Hidden danger identification method and device and medium

Abstract

The invention provides a hidden danger identification method and device and a medium, and relates to the technical field of networks, and the method comprises the steps: obtaining first actual index data of network equipment in a first time period; inputting the first actual index data into a time sequence prediction model to obtain multiple groups of first prediction index data grouped by the network equipment according to a time sequence in a second time period; inputting the plurality of groups of first prediction index data into an anomaly detection model to obtain a predicted anomaly frequency when the network equipment is abnormal in the second time period; and according to the network quality assurance grade and the predicted abnormal frequency of the network equipment in the second time period, judging the hidden danger grade of the network equipment in the second time period. According to multiple groups of network index data predicted according to the time sequence, the predicted abnormality occurrence frequency is obtained, and the hidden danger level of the network equipment is judged in combination with the network quality assurance level of the network equipment, so that accurate troubleshooting can be realized.

Description

Technical Field

[0001] The present disclosure at least relates to the field of network technology, and in particular to a hidden danger identification method, a hidden danger identification device, and a computer-readable storage medium. Background Art

[0002] Predicting possible future faults in the network in advance improves the predictability of fault diagnosis, helps to discover potential faults in a timely manner, and make fault handling deployments in advance.

[0003] However, if all predicted fault hazards are troubleshooted, the operation and maintenance personnel may be overloaded with work and fail to focus on protecting the network.

[0004] Therefore, it is necessary to more accurately locate and predict network fault hazards and develop differentiated fault hazard troubleshooting plans. Summary of the invention

[0005] The technical problem to be solved by the present disclosure is to provide a hidden danger identification method, a hidden danger identification device and a computer-readable storage medium in view of the above-mentioned shortcomings, so as to solve the problem of how to more accurately locate the network failure hidden dangers to be checked.

[0006] In a first aspect, the present disclosure provides a hidden danger identification method, the method comprising:

[0007] Acquire first actual indicator data of the network device in a first time period;

[0008] Inputting the first actual indicator data into the time series prediction model to obtain multiple groups of first prediction indicator data of the network device grouped according to the time series in the second time period;

[0009] Inputting the plurality of sets of first prediction indicator data into an anomaly detection model to obtain a predicted anomaly frequency of anomalies occurring in the network device during a second period of time;

[0010] The hidden danger level of the network equipment in the second time period is determined based on the network quality assurance level and the predicted abnormal frequency of the network equipment in the second time period.

[0011] Further, wherein:

[0012] Network equipment specifically includes data communication equipment for business dedicated lines in the network;

[0013] The indicator data specifically includes: CPU utilization, port bandwidth utilization, port upstream traffic, port downstream traffic, number of error packets, received optical power and emitted optical power.

[0014] Furthermore, before inputting the first actual indicator data into the time series prediction model, the method further includes:

[0015] Acquire second actual indicator data of the network device in a third time period;

[0016] Using a sliding window to obtain third actual indicator data within a fourth time period and fourth actual indicator data within a fifth time period from the second actual indicator data;

[0017] The third actual indicator data and the fourth actual indicator data are used to train a long short-term memory network LSTM model to obtain a time series prediction model.

[0018] Furthermore, the third actual indicator data and the fourth actual indicator data are used to train the LSTM model to obtain a time series prediction model, specifically including:

[0019] Input the third actual indicator data into the LSTM model to obtain the second prediction indicator data of the network device in the fifth period;

[0020] Calculate the residual between the fourth actual indicator data and the second predicted indicator data;

[0021] In response to the residual being greater than the first threshold, adjusting the parameters of the LSTM model, and repeating the above steps;

[0022] In response to the residual being less than the first threshold, the LSTM model of obtaining the final parameters is a time series prediction model.

[0023] Further, multiple groups of first prediction indicator data are input into the anomaly detection model to obtain the predicted anomaly frequency of the network device anomaly occurring in the second time period, specifically including:

[0024] Standardizing each set of first prediction indicator data to obtain multiple sets of first standardized indicator data;

[0025] Multiple groups of first standardized indicator data are input into the ellipse formula in time sequence to obtain the number and continuity of the ellipse formula calculation results that are not located inside the ellipse in the second time period.

[0026] Further, wherein:

[0027] The ellipse formula is:

[0028]

[0029] In the formula, x is the first standardized index data of the input, is the center of the ellipse, T is the matrix transpose, u1 is the first principal component parameter, u2 is the second principal component parameter, a is the radius of the major axis of the ellipse, and b is the radius of the minor axis of the ellipse;

[0030] The inside of the ellipse refers to the range where the ellipse formula is less than or equal to 1.

[0031] Furthermore, before inputting the first prediction indicator data into the anomaly detection model, the method further includes:

[0032] Obtaining a first amount of normal indicator data;

[0033] Standardizing the normal indicator data to obtain second standardized indicator data;

[0034] Obtaining the mean of the second standardized indicator data;

[0035] Obtaining a scatter matrix of second standardized indicator data;

[0036] Get the eigenvalues ​​and eigenvectors of the scatter matrix;

[0037] The center of the ellipse is obtained according to the mean of the second standardized index data, the major and minor axis radii of the ellipse equation are obtained according to the first and second eigenvalues, and the principal component parameters of the ellipse equation are obtained according to the first and second eigenvectors.

[0038] Further, judging the hidden danger level of the network device in the second period according to the network quality assurance level and the predicted abnormal frequency of the network device in the second period includes:

[0039] Obtain networking dimension information, spatial dimension information, and user dimension information of the service dedicated line where the network device is located, and obtain the network quality assurance level of the network device in the second time period according to the networking dimension information, spatial dimension information, and user dimension information;

[0040] Obtain the frequency of potential hazards to be processed corresponding to the network quality assurance level of the network device in the second time period, and in response to the predicted abnormal frequency being greater than or equal to the corresponding frequency of potential hazards to be processed, determine that the network device is a potential hazard to be processed and dispatch it for processing.

