Communication network operation and maintenance fault positioning and tracking method and system

Abstract

The invention provides a communication network operation and maintenance fault positioning and tracking method and system, relates to the technical field, and belongs to the technical field of communication network fault diagnosis. According to the method, historical operation data, including network flow data, performance index data and alarm log data, of communication network equipment are collected, fault feature vectors are generated through training of a deep learning model, and a fault feature knowledge base is constructed; receiving operation data reported by equipment in real time to perform feature extraction, and performing similarity matching based on the fault feature knowledge base to determine a fault type; and analyzing a fault propagation path by adopting a graph traversal algorithm, determining fault root cause equipment by calculating a fault probability score of an equipment node, and generating a fault tracking report. According to the invention, accurate positioning and rapid diagnosis of communication network faults are realized, the fault processing efficiency is improved, and the network operation and maintenance cost is reduced.

Description

Technical Field

[0001] The present invention relates to communication network technology, and in particular to a method and system for locating and tracking faults in communication network operation and maintenance. Background Art

[0002] With the continuous expansion of communication network scale and the continuous improvement of business complexity, the difficulty of network equipment fault diagnosis and processing has increased significantly. A large number of network devices are deployed in existing communication networks, which generate massive amounts of operation data, including network traffic data, equipment performance indicator data, and alarm log data. In order to ensure the stable operation of the network, it is necessary to monitor and analyze these data in real time to promptly discover and handle network faults. Traditional fault diagnosis methods mainly rely on the experience of operation and maintenance personnel, and locate the cause of the fault by manually analyzing equipment alarm information and performance indicators.

[0003] However, existing fault diagnosis technologies have the following problems: First, due to the complex network topology and the large number of dependencies between devices, it is difficult to accurately identify the fault propagation path and root device by relying solely on manual experience; second, traditional fault feature extraction methods cannot effectively process multi-dimensional historical data, resulting in low accuracy in fault pattern recognition; third, existing fault handling solutions are often static, lacking in-depth learning and knowledge accumulation of historical fault cases, and are difficult to adapt to dynamic changes in the network environment.

[0004] The present invention aims to solve the above technical problems existing in the process of communication network fault diagnosis, and provides a communication network fault diagnosis method based on deep learning. The method establishes a fault feature knowledge base through deep learning of historical operation data, combines real-time data analysis and graph traversal algorithm, realizes accurate fault location and root cause analysis, and provides corresponding processing solutions based on the knowledge base, thereby improving the accuracy and efficiency of fault diagnosis. Summary of the invention

[0005] The embodiments of the present invention provide a communication network operation and maintenance fault location and tracking method and system, which can solve the problems in the prior art.

[0006] According to a first aspect of the embodiments of the present invention, Provides a communication network operation and maintenance fault location and tracking method, including: Collect historical operation data of multiple communication network devices, the historical operation data including network traffic data, equipment performance indicator data and alarm log data; train a deep learning model based on the historical operation data to generate a fault feature vector; associate the fault feature vector with the corresponding fault handling solution and store it to form the fault feature knowledge base; establish a fault handling model including fault location rules and fault propagation paths according to the fault feature knowledge base; Receive the operation data reported in real time by the communication network equipment, the operation data including network traffic data, equipment performance indicator data and alarm log data; use the deep learning model to extract features from the operation data to generate a real-time fault feature vector; perform similarity matching between the real-time fault feature vector and the fault feature vector in the fault feature knowledge base to determine the fault type; analyze the fault propagation path corresponding to the fault type according to the fault processing model to determine the fault impact range; Based on the fault propagation path, a graph traversal algorithm is used to analyze the upstream and downstream devices of the faulty device in turn; the fault probability score of each device node is calculated, and the fault probability score is weighted according to the number of abnormal indicators of the device, the alarm level and the fault duration; the device node with the highest fault probability score is determined as the root cause device of the fault; the fault handling solution corresponding to the root cause device of the fault is extracted from the fault feature knowledge base; and a fault tracking report including the fault location process, the root cause device of the fault and the fault handling solution is generated.

[0007] Training a deep learning model based on the historical operation data to generate a fault feature vector; associating the fault feature vector with a corresponding fault handling solution to form the fault feature knowledge base; and establishing a fault handling model including fault location rules and fault propagation paths according to the fault feature knowledge base includes: Acquire historical operation data of the communication network equipment, the historical operation data including bandwidth utilization data, packet loss rate data, latency data, CPU usage data, memory occupancy data, disk IO data, alarm level data, alarm type data, and alarm duration data; align the historical operation data according to the time series and construct a data input matrix; A long short-term memory network is used to extract time series features from the data input matrix, wherein the long short-term memory network includes three layers of recurrent units, each layer of recurrent units includes one hundred and twenty-eight neurons, and each layer of recurrent units in the long short-term memory network uses a hyperbolic tangent function as an activation function; a forty-eight-hour time window is set by the long short-term memory network, and sliding sampling is performed on the data input matrix to obtain time series pattern features; A multilayer perceptron is used to perform index correlation learning on the time series pattern features, the multilayer perceptron includes four fully connected layers, the number of neurons in the four fully connected layers is 512, 256, 128, and 64, respectively, the first three fully connected layers of the multilayer perceptron use a rectified linear unit function as an activation function, and the last fully connected layer of the multilayer perceptron uses a normalized exponential function for normalization to obtain normalized features; The time series pattern feature and the normalized feature are subjected to feature fusion, and a 64-dimensional fault feature vector is generated by dimensionality reduction processing; a graph database is constructed, the fault feature vector is stored as attribute information of a graph node in the graph database, and the fault handling solution is stored as association information of the graph node; An association rule mining algorithm is used to analyze the association pattern between the fault feature vectors, wherein the minimum support of the association rule mining algorithm is 0.05 and the minimum confidence is 0.8. Frequent item sets are mined by the association rule mining algorithm to generate fault location rules; a hierarchical fault propagation model is established based on the fault location rules, wherein the hierarchical fault propagation model includes physical connection relationships and business dependency relationships; When a new fault case is received, the fault feature vector in the graph database is updated, and the rule weight of the fault location rule is adjusted online according to the fault repair time using a reinforcement learning method. The fault repair time is used as a reward signal of the reinforcement learning method to achieve dynamic optimization of the fault location strategy.

