server and the device. Through this link, the terminal execution server can obtain some low-frequency collected data indicators of the device, such as the device's operating status, offline times, virtual network operating status, etc.

[0070] Step 22: Obtain the device CPU utilization, memory utilization, and link utilization of the device through the second link established between the terminal execution server and the device.

[0071] Specifically, the Telemetry method establishes a link between the terminal execution server and the device, and obtains some high-frequency collected data indicators of the device through the link, such as device CPU utilization, memory utilization, link utilization, etc.

[0072] Step 23: Obtain the BGP routing status and BGP neighbor status by executing the neighbor relationship established between the server and the device through the terminal.

[0073] Specifically, the terminal execution server establishes a BGP-LS neighbor relationship with the device and obtains some BGP information, such as BGP routing status and BGP neighbor status.

[0074] Furthermore, in order to improve the accuracy of network health assessment model training, after obtaining the historical data of each device collected by each terminal execution server, the collected historical data may also be preprocessed. This embodiment does not specifically limit the preprocessing. For example, it may be data cleaning, or data screening and other processing. In order to better process the historical data, this embodiment supplements the missing values ​​of the collected multidimensional historical data, specifically using a linear function to supplement the missing points, and the linear formula is as follows:

[0075] ;

[0076] in, Represents the points to be added. Representative distance The most recently collected point. Representative distance The most recently collected point, m represents The number of missing points between It is the number of missing points.

[0077] It should be noted that the above-mentioned labeling of historical data is performed to obtain corresponding data labels. Specifically, the labeling adopts the abnormal window labeling method. When a device link failure is artificially created or obtained in the existing network, the device or link data collected within the time window of the failure is marked as unhealthy, and the non-fault window is marked as healthy, thereby achieving the labeling of healthy and unhealthy labels for historical data.

[0078] S103: Train the decision trees of each terminal execution server based on the training data of each terminal execution server, and determine the indicator nodes of each decision tree through the central decision server.

[0079] In this embodiment, each terminal execution server trains its own terminal execution server decision tree based on its own training data, and the central decision server makes a decision, thereby determining the indicator nodes of each terminal execution server decision tree and the central decision server decision tree.

[0080] Further, in order to improve the accuracy of the network health assessment model training, the above-mentioned training of each terminal execution server decision tree based on the training data of each terminal execution server, and determining each indicator node of each decision tree through the central decision server, may include the following steps:

[0081] Step 31: Calculate the information gain of the indicator to be calculated based on the training data of each terminal execution server, and use the indicator corresponding to the maximum information gain calculated by each terminal execution server as the indicator to be recommended.

[0082] The indicators to be calculated in this example can be understood as follows: during the training process, when the local terminal execution server decision tree is empty, the root node of the terminal execution server decision tree has not been determined. At this time, the indicators to be calculated are all the indicators of the training data in the terminal execution server; when the local terminal execution server decision tree is not empty, that is, the terminal execution server decision tree has a root node or an intermediate node, this training is to train the intermediate node or the leaf node, and the local terminal execution server decision tree needs to be obtained first. At this time, the indicators to be calculated are the remaining indicators after removing the indicators that have been used by the terminal execution server decision tree. If there are no more indicators in the training data of the terminal execution server after removal, it means that the training of the terminal execution server decision tree is completed.

[0083] The decision tree is trained on each terminal execution server. The decision tree is an ID3 decision tree. The training process mainly calculates the information gain. The information gain calculation formula is as follows:

[0084] ;

[0085] Among them, D represents the data set used by the current decision node; a represents an indicator in D, a is selected as the partition indicator, and there are V branch nodes. Represents the number of data sets of the Vth node, and Ent represents the entropy of the data set. The data set here is the training data set. Each terminal execution server selects the indicator with the largest information gain as the indicator to be recommended and reports it to the central decision server.