[0041] In a second aspect, the present disclosure provides a hidden danger identification device, the device comprising:

[0042] An acquisition module, used to acquire first actual indicator data of the network device in a first time period;

[0043] A prediction module, connected to the acquisition module, for inputting the first actual indicator data into the time series prediction model to obtain a plurality of groups of first prediction indicator data of the network device grouped according to the time series in the second time period;

[0044] A detection module, connected to the prediction module, for inputting the plurality of sets of first prediction indicator data into an anomaly detection model to obtain a predicted anomaly frequency of anomalies occurring in the network device within a second time period;

[0045] The judgment module is connected to the detection module and is used to judge the hidden danger level of the network equipment in the second time period according to the network quality assurance level and the predicted abnormal frequency of the network equipment in the second time period.

[0046] In a third aspect, the present disclosure provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, the hidden danger identification method as described above is implemented.

[0047] The present disclosure provides a hidden danger identification method, a hidden danger identification device and a computer-readable storage medium, which predict multiple groups of network indicator data in time series, obtain predicted abnormal occurrence frequencies based on the multiple groups of network indicator data, and judge the hidden danger level of the network equipment based on the predicted abnormal occurrence frequencies combined with the network quality assurance level of the network equipment. The hidden danger level can be used as a basis for fault hidden danger troubleshooting, thereby achieving accurate troubleshooting and improving fault handling efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Figure 1 is a flow chart of a hidden danger identification method according to an embodiment of the present disclosure;

[0049] Figure 2 is a flow chart of another hidden danger identification method according to an embodiment of the present disclosure;

[0050] Figure 3 is a flow chart of another hidden danger identification method according to an embodiment of the present disclosure;

[0051] Figure 4 It is a structural schematic diagram of a hidden danger identification device according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0052] In order to enable those skilled in the art to better understand the technical solution of the present disclosure, the embodiments of the present disclosure will be further described in detail below with reference to the accompanying drawings.

[0053] It should be understood that the specific embodiments and drawings described herein are only used to explain the present disclosure rather than to limit the present disclosure.

[0054] It can be understood that, in the absence of conflict, the various embodiments of the present disclosure and the various features in the embodiments can be combined with each other.

[0055] It can be understood that, for the convenience of description, the drawings of the present disclosure only show parts related to the present disclosure, while parts irrelevant to the present disclosure are not shown in the drawings.

[0056] It can be understood that each unit and module involved in the embodiments of the present disclosure may correspond to only one entity structure, or may be composed of multiple entity structures, or multiple units and modules may be integrated into one entity structure.

[0057] It will be understood that, in the absence of conflict, the functions and steps marked in the flowcharts and block diagrams of the present disclosure may occur in an order different from that marked in the drawings.

[0058] It is understood that the flowcharts and block diagrams of the present disclosure illustrate the possible architectures, functions, and operations of the systems, devices, equipment, and methods according to the various embodiments of the present disclosure. Each box in the flowchart or block diagram may represent a unit, module, program segment, or code, which contains executable instructions for implementing the specified functions. Moreover, each box or combination of boxes in the block diagram and flowchart may be implemented by a hardware-based system that implements the specified functions, or may be implemented by a combination of hardware and computer instructions.

[0059] It can be understood that the units and modules involved in the embodiments of the present disclosure can be implemented by software or hardware, for example, the units and modules can be located in a processor.

[0060] In order to facilitate the understanding of the present disclosure, the main inventive concept of the present disclosure is firstly explained in conjunction with a specific application.

[0061] In the past two years, new technologies of operators have developed rapidly, the IT (Internet Technology) industry has developed rapidly, and the demand for dedicated bandwidth has continued to grow rapidly. In order to improve the work efficiency of corporate staff and enhance the security of corporate network information, more and more traditional enterprises have rented the basic network resources of telecommunications operators to build their own unique internal corporate networks.

[0062] According to statistics, for full-service communications operators, the revenue from leased-line services for large customers has been increasing year by year, and leased-line customers have an increasingly strong perceived demand for network quality.

[0063] To maintain good customer satisfaction, operators can monitor in real time the data related to the network services provided by the network service system to users, send alarms to operation and maintenance personnel when the data is abnormal, and implement fault diagnosis for customer services.

[0064] The current fault diagnosis technology may have the following problems:

[0065] Some solutions only use alarm data to determine whether a fault has occurred. They only consider the current abnormal status data and do not explore the temporal correlation between various indicator data. They are unable to identify potential fault hazards and cannot achieve predictive fault diagnosis.

[0066] In another part of the solutions, the fault prediction results are single and cannot reflect the impact scope and urgency of the fault in real time and dynamically, making it difficult for operation and maintenance personnel to prioritize the faults with large impact scope and more urgent, resulting in low fault handling efficiency, which in turn affects customer experience.

[0067] Moreover, when the dimension of the monitored indicator is large, the computational complexity of detecting indicator anomalies is large, resulting in low detection efficiency.

[0068] In view of the above-mentioned problems, the present disclosure provides a hidden danger identification method, which mainly includes:

[0069] Combining ellipse fitting with LSTM (Long Short-Term Memory) neural network for warning hidden danger identification and prediction, using ellipse fitting method for LSTM prediction value, projecting multidimensional data onto a two-dimensional plane for ellipse fitting and indicator anomaly detection, can detect more complex anomalies and improve the accuracy and robustness of anomaly detection;

[0070] The alarm hidden danger identification prediction results are then correlated and aggregated with the dedicated line resource indicators and alarm dimensions to achieve dynamic prediction and self-adjustment of the dedicated line security level. This can dynamically reflect the impact scope and urgency of the fault in real time, which is conducive to dispatching orders in order of different levels of importance, thereby improving the efficiency of fault handling and achieving accurate troubleshooting.