[0008] Receiving operation data reported in real time by the communication network equipment, the operation data including network traffic data, equipment performance indicator data and alarm log data; extracting features from the operation data using the deep learning model to generate a real-time fault feature vector includes: Deploy a collection agent on the communication network equipment to collect network traffic data through the simple network management protocol, the network traffic data includes interface throughput data, message forwarding rate data, and protocol message statistics data; collect device performance indicator data through the network configuration protocol, the device performance indicator data includes CPU load data, memory usage data, and hardware temperature data; collect alarm log data through the system log protocol, the alarm log data includes device alarm information data, system log data, and operation record data; The collection agent dynamically adjusts the sampling frequency according to the load status of the communication network device. When the communication network device is in a normal state, the sampling interval is five minutes. When the device performance indicator data is detected to be abnormal, the sampling interval is adjusted to one minute; the collected network traffic data, the device performance indicator data, and the alarm log data are deduplicated, zero-filled, and normalized to obtain pre-processed data; The pre-processed data is aligned using a data alignment algorithm based on a time window; missing data in the pre-processed data is compensated by a linear interpolation method; integrity indicators, timeliness indicators, and accuracy indicators of the pre-processed data are calculated to generate a data quality assessment result; The preprocessed data is standardized and a data batch is constructed using a ten-minute sliding time window; the data batch is input into a long short-term memory network to extract time series features; the hidden state of the long short-term memory network is used to maintain historical information; Construct a multi-head self-attention layer, assign attention weights to the network traffic data, the device performance indicator data, and the alarm log data respectively; maintain the original feature information through a residual connection structure; perform feature fusion on the temporal features extracted by the long short-term memory network and the weighted features of the multi-head self-attention layer; The fused features are mapped to a 64-dimensional feature space through a fully connected layer to generate a real-time fault feature vector; the model parameter accuracy is reduced to an eight-bit fixed-point number using a model quantization technique; the density distribution data and variance data of the real-time fault feature vector are calculated; Anomaly detection is performed on the real-time fault feature vector using an anomaly detection algorithm based on Mahalanobis distance. When the Mahalanobis distance of the real-time fault feature vector exceeds a preset threshold, a resampling process and a feature extraction process are triggered. When a new fault mode is detected, model parameters are updated through online learning. Historical version data of the real-time fault feature vector is maintained to trace the feature extraction results.

[0009] Performing similarity matching between the real-time fault feature vector and the fault feature vector in the fault feature knowledge base to determine the fault type; analyzing the fault propagation path corresponding to the fault type according to the fault processing model to determine the fault impact range includes: Calculate the cosine similarity between the real-time fault feature vector and the historical fault feature vector in the fault feature knowledge base, the cosine similarity is obtained by dividing the dot product of the two feature vectors by the product of the module lengths of the two feature vectors; calculate the weighted Euclidean distance between the real-time fault feature vector and the historical fault feature vector, the weighted Euclidean distance is calculated based on the square root of the sum of the squares of the differences in each dimension of the two feature vectors; calculate the Mahalanobis distance between the real-time fault feature vector and the historical fault feature vector, the Mahalanobis distance is calculated by introducing the covariance matrix; perform weighted fusion of the cosine similarity, the weighted Euclidean distance, and the Mahalanobis distance to obtain a comprehensive similarity score; Sorting the historical fault feature vectors in the fault feature knowledge base in descending order according to the comprehensive similarity score, and selecting a preset number of candidate fault types with the highest scores; calculating the confidence of each candidate fault type according to the comprehensive similarity score and the frequency of occurrence of the candidate fault type in the historical data; Input the comprehensive similarity score and the occurrence frequency into a support vector machine classifier to obtain a probability prediction value of the candidate fault type; when the confidence of the candidate fault type with the highest confidence exceeds a preset confidence threshold, determine the candidate fault type as the current fault type; when the confidence of all the candidate fault types is lower than the preset confidence threshold, mark the current fault as a new fault type; A physical layer propagation graph is constructed based on network topology information, wherein nodes of the physical layer propagation graph represent communication network devices, and edges of the physical layer propagation graph represent physical link connection relationships; propagation probability weights are assigned to the physical link connection relationships based on statistical characteristics of fault propagation in historical fault data; Building a service layer propagation graph based on the service call chain and resource sharing information, wherein the service layer propagation graph describes the dependency relationship between network services; defining a propagation delay parameter for the service dependency relationship in the service layer propagation graph, wherein the propagation delay parameter indicates the time required for a fault to propagate from a source service to a target service; Mapping the current fault type to the source node in the physical layer propagation graph and the business layer propagation graph; performing fault propagation simulation in parallel in the physical layer propagation graph and the business layer propagation graph using an improved breadth-first search algorithm; calculating the spatiotemporal range of fault impact based on the propagation probability weight, the business dependency, and the propagation delay parameter; Maintain a priority queue and prioritize the propagation paths based on the risk factor; predict the spread of the fault at a future time point based on the current propagation state and the historical propagation pattern; compare the predicted impact range with the actual observed fault spread, and update the propagation probability weight and the propagation delay parameter.

[0010] Based on the fault propagation path, the upstream and downstream devices of the faulty device are analyzed in sequence using a graph traversal algorithm; the fault probability score of each device node is calculated, and the fault probability score is weightedly calculated according to the number of abnormal indicators of the device, the alarm level and the fault duration, including: A depth-first search method is used to traverse the upstream device of the faulty device, loop traversal is avoided by maintaining access marks, and the traversal depth is recorded to control the analysis scope; when the traversal depth exceeds the preset level, the current path information is temporarily stored and backtracked; an improved breadth-first search algorithm is used to traverse the downstream device of the faulty device, and the nodes to be visited are managed through a priority queue, and the priority is determined based on the business importance of the node and the link bandwidth; Count the number of abnormal indicators of the upstream device and the downstream device, and map the continuous indicator values ​​of CPU usage, memory occupancy, and interface packet loss rate into discrete abnormal levels through multi-level threshold intervals; extract the alarm information of the upstream device and the downstream device, and classify the alarm information into emergency alarm, important alarm, and minor alarm according to the severity; calculate the duration and repetition frequency of each level of alarm; The sigmoid function is used to map the number of abnormal indicators to the interval from zero to one to obtain the indicator abnormality score; the hierarchical analysis method is used to construct a judgment matrix, and the relative importance of the emergency alarm, the important alarm, and the minor alarm is calculated to obtain the alarm level weight; the time decay factor is introduced to gradually weaken the influence of the earlier alarm information on the current fault probability; The piecewise function model is used to process the fault duration. For short-term faults, the linear growth rate is increased, for medium-term faults, the growth rate is slowed down. For long-term faults, the self-repair capability of the equipment is considered to make the probability growth tend to be smooth, and the duration score is obtained. The indicator abnormality score, the product of the alarm level weight and the time attenuation factor, and the duration score are respectively multiplied by the corresponding weight coefficient and summed to obtain a fault probability score; the weight coefficient is regularly updated using a sliding time window mechanism; The fault probability score is adjusted based on the physical connection relationship between devices. The devices in series relationship adopt the cumulative effect of fault probability, and the devices in parallel relationship adopt the fault probability supplement mechanism. A fault probability transmission attenuation model is established to reduce the impact of faults as the propagation distance increases. Establish a time series of equipment failure probability, trigger an early warning when the failure probability score of a certain equipment continues to rise; mark the equipment as a high-risk node when the failure probability score exceeds a preset threshold; compare the predicted failure probability score with the actual failure situation, and optimize the weight coefficient.

