Abnormity detection method and device of core network and storage medium

Abstract

The invention provides a core network anomaly detection method and device and a storage medium, and the method comprises the steps: determining a performance index of at least one core network, and determining a target anomaly threshold value of each performance index based on an extreme value theory; acquiring real-time data of each performance index in the core network; determining an abnormal target performance index based on the real-time data of each performance index and a corresponding target abnormal threshold; and based on the target performance index, determining an anomaly detection result of the core network through a root cause judgment rule. Therefore, according to the invention, the target abnormal threshold value of each performance index can be determined based on the extreme value theory, the core network is automatically subjected to abnormal detection and the abnormal detection result is obtained through the real-time data of each performance index in the core network and the corresponding target abnormal threshold value, manual analysis and hypothesis of data distribution are not needed, the labor cost is reduced, and the detection efficiency is improved. And the detection efficiency and the accuracy of an abnormal detection result are improved.

Description

Technical Field

[0001] The present disclosure relates to the field of anomaly detection technology, and in particular to an anomaly detection method, device and storage medium for a core network. Background Art

[0002] With the rapid development of computer technology, the network has become an indispensable part of daily life. Based on this, it is necessary to quickly and accurately detect the network quality in order to promptly discover and solve abnormal situations in the core network, so as to avoid affecting the normal life of users.

[0003] In the prior art, it is possible to monitor the network access of users in different regions, analyze network performance indicator data, and perform anomaly detection of the core network in combination with expert experience and statistical methods, but the labor cost is high and the detection efficiency is low. Alternatively, a method combining classification recognition and classification mining is used for data mining and data analysis, and a classification analysis algorithm based on a support vector machine is used to classify and identify network anomaly data, a security prediction model is established based on an LSTM neural network, and the mined data is input into the security prediction model for security prediction. Different response plans are taken according to the security prediction results. However, the above-mentioned prior art relies on the distribution of the data itself, and the feature analysis is not comprehensive, which may cause inaccurate anomaly detection results. Summary of the invention

[0004] In order to overcome the problems existing in the related art, the present disclosure provides a core network anomaly detection method, device and storage medium.

[0005] According to a first aspect of an embodiment of the present disclosure, a method for detecting anomalies in a core network is provided, the method comprising:

[0006] Determine at least one performance indicator of the core network, and determine a target abnormal threshold value of each of the performance indicators based on extreme value theory;

[0007] Obtaining real-time data of each of the performance indicators in the core network;

[0008] Determine the target performance indicator having an abnormality based on the real-time data of each of the performance indicators and the corresponding target abnormality threshold;

[0009] Based on the target performance indicator, an abnormality detection result of the core network is determined through a root cause judgment rule.

[0010] Optionally, in the embodiment of the present disclosure, determining the target abnormal threshold of each performance indicator based on extreme value theory includes:

[0011] Acquire historical data of each of the performance indicators, and sort the historical data based on time sequence to obtain time series data;

[0012] Determine an initial abnormal threshold value of each of the performance indicators based on the time series data;

[0013] Based on the extreme value distribution, determine the threshold calculation formula;

[0014] Based on the time series data of each of the performance indicators and the corresponding initial abnormal threshold, the target abnormal threshold corresponding to each of the performance indicators is obtained by the threshold calculation formula.

[0015] Optionally, in the embodiment of the present disclosure, determining the target performance indicator having an abnormality based on the real-time data of each performance indicator and the corresponding target abnormality threshold includes:

[0016] Comparing the real-time data of each performance indicator with the corresponding target abnormality threshold to obtain a comparison result;

[0017] The performance indicator for which the comparison result is greater than is determined as the target performance indicator in which the abnormality occurs.

[0018] Optionally, in an embodiment of the present disclosure, determining the abnormality detection result of the core network by a root cause judgment rule based on the target performance indicator includes:

[0019] Determining a target performance type corresponding to the target performance indicator;

[0020] Determine the abnormal index ratio of the target performance type;

[0021] If the abnormal index proportion of the target performance type is greater than or equal to the preset proportion value, the abnormal detection result of the core network is determined to be abnormal, and the cause of the abnormality is determined by the root cause judgment rule; otherwise, the abnormal detection result of the core network is determined to be normal.