[0071] Specifically, the hidden danger identification method can also be called a customer service-oriented fault diagnosis and self-adjustment method, which implements fault diagnosis for customer leased line services and self-adjusts the priority level of fault processing according to customer leased line services.

[0072] Embodiment 1:

[0073] like Figure 1 As shown, the present disclosure provides a hidden danger identification method, the method comprising:

[0074] S1. Obtaining first actual indicator data of a network device in a first period of time;

[0075] S2. Inputting the first actual indicator data into a time series prediction model to obtain a plurality of groups of first prediction indicator data of the network devices grouped according to the time series in a second time period;

[0076] S3, inputting the multiple groups of first prediction indicator data into the anomaly detection model to obtain the predicted anomaly frequency of the network device anomaly occurring in the second time period;

[0077] S4. Determine the hidden danger level of the network equipment in the second period according to the network quality assurance level and the predicted abnormal frequency of the network equipment in the second period.

[0078] In this embodiment, multiple groups of network indicator data are predicted in time series, and the predicted frequency of abnormal occurrence is obtained based on the multiple groups of network indicator data. The hidden danger level of the network equipment is judged based on the predicted frequency of abnormal occurrence and the network quality assurance level of the network equipment. The hidden danger level can be used as a basis for fault hidden danger troubleshooting.

[0079] For example, collect the 7-dimensional actual indicator data of the network equipment in the past month, predict the average predicted indicator data every 30 minutes in the next three days, and each group of average predicted indicator data is also a 7-dimensional vector. Analyze whether there is an abnormality in the average predicted indicator data, and obtain the frequency of occurrence of abnormal data. According to the frequency and the network quality assurance level of the network equipment in the next three days, determine whether the fault hidden danger needs to be dealt with immediately. For example, if it is predicted that two network abnormal indicators will appear consecutively on the third day, it means that the network equipment may be in an abnormal state for 1 hour on the third day. Combined with the importance of the network equipment on the third day, if the user holds an important event in the next three days and needs to ensure communication, then the fault hidden danger level is high and needs to be checked in time.

[0080] It can be understood that the above description that each set of data is a 7-dimensional vector is only a specific example, and according to actual conditions, each set of data can be any dimension greater than or equal to 1.

[0081] The above method integrates the time series prediction capability and anomaly detection capability. It can mine the correlation between data, automatically discover the change pattern behind the data, effectively identify anomalies according to the predicted frequency, and then associate and aggregate them with the network quality assurance level of the network equipment in the second time period. It can dynamically reflect the impact scope and urgency of the fault in real time, and realize dynamic prediction and self-adjustment of the dedicated line assurance level, which is conducive to troubleshooting and dispatching according to the importance of different levels, thereby improving the efficiency of fault handling and realizing accurate troubleshooting.

[0082] In one embodiment, wherein:

[0083] Network equipment specifically includes data communication equipment for business dedicated lines in the network;

[0084] The indicator data specifically includes: CPU utilization, port bandwidth utilization, port upstream traffic, port downstream traffic, number of error packets, received optical power and emitted optical power.

[0085] In this embodiment, the operator's leased lines are mainly divided into transmission and Internet dedicated lines for large government and enterprise customers, and broadband dedicated lines for public customers. In order to improve the perception of dedicated line services, it is necessary to build a more accurate diagnosis mechanism and method. To achieve the above technical purpose, this embodiment uses elliptical fitting combined with LSTM prediction to identify hidden dangers and generate abnormal indicators. If the abnormal indicator appears frequently in a short period of time, or an explicit alarm appears in the network at the same time, the abnormal indicator will eventually be upgraded to a fault, and the network fault will be dispatched for repair. Taking the identification of network hidden dangers of data communication equipment as an example, the full amount of operation indicators of all dedicated line business data communication equipment are directly managed through the SNMP (Simple Network Management Protocol) protocol, including 7 categories such as CPU (Central Processing Unit) utilization, port bandwidth utilization, port traffic, error packets, and transmit and receive optical power. Since data communication devices carry different types of services or different port service models of the same device, the judgment criteria of port-level performance indicators are also different. Therefore, the data indicators use 7 categories: device CPU utilization, port bandwidth utilization, port upstream traffic, port downstream traffic, number of error packets, received optical power, and luminous power. For example, statistics are performed based on the one-year historical data of each indicator, and then the LSTM neural network algorithm is used to output data forecasts for the next week using at least 3 months of historical data. The data granularity is 15 minutes, 96 data per day, and the number of predicted future data is 96*7. The LSTM prediction value uses the ellipse fitting method for anomaly detection. If the absolute value of its error is within a certain threshold range, it means that the value is normal, otherwise it is abnormal.

[0086] In one embodiment, before inputting the first actual indicator data into the time series prediction model, the method further includes:

[0087] Acquire second actual indicator data of the network device in a third time period;

[0088] Using a sliding window to obtain third actual indicator data within a fourth time period and fourth actual indicator data within a fifth time period from the second actual indicator data;

[0089] The third actual indicator data and the fourth actual indicator data are used to train a long short-term memory network LSTM model to obtain a time series prediction model.