[0086] Furthermore, in order to improve the accuracy of the network health assessment model training, the information gain of the indicator to be calculated based on the training data of each terminal execution server may include the following steps:

[0087] Step 311: Obtain data of the indicator to be calculated from the training data of the terminal execution server;

[0088] Step 312: If the data of the indicator to be calculated is enumerated data, the information gain of the indicator to be calculated is calculated according to the data of the indicator to be calculated;

[0089] Step 313: If the data of the indicator to be calculated is constant or continuous data, the data of the indicator to be calculated is discretized using the equal-width interval method to obtain discrete data, and the information gain of the indicator to be calculated is calculated based on the discrete data.

[0090] This embodiment takes into account a variety of data types, such as enumeration type, threshold type, discrete constant and continuous constant. The information gain calculation in this embodiment provides calculation methods for various data types. If the currently trained data is enumeration type, there is no need to do additional processing on the data, and the information gain can be calculated directly; if the currently trained indicator is constant or continuous, it needs to be discretized first. Specifically, this embodiment can use the equal width interval method to select discretization points. Exemplarily, first take out the data interval of indicator a in the data set (the data set composed of training data) to obtain the maximum value of the indicator. With minimum According to the 20% incremental principle, the incremental gradient calculation formula is:

[0091] ;

[0092] Use in sequence , , , The information gain of this indicator is calculated as the separation point, and the maximum information gain is taken as the information gain of this indicator.

[0093] Step 32: Through the central decision server, determine the indicator nodes of the decision tree of each terminal execution server according to the preset recommendation strategy and the indicator to be recommended.

[0094] The indicator to be recommended in this embodiment is the indicator corresponding to the maximum information gain calculated by each terminal execution server. This embodiment does not limit the preset recommendation strategy. For example, in this embodiment, the terminal execution server corresponding to each device first independently trains its own indicator with the largest information gain and reports it to the central decision server. The central decision server first sorts the reported indicators according to the number of times, and the indicator with the largest number of times is used as the node of this decision tree; if the number of times is the same, the indicator with the largest information gain is used as the node. If the information gain is the same again, the indicator reported first is selected as the node.

[0095] Further, in order to improve the accuracy of the network health assessment model training, the central decision server may determine the indicator nodes of the decision tree of each terminal execution server according to the preset recommendation strategy and the indicator to be recommended, which may include the following steps:

[0096] Step 321: determining the recommended indicator from the indicators to be recommended according to the preset recommendation strategy and the information gain of the indicators to be recommended through the central decision server, and sending the recommended indicator to each terminal execution server;

[0097] Step 322: if the historical data of the first terminal execution server contains a recommended indicator, the recommended indicator is used as an indicator node of the decision tree of the first terminal execution server;

[0098] Step 323: If the historical data of the first terminal execution server does not contain the recommended indicator, the recommended indicator is ignored; the first terminal execution server is any terminal execution server.

[0099] In order to better understand steps 321 to 323, the following example can be referred to: the terminal execution server A calculates the information gain of indicator 1, the information gain of indicator 3, and the information gain of indicator 5, and the information gain of indicator 3 is the largest; the terminal execution server B calculates the information gain of indicator 1, the information gain of indicator 3, the information gain of indicator 6, and the information gain of indicator 8, and the information gain of indicator 6 is the largest. The terminal execution server A reports indicator 3 to the central decision server, and the terminal execution server B reports indicator 6 to the central decision server. The central decision server finally determines that indicator 6 is the recommended indicator according to the preset recommendation strategy, and then recommends indicator 6 to the terminal execution server A and the terminal execution server B. At this time, the terminal execution server B uses indicator 6 as the current indicator node of the terminal execution server decision tree B; because the terminal execution server A does not have indicator 6, the decision tree node processing is not performed in this training, and the training continues.

[0100] Step 33: After the training of each terminal execution server decision tree is completed, use federated learning to aggregate the trained terminal execution server decision trees, determine the various indicator nodes of the central decision server decision tree, and obtain the trained central decision server decision tree.