[0022] Optionally, in the embodiment of the present disclosure, the method further includes:

[0023] Based on the real-time data of the performance indicator and the corresponding target abnormality threshold, determining whether to update the target abnormality threshold of the performance indicator;

[0024] If it is determined to update the target abnormality threshold of the performance indicator, the target abnormality threshold of the performance indicator is re-determined, and the re-determined target abnormality threshold is determined as the target abnormality threshold of the performance indicator.

[0025] Optionally, in an embodiment of the present disclosure, the performance indicators include one or more of TCP establishment success rate, TCP establishment average delay, TCP retransmission rate, TCP out-of-order rate, HTTP download rate, HTTP uplink rate, user number fluctuation, traffic fluctuation, registration success rate, PDU session establishment success rate, reference signal received power, uplink signal-to-noise ratio, MR coverage, cell downlink RLC SDU packet loss rate, switch-out success rate, uplink PRB utilization, and downlink PRB utilization.

[0026] Optionally, in the embodiment of the present disclosure, the threshold calculation formula includes:

[0027]

[0028] Among them, m i is the initial abnormal threshold of the i-th performance indicator, and q is the threshold The probability of occurrence, is the number of data exceeding the initial abnormal threshold in the time series data corresponding to the i-th performance indicator, n i is the number of time series data corresponding to the i-th performance indicator, γ and σ are the variables to be solved, is the target abnormal threshold of the i-th performance indicator.

[0029] According to a second aspect of an embodiment of the present disclosure, a core network anomaly detection device is provided, the device comprising:

[0030] A first determination module is used to determine at least one performance indicator of a core network, and determine a target abnormal threshold value of each performance indicator based on extreme value theory;

[0031] An acquisition module, used to acquire real-time data of each of the performance indicators in the core network;

[0032] An anomaly detection module, used to determine the target performance indicator with an abnormality based on the real-time data of each performance indicator and the corresponding target anomaly threshold;

[0033] The second determination module is used to determine the abnormality detection result of the core network based on the target performance indicator and through a root cause judgment rule.

[0034] According to a third aspect of an embodiment of the present disclosure, there is provided an electronic device, including:

[0035] processor;

[0036] a memory for storing processor-executable instructions;

[0037] The processor is configured to implement the method described in the first aspect above.

[0038] According to a fourth aspect of an embodiment of the present disclosure, a non-temporary computer-readable storage medium is provided, wherein the computer storage medium stores computer-executable instructions; after the computer-executable instructions are executed by a processor, the method described in the first aspect above can be implemented.

[0039] The technical solution provided by the embodiments of the present disclosure may have the following beneficial effects:

[0040] The present disclosure proposes a method, device and storage medium for detecting anomalies in a core network. The method includes determining at least one performance indicator of the core network, and determining a target anomaly threshold value of each performance indicator based on extreme value theory; obtaining real-time data of each performance indicator in the core network; determining the target performance indicator where an anomaly occurs based on the real-time data of each performance indicator and the corresponding target anomaly threshold value; and determining the anomaly detection result of the core network through a root cause judgment rule based on the target performance indicator. Therefore, the present disclosure can determine the target anomaly threshold value of each performance indicator based on extreme value theory, and automatically perform anomaly detection on the core network and obtain anomaly detection results through the real-time data of each performance indicator in the core network and the corresponding target anomaly threshold value, without relying on manual analysis and assuming data distribution, thereby reducing labor costs and improving detection efficiency and the accuracy of anomaly detection results.

[0041] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present disclosure and, together with the description, serve to explain the principles of the present disclosure.