[0090] In this embodiment, the first time period is a time period from the past to the present of a first specified time length; the second time period is a time period from the present to the future of a second specified time length; the fourth time period can be equal to the first specified time length, and the fifth time period can be equal to the second specified time length. Steps S1-S3 are warning hidden danger identification predictions combined with ellipse fitting and LSTM neural network, and the specific steps can be as follows Figure 2 As shown, including:

[0091] 1.1) Historical data preprocessing: Interpolation historical data preprocessing and hidden danger set identification data preprocessing are used to process the missing data values. Based on the empirical value evaluation, the historical data mean method at the same time point is used to make up the data. That is, the CPU utilization, port bandwidth utilization and other data are used to use the average value of the value to check and fill in the missing values, so as to ensure the integrity of the historical data before the LSTM algorithm is processed and ensure the relatively high quality of the data.

[0092] 1.2) LSTM prediction: Use the historical data organized in step 1.1) to predict future data values. For example, use at least 3 months of historical data to predict the data for the next week through the LSTM neural network algorithm, with a granularity of 15 minutes, and predict 24*60min / 15min=96 data points per day.

[0093] In one implementation, the LSTM model is trained using the third actual indicator data and the fourth actual indicator data to obtain a time series prediction model, specifically including:

[0094] Input the third actual indicator data into the LSTM model to obtain the second prediction indicator data of the network device in the fifth period;

[0095] Calculate the residual between the fourth actual indicator data and the second predicted indicator data;

[0096] In response to the residual being greater than the first threshold, adjusting the parameters of the LSTM model, and repeating the above steps;

[0097] In response to the residual being less than the first threshold, the LSTM model of obtaining the final parameters is a time series prediction model.

[0098] In this embodiment, the method also includes step 1.3) LSTM model training process: the premise of using LSTM prediction is that there needs to be a trained LSTM prediction model, that is, a time series prediction model. The model can be obtained by training based on indicator data of a longer historical time, and a sliding time period is set. The time period can be a fixed time period or a sliding window that is automatically adjusted according to the alarm frequency. The sliding window is used to obtain N continuous L-dimensional data samples {x1, x2, ..., xN}, and the data samples are input into the model for training. The difference between the LSTM predicted value and the true value, let the LSTM predicted value at time t be y^(t), and the true observed value be y(t), then the residual e(t) can be calculated as: e(t) = y(t)-y^(t), and a residual time series {e(t)} is obtained. {e(t)} is standardized to make its mean 0 and standard deviation 1: e'(t) = (e(t)-μ) / σ, where μ is the residual mean and σ is the residual standard deviation. The model training effect is confirmed based on the standardized residual. When the training end condition is met, the time series prediction model is obtained.

[0099] In one implementation, multiple sets of first prediction indicator data are input into an anomaly detection model to obtain a predicted anomaly frequency of anomalies occurring in a network device during a second period, specifically including:

[0100] Standardizing each set of first prediction indicator data to obtain multiple sets of first standardized indicator data;

[0101] Inputting a plurality of sets of first standardized index data into the ellipse formula in time sequence to obtain a calculation result of the first ellipse formula that is not located inside the ellipse in the second time period;

[0102] Gets the number and persistence of the first ellipse equation calculation results.

[0103] In this embodiment, the anomaly detection model outputs predicted anomaly indicators based on ellipse fitting, and obtains the predicted anomaly frequency of the network device occurring anomalies in the second time period based on the anomaly indicators. The ellipse fitting first needs to obtain standardized 7-dimensional data to make each dimension equally weighted, and then perform principal component analysis (PCA) to select the two principal components with the highest contribution rate as the major and minor axis direction data of the ellipse, effectively reducing the 7-dimensional data to two dimensions, and performing ellipse fitting on the two-dimensional plane to achieve anomaly detection, which can well summarize the overall distribution characteristics of multidimensional data and effectively identify abnormal points.

[0104] The benefits of LSTM+ellipse fitting are: by constructing a multidimensional vector, the dynamic characteristics of the sequence are retained; using ellipse fitting to automatically discover the main change pattern of the sequence, there is no need to manually set the threshold, and the algorithm adaptively determines the abnormal boundary. When using this method for anomaly detection, it is necessary to: select a reasonable window length T so that the vector can better retain the dynamic characteristics of the sequence; set the corresponding fitting data volume N according to the accuracy and timeliness requirements of anomaly detection. This method integrates the time series prediction ability of LSTM and the anomaly detection ability of ellipse fitting, and can detect more complex anomalies than simple threshold methods, improving the accuracy and robustness of anomaly detection.

[0105] In one embodiment, wherein:

[0106] The ellipse formula is:

[0107]

[0108] In the formula, x is the first standardized index data of the input, is the center of the ellipse, T is the matrix transpose, u1 is the first principal component parameter, u2 is the second principal component parameter, a is the radius of the major axis of the ellipse, and b is the radius of the minor axis of the ellipse;

[0109] The inside of the ellipse refers to the range where the ellipse formula is less than or equal to 1.

[0110] In this embodiment, the number and continuity of the ellipse formula calculation results that are not located inside the ellipse in the second time period are obtained, specifically including: obtaining the number of ellipse formula calculation results that appear continuously in the second time period in a time sequence and are greater than 1; or, obtaining the number of points that appear continuously in the second time period in a time sequence and are located outside the ellipse figure where the ellipse formula is equal to 1. That is, the calculation results of the first ellipse formula can be displayed using both formula and graphic methods. For example: for any new data point, after projecting it onto a two-dimensional plane, substitute it into the ellipse equation, and determine whether it is an abnormal point based on the result value. If the result value is greater than 1, it is an abnormal point, otherwise it is a normal point; or, based on the indicator data of the real-time operation of the network, substitute it into the ellipse equation to determine whether it is an abnormal point. If it is located inside the ellipse, it means that it is within the normal range, and it is a normal value; if it is located outside the ellipse, it is determined to be abnormal, which is an abnormal indicator value.