[0101] With the explosive growth of network data, the transmission of indicator data monitored on the nodes occupies more and more bandwidth. If the data of each node is gathered together for manual analysis or model training as in the past, the training speed will be seriously reduced and the training cost will become higher and higher. This embodiment uses federated learning for clustering to solve the problems of slow training speed and training cost. Aggregate the decision trees obtained by training each terminal execution server to generate a central decision server decision tree, thereby forming a global random forest model. Each terminal execution server decision tree and the central decision server decision tree can perform network health assessment. The central decision server in this embodiment can also make a decision on the end of training, such as judging whether to end the training according to the pruning strategy. This embodiment does not limit the pruning strategy. For example, a pre-pruning strategy can be used to judge based on the limit depth, the number of leaf nodes, and the information gain of the node selected this time; or it can also be based on a post-pruning strategy. When the central decision service decides that this training phase is over, notify all terminal execution servers to end the training. Alternatively, when the central decision server receives the information that the decision tree training is completed from all the terminal execution servers, the central decision server decides that the training phase is over and notifies all the terminal execution servers.

[0102] S104: After the training is completed, the trained decision trees are jointly constructed to obtain a network health assessment model.

[0103] When all decision trees are trained, all decision trees are jointly constructed to obtain a network health assessment model.

[0104] The network health assessment model training method provided by the embodiment of the present invention is applied, by configuring a decision tree for each terminal execution server and a central decision server; obtaining historical data of each device collected by each terminal execution server and the corresponding data label, and using the historical data of each device and the corresponding data label as training data for each terminal execution server; training each terminal execution server decision tree based on the training data of each terminal execution server, and determining each indicator node of each decision tree through the central decision server; after the training is completed, the trained decision trees are jointly constructed to obtain a network health assessment model. The present invention uses training data containing historical data and data labels to train the model and determine the indicators of each node of the decision tree. Compared with the traditional method of manually defining indicator weights, it has good objectivity; and, a decision tree is configured for each terminal execution server, and each decision tree is trained based on the training data obtained by each terminal execution server. During the training process, the central decision server makes decisions on the nodes (for storing indicators) of the decision trees of each terminal execution server. Therefore, the decision trees of each terminal execution server affect each other during the training process. In this way, the network health model trained as a whole can more accurately evaluate the network health status of each device, and further can also accurately evaluate the overall network health status; and all data will fall step by step on each node of the decision tree according to the decision tree rules. Compared with the black box neural network model, the network health assessment model trained by this method can give the assessment process of the network health results and can display the status of each node of each decision tree, so it is more interpretable. In addition, decision trees can conveniently process continuous data. When processing the features of continuous data, a threshold can be set for this feature, and then the data set can be divided into two subsets based on the comparison result between the value of the feature and the threshold, and an optimal separation point can be iterated based on the information gain. The decision tree data of each device is trained locally, and then the updated part of the decision tree training process is uploaded to the central decision server for aggregation and integration. Each decision tree forms an independent health assessment model responsible for its own health assessment, thereby reducing data transmission and reducing bandwidth, storage and other costs.

[0105] Please refer to Figure 3 , Figure 3 A flowchart of a network health assessment method provided by an embodiment of the present invention. The method may include:

[0106] S201: Acquire data through each terminal execution server.

[0107] This embodiment obtains data of each device through each terminal execution server. This embodiment does not limit the data of the device. For example, the data may include the running status of the device, the number of offline times, the running status of the virtual network, the CPU utilization rate of the device, the memory utilization rate, the link utilization rate, the BGP routing status, the BGP neighbor status, etc.

[0108] S202: Performing network health assessment on corresponding data through each terminal execution server decision tree in the network health assessment model to obtain the assessment results corresponding to each terminal execution server; the network health assessment model is a network health assessment model obtained by using the above-mentioned network health assessment model training method.

[0109] This embodiment uses the network health assessment model obtained by the above-mentioned network health assessment model training method to perform network health assessment. Specifically, each terminal execution server decision tree in the network health assessment model performs network health assessment on the data collected by each terminal, and reports each assessment result to the central decision server. The central decision server can provide feedback and display the results of each assessment. It needs to be explained that the central decision server decision tree in the network health assessment model can be used as a backup decision tree for each terminal execution server decision tree. When each terminal execution server decision tree fails, there is no need to retrain at this time. The terminal execution server decision tree can be quickly restored based on the central decision server decision tree.