[0043] Figure 1 is a flowchart of a method for detecting anomalies in a core network according to some embodiments of the present disclosure;

[0044] Figure 2 is a structural schematic diagram of an abnormality detection device of a core network according to some embodiments of the present disclosure;

[0045] Figure 3 It is a block diagram of an electronic device suitable for executing an anomaly detection method of a core network according to some embodiments of the present disclosure. DETAILED DESCRIPTION

[0046] Some embodiments of the present disclosure will be described in detail here, and examples thereof are shown in the accompanying drawings. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. Various changes, modifications and equivalents of the methods, devices and / or systems described herein will become apparent after understanding the present disclosure. For example, the order of operations described herein is merely an example and is not limited to those orders set forth herein, but can be changed as becomes apparent after understanding the present disclosure, except for operations that must be performed in a specific order. In addition, for clarity and brevity, descriptions of features known in the art may be omitted.

[0047] The embodiments described in some embodiments of the present disclosure below do not represent all embodiments consistent with the present disclosure. Instead, they are merely examples of devices and methods consistent with some aspects of the present disclosure as detailed in the appended claims.

[0048] Figure 1 is a flowchart of a core network anomaly detection method according to some embodiments of the present disclosure, such as Figure 1 As shown, the method may include the following steps:

[0049] Step 101: Determine at least one performance indicator of a core network, and determine a target abnormal threshold value of each performance indicator based on extreme value theory.

[0050] It should be noted that the executor of the above-mentioned core network anomaly detection method is the core network anomaly detection device, which can be implemented by software and / or hardware. The core network anomaly detection device in this embodiment can be configured in an electronic device.

[0051] In this example embodiment, the electronic device may include devices such as terminal devices and servers, and this embodiment does not limit the electronic device.

[0052] In the embodiment of the present disclosure, at least one performance indicator of the core network can be determined through expert experience. In the embodiment of the present disclosure, the above performance indicators may include one or more of TCP (Transmission Control Protocol) establishment success rate, TCP establishment average delay, TCP retransmission rate, TCP disorder rate, HTTP (Hypertext Transfer Protocol) download rate, HTTP uplink rate, user number fluctuation, traffic fluctuation, registration success rate, PDU session establishment success rate, reference signal received power, uplink signal-to-noise ratio, MR (Measurement Report) coverage, cell downlink RLC SDU packet loss rate, handover success rate, uplink PRB (Physical Resource Block) utilization, and downlink PRB utilization. In the embodiment of the present disclosure, after determining the performance indicators, the determined performance indicators can be numbered so as to subsequently determine the target abnormal threshold of each performance indicator.

[0053] Among them, in the embodiment of the present disclosure, after the performance indicators are determined through the above steps, the target abnormal threshold of each performance indicator can be determined based on the extreme value theory. Specifically, in the embodiment of the present disclosure, the above method for determining the target abnormal threshold of each performance indicator based on the extreme value theory can include the following steps:

[0054] Step 1: Obtain historical data of each performance indicator, and sort the historical data in chronological order to obtain time series data;

[0055] Step 2: Determine the initial abnormal threshold of each performance indicator based on the time series data;

[0056] Step 3: Determine the threshold calculation formula based on extreme value distribution;

[0057] Step 4: Based on the time series data of each performance indicator and the corresponding initial abnormal threshold, the target abnormal threshold corresponding to each performance indicator is obtained through the threshold calculation formula.

[0058] In the embodiment of the present disclosure, historical data of each performance indicator in the core network is collected, and the collected historical data is converted into time series data suitable for anomaly detection through data cleaning and time sequence sorting. In addition, in the embodiment of the present disclosure, the initial anomaly threshold of each performance indicator can be determined by statistical learning or expert experience.

[0059] Furthermore, in the disclosed embodiment, the extreme value theory is a theory for dealing with situations that are extremely far from the median of the probability distribution, and can be used to analyze situations with rare probabilities (such as earthquakes or floods that occur once in a hundred years). Among them, in the disclosed embodiment, the fluctuation of network quality in the core network basically continues to be stable and good, and poor network quality is a minority of extremely low probability events. Based on this, the extreme value theory can be used to detect abnormalities in various performance indicators.