[0111] In one embodiment, before inputting the first prediction indicator data into the anomaly detection model, the method further includes:

[0112] Obtaining a first amount of normal indicator data;

[0113] Standardizing the normal indicator data to obtain second standardized indicator data;

[0114] Obtaining the mean of the second standardized indicator data;

[0115] Obtaining a scatter matrix of second standardized indicator data;

[0116] Get the eigenvalues ​​and eigenvectors of the scatter matrix;

[0117] The center of the ellipse is obtained according to the mean of the second standardized index data, the major and minor axis radii of the ellipse equation are obtained according to the first and second eigenvalues, and the principal component parameters of the ellipse equation are obtained according to the first and second eigenvectors.

[0118] In this embodiment, 7 types of indicator data representing the network operation status are used: CPU utilization of the device, port bandwidth utilization, port upstream traffic, port downstream traffic, number of error packets, received optical power, and luminous power. Each type of indicator is used as a dimension, which is abstracted into a given 7-dimensional data. Principal component analysis (PCA) is used to reduce the dimension to a two-dimensional plane, and then ellipse fitting is performed on the two-dimensional plane. The specific steps of the ellipse fitting algorithm are as follows:

[0119] 2.1) Data standardization: Since the numerical range of each indicator may vary greatly, in order to avoid some indicators from having too much influence on the results, the original data needs to be standardized first so that their mean is 0 and the standard deviation is 1. The standardization formula is as follows:

[0120]

[0121] 2.2) Principal Component Analysis: Perform PCA decomposition on the standardized data to obtain seven principal components and their respective contribution rates. Select the two principal components with the highest contribution rates, project the original seven-dimensional data onto these two principal components, and obtain two-dimensional data points, including:

[0122] Calculate the scatter matrix (covariance matrix) of the data points:

[0123]

[0124] Where xi is the i-th data point and N is the total number of data points;

[0125] Perform eigenvalue decomposition on the scatter matrix:

[0126] S=UΛU T

[0127] Among them, U is the eigenvector matrix, Λ is the diagonal matrix;

[0128] In component analysis, the contribution rate is usually calculated by the eigenvalue, that is, the value in the diagonal matrix. The eigenvalue represents the variance of each principal component, and the contribution rate = a certain eigenvalue / the sum of all eigenvalues.

[0129] For example, suppose we get 7 eigenvalues: 100, 80, 30, 20, 10, 5, 2; the contribution rates are 40.49%, 32.39%, 12.15%, 8.10%, 4.05%, 2.02%, 0.81% respectively; the contribution rate of the first two principal components has reached 72.88% in total, which can explain most of the data variation. The information of each dimension is compressed into the first two principal components during the dimensionality reduction process. The contribution rate of the remaining components is relatively small, and the amount of information they occupy in the data after dimensionality reduction is also reduced accordingly.

[0130] 2.3) For the data points mapped to the two-dimensional plane, use the following method to fit the ellipse:

[0131] Calculate the parameters of the ellipse: Assume that λ1 and λ2 are the first two eigenvalues ​​in the diagonal matrix Λ, and u1 and u2 are the corresponding eigenvectors. Then the center of the ellipse is the data mean xˉ, and the major and minor semi-axes are and Where k is a factor that determines the size of the ellipse, usually 2-3, the semi-axis direction is specified by the eigenvectors u1 and u2, and the ellipse equation is:

[0132]

[0133] For the 7 indicator data, we can imagine it as a 7-dimensional space, where each dimension represents an indicator. In this 7-dimensional space, we can find an ellipsoid that best summarizes the data distribution characteristics. The scatter matrix can be imagined as the discreteness of the data points in 7 dimensions. The fluctuation range of the indicator values ​​in the dimensions with large dispersion is large, and the fluctuation range of the indicator values ​​in the dimensions with small dispersion is small. By performing eigenvalue decomposition on the scatter matrix, we can find the 7 "main change directions" presented by the data. Each direction is actually a combination of the 7 original indicators and can be regarded as a new "comprehensive indicator". The size of the eigenvalue reflects the degree of dispersion of the data along the corresponding direction. The larger the value, the larger the fluctuation range of this "comprehensive indicator". The semi-axis direction of the ellipse is the 7 "main change directions". The length of the semi-axis is determined according to the degree of dispersion of the corresponding "comprehensive indicator" (that is, the size of the eigenvalue). The radius corresponding to the "comprehensive indicator" with large dispersion is long, and the radius with small dispersion is short. After PCA dimensionality reduction, the two principal components with the highest contribution rate are retained. These two principal components become the basis of the new two-dimensional space. In this new two-dimensional space, an ellipse is fitted. The two semi-axis directions of the ellipse correspond to the two principal components, and the length of the semi-axis is proportional to the size of the corresponding eigenvalue. The radius of the final fitted ellipse reflects the discreteness of the data in different "comprehensive indicator" directions. The data points inside this ellipse are considered normal, and the points outside are judged as abnormal points. The key benefit of this method is that by reasonably combining the seven original indicators, the main change patterns behind the data are automatically discovered, so that the characteristics of high-dimensional data are effectively reflected in the geometric shape, thereby simplifying the complexity of anomaly detection.