[0110] The network health assessment model training method provided by the embodiment of the present invention is applied to obtain data through each terminal execution server; the network health assessment is performed on the corresponding data through each terminal execution server decision tree in the network health assessment model to obtain the assessment results corresponding to each terminal execution server; the network health assessment model is a network health assessment model obtained by using the above network health assessment model training method. The health assessment result obtained by this method using the network health assessment model obtained by the above training has good objectivity, can accurately assess the network health status of each device, and can further accurately assess the overall network health status, and can also display the status of each node of each decision tree, which is more interpretable.

[0111] In order to make the present invention easier to understand, please refer to Figure 4 , Figure 4 A schematic diagram of a network health assessment platform business architecture provided by an embodiment of the present invention may specifically include:

[0112] The terminal execution server includes multiple terminal execution servers (i.e. Figure 4 Each of the terminal execution service examples includes data collection, data preprocessing, and model training. Figure 4The central decision service instance in the example) includes the display of model aggregation results. Figure 3 The data collection and dotted arrows in the figure can be understood as model application; the solid arrows can be understood as model training. The following is a detailed description:

[0113] (1) Data collection. The historical data of the corresponding devices is obtained through the Netconf service, elemetry service, BGP service, etc. of the terminal execution service, and placed in the database, which is the training database.

[0114] (2) Data preprocessing. The collected multi-dimensional historical data is supplemented with missing values, and the data health is marked. The marking results and the supplemented data are stored in the database. The data health marking can use the domain knowledge base marking method (i.e., the manual inspection marking method) and the abnormal window marking method. This embodiment uses one of the data health marking methods.

[0115] (3) Model training. Model training is performed on each terminal execution server decision tree based on the data in the database, including information gain calculation and attribute recommendation (i.e., indicator recommendation).

[0116] (4) Model aggregation. The method for determining the end of training is a pruning strategy. The pruning strategy may include pre-pruning and post-pruning. This embodiment may adopt one of the detection strategies. The central model refers to the central decision service end decision tree.

[0117] (5) Health assessment. Execute the server-side decision tree at the end (i.e. Figure 4 During the training process of the local model in the central decision server, the decision tree of the central decision server makes decisions and determines each node in the decision tree of the terminal execution server. During the model application process, the trained decision tree of the terminal execution server evaluates the health of the collected data and sends it to the central decision server.

[0118] (6) Result display. The data health assessment results sent by the terminal execution server are summarized and displayed.

[0119] The following is an introduction to a network health assessment model training device provided by an embodiment of the present invention. The network health assessment model training device described below and the network health assessment model training method described above can be referenced to each other.

[0120] Please refer to Figure 5 , Figure 5 A schematic diagram of a network health assessment model training device provided by an embodiment of the present invention may include:

[0121] A decision tree configuration module 100 is used to configure a decision tree for each peripheral execution server and a central decision server;

[0122] The training data acquisition module 200 is used to acquire the historical data of each device collected by each of the terminal execution servers and the corresponding data labels, and use the historical data of each device and the corresponding data labels as the training data of each of the terminal execution servers;

[0123] A decision tree training module 300 is used to train the decision trees of each terminal execution server based on the training data of each terminal execution server, and determine each indicator node of each decision tree through the central decision server;

[0124] The network health assessment model construction module 400 is used to construct a network health assessment model by combining the trained decision trees after the training is completed.

[0125] Based on the above embodiment, the decision tree training module 300 may include:

[0126] A unit for determining an indicator to be recommended, configured to calculate information gain of the indicator to be calculated based on the training data of each of the terminal execution servers, and to use the indicator corresponding to the maximum information gain calculated by each of the terminal execution servers as the indicator to be recommended;

[0127] The terminal execution server decision tree training unit is used to determine the indicator nodes of each terminal execution server decision tree according to the preset recommendation strategy and the indicator to be recommended through the central decision server;

[0128] The central decision server decision tree training unit is used to aggregate the trained terminal execution server decision trees by using federated learning after the training of each terminal execution server decision tree is completed, determine the various indicator nodes of the central decision server decision tree, and obtain the trained central decision server decision tree.