[0060] Furthermore, in the embodiments of the present disclosure, unlike traditional methods which require assumptions about data distribution and assume that the probability of normal data occurring is higher than the probability of abnormal data occurring, extreme value theory does not require assumptions about data distribution and can infer low-probability areas and determine abnormal data through theoretical results. This single-parameter method can be applicable to stable samples and / or moving samples.

[0061] Among them, in the embodiments of the present disclosure, the changes and distribution of the above performance indicator data are irregular, and the extreme value theory can find the regularity of extreme events. Extreme events have the same distribution but are different from their original distribution. For example, the maximum values ​​of temperature and tide have the same distribution but are different from other data distributions. This distribution is an extreme value distribution, which may specifically include:

[0062]

[0063] Among them, in the embodiment of the present disclosure, all extreme values ​​of normal standard distributions conform to the extreme value distribution, x is the data in the extreme value distribution, and the extreme value coefficient γ depends on the original distribution rule.

[0064] Furthermore, in the disclosed embodiment, the performance indicator data of the core network is relatively complex, and the data curve distribution of the data to be detected cannot be known before the abnormality detection. Based on this, the abnormality detection of the real-time data of the core network based on the extreme value theory can be regarded as a problem of predicting data distribution, so that the abnormal data distribution problem of the core network can be regarded as a process of solving the γ parameter in the above extreme value distribution.

[0065] Among them, in the embodiment of the present disclosure, in extreme value theory, the POT (Peaks Over Threshold) method can be used to solve γ, that is, the time series is converted into a distribution solution for the part exceeding the preset threshold. For example, assuming that the initial abnormal threshold m of the i-th performance indicator is i , when the i-th performance indicator at a certain time point t Exceeds the corresponding initial abnormal threshold m i When , the excess data is retained to form a new data distribution, that is, the part of the extreme value exceeding the threshold satisfies the Pareto distribution:

[0066]

[0067] And, in the embodiment of the present disclosure, the above data distribution satisfies the generalized Pareto distribution. Based on this, based on the above distribution, the threshold calculation formula determined is:

[0068]

[0069] Among them, m i is the initial abnormal threshold of the i-th performance indicator, and q is the threshold The probability of occurrence, N i is the number of data exceeding the initial abnormal threshold in the time series data corresponding to the i-th performance indicator, n i is the number of time series data corresponding to the i-th performance indicator, γ and σ are the variables to be solved, is the target abnormal threshold of the i-th performance indicator.

[0070] Furthermore, in the embodiment of the present disclosure, it is necessary to solve γ and σ in the above threshold calculation formula to determine the target abnormal threshold of each performance indicator. In the embodiment of the present disclosure, the probability distribution of each performance indicator can be obtained by maximum likelihood estimation, and the corresponding γ and σ of each performance indicator can be obtained by log likelihood function.

[0071] And, in the embodiment of the present disclosure, the variable q can be set as needed. For example, assuming that the target abnormality threshold corresponding to the occurrence probability of 0.1 needs to be determined, q=0.1 can be substituted into the threshold calculation formula for calculation.

[0072] Step 102: Acquire real-time data of various performance indicators in the core network.

[0073] In the disclosed embodiment, real-time data of various performance indicators in the core network can be acquired in real time, so as to perform abnormality detection on the core network based on the real-time data.

[0074] Step 103: Based on the real-time data of each performance indicator and the corresponding target abnormality threshold, determine the target performance indicator with abnormality.

[0075] In the disclosed embodiment, after obtaining the real-time data of each performance indicator and the corresponding target abnormal threshold through the above steps, the target performance indicator with abnormality can be determined based on the real-time data of each performance indicator and the corresponding target abnormal threshold.

[0076] Specifically, in the embodiment of the present disclosure, the method for determining the target performance indicator having an abnormality based on the real-time data of each performance indicator and the corresponding target abnormality threshold may include the following steps:

[0077] Step 1031, comparing the real-time data of each performance indicator with the corresponding target abnormal threshold to obtain a comparison result;

[0078] Step 1032: Determine the performance indicator with a comparison result greater than as the target performance indicator with an abnormality.