[0134] In one implementation, judging the hidden danger level of the network device in the second time period according to the network quality assurance level and the predicted abnormal frequency of the network device in the second time period specifically includes:

[0135] Obtain networking dimension information, spatial dimension information, and user dimension information of the service dedicated line where the network device is located, and obtain the network quality assurance level of the network device in the second time period according to the networking dimension information, spatial dimension information, and user dimension information;

[0136] Obtain the frequency of potential hazards to be processed corresponding to the network quality assurance level of the network device in the second time period, and in response to the predicted abnormal frequency being greater than or equal to the corresponding frequency of potential hazards to be processed, determine that the network device is a potential hazard to be processed and dispatch it for processing.

[0137] In this embodiment, if Figure 3 As shown in the figure, the prediction results of network anomaly indicators are combined with dedicated line resource indicators and alarm dimensions to identify hidden dangers and automatically adjust the fault level.

[0138] pass Figure 2The steps can accurately detect the anomalies of the dedicated line network. In the actual operation and maintenance guarantee process, since there are hundreds of thousands of dedicated lines in the entire network, the predicted anomaly indicators generated at the same time will be as high as hundreds of thousands. It is impossible for all of these anomaly indicators to be upgraded to fault tickets that need to be repaired. Therefore, the system needs to combine other indicators of the user's dedicated line to perform data correlation convergence again, so as to upgrade and adjust the dedicated line faults that are of concern, and ensure that the professional faults of key customers can be discovered and upgraded as soon as possible.

[0139] The user dedicated line resource indicators include information in three dimensions: leased line networking characteristics, leased line resource space, and user daily use, in order to build a user dedicated line level model and determine the network quality assurance level. This indicator needs to be provided by the network resource system.

[0140] Based on the dimension of leased line networking characteristics, it mainly refers to the basic information of leased lines, including the type of leased line service, whether the leased line is primary or backup, and the name of the leased line customer. Among them, the types of leased line services include: transmission, Internet, WLAN (Wireless Local Area Network) shared Internet and other services; the primary and backup information values ​​of the services include: whether the dedicated lines are backup for each other, the primary and backup relationship, whether the backup mode is 1:1 or N:1, and the name of the leased line customer.

[0141] Based on the resource space association dimension: mainly refers to the physical space address information of each routing node of the leased line. The system can automatically find the spatial overlap information of multiple dedicated line devices of the same leased line customer, and extract the actual physical address of the customer's leased line business terminal equipment, routing equipment and its equipment, room and other physical space information, physical address attribution type (module station, customer access point, sports venue, conference venue, railway station, etc.), physical address security level (such as the attribution type of the physical address, according to the operation and maintenance requirements, provide A (high), B (medium), C (low) different levels of security levels, such as the security level of the conference venue during important meetings is A) and other spatial dimension attribute indicators.

[0142] Based on the user's daily usage dimension: extract customer usage habit characteristics, such as customer's get off work and commuting time, customer's important guarantee start and end time, customer's dedicated line fixed rate range and other indicators, customer leased line SLA (Service Level Agreement) indicators.

[0143] According to the data of the three dimensional indicators provided by the resource system, the dedicated line security level is dynamically predicted, and the network quality level of the dedicated line is judged in real time according to the weighted sum attribute value. The level classification is arranged according to the value order. The quality and safety level of the network is divided into different network quality level functions. The higher the network quality and safety level, the higher the required network quality reliability. If a fault hidden danger occurs, it will be upgraded and dispatched immediately after identification; if the network quality level is low, it means that the reliability of the network dedicated line is low, and the fault dispatch priority is low. The network level parameter evaluation criteria and level result examples are shown in Table 1:

[0144] Table 1 Example of dedicated line security level

[0145]

[0146] In the hidden danger identification process, the alarm hidden danger set is associated with the dedicated line security level to complete the self-adjustment of the fault level. The multi-dimensional indicators are associated with different levels of faults through the following steps to achieve self-adjustment of the fault level. Specifically, based on the dedicated line network quality level and the alarm hidden danger identification result set, the abnormal data set results of the alarm hidden danger identification are used as the abnormal indicators of the fault hidden danger, and the alarm information in the network alarm information database is traversed using the sliding time period. The abnormal indicator information identified each time is associated and aggregated with the key indicators of the equipment monitoring to obtain the associated transaction set. In each sliding time period, according to the determined dedicated line security level, the frequency of performance abnormality figures within a certain period (such as 15 minutes) is dynamically defined, and the performance that meets the frequency threshold is derived into an invisible fault; if an abnormal data collection point appears within 15 minutes during the security time of a customer with a first-level network quality level, the invisible fault is automatically adjusted to a high-level fault for early warning processing; if the network performance indicator of a customer with a third-level network quality level exceeds 4 abnormal data within 1 hour after get off work, it is judged as a continuous invisible fault, and the fault is upgraded and processed for early warning.

[0147] In summary, this embodiment mainly has the following beneficial effects:

[0148] 1) By combining ellipse fitting with LSTM neural network to identify and predict warning hazards, and using ellipse fitting method for indicator anomaly detection for LSTM predicted values, the time series prediction ability of LSTM and the anomaly detection ability of ellipse fitting are integrated to mine the correlation between data, detect more complex anomalies, and improve the accuracy and robustness of anomaly detection. Compared with using only LSTM model for anomaly detection, by combining ellipse fitting, the change pattern behind the data can be automatically discovered and anomalies can be effectively identified.

[0149] 2) By projecting the multidimensional data onto the two dimensions with the highest contribution rates, we obtain two-dimensional data points. By performing ellipse fitting and anomaly detection on the two-dimensional plane, we can well summarize the overall distribution characteristics of the multidimensional data, which is conducive to automatically discovering the change patterns behind the data and effectively identifying anomalies. This allows the characteristics of high-dimensional data to be effectively reflected in geometric shapes, thereby simplifying the complexity of anomaly detection.