[0129] Based on the above embodiment, the terminal execution server decision tree training unit may include:

[0130] A recommendation indicator determination subunit, configured to determine a recommendation indicator from the indicators to be recommended through the central decision server according to the preset recommendation strategy and the information gain of the indicators to be recommended, and send the recommendation indicator to each of the terminal execution servers;

[0131] A first result subunit is used for using the recommended indicator as an indicator node of the decision tree of the first terminal execution server if the historical data of the first terminal execution server contains the recommended indicator;

[0132] The second result subunit is used to ignore the recommendation indicator if the historical data of the first terminal execution server does not contain the recommendation indicator; the first terminal execution server is any terminal execution server.

[0133] Based on the above embodiment, the unit for determining the index to be recommended may include:

[0134] A data acquisition subunit, used for acquiring the data of the indicator to be calculated from the training data of the terminal execution server;

[0135] A first information gain calculation subunit, configured to calculate the information gain of the indicator to be calculated according to the data of the indicator to be calculated if the data of the indicator to be calculated is enumerated data;

[0136] The second information gain calculation subunit is used to discretize the data of the indicator to be calculated by using the equal-width interval method to obtain discrete data if the data of the indicator to be calculated is constant or continuous data, and calculate the information gain of the indicator to be calculated based on the discrete data.

[0137] It should be noted that the order of the modules and units in the above network health assessment model training device can be changed without affecting the logic.

[0138] The network health assessment model training device provided by the embodiment of the present invention is used to configure a decision tree for each terminal execution server and a central decision server through a decision tree configuration module 100; a training data acquisition module 200 is used to obtain the historical data of each device collected by each of the terminal execution servers, and the corresponding data labels, and use the historical data of each device and the corresponding data labels as the training data of each of the terminal execution servers; a decision tree training module 300 is used to train each terminal execution server decision tree based on the training data of each terminal execution server, and determine each indicator node of each decision tree through the central decision server; a network health assessment model construction module 400 is used to construct a network health assessment model together with each of the trained decision trees after the training is completed. This device uses training data containing historical data and data labels to train the model and determine the indicators of each node of the decision tree. Compared with the traditional method of manually defining indicator weights, it has good objectivity; and, a decision tree is configured for each terminal execution server, and each decision tree is trained based on the training data obtained by each terminal execution server. During the training process, the central decision server makes decisions on the nodes (used to store indicators) of the decision tree of each terminal execution server. Therefore, the decision trees of each terminal execution server affect each other during the training process. In this way, the network health model trained as a whole can more accurately evaluate the network health status of each device, and further can accurately evaluate the overall network health status; and all data will fall step by step on each node of the decision tree according to the decision tree rules. Compared with the black box neural network model, the network health assessment model trained by this method can give the evaluation process of the network health results and can display the status of each node of each decision tree, so it is more interpretable. In addition, decision trees can conveniently process continuous data. When processing the features of continuous data, a threshold can be set for this feature, and then the data set can be divided into two subsets based on the comparison result between the value of the feature and the threshold, and an optimal separation point can be iterated based on the information gain. The decision tree data of each device is trained locally, and then the updated part of the decision tree training process is uploaded to the central decision server for aggregation and integration. Each decision tree forms an independent health assessment model responsible for its own health assessment, thereby reducing data transmission and reducing bandwidth, storage and other costs.

[0139] The following is an introduction to a network health assessment device provided by an embodiment of the present invention. The device described below and the network health assessment method described above can be referenced to each other.

[0140] Please refer to Figure 6 , Figure 6 A schematic diagram of the structure of a network health assessment device provided by an embodiment of the present invention may include:

[0141] The data acquisition module 500 is used to acquire data through each terminal execution server;

[0142] The health assessment module 600 is used to perform network health assessment on the corresponding data through each terminal execution server decision tree in the network health assessment model to obtain the assessment results corresponding to each terminal execution server; the network health assessment model is a network health assessment model obtained by using the above-mentioned network health assessment model training method.