[0011] Determine the device node with the highest fault probability score as the fault root cause device; extract the fault handling solution corresponding to the fault root cause device from the fault feature knowledge base; generate a fault tracing report including the fault location process, the fault root cause device and the fault handling solution, including: Establish a time series analysis model for fault probability scores, calculate the changing trend of the fault probability of each device node, and identify the device node that first experiences an abnormality based on the time sequence of the rise in fault probability; construct a Bayesian network based on the physical connection relationship and business dependency relationship of the devices, and evaluate the probability distribution of each device as the root cause of the fault through a backward reasoning algorithm; calculate the correlation coefficient matrix of device failure time to identify device groups with significant time correlation, and perform weighted fusion of the Bayesian reasoning results and the fault probability score to determine the root cause device; Semantically annotate the historical processing solutions in the fault feature knowledge base to establish a multi-dimensional knowledge graph that includes equipment type, fault phenomenon, processing steps, and processing effect; learn the association features between knowledge entities through the graph neural network model; calculate the attribute similarity between the current fault root cause equipment and the equipment in the historical case, extract the key features of the fault indicator and the alarm information, and calculate the matching degree of the fault phenomenon; The execution process of the historical processing scheme is modeled as a state-action sequence, and the optimal processing strategy is learned through the Q-learning algorithm; based on the importance of the equipment, the scope of business impact, and the repair time requirement, the constraint conditions are constructed, and the fault processing scheme with the highest matching degree with the fault root cause equipment is extracted from the fault feature knowledge base; Extract the key event sequence in the fault location process, including the abnormal discovery time, fault diffusion process, and location operation steps; use the template filling method to convert the extracted information into structured report content; record the progress of fault handling in real time, including the executed operation steps, handling effect evaluation, and reasons for solution adjustment; Summarize the fault cases that have been processed, extract fault feature patterns and key points of the processing solutions, and realize the continuous accumulation of fault processing knowledge through dynamic updating of the multi-dimensional knowledge graph; calculate the evaluation score of the processing solution based on the repair time, business impact, and processing cost; optimize the processing solution in the fault feature knowledge base based on the difference between the processing effect and the expected goal; generate a fault tracking report including the fault location process, the fault root cause equipment, and the fault processing solution.

[0012] According to a second aspect of the embodiments of the present invention, Provides a communication network operation and maintenance fault location tracking system, including: The first unit is used to collect historical operation data of multiple communication network devices, wherein the historical operation data includes network traffic data, device performance indicator data, and alarm log data; train a deep learning model based on the historical operation data to generate a fault feature vector; associate the fault feature vector with a corresponding fault handling solution and store it to form the fault feature knowledge base; and establish a fault handling model including fault location rules and fault propagation paths according to the fault feature knowledge base; The second unit is used to receive the operation data reported in real time by the communication network equipment, the operation data including network traffic data, equipment performance indicator data and alarm log data; use the deep learning model to extract features of the operation data to generate a real-time fault feature vector; perform similarity matching between the real-time fault feature vector and the fault feature vector in the fault feature knowledge base to determine the fault type; analyze the fault propagation path corresponding to the fault type according to the fault processing model to determine the fault impact range; The third unit is used to analyze the upstream and downstream devices of the faulty device in sequence based on the fault propagation path by using a graph traversal algorithm; calculate the fault probability score of each device node, and the fault probability score is weighted according to the number of abnormal indicators of the device, the alarm level and the fault duration; determine the device node with the highest fault probability score as the root cause device of the fault; extract the fault handling solution corresponding to the root cause device of the fault from the fault feature knowledge base; and generate a fault tracking report including the fault location process, the root cause device of the fault and the fault handling solution.

[0013] According to a third aspect of the embodiments of the present invention, An electronic device is provided, comprising: processor; a memory for storing processor-executable instructions; The processor is configured to call the instructions stored in the memory to execute the aforementioned method.

[0014] A fourth aspect of the embodiments of the present invention is: A computer-readable storage medium is provided, on which computer program instructions are stored. When the computer program instructions are executed by a processor, the aforementioned method is implemented.

[0015] The beneficial effects of this application are as follows: The present invention uses a deep learning model to automatically extract fault features and match them with a pre-established fault feature knowledge base to quickly determine the fault type and impact range, avoiding the time-consuming and labor-intensive problems of traditional manual troubleshooting and significantly improving fault location efficiency.

[0016] The present invention is based on the fault propagation path and graph traversal algorithm, combined with multi-dimensional information such as equipment abnormality indicators, alarm levels and fault duration, to analyze the upstream and downstream equipment of the faulty equipment and calculate the fault probability score, thereby accurately locating the root cause of the fault, avoiding misjudgment and missed judgment, and improving the accuracy of fault location.

[0017] The present invention associates and stores fault feature vectors with corresponding fault handling solutions. Once the root cause of the fault is determined, the corresponding handling solution can be quickly extracted from the fault feature knowledge base to guide operation and maintenance personnel to quickly and effectively troubleshoot the fault, shorten the fault recovery time, and improve the reliability and stability of the network. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 A schematic diagram of a flow chart of a method for locating and tracing a communication network operation and maintenance fault according to an embodiment of the present invention; Figure 2 It is a structural diagram of a communication network operation and maintenance fault location and tracking system according to an embodiment of the present invention. DETAILED DESCRIPTION

[0019] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0020] The technical solution of the present invention is described in detail with specific embodiments below. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described in detail in some embodiments.

[0021] Figure 1 FIG. 1 is a flow chart of a method for locating and tracing a communication network operation and maintenance fault according to an embodiment of the present invention. Figure 1 As shown, the method includes: S11. Collect historical operation data of multiple communication network devices, the historical operation data including network traffic data, equipment performance indicator data and alarm log data; train a deep learning model based on the historical operation data to generate a fault feature vector; associate the fault feature vector with the corresponding fault handling solution and store it to form the fault feature knowledge base; establish a fault handling model including fault location rules and fault propagation paths according to the fault feature knowledge base; S12. Receive the operation data reported in real time by the communication network equipment, the operation data including network traffic data, equipment performance indicator data and alarm log data; use the deep learning model to extract features from the operation data to generate a real-time fault feature vector; perform similarity matching between the real-time fault feature vector and the fault feature vector in the fault feature knowledge base to determine the fault type; analyze the fault propagation path corresponding to the fault type according to the fault processing model to determine the fault impact range; S13. Based on the fault propagation path, a graph traversal algorithm is used to analyze the upstream and downstream devices of the faulty device in turn; the fault probability score of each device node is calculated, and the fault probability score is weighted according to the number of abnormal indicators of the device, the alarm level and the fault duration; the device node with the highest fault probability score is determined as the root cause device of the fault; the fault handling solution corresponding to the root cause device of the fault is extracted from the fault feature knowledge base; and a fault tracking report including the fault location process, the root cause device of the fault and the fault handling solution is generated.

[0022] The specific implementation of the communication network operation and maintenance fault location and tracking method is as follows: First, collect historical operation data. Collect at least three months of historical operation data from multiple communication network devices, including network traffic data (e.g., port traffic and packet loss rate every 5 minutes), device performance indicator data (e.g., CPU utilization, memory usage), and alarm log data (e.g., alarm ID, alarm time, alarm level).

[0023] Next, train the deep learning model. Use the collected historical operation data to train the deep learning model, such as the long short-term memory network (LSTM), to learn the failure mode. The input data is time series data, including network traffic, equipment performance indicators, and alarm logs. The output is a fault feature vector, which represents the characteristics of different fault types. For example, a feature vector may represent a fiber line interruption fault, and another feature vector may represent a device CPU overload fault.

[0024] Then, a fault feature knowledge base is constructed. The fault feature vector obtained through training is associated with the corresponding fault handling solution and stored to form a fault feature knowledge base. The fault handling solution includes the fault cause, fault impact, fault location steps and fault recovery steps. For example, the solution for the interruption of the optical fiber line may include steps such as checking the optical fiber connection and replacing the optical fiber line.