[0079] In the embodiment of the present disclosure, it is assumed that represents the observed value of the i-th performance indicator at time t, is the target abnormal threshold of the i-th performance indicator, if At this time, the observed value of the i-th performance indicator at time t is greater than the target abnormal threshold of the i-th performance indicator. Determine the observed value of the i-th performance indicator at time t. If it is abnormal, the i-th performance indicator is determined as the target performance indicator with the abnormality.

[0080] Step 104: Based on the target performance indicator, determine the abnormality detection result of the core network through the root cause judgment rule.

[0081] In the disclosed embodiment, after the target performance indicator is obtained through the above steps, the abnormality detection result of the core network can be determined based on the target performance indicator through the root cause judgment rule.

[0082] Specifically, in the embodiment of the present disclosure, the method for determining the abnormality detection result of the core network based on the target performance indicator and the root cause judgment rule may include the following steps:

[0083] Step 1041: Determine the target performance type corresponding to the target performance indicator.

[0084] Step 1042: Determine the abnormal index ratio of the target performance type.

[0085] Step 1043: If the abnormal index proportion of the target performance type is greater than or equal to the preset proportion, the abnormal detection result of the core network is determined to be abnormal, and the cause of the abnormality is determined through the root cause judgment rule; otherwise, the abnormal detection result of the core network is determined to be normal.

[0086] In the embodiment of the present disclosure, the target performance type may include a first performance type, a second performance type, a third performance type, and a fourth performance type. Also, in the embodiment of the present disclosure, the abnormal index ratio of the target performance type may be obtained by dividing the number of target performance indicators with abnormalities in the target performance type by the number of all performance indicators in the target performance type. Specifically, Table 1 is a root cause judgment rule proposed in the embodiment of the present disclosure.

[0087] Table 1

[0088]

[0089] As shown in Table 1, each performance type has corresponding performance indicators and abnormal indicator ratio values.

[0090] Among them, in the embodiment of the present disclosure, after determining the proportion of abnormal indicators of the target performance type through the above steps, if the proportion of abnormal indicators of the target performance type is greater than or equal to the preset proportion, it means that the abnormality triggers the target performance type, then the abnormality detection result of the core network is determined to be abnormal, and the root cause corresponding to the target performance type is determined as the cause of the abnormality; otherwise, the abnormality detection result of the core network is determined to be normal.

[0091] For example, in an embodiment of the present disclosure, assuming that the target performance type is the third performance type, and the preset proportion of the third performance type is 50%, the abnormal indicator proportion of the third performance type is calculated to be 33.3%. At this time, the abnormal indicator proportion of the third performance type is less than the preset proportion, and the abnormal detection result of the core network is determined to be normal.

[0092] Furthermore, in the disclosed embodiment, anomaly detection is performed on the core network through multi-dimensional performance indicators, so that the anomaly detection result is more accurate.

[0093] Furthermore, in the embodiment of the present disclosure, the above method may also include: determining whether to update the target abnormality threshold of the performance indicator based on the real-time data of the performance indicator and the corresponding target abnormality threshold; if it is determined that the target abnormality threshold of the performance indicator is to be updated, redetermining the target abnormality threshold of the performance indicator, and determining the redetermined target abnormality threshold as the target abnormality threshold of the performance indicator.

[0094] Specifically, in an embodiment of the present disclosure, if the real-time data of a performance indicator is less than a corresponding target abnormality threshold, it is determined that the target abnormality threshold of the performance indicator is updated, and the above steps are repeated to redetermine the target abnormality threshold of the performance indicator, and the redetermined target abnormality threshold is determined as the target abnormality threshold of the performance indicator, thereby continuously updating the abnormality detection threshold corresponding to the performance indicator, and further timely discovering abnormal situations of network delay, and performing problem troubleshooting and performance optimization.