[0143] The network health assessment model training device provided by the embodiment of the present invention is used to obtain data through each terminal execution server through the data acquisition module 500; the health assessment module 600 is used to perform network health assessment on the corresponding data through each terminal execution server decision tree in the network health assessment model to obtain the assessment results corresponding to each terminal execution server; the network health assessment model is a network health assessment model obtained by using the above-mentioned network health assessment model training method. The health assessment result obtained by this device using the network health assessment model obtained by the above-mentioned training has good objectivity, can accurately assess the network health status of each device, and can further accurately assess the overall network health status. It can also display the status of each node of each decision tree, and is more interpretable.

[0144] The electronic device provided by the embodiment of the present invention is introduced below. The electronic device described below and the network health assessment model training method and / or network health assessment method described above can be referenced to each other.

[0145] Please refer to Figure 7 , Figure 7 The structural diagram of the electronic device provided by the embodiment of the present invention may include:

[0146] A memory 10, used for storing computer programs;

[0147] The processor 20 is used to execute a computer program to implement the above-mentioned network health assessment model training method and / or network health assessment method.

[0148] The memory 10 , the processor 20 , and the communication interface 31 all communicate with each other via the communication bus 32 .

[0149] In the embodiment of the present invention, the memory 10 is used to store one or more programs, and the program may include program code, and the program code includes computer operation instructions. In the embodiment of the present invention, the memory 10 may store programs for implementing the following functions:

[0150] Configure decision trees for each peripheral execution server and central decision server;

[0151] Acquire historical data of each device collected by each of the terminal execution servers, and corresponding data labels, and use the historical data of each device and the corresponding data labels as training data for each of the terminal execution servers;

[0152] Training each of the terminal execution server decision trees based on the training data of each of the terminal execution servers, and determining each indicator node of each of the decision trees through the central decision server;

[0153] After the training is completed, the trained decision trees are jointly constructed to obtain a network health assessment model;

[0154] and / or;

[0155] Obtain data through each terminal execution server;

[0156] The network health assessment model is a network health assessment model obtained by using the above-mentioned network health assessment model training method to perform network health assessment on the corresponding data through each terminal execution server decision tree to obtain the assessment results corresponding to each terminal execution server.

[0157] In a possible implementation, the memory 10 may include a program storage area and a data storage area, wherein the program storage area may store an operating system and an application required for at least one function, etc.; the data storage area may store data created during use.

[0158] In addition, the memory 10 may include a read-only memory and a random access memory, and provide instructions and data to the processor. A portion of the memory may also include an NVRAM. The memory stores an operating system and operating instructions, executable modules or data structures, or a subset thereof, or an extended set thereof, wherein the operating instructions may include various operating instructions for implementing various operations. The operating system may include various system programs for implementing various basic tasks and processing hardware-based tasks.

[0159] The processor 20 may be a central processing unit (CPU), an application specific integrated circuit, a digital signal processor, a field programmable gate array or other programmable logic device, a microprocessor or any conventional processor, etc. The processor 20 may call a program stored in the memory 10 .

[0160] The communication interface 31 may be an interface of a communication module, and is used to connect to other devices or systems.

[0161] Of course, it should be noted that Figure 7 The structure shown does not constitute a limitation on the electronic device in the embodiment of the present invention. In actual applications, the electronic device may include Figure 7 More or fewer components than shown, or combinations of certain components.

[0162] It is understandable that if the network health assessment model training method and / or the network health assessment method in the above-mentioned embodiment is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on such an understanding, the technical solution of the present invention is essentially or the part that contributes to the current technology or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium to execute all or part of the steps of the methods of each embodiment of the present invention.

[0163] The computer-readable storage medium may include: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and other media that can store program codes.

[0164] Based on this, an embodiment of the present invention further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the above-mentioned network health assessment model training method and / or network health assessment method are implemented.

[0165] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0166] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0167] Finally, it should be noted that, in this article, relationships such as first and second, etc. are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprises" or any other variations are intended to cover non-exclusive inclusion, so that a process, method, article or device that includes a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device.