[0150] 3) By combining ellipse fitting with LSTM neural network to obtain the alarm hidden danger identification prediction results, and then correlating and aggregating them with dedicated line resource indicators and alarm dimensions, the impact scope and urgency of the fault can be reflected in real time and dynamically, and the dedicated line security level can be dynamically predicted and adjusted. This is conducive to dispatching orders in order of different levels of importance, thereby improving the efficiency of fault handling and achieving accurate troubleshooting.

[0151] Embodiment 2:

[0152] like Figure 4 As shown, the present disclosure provides a hidden danger identification device, the device comprising:

[0153] An acquisition module 1 is used to acquire first actual indicator data of a network device in a first period of time;

[0154] Prediction module 2, connected to acquisition module 1, for inputting the first actual indicator data into the time series prediction model to obtain a plurality of groups of first prediction indicator data of the network device grouped according to the time series in the second time period;

[0155] The detection module 3 is connected to the prediction module 2 and is used to input the multiple groups of first prediction indicator data into the anomaly detection model to obtain the predicted anomaly frequency of the network device occurring anomalies in the second time period;

[0156] The judgment module 4 is connected to the detection module 3, and is used to judge the hidden danger level of the network device in the second time period according to the network quality assurance level and the predicted abnormal frequency of the network device in the second time period.

[0157] In one embodiment, wherein:

[0158] Network equipment specifically includes data communication equipment for business dedicated lines in the network;

[0159] The indicator data specifically includes: CPU utilization, port bandwidth utilization, port upstream traffic, port downstream traffic, number of error packets, received optical power and emitted optical power.

[0160] In one embodiment, wherein:

[0161] The acquisition module 1 is further used to acquire the second actual indicator data of the network device in the third time period; and to acquire the third actual indicator data in the fourth time period and the fourth actual indicator data in the fifth time period from the second actual indicator data using a sliding window;

[0162] The prediction module 2 also includes a model training unit, which is used to train a long short-term memory network LSTM model using the third actual indicator data and the fourth actual indicator data to obtain a time series prediction model.

[0163] In one embodiment, the model training unit is specifically used to:

[0164] Input the third actual indicator data into the LSTM model to obtain the second prediction indicator data of the network device in the fifth period;

[0165] Calculate the residual between the fourth actual indicator data and the second predicted indicator data;

[0166] In response to the residual being greater than the first threshold, adjusting the parameters of the LSTM model, and repeating the above steps;

[0167] In response to the residual being less than the first threshold, the LSTM model of obtaining the final parameters is a time series prediction model.

[0168] In one embodiment, the detection module 3 specifically includes:

[0169] A standardization unit, used for standardizing each set of first prediction indicator data to obtain multiple sets of first standardized indicator data;

[0170] The ellipse calculation unit is connected to the standardization unit and is used to input multiple groups of first standardized index data into the ellipse formula in time sequence to obtain the number and continuity of the ellipse formula calculation results that are not located inside the ellipse in the second time period.

[0171] In one embodiment, wherein:

[0172] The ellipse formula is:

[0173]

[0174] In the formula, x is the first standardized index data of the input, is the center of the ellipse, T is the matrix transpose, u1 is the first principal component parameter, u2 is the second principal component parameter, a is the radius of the major axis of the ellipse, and b is the radius of the minor axis of the ellipse;

[0175] The inside of the ellipse refers to the range where the ellipse formula is less than or equal to 1.

[0176] In one embodiment, wherein:

[0177] The acquisition module 1 is also used to acquire a first amount of normal indicator data;

[0178] The standardization unit is also used for standardizing the normal indicator data to obtain second standardized indicator data;

[0179] The ellipse calculation unit is also used to obtain the mean of the second standardized index data; obtain the scatter matrix of the second standardized index data; obtain the eigenvalues ​​and eigenvectors of the scatter matrix; and obtain the center of the ellipse according to the mean of the second standardized index data, obtain the major and minor axis radii of the ellipse equation according to the first and second eigenvalues, and obtain the principal component parameters of the ellipse equation according to the first and second eigenvectors.

[0180] In one implementation, the judgment module 4 specifically includes:

[0181] The guarantee level unit is used to obtain the networking dimension information, spatial dimension information and user dimension information of the service dedicated line where the network device is located, and obtain the network quality guarantee level of the network device in the second time period according to the networking dimension information, spatial dimension information and user dimension information;

[0182] The hidden danger level unit is connected to the security level unit, and is used to obtain the frequency of hidden dangers to be processed corresponding to the network quality security level of the network equipment in the second time period. In response to the predicted abnormal frequency being greater than or equal to the corresponding frequency of hidden dangers to be processed, the network equipment is judged as a hidden danger to be processed and an order is issued for processing.

[0183] Embodiment 3:

[0184] Embodiment 3 of the present disclosure provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, the hidden danger identification method as described in Embodiment 1 or the hidden danger identification device as described in Embodiment 2 is implemented.

[0185] The computer-readable storage medium includes volatile or non-volatile, removable or non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, computer program modules or other data). Computer-readable storage media include, but are not limited to, RAM (Random Access Memory), ROM (Read-Only Memory), EEPROM (Electrically Erasable Programmable read only memory), flash memory or other memory technology, CD-ROM (Compact Disc Read-Only Memory), digital versatile disk (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store the desired information and can be accessed by a computer.

[0186] In addition, the present disclosure may also provide a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the processor runs the computer program stored in the memory, the processor executes the hidden danger identification method as described in Example 1. The computer device may be a hidden danger identification device as described in Example 2.

[0187] The memory is connected to the processor, the memory may be a flash memory or a read-only memory or other memory, and the processor may be a central processing unit or a single-chip microcomputer.