[0095] The present disclosure proposes a method for detecting anomalies in a core network, which includes determining at least one performance indicator of the core network, and determining a target anomaly threshold value of each performance indicator based on extreme value theory; obtaining real-time data of each performance indicator in the core network; determining the target performance indicator where an anomaly occurs based on the real-time data of each performance indicator and the corresponding target anomaly threshold value; and determining the anomaly detection result of the core network through a root cause judgment rule based on the target performance indicator. Thus, the present disclosure can determine the target anomaly threshold value of each performance indicator based on extreme value theory, and automatically perform anomaly detection on the core network and obtain anomaly detection results through the real-time data of each performance indicator in the core network and the corresponding target anomaly threshold value, without relying on manual analysis and assuming data distribution, thereby reducing labor costs and improving detection efficiency and the accuracy of anomaly detection results.

[0096] Figure 2 According to some embodiments of the present disclosure, a core network anomaly detection device is shown, such as Figure 2 As shown, the device may include:

[0097] A first determination module 201 is used to determine at least one performance indicator of a core network, and determine a target abnormal threshold value of each performance indicator based on extreme value theory;

[0098] The acquisition module 202 is used to obtain real-time data of various performance indicators in the core network;

[0099] Anomaly detection module 203, used to determine the target performance indicator with abnormality based on the real-time data of each performance indicator and the corresponding target abnormality threshold;

[0100] The second determination module 204 is used to determine the abnormality detection result of the core network based on the target performance indicator and through the root cause judgment rule.

[0101] In the embodiment of the present disclosure, the first determining module 201 is specifically used to:

[0102] Obtain historical data of each performance indicator, and sort the historical data in chronological order to obtain time series data;

[0103] Determine the initial abnormal threshold of each performance indicator based on time series data;

[0104] Based on the extreme value distribution, determine the threshold calculation formula;

[0105] Based on the time series data of each performance indicator and the corresponding initial abnormal threshold, the target abnormal threshold corresponding to each performance indicator is obtained through the threshold calculation formula.

[0106] Optionally, in the embodiment of the present disclosure, the above-mentioned abnormality detection module 203 is specifically used to:

[0107] Compare the real-time data of each performance indicator with the corresponding target abnormal threshold to obtain a comparison result;

[0108] The performance indicator with a comparison result greater than or equal to 0 is determined as the target performance indicator with an abnormality.

[0109] Optionally, in the embodiment of the present disclosure, the second determining module 204 is specifically:

[0110] Determine the target performance type corresponding to the target performance indicator;

[0111] Determine the abnormal indicator ratio of the target performance type;

[0112] If the abnormal index proportion of the target performance type is greater than or equal to the preset proportion value, the abnormal detection result of the core network is determined to be abnormal, and the cause of the abnormality is determined through the root cause judgment rule; otherwise, the abnormal detection result of the core network is determined to be normal.

[0113] Optionally, in the embodiment of the present disclosure, the above device is also used for:

[0114] Based on the real-time data of the performance indicator and the corresponding target abnormality threshold, determine whether to update the target abnormality threshold of the performance indicator;

[0115] If it is determined to update the target abnormality threshold of the performance indicator, the target abnormality threshold of the performance indicator is re-determined, and the re-determined target abnormality threshold is determined as the target abnormality threshold of the performance indicator.

[0116] Optionally, in the embodiment of the present disclosure, the above-mentioned performance indicators include one or more of TCP establishment success rate, TCP establishment average delay, TCP retransmission rate, TCP out-of-order rate, HTTP download rate, HTTP uplink rate, user number fluctuation, traffic fluctuation, registration success rate, PDU session establishment success rate, reference signal received power, uplink signal-to-noise ratio, MR coverage, cell downlink RLC SDU packet loss rate, switching success rate, uplink PRB utilization, and downlink PRB utilization.

[0117] Optionally, in the embodiment of the present disclosure, the above threshold calculation formula includes:

[0118]

[0119] Among them, m i is the initial abnormal threshold of the i-th performance indicator, and q is the threshold The probability of occurrence, is the number of data exceeding the initial abnormal threshold in the time series data corresponding to the i-th performance indicator, n i is the number of time series data corresponding to the i-th performance indicator, γ and σ are the variables to be solved, is the target abnormal threshold of the ith performance indicator.