[0025] Based on the fault feature knowledge base, a fault handling model is established. The model contains fault location rules and fault propagation paths. The fault location rules determine the fault type based on the similarity matching results between the real-time fault feature vector and the fault feature vector in the knowledge base. The fault propagation path describes how the fault propagates in the network, such as from the core switch to the access switch and then to the user terminal.

[0026] When communication network equipment reports operating data in real time, including network traffic data, equipment performance indicator data, and alarm log data, the trained deep learning model is used to extract features from these real-time operating data to generate real-time fault feature vectors.

[0027] The real-time fault feature vector is matched with the fault feature vector in the fault feature knowledge base by similarity, for example, using cosine similarity, to determine the fault type. The fault type with the highest similarity is selected as the current fault type.

[0028] According to the fault propagation path corresponding to the fault type determined by the fault handling model analysis, the fault impact scope is determined. For example, if the fault type is a core switch fault, the fault impact scope may be the entire network.

[0029] Based on the fault propagation path, a graph traversal algorithm, such as the breadth-first search algorithm, is used to analyze the upstream and downstream devices of the faulty device in sequence. A network topology graph is constructed, in which nodes represent devices and edges represent connections between devices.

[0030] Calculate the fault probability score for each device node. The fault probability score is weighted based on the number of abnormal indicators of the device (for example, the number of performance indicators exceeding the threshold), the alarm level (for example, severe alarm, major alarm, minor alarm), and the fault duration. For example, the weight of the number of abnormal indicators is 0.5, the weight of the alarm level is 0.3, and the weight of the fault duration is 0.2.

[0031] The device node with the highest fault probability score is determined as the fault root cause device.

[0032] Extract the fault handling solution corresponding to the determined fault root cause device from the fault feature knowledge base.

[0033] Finally, a fault tracing report is generated that includes the fault location process, the root cause device, and the fault handling solution. For example, the report can include information such as the time of fault occurrence, the scope of fault impact, the root cause device, the fault handling steps, and the fault recovery time.

[0034] Case: Assume that the CPU utilization of a core switch continues to exceed 90%, the memory usage continues to exceed 80%, and a serious alarm is triggered. After the real-time operation data is processed by the deep learning model, the real-time fault feature vector generated has the highest similarity with the fault feature vector of "device CPU overload" in the fault feature knowledge base. According to the fault handling model, the propagation path of the fault will affect all downstream devices connected to the core switch. By analyzing the upstream and downstream devices through the graph traversal algorithm, it is found that the core switch has the highest fault probability score, so the core switch is determined to be the root cause device of the fault. The fault handling solution for "device CPU overload" is extracted from the fault feature knowledge base, such as restarting the device or increasing CPU resources. Finally, a fault tracking report is generated, including the fault location process, the root cause device (core switch), and the fault handling solution (restarting the device or increasing CPU resources).

[0035] Beneficial effects:

[0036] Through deep learning models and fault feature knowledge base, the root cause of the fault can be located quickly and accurately, reducing troubleshooting time.

[0037] Automated fault location and solution recommendations can reduce manual intervention and lower operation and maintenance costs.

[0038] Rapidly locating and resolving faults can reduce the impact of faults on the network and improve network stability.

[0039] In an optional implementation, training a deep learning model based on the historical operation data to generate a fault feature vector; associating the fault feature vector with a corresponding fault handling solution to form the fault feature knowledge base; and establishing a fault handling model including fault location rules and fault propagation paths according to the fault feature knowledge base includes: Acquire historical operation data of the communication network equipment, the historical operation data including bandwidth utilization data, packet loss rate data, latency data, CPU usage data, memory occupancy data, disk IO data, alarm level data, alarm type data, and alarm duration data; align the historical operation data according to the time series and construct a data input matrix; A long short-term memory network is used to extract time series features from the data input matrix, wherein the long short-term memory network includes three layers of recurrent units, each layer of recurrent units includes one hundred and twenty-eight neurons, and each layer of recurrent units in the long short-term memory network uses a hyperbolic tangent function as an activation function; a forty-eight-hour time window is set by the long short-term memory network, and sliding sampling is performed on the data input matrix to obtain time series pattern features; A multilayer perceptron is used to perform index correlation learning on the time series pattern features, the multilayer perceptron includes four fully connected layers, the number of neurons in the four fully connected layers is 512, 256, 128, and 64, respectively, the first three fully connected layers of the multilayer perceptron use a rectified linear unit function as an activation function, and the last fully connected layer of the multilayer perceptron uses a normalized exponential function for normalization to obtain normalized features; The time series pattern feature and the normalized feature are subjected to feature fusion, and a 64-dimensional fault feature vector is generated by dimensionality reduction processing; a graph database is constructed, the fault feature vector is stored as attribute information of a graph node in the graph database, and the fault handling solution is stored as association information of the graph node; An association rule mining algorithm is used to analyze the association pattern between the fault feature vectors, wherein the minimum support of the association rule mining algorithm is 0.05 and the minimum confidence is 0.8. Frequent item sets are mined by the association rule mining algorithm to generate fault location rules; a hierarchical fault propagation model is established based on the fault location rules, wherein the hierarchical fault propagation model includes physical connection relationships and business dependency relationships; When a new fault case is received, the fault feature vector in the graph database is updated, and the rule weight of the fault location rule is adjusted online according to the fault repair time using a reinforcement learning method. The fault repair time is used as a reward signal of the reinforcement learning method to achieve dynamic optimization of the fault location strategy.

[0040] In order to more clearly explain the communication network fault handling method based on historical operation data and deep learning, and to show its technical details, the specific implementation method of the method is described in detail below, and a data case is provided for illustration.

[0041] First, collect historical operation data of communication network equipment. These data cover multiple dimensions, including bandwidth utilization, packet loss rate, latency, CPU usage, memory occupancy, disk IO, alarm level, alarm type, and alarm duration. For example, these data can be collected every 5 minutes and stored in a database. A specific data case is as follows: the timestamp is 00:00:00 on January 1, 2024, the bandwidth utilization is 80%, the packet loss rate is 0.1%, the latency is 20ms, the CPU usage is 60%, the memory occupancy is 70%, the disk IO is 1000 times / second, the alarm level is level 2, the alarm type is "port congestion", and the alarm duration is 10 minutes.

[0042] Next, preprocess the collected historical operation data. Align the data according to the time series and build a data input matrix. For example, take every 48 hours of data as a time window and build a 48x9 data input matrix, where 48 represents the time step and 9 represents different data dimensions.

[0043] Then, the long short-term memory network (LSTM) is used to extract the time series features. The LSTM network contains three layers of recurrent units, each layer contains 128 neurons, and the activation function uses the hyperbolic tangent function. Using a 48-hour time window, the data input matrix is ​​sampled by sliding to obtain the time series pattern features. For example, the LSTM network can learn the periodic change pattern of network traffic.

[0044] After that, a multi-layer perceptron (MLP) is used to learn the correlation between indicators. The MLP contains four fully connected layers with 512, 256, 128, and 64 neurons respectively. The first three layers use the rectified linear unit function as the activation function, and the last layer uses the normalized exponential function for normalization to obtain normalized features. For example, MLP can learn the positive correlation between CPU usage and bandwidth utilization.