[0188] Embodiments 1-3 of the present disclosure provide a hidden danger identification method, a hidden danger identification device, and a computer-readable storage medium, which predict multiple groups of network indicator data in time series, obtain predicted abnormal occurrence frequencies based on the multiple groups of network indicator data, and judge the hidden danger level of the network equipment based on the predicted abnormal occurrence frequencies combined with the network quality assurance level of the network equipment. The hidden danger level can be used as a basis for fault hidden danger troubleshooting, thereby achieving accurate troubleshooting and improving fault handling efficiency.

[0189] It is to be understood that the above embodiments are merely exemplary embodiments used to illustrate the principles of the present disclosure, but the present disclosure is not limited thereto. For those of ordinary skill in the art, various modifications and improvements can be made without departing from the spirit and substance of the present disclosure, and these modifications and improvements are also considered to be within the scope of protection of the present disclosure.

Claims

1. A hidden danger identification method, characterized in that: The method comprises: Acquire first actual indicator data of the network device in a first time period; Inputting the first actual indicator data into the time series prediction model to obtain multiple groups of first prediction indicator data of the network device grouped according to the time series in the second time period; Inputting the plurality of sets of first prediction indicator data into an anomaly detection model to obtain a predicted anomaly frequency of anomalies occurring in the network device during a second period of time; The hidden danger level of the network equipment in the second time period is determined based on the network quality assurance level and the predicted abnormal frequency of the network equipment in the second time period.

2. The method according to claim 1, characterized in that in: Network equipment specifically includes data communication equipment for business dedicated lines in the network; The indicator data specifically includes: CPU utilization, port bandwidth utilization, port upstream traffic, port downstream traffic, number of error packets, received optical power and emitted optical power.

3. The method according to claim 1, characterized in that Before inputting the first actual indicator data into the time series prediction model, the method further includes: Acquire second actual indicator data of the network device in a third time period; Using a sliding window to obtain third actual indicator data within a fourth time period and fourth actual indicator data within a fifth time period from the second actual indicator data; The third actual indicator data and the fourth actual indicator data are used to train a long short-term memory network LSTM model to obtain a time series prediction model.

4. The method according to claim 3, characterized in that The LSTM model is trained using the third actual indicator data and the fourth actual indicator data to obtain a time series prediction model, specifically including: Input the third actual indicator data into the LSTM model to obtain the second prediction indicator data of the network device in the fifth period; Calculate the residual between the fourth actual indicator data and the second predicted indicator data; In response to the residual being greater than the first threshold, adjusting the parameters of the LSTM model, and repeating the above steps; In response to the residual being less than the first threshold, the LSTM model of obtaining the final parameters is a time series prediction model.

5. The method according to any one of claims 1 to 4, characterized in that: Inputting multiple sets of first prediction indicator data into the anomaly detection model to obtain the predicted anomaly frequency of the network device anomaly occurring in the second time period, specifically including: Standardizing each set of first prediction indicator data to obtain multiple sets of first standardized indicator data; Multiple groups of first standardized indicator data are input into the ellipse formula in time sequence to obtain the number and continuity of the ellipse formula calculation results that are not located inside the ellipse in the second time period.

6. The method according to claim 5, characterized in that in: The ellipse formula is: In the formula, x is the first standardized index data of the input, is the center of the ellipse, T is the matrix transpose, u1 is the first principal component parameter, u2 is the second principal component parameter, a is the radius of the major axis of the ellipse, and b is the radius of the minor axis of the ellipse; The inside of the ellipse refers to the range where the ellipse formula is less than or equal to 1.

7. The method according to claim 6, characterized in that Before inputting the first prediction indicator data into the anomaly detection model, the method further includes: Obtaining a first amount of normal indicator data; Standardizing the normal indicator data to obtain second standardized indicator data; Obtaining the mean of the second standardized indicator data; Obtaining a scatter matrix of second standardized indicator data; Get the eigenvalues ​​and eigenvectors of the scatter matrix; The center of the ellipse is obtained according to the mean of the second standardized index data, the major and minor axis radii of the ellipse equation are obtained according to the first and second eigenvalues, and the principal component parameters of the ellipse equation are obtained according to the first and second eigenvectors.

8. The method according to claim 2, characterized in that: According to the network quality assurance level and predicted abnormal frequency of the network equipment in the second period, the hidden danger level of the network equipment in the second period is judged, specifically including: Obtain networking dimension information, spatial dimension information, and user dimension information of the service dedicated line where the network device is located, and obtain the network quality assurance level of the network device in the second time period according to the networking dimension information, spatial dimension information, and user dimension information; Obtain the frequency of potential hazards to be processed corresponding to the network quality assurance level of the network device in the second time period, and in response to the predicted abnormal frequency being greater than or equal to the corresponding frequency of potential hazards to be processed, determine that the network device is a potential hazard to be processed and dispatch it for processing.

9. A hidden danger identification device, characterized in that: The device comprises: An acquisition module, used to acquire first actual indicator data of the network device in a first time period; A prediction module, connected to the acquisition module, for inputting the first actual indicator data into the time series prediction model to obtain a plurality of groups of first prediction indicator data of the network device grouped according to the time series in the second time period; A detection module, connected to the prediction module, for inputting the plurality of sets of first prediction indicator data into an anomaly detection model to obtain a predicted anomaly frequency of anomalies occurring in the network device within a second time period; The judgment module is connected to the detection module and is used to judge the hidden danger level of the network equipment in the second time period according to the network quality assurance level and the predicted abnormal frequency of the network equipment in the second time period.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the hidden danger identification method according to any one of claims 1 to 8 is implemented.

Images