[0120] In one or more embodiments of the present disclosure, at least one performance indicator of the core network is determined, and the target abnormal threshold of each performance indicator is determined based on the extreme value theory; the real-time data of each performance indicator in the core network is obtained; based on the real-time data of each performance indicator and the corresponding target abnormal threshold, the target performance indicator where the abnormality occurs is determined; based on the target performance indicator, the abnormal detection result of the core network is determined by the root cause judgment rule. Therefore, the present disclosure can determine the target abnormal threshold of each performance indicator based on the extreme value theory, and automatically perform abnormal detection on the core network and obtain abnormal detection results through the real-time data of each performance indicator in the core network and the corresponding target abnormal threshold, without relying on manual analysis and assuming data distribution, reducing labor costs, and improving detection efficiency and the accuracy of abnormal detection results.

[0121] like Figure 3 As shown, the electronic device 300 includes a computing unit 301, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 302 or a computer program loaded from a storage unit 308 into a random access memory (RAM) 303. In the RAM 303, various programs and data required for the operation of the electronic device 300 can also be stored. The computing unit 301, the ROM 302, and the RAM 303 are connected to each other via a bus 304. An input / output (I / O) interface 305 is also connected to the bus 304.

[0122] A number of components in the electronic device 300 are connected to the I / O interface 305, including: an input unit 308, such as a keyboard, a mouse, etc.; an output unit 307, such as various types of displays, speakers, etc.; a storage unit 308, such as a disk, an optical disk, etc.; and a communication unit 309, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 309 allows the electronic device 300 to exchange information / data with other electronic devices through a computer network such as the Internet and / or various telecommunication networks.

[0123] The computing unit 301 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 301 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The computing unit 301 performs the various methods and processes described above, such as the anomaly detection method of the core network. For example, in some embodiments, the anomaly detection method of the core network may be implemented as a computer software program, which is tangibly contained in a machine-readable medium, such as a storage unit 308. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 300 via the ROM 302 and / or the communication unit 309. When the computer program is loaded into the RAM 303 and executed by the computing unit 301, one or more steps of the anomaly detection method of the core network described above may be performed. Alternatively, in other embodiments, the computing unit 301 may be configured to perform the anomaly detection method of the core network in any other appropriate manner (e.g., by means of firmware).

[0124] Various embodiments of the devices and techniques described above herein can be implemented in digital electronic circuit devices, integrated circuit devices, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), devices on a chip (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable device including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage device, at least one input device, and at least one output device, and transmit data and instructions to the storage device, the at least one input device, and the at least one output device.

[0125] The program code for implementing the method of the present disclosure may be written in any combination of one or more programming languages. These program codes may be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that the program code, when executed by the processor or controller, enables the functions / operations specified in the flow chart and / or block diagram to be implemented. The program code may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0126] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution device, device, or electronic device. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor devices, devices, or electronic devices, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage electronic device, a magnetic storage electronic device, or any suitable combination of the foregoing.

[0127] To provide interaction with a user, the devices and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0128] The apparatus and techniques described herein may be implemented in a computing device including backend components (e.g., as a data server), or a computing device including middleware components (e.g., an application server), or a computing device including frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the apparatus and techniques described herein), or a computing device including any combination of such backend components, middleware components, or frontend components. The components of the apparatus may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), the Internet, and a blockchain network.

[0129] A computer device may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The relationship between the client and the server is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or a cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services ("Virtual Private Server", or "VPS" for short). The server may also be a server of a distributed device, or a server combined with a blockchain.

[0130] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in this disclosure can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solutions disclosed in this disclosure can be achieved, and this document does not limit this.

[0131] The above specific implementations do not constitute a limitation on the protection scope of the present disclosure. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present disclosure shall be included in the protection scope of the present disclosure.