[0045] The time series pattern features extracted by LSTM and the normalized features learned by MLP are fused. A dimensionality reduction method, such as principal component analysis (PCA), is used to reduce the fused features to 64 dimensions and generate a fault feature vector.

[0046] Build a graph database and store the generated 64-dimensional fault feature vector as the attribute information of the graph node. At the same time, store the corresponding fault handling solution as the association information of the graph node. For example, a feature vector may correspond to the handling solution of "restarting the device".

[0047] Use association rule mining algorithms, such as the Apriori algorithm, to analyze the association patterns between fault feature vectors. Set the minimum support to 0.05 and the minimum confidence to 0.8. Use this algorithm to mine frequent item sets and generate fault location rules. For example, you can mine "high CPU usage and high bandwidth utilization" and "port congestion" faults.

[0048] Based on the mined fault location rules, a hierarchical fault propagation model is established. The model includes physical connection relationships and business dependencies. For example, a server failure may propagate to the switch connected to it, thereby affecting the business that depends on the server.

[0049] When a new fault case is received, the fault feature vector is first extracted according to the above steps and updated to the graph database. Then, reinforcement learning methods, such as Q-learning, are used to adjust the weight of the fault location rule online according to the fault repair time. The fault repair time is used as a reward signal for reinforcement learning to achieve dynamic optimization of the fault location strategy. For example, if a rule can quickly locate the fault and shorten the repair time, the weight of the rule will be increased.

[0050] The beneficial effects of this method can be summarized in the following three aspects: 1. Improve fault location efficiency: By extracting fault features through deep learning models and combining association rule mining and fault propagation models, the root cause of the fault can be located quickly and accurately, reducing troubleshooting time.

[0051] 2. Improve the intelligent level of fault handling: Use reinforcement learning methods to dynamically optimize fault location strategies, so that the system can automatically adjust rule weights according to actual conditions and improve the intelligent level of fault handling.

[0052] 3. Reduce operation and maintenance costs: Through automated fault location and processing, reduce manual intervention, reduce operation and maintenance costs, and improve network stability and reliability.

[0053] In an optional implementation, receiving operation data reported in real time by the communication network device, the operation data including network traffic data, device performance indicator data, and alarm log data; and extracting features from the operation data using the deep learning model to generate a real-time fault feature vector includes: Deploy a collection agent on the communication network equipment to collect network traffic data through the simple network management protocol, the network traffic data includes interface throughput data, message forwarding rate data, and protocol message statistics data; collect device performance indicator data through the network configuration protocol, the device performance indicator data includes CPU load data, memory usage data, and hardware temperature data; collect alarm log data through the system log protocol, the alarm log data includes device alarm information data, system log data, and operation record data; The collection agent dynamically adjusts the sampling frequency according to the load status of the communication network device. When the communication network device is in a normal state, the sampling interval is five minutes. When the device performance indicator data is detected to be abnormal, the sampling interval is adjusted to one minute; the collected network traffic data, the device performance indicator data, and the alarm log data are deduplicated, zero-filled, and normalized to obtain pre-processed data; The pre-processed data is aligned using a data alignment algorithm based on a time window; missing data in the pre-processed data is compensated by a linear interpolation method; integrity indicators, timeliness indicators, and accuracy indicators of the pre-processed data are calculated to generate a data quality assessment result; The preprocessed data is standardized and a data batch is constructed using a ten-minute sliding time window; the data batch is input into a long short-term memory network to extract time series features; the hidden state of the long short-term memory network is used to maintain historical information; Construct a multi-head self-attention layer, assign attention weights to the network traffic data, the device performance indicator data, and the alarm log data respectively; maintain the original feature information through a residual connection structure; perform feature fusion on the temporal features extracted by the long short-term memory network and the weighted features of the multi-head self-attention layer; The fused features are mapped to a 64-dimensional feature space through a fully connected layer to generate a real-time fault feature vector; the model parameter accuracy is reduced to an eight-bit fixed-point number using a model quantization technique; the density distribution data and variance data of the real-time fault feature vector are calculated; Anomaly detection is performed on the real-time fault feature vector using an anomaly detection algorithm based on Mahalanobis distance. When the Mahalanobis distance of the real-time fault feature vector exceeds a preset threshold, a resampling process and a feature extraction process are triggered. When a new fault mode is detected, model parameters are updated through online learning. Historical version data of the real-time fault feature vector is maintained to trace the feature extraction results.

[0054] A communication network equipment fault diagnosis method analyzes equipment operation data through a deep learning model to achieve real-time fault feature extraction and anomaly detection.

[0055] First, deploy a collection agent on the communication network equipment. The collection agent collects network traffic data through the Simple Network Management Protocol (SNMP), including interface throughput, message forwarding rate, and message statistics of various network protocols, such as the number of messages and bytes of TCP, UDP, ICMP and other protocols. At the same time, the collection agent also collects device performance indicator data through the Network Configuration Protocol (NETCONF), such as CPU load, memory usage, hardware temperature, etc. In addition, alarm log data is collected through the System Log Protocol (Syslog), including device alarm information, system logs, and operation records.

[0056] The collection agent dynamically adjusts the sampling frequency according to the device load status. For example, when the device CPU load is less than 70% and the memory usage is less than 80%, the sampling interval is five minutes; when the CPU load exceeds 80% or the memory usage exceeds 90%, the sampling interval is adjusted to one minute. Assume that the device is in normal status from 10:00 to 10:05, and the collection agent collects data every five minutes; at 10:05, the CPU load suddenly increases to 90%, the collection agent adjusts the sampling interval to one minute, and continues to collect data at 10:06, 10:07, and other time points.

[0057] Preprocess the collected network traffic data, device performance indicator data, and alarm log data. Remove duplicate data. For example, only keep one piece of the same indicator data with the same timestamp. Fill missing data with zeros. For example, if the interface throughput data at a certain point in time is missing, fill it with zero values. Normalize all data and scale the data to between 0 and 1. For example, scale the CPU load data from 0% to 100% to 0 to 1. Assume that the CPU load data of a device is [70, 80, 90, 100], which is normalized to [0.7, 0.8, 0.9, 1].

[0058] The preprocessed data is aligned using a time window-based data alignment algorithm. For example, a 10-minute time window is used to align all data to the same 10-minute time period according to the timestamp. If data is missing at a certain time point, linear interpolation is used to compensate. For example, if the CPU load data at 10:02 is missing, and the CPU load at 10:01 is 70%, and the CPU load at 10:03 is 80%, the CPU load at 10:02 is calculated to be 75% through linear interpolation.

[0059] The completeness index, timeliness index and accuracy index of the preprocessed data are calculated to generate data quality assessment results. For example, the completeness index can be expressed by the proportion of non-missing data to total data points; the timeliness index can be expressed by the data delay time; and the accuracy index can be expressed by the data error rate.

[0060] Standardize the preprocessed data, for example, use Z-score standardization to convert the data into a distribution with a mean of 0 and a standard deviation of 1. Use a sliding time window of ten minutes to build data batches. Input the data batches into the long short-term memory network (LSTM) to extract time series features. The hidden state of LSTM is used to maintain historical information.

[0061] Construct a multi-head self-attention layer and assign attention weights to network traffic data, device performance indicator data, and alarm log data. For example, if the network traffic data fluctuates greatly within a certain period of time, a higher attention weight is assigned. The original feature information is maintained through the residual connection structure. The time series features extracted by LSTM are fused with the weighted features of the multi-head self-attention layer.

[0062] The fused features are mapped to a 64-dimensional feature space through a fully connected layer to generate a real-time fault feature vector. The model quantization technology is used to reduce the accuracy of the model parameters to eight-bit fixed-point numbers. The density distribution data and variance data of the real-time fault feature vector are calculated.

[0063] Anomaly detection is performed on real-time fault feature vectors using anomaly detection algorithm based on Mahalanobis distance. When the Mahalanobis distance of a real-time fault feature vector exceeds a preset threshold, the resampling process and feature extraction process are triggered, and the sampling interval is adjusted to a shorter time interval. When a new fault mode is detected, the model parameters are updated through online learning. The historical version data of the real-time fault feature vector is maintained to trace the feature extraction results.

[0064] The beneficial effects of this method include: 1. Improve the accuracy of fault diagnosis: Extracting fault features through deep learning models can more accurately identify equipment faults.

[0065] 2. Improve the efficiency of fault diagnosis: Real-time fault feature extraction and anomaly detection can quickly discover equipment faults and shorten troubleshooting time.

[0066] 3. Reduce the cost of fault diagnosis: Automated fault diagnosis reduces manual intervention and reduces labor costs.

[0067] In an optional implementation, the real-time fault feature vector is matched with the fault feature vector in the fault feature knowledge base for similarity to determine the fault type; and the fault propagation path corresponding to the fault type is analyzed according to the fault processing model to determine the fault impact range, including: Calculate the cosine similarity between the real-time fault feature vector and the historical fault feature vector in the fault feature knowledge base, the cosine similarity is obtained by dividing the dot product of the two feature vectors by the product of the module lengths of the two feature vectors; calculate the weighted Euclidean distance between the real-time fault feature vector and the historical fault feature vector, the weighted Euclidean distance is calculated based on the square root of the sum of the squares of the differences in each dimension of the two feature vectors; calculate the Mahalanobis distance between the real-time fault feature vector and the historical fault feature vector, the Mahalanobis distance is calculated by introducing the covariance matrix; perform weighted fusion of the cosine similarity, the weighted Euclidean distance, and the Mahalanobis distance to obtain a comprehensive similarity score; Sorting the historical fault feature vectors in the fault feature knowledge base in descending order according to the comprehensive similarity score, and selecting a preset number of candidate fault types with the highest scores; calculating the confidence of each candidate fault type according to the comprehensive similarity score and the frequency of occurrence of the candidate fault type in the historical data; Input the comprehensive similarity score and the occurrence frequency into a support vector machine classifier to obtain a probability prediction value of the candidate fault type; when the confidence of the candidate fault type with the highest confidence exceeds a preset confidence threshold, determine the candidate fault type as the current fault type; when the confidence of all the candidate fault types is lower than the preset confidence threshold, mark the current fault as a new fault type; A physical layer propagation graph is constructed based on network topology information, wherein nodes of the physical layer propagation graph represent communication network devices, and edges of the physical layer propagation graph represent physical link connection relationships; propagation probability weights are assigned to the physical link connection relationships based on statistical characteristics of fault propagation in historical fault data; Building a service layer propagation graph based on the service call chain and resource sharing information, wherein the service layer propagation graph describes the dependency relationship between network services; defining a propagation delay parameter for the service dependency relationship in the service layer propagation graph, wherein the propagation delay parameter indicates the time required for a fault to propagate from a source service to a target service; Mapping the current fault type to the source node in the physical layer propagation graph and the business layer propagation graph; performing fault propagation simulation in parallel in the physical layer propagation graph and the business layer propagation graph using an improved breadth-first search algorithm; calculating the spatiotemporal range of fault impact based on the propagation probability weight, the business dependency, and the propagation delay parameter; Maintain a priority queue and prioritize the propagation paths based on the risk factor; predict the spread of the fault at a future time point based on the current propagation state and the historical propagation pattern; compare the predicted impact range with the actual observed fault spread, and update the propagation probability weight and the propagation delay parameter.

[0068] In order to more accurately locate and handle faults in communication networks, this embodiment proposes a fault diagnosis and impact range prediction method based on a fault feature knowledge base and a propagation model.

[0069] First, build a fault feature knowledge base. This knowledge base stores feature vectors of historical faults, as well as corresponding fault types, propagation paths, impact ranges, and other information. Each feature vector consists of multiple dimensions, such as CPU utilization, memory usage, network traffic, error rates, and so on. For newly occurring faults, collect their various performance indicators and build real-time fault feature vectors.

[0070] Next, the fault type is identified. The similarity between the real-time fault feature vector and each historical fault feature vector in the knowledge base is calculated. Three similarity measurement methods are used here: the first method is to calculate the cosine value of the angle between the two vectors; the second method is to calculate the square root of the sum of the squares of the differences between the two vectors in each dimension, and weight the importance of fault type identification according to different dimensions; the third method is the Mahalanobis distance that considers the correlation between each dimension. The three similarities are weighted and fused to obtain a comprehensive similarity score.

[0071] Sort the historical faults in descending order according to the comprehensive similarity score, and select the preset number of candidate fault types with the highest scores. For example, select the five historical faults with the highest scores as candidate fault types. Then, calculate the confidence of each candidate fault type based on the comprehensive similarity score and the frequency of occurrence of the candidate fault type in the historical data. For example, if a candidate fault type has a high comprehensive similarity score, but it rarely appears in the historical data, its confidence will be reduced accordingly.

[0072] To further improve the accuracy, the comprehensive similarity score and the frequency of occurrence are input into a support vector machine classifier to obtain the probability prediction value of each candidate fault type. If the confidence of the candidate fault type with the highest confidence exceeds the preset threshold, such as 80%, the candidate fault type is determined to be the current fault type. If the confidence of all candidate fault types is lower than the preset threshold, the current fault is marked as a new fault type, and its feature vector is added to the fault feature knowledge base for subsequent analysis.

[0073] After determining the fault type, its impact range needs to be predicted. First, a physical layer propagation graph is constructed based on the network topology information. The nodes in the graph represent communication network devices, and the edges represent physical link connection relationships. Based on the statistical characteristics of fault propagation in historical fault data, a propagation probability weight is assigned to each physical link. For example, if a link often propagates faults in historical faults, its propagation probability weight will be higher.

[0074] At the same time, a business layer propagation graph is constructed based on the business call chain and resource sharing information. This graph describes the dependencies between network services. A propagation delay parameter is defined for each business dependency, which represents the time required for the fault to propagate from the source business to the target business.

[0075] The current fault type is mapped to the source node in the physical layer propagation graph and the business layer propagation graph. The improved breadth-first search algorithm is used to perform fault propagation simulation in parallel in the two graphs. During the simulation, the spatial and temporal scope of the fault impact is calculated based on the propagation probability weight, business dependency, and propagation delay parameters. For example, the fault of a device may propagate to other devices through physical links, and may also affect other services through business dependencies.

[0076] To manage fault propagation more effectively, a priority queue is maintained to prioritize propagation paths based on risk factors, which can take into account factors such as the importance of the affected device or service and the speed of fault propagation.

[0077] Based on the current propagation status and historical propagation patterns, predict the spread range of the fault at a future time point. For example, the time series analysis method can be used to predict the fault propagation trend. Compare the predicted impact range with the actual observed fault propagation situation, and update the propagation probability weight and propagation delay parameters based on the comparison results to improve the prediction accuracy.

[0078] For example, a fault occurs in a network, and the real-time fault feature vector collected is [0.8, 0.5, 0.2, 0.9]. After calculating the similarity with the three historical fault feature vectors in the knowledge base [0.7, 0.6, 0.3, 0.8], [0.2, 0.3, 0.8, 0.1], [0.9, 0.4, 0.1, 0.9], the comprehensive similarity scores are 0.95, 0.3, and 0.92 respectively. Select the two candidate fault types with the highest scores, assuming that their frequencies of occurrence in historical data are 0.1 and 0.05 respectively. After calculation, their confidences are 0.85 and 0.75 respectively. Since 0.85 is greater than the preset threshold of 0.8, the current fault type is determined to be the first candidate fault type. Assuming that the source node corresponding to this fault type is device A, through propagation simulation, it is predicted that the fault will propagate to devices B and C and affect services X and Y.

[0079] The beneficial effects of this method can be summarized in the following three aspects: 1. Improve the accuracy and efficiency of fault diagnosis: By combining multiple similarity measurement methods and machine learning techniques, it is possible to more accurately identify fault types, reduce misdiagnosis rates, and improve fault diagnosis efficiency.

[0080] 2. Accurately predict the scope of fault impact: By constructing physical layer and business layer propagation diagrams and combining historical data with real-time data for simulation, the temporal and spatial scope of fault impact can be more accurately predicted, providing a more reliable basis for fault handling.

[0081] 3. Adaptive optimization of prediction model: By comparing the prediction results with the actual situation, the model parameters are continuously updated so that the prediction model can be adaptively adjusted to improve the prediction accuracy and better adapt to changes in the network environment.

[0082] In an optional implementation, based on the fault propagation path, a graph traversal algorithm is used to analyze the upstream and downstream devices of the faulty device in sequence; a fault probability score of each device node is calculated, and the fault probability score is weightedly calculated according to the number of abnormal indicators of the device, the alarm level and the fault duration, including: A depth-first search method is used to traverse the upstream device of the faulty device, loop traversal is avoided by maintaining access marks, and the traversal depth is recorded to control the analysis scope; when the traversal depth exceeds the preset level, the current path information is temporarily stored and backtracked; an improved breadth-first search algorithm is used to traverse the downstream device of the faulty device, and the nodes to be visited are managed through a priority queue, and the priority is determined based on the business importance of the node and the link bandwidth; Count the number of abnormal indicators of the upstream device and the downstream device, and map the continuous indicator values ​​of CPU usage, memory occupancy, and interface packet loss rate into discrete abnormal levels through multi-level threshold intervals; extract the alarm information of the upstream device and the downstream device, and classify the alarm information into emergency alarm, important alarm, and minor alarm according to the severity; calculate the duration and repetition frequency of each level of alarm; The sigmoid function is used to map the number of abnormal indicators to the interval from zero to one to obtain the indicator abnormality score; the hierarchical analysis method is used to construct a judgment matrix, and the relative importance of the emergency alarm, the important alarm, and the minor alarm is calculated to obtain the alarm level weight; the time decay factor is introduced to gradually weaken the influence of the earlier alarm information on the current fault probability; The piecewise function model is used to process the fault duration. For short-term faults, the linear growth rate is increased, for medium-term faults, the growth rate is slowed down. For long-term faults, the self-repair capability of the equipment is considered to make the probability growth tend to be smooth, and the duration score is obtained. The indicator abnormality score, the product of the alarm level weight and the time attenuation factor, and the duration score are respectively multiplied by the corresponding weight coefficient and summed to obtain a fault probability score; the weight coefficient is regularly updated using a sliding time window mechanism; The fault probability score is adjusted based on the physical connection relationship between devices. The devices in series relationship adopt the cumulative effect of fault probability, and the devices in parallel relationship adopt the fault probability supplement mechanism. A fault probability transmission attenuation model is established to reduce the impact of faults as the propagation distance increases. Establish a time series of equipment failure probability, trigger an early warning when the failure probability score of a certain equipment continues to rise; mark the equipment as a high-risk node when the failure probability score exceeds a preset threshold; compare the predicted failure probability score with the actual failure situation, and optimize the weight coefficient.

[0083] Fault diagnosis system embodiment: The system aims to calculate the failure probability score of the equipment by analyzing the fault propagation path between equipment and the abnormal indicators of each equipment, thereby achieving early warning of potential failures.

[0084] First, the system obtains the network topology and real-time performance data of the device. The network topology describes the connection relationship between devices, including device type, connection mode, etc. Real-time performance data includes indicators such as CPU usage, memory usage, interface packet loss rate, and device alarm information, such as alarm level, alarm content, and alarm occurrence time.

[0085] Next, when a device fails, the system uses a graph traversal algorithm to analyze the upstream and downstream devices of the failed device based on the network topology.

[0086] The traversal to the upstream device adopts the depth-first search method. The system maintains an access mark array to record the nodes that have been visited to avoid loop traversal. At the same time, the system records the traversal depth to control the analysis scope. When the traversal depth exceeds the preset level (for example, set to 3 levels), the system temporarily stores the current path information and backtracks.

[0087] The traversal to the downstream device direction adopts an improved breadth-first search algorithm. The system uses a priority queue to manage the nodes to be visited. The priority of the node is determined based on the business importance of the node and the link bandwidth. For example, nodes with high business importance and large link bandwidth have higher priority.

[0088] The system counts the number of abnormal indicators of upstream and downstream devices. For continuous indicator values ​​such as CPU usage, memory occupancy, and interface packet loss rate, the system pre-sets multi-level threshold intervals. For example, CPU usage is divided into three levels: low, medium, and high, and continuous indicator values ​​are mapped to discrete abnormal levels.

[0089] The system extracts the alarm information of upstream and downstream devices, and classifies the alarm information into emergency alarm, major alarm and minor alarm according to the severity. The system records the duration and repetition frequency of each level of alarm.

[0090] The system maps the number of abnormal indicators to a range of 0 to 1 to obtain the indicator abnormality score. For example, the S-type function (Sigmoid function) is used to map the number of abnormal indicators to a range of 0 to 1.

[0091] The system uses the hierarchical analysis method to construct a judgment matrix, calculate the relative importance of emergency alarms, major alarms, and minor alarms, and obtain the weight of the alarm level. For example, the judgment matrix is ​​constructed by expert scoring, and the eigenvector is calculated to obtain the weight of each level of alarm.

[0092] The system introduces a time decay factor to gradually reduce the impact of earlier alarm information on the current fault probability. For example, an exponential decay function is used, and the impact of alarm information gradually decreases as time goes by.

[0093] The system uses a piecewise function model to process fault duration and obtain a duration score. For example, for short-term faults (e.g., duration less than 1 hour), the score increases linearly; for medium-term faults (e.g., duration between 1 hour and 1 day), the score growth rate slows down; for long-term faults (e.g., duration more than 1 day), considering the self-repair capability of the equipment, the score growth tends to be flat.

[0094] The system multiplies the indicator anomaly score, the product of the alarm level weight and the time decay factor, and the duration score by the corresponding weight coefficient and sums them up to obtain the fault probability score. The system uses a sliding time window mechanism to regularly update the weight coefficient. For example, the weight coefficient is recalculated based on historical data at regular intervals (for example, 1 hour).

[0095] The system adjusts the fault probability score based on the physical connection relationship between devices. For devices in a series relationship, the cumulative effect of fault probability is used; for devices in a parallel relationship, the fault probability supplement mechanism is used. The system establishes a fault probability transmission attenuation model so that the impact of the fault decreases as the propagation distance increases. For example, an exponential attenuation function is used, and the impact of the fault gradually decreases as the propagation distance increases.

[0096] The system establishes a time series of equipment failure probabilities. When the failure probability score of a certain equipment continues to rise, an early warning is triggered. When the failure probability score exceeds the preset threshold, the equipment is marked as a high-risk node. The system compares the predicted failure probability score with the actual failure situation and optimizes the weight coefficient.

[0097] Example: Assume that device A fails. Devices B and C are upstream devices of device A, and device D is downstream device of device A. The CPU usage of device B exceeds the high threshold for 2 hours, and there is a major alarm for 1 hour. The interface packet loss rate of device D exceeds the medium threshold for 30 minutes, and there is a minor alarm for 15 minutes. The system calculates the failure probability scores of devices B and D according to the above method.

[0098] Beneficial effects:

[0099] 1. Improve the accuracy of fault warning: By comprehensively considering the abnormal indicators of the equipment, alarm information, fault duration and the connection relationship between the equipment, the failure probability of the equipment can be evaluated more accurately, thereby improving the accuracy of fault warning.

[0100] 2. Shorten troubleshooting time: By analyzing the upstream and downstream devices of the faulty device, the root cause of the fault can be quickly located, thereby shortening the troubleshooting time.

[0101] 3. Reduce the losses caused by failures: By providing early warning of potential failures, timely measures can be taken to avoid failures or mitigate the impact of failures, thereby reducing the losses caused by failures.

[0102] In an optional implementation, determining the device node with the highest fault probability score as the fault root cause device; extracting the fault handling solution corresponding to the fault root cause device from the fault feature knowledge base; and generating a fault tracing report including the fault location process, the fault root cause device and the fault handling solution includes: Establish a time series analysis model for fault probability scores, calculate the changing trend of the fault probability of each device node, and identify the device node that first experiences an abnormality based on the time sequence of the rise in fault probability; construct a Bayesian network based on the physical connection relationship and business dependency relationship of the devices, and evaluate the probability distribution of each device as the root cause of the fault through a backward reasoning algorithm; calculate the correlation coefficient matrix of device failure time to identify device groups with significant time correlation, and perform weighted fusion of the Bayesian reasoning results and the fault probability score to determine the root cause device; Semantically annotate the historical processing solutions in the fault feature knowledge base to establish a multi-dimensional knowledge graph that includes equipment type, fault phenomenon, processing steps, and processing effect; learn the association features between knowledge entities through the graph neural network model; calculate the attribute similarity between the current fault root cause equipment and the equipment in the historical case, extract the key features of the fault indicator and the alarm information, and calculate the matching degree of the fault phenomenon; The execution process of the historical processing scheme is modeled as a state-action sequence, and the optimal processing strategy is learned through the Q-learning algorithm; based on the importance of the equipment, the scope of business impact, and the repair time requirement, the constraint conditions are constructed, and the fault processing scheme with the highest matching degree with the fault root cause equipment is extracted from the fault feature knowledge base; Extract the key event sequence in the fault location process, including the abnormal discovery time, fault diffusion process, and location operation steps; use the template filling method to convert the extracted information into structured report content; record the progress of fault handling in real time, including the executed operation steps, handling effect evaluation, and reasons for solution adjustment; Summarize the fault cases that have been processed, extract fault feature patterns and key points of the processing solutions, and realize the continuous accumulation of fault processing knowledge through dynamic updating of the multi-dimensional knowledge graph; calculate the evaluation score of the processing solution based on the repair time, business impact, and processing cost; optimize the processing solution in the fault feature knowledge base based on the difference between the processing effect and the expected goal; generate a fault tracking report including the fault location process, the fault root cause equipment, and the fault processing solution.

[0103] A fault tracing method is used to quickly locate the root cause of the fault and provide an effective solution. The specific implementation method is as follows: First, collect the real-time operation data of the equipment, including performance indicators, alarm information, log data, etc. For example, collect indicators such as the server's CPU utilization, memory usage, network traffic, disk IO, and indicators such as the packet loss rate and delay of network devices.

[0104] Then, a time series analysis model for the failure probability score is established. The model can use time series analysis methods, such as sliding window averaging, exponential smoothing, etc., to calculate the changing trend of the failure probability of each device node. For example, set a time window of 5 minutes, calculate the average failure probability of each device in the past 5 minutes, and track its changing trend. By comparing the time sequence of the increase in the failure probability of different devices, identify the device node that first has an abnormality. For example, if the CPU utilization of server A starts to rise continuously at 9:00 am, and the CPU utilization of server B starts to rise at 9:05 am, server A is considered to be the device node that first has an abnormality.

[0105] Next, a Bayesian network is constructed based on the physical connection relationship and business dependency relationship of the devices. For example, if server A and server B are connected through a network switch, and server A depends on the database service provided by server B, then the corresponding connection and dependency relationship is established in the Bayesian network. The probability distribution of each device as the root cause of the fault is evaluated through a backward reasoning algorithm. For example, if both server A and server B are abnormal, and server A depends on server B, then the probability of server B being the root cause of the fault is higher.

[0106] At the same time, the correlation coefficient matrix of the equipment failure time is calculated. By analyzing the correlation between the failure time series of different equipment, the equipment group with significant time correlation is identified. For example, if the CPU utilization of server A and server B both peak in the same time period, it is considered that there is a significant time correlation between them. The Bayesian inference result is weightedly fused with the failure probability score to finally determine the root cause device of the failure. For example, if the Bayesian inference probability of server B is 0.8 and the failure probability score is 0.9, its final score is 0.8*0.7+0.9*0.3=0.83.

[0107] Semantically annotate the historical processing solutions in the fault feature knowledge base and establish a multi-dimensional knowledge graph that includes device type, fault phenomenon, processing steps, and processing effects. For example, annotate "restart the server" as a processing step and "CPU utilization returns to normal" as a processing effect. Learn the association features between knowledge entities through the graph neural network model. For example, learn the association between different device types, fault phenomena, and processing solutions.

[0108] Calculate the similarity of the attributes of the current fault root device and the device in the historical case. For example, compare the device type, operating system version, software configuration and other attributes. Extract the key features of the fault indicator and alarm information, and calculate the matching degree of the fault phenomenon. For example, extract key indicators such as CPU utilization and memory usage, and calculate the similarity with the fault phenomenon in the historical case.

[0109] Model the execution process of historical processing solutions as a state-action sequence. For example, model "restart the server" as an action and "CPU utilization returns to normal" as a state. Learn the optimal processing strategy through the Q-learning algorithm. For example, learn which action should be performed in different states to achieve the best processing effect. Construct constraints based on the importance of the device, the scope of business impact, and the repair time requirements. For example, if the device is very important, give priority to the processing solution with lower risk. Extract the fault processing solution with the highest match to the root cause device from