[0168] The above is a detailed introduction to a network health assessment model training method and a network health assessment method, device, equipment, computer-readable storage medium and computer program product provided by the present invention. Specific examples are used in this article to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea; at the same time, for a general technician in this field, according to the idea of ​​the present invention, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

Claims

1. A network health assessment model training method, characterized in that: include: Configure decision trees for each peripheral execution server and central decision server; Acquire historical data of each device collected by each of the terminal execution servers, and corresponding data labels, and use the historical data of each device and the corresponding data labels as training data for each of the terminal execution servers; Training each of the terminal execution server decision trees based on the training data of each of the terminal execution servers, and determining each indicator node of each of the decision trees through the central decision server; After the training is completed, the trained decision trees are jointly constructed to obtain a network health assessment model.

2. The network health assessment model training method according to claim 1, characterized in that: The decision trees of the terminal execution servers are trained based on the training data of the terminal execution servers, and the indicator nodes of the decision trees are determined by the central decision server, including: Calculate the information gain of the indicator to be calculated based on the training data of each of the terminal execution servers, and use the indicator corresponding to the maximum information gain calculated by each of the terminal execution servers as the indicator to be recommended; Determine the indicator nodes of the decision tree of each terminal execution server according to the preset recommendation strategy and the indicator to be recommended through the central decision server; After the training of each of the terminal execution server decision trees is completed, federated learning is used to aggregate the trained terminal execution server decision trees, determine the indicator nodes of the central decision server decision tree, and obtain the trained central decision server decision tree.

3. The network health assessment model training method according to claim 2, characterized in that: Through the central decision server, the indicator nodes of the decision tree of each terminal execution server are determined according to the preset recommendation strategy and the indicator to be recommended, including: Determine the recommended indicator from the indicators to be recommended according to the preset recommendation strategy and the information gain of the indicators to be recommended through the central decision server, and send the recommended indicator to each of the terminal execution servers; If the historical data of the first terminal execution server contains the recommended indicator, the recommended indicator is used as an indicator node of the decision tree of the first terminal execution server; If the historical data of the first terminal execution server does not contain the recommended indicator, the recommended indicator is ignored; the first terminal execution server is any terminal execution server.

4. The network health assessment method according to claim 2, characterized in that: Calculating the information gain of the indicator to be calculated based on the training data of each of the terminal execution servers includes: Acquire the data of the indicator to be calculated from the training data of the terminal execution server; If the data of the indicator to be calculated is enumerated data, the information gain of the indicator to be calculated is calculated according to the data of the indicator to be calculated; If the data of the indicator to be calculated is constant or continuous data, the data of the indicator to be calculated is discretized using the equal-width interval method to obtain discrete data, and the information gain of the indicator to be calculated is calculated based on the discrete data.

5. A network health assessment method, characterized in that: include: Obtain data through various terminal execution servers; A network health assessment is performed on the corresponding data through each terminal execution server decision tree in the network health assessment model to obtain an assessment result corresponding to each terminal execution server; the network health assessment model is a network health assessment model obtained by using any network health assessment model training method according to claims 1 to 4.

6. A network health assessment model training device, characterized in that: include: A decision tree configuration module is used to configure decision trees for each peripheral execution server and the central decision server; A training data acquisition module, used to acquire the historical data of each device collected by each of the terminal execution servers, and the corresponding data labels, and use the historical data of each device and the corresponding data labels as training data for each of the terminal execution servers; A decision tree training module, used to train the decision trees of each terminal execution server based on the training data of each terminal execution server, and determine each indicator node of each decision tree through the central decision server; The network health assessment model construction module is used to construct the network health assessment model by combining the trained decision trees after the training is completed.

7. A network health assessment device, characterized in that: include: The data acquisition module is used to acquire data through various terminal execution servers; A health assessment module is used to perform network health assessment on the corresponding data through each terminal execution server decision tree in the network health assessment model to obtain the assessment results corresponding to each terminal execution server; the network health assessment model is a network health assessment model obtained by using any network health assessment model training method according to any one of claims 1 to 4.

8. An electronic device, characterized in that: include: Memory for storing computer programs; A processor, configured to execute the computer program to implement the steps of the method according to any one of claims 1 to 5.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 5 are implemented.

10. A computer program product comprising a computer program or instructions, characterized in that When the computer program or instruction is executed by a processor, the steps of the method according to any one of claims 1 to 5 are implemented.

Images