Claims

1. A core network anomaly detection method, characterized in that: The method comprises: Determine at least one performance indicator of the core network, and determine a target abnormal threshold value of each of the performance indicators based on extreme value theory; Obtaining real-time data of each of the performance indicators in the core network; Determine the target performance indicator with abnormality based on the real-time data of each performance indicator and the corresponding target abnormality threshold; Based on the target performance indicator, an abnormality detection result of the core network is determined through a root cause judgment rule.

2. The method according to claim 1, characterized in that Determining the target abnormal threshold of each performance indicator based on extreme value theory includes: Acquire historical data of each of the performance indicators, and sort the historical data based on time sequence to obtain time series data; Determine an initial abnormal threshold value of each of the performance indicators based on the time series data; Based on the extreme value distribution, determine the threshold calculation formula; Based on the time series data of each of the performance indicators and the corresponding initial abnormal threshold, the target abnormal threshold corresponding to each of the performance indicators is obtained by the threshold calculation formula.

3. The method according to claim 1, characterized in that Determining the target performance indicator having an abnormality based on the real-time data of each performance indicator and the corresponding target abnormality threshold includes: Compare the real-time data of each performance indicator with the corresponding target abnormality threshold to obtain a comparison result; The performance indicator for which the comparison result is greater than is determined as the target performance indicator in which the abnormality occurs.

4. The method according to claim 1, characterized in that The determining, based on the target performance indicator, the abnormality detection result of the core network by a root cause judgment rule includes: Determining a target performance type corresponding to the target performance indicator; Determine the abnormal index ratio of the target performance type; If the abnormal index proportion of the target performance type is greater than or equal to the preset proportion value, the abnormal detection result of the core network is determined to be abnormal, and the cause of the abnormality is determined by the root cause judgment rule; otherwise, the abnormal detection result of the core network is determined to be normal.

5. The method according to claim 1, characterized in that The method further comprises: Based on the real-time data of the performance indicator and the corresponding target abnormality threshold, determining whether to update the target abnormality threshold of the performance indicator; If it is determined to update the target abnormality threshold of the performance indicator, the target abnormality threshold of the performance indicator is re-determined, and the re-determined target abnormality threshold is determined as the target abnormality threshold of the performance indicator.

6. The method according to any one of claims 1 to 5, characterized in that: The performance indicators include one or more of the transmission control protocol TCP establishment success rate, TCP establishment average delay, TCP retransmission rate, TCP disorder rate, hypertext transfer protocol HTTP download rate, HTTP uplink rate, user number fluctuation, traffic fluctuation, registration success rate, PDU session establishment success rate, reference signal received power, uplink signal-to-noise ratio, measurement report MR coverage, cell downlink RLC SDU packet loss rate, switching success rate, uplink physical resource fast PRB utilization, and downlink PRB utilization.

7. The method according to claim 2, characterized in that The threshold calculation formula includes: Among them, m i is the initial abnormal threshold of the i-th performance indicator, and q is the threshold The probability of occurrence, is the number of data exceeding the initial abnormal threshold in the time series data corresponding to the i-th performance indicator, n i is the number of time series data corresponding to the i-th performance indicator, γ and σ are the variables to be solved, is the target abnormal threshold of the i-th performance indicator.

8. A core network anomaly detection device, characterized in that: The device comprises: A first determination module is used to determine at least one performance indicator of a core network, and determine a target abnormal threshold value of each performance indicator based on extreme value theory; An acquisition module, used to acquire real-time data of each of the performance indicators in the core network; An anomaly detection module, used to determine the target performance indicator with an abnormality based on the real-time data of each performance indicator and the corresponding target anomaly threshold; The second determination module is used to determine the abnormality detection result of the core network based on the target performance indicator and through a root cause judgment rule.

9. An electronic device, characterized in that: include: at least one processor; as well as a memory in communication with the at least one processor, wherein: The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method according to any one of claims 1 to 7.

10. A non-transitory computer-readable storage medium, wherein the computer storage medium stores computer-executable instructions; after the computer-executable instructions are executed by a processor, the method according to any one of claims 1 to 7 can be implemented.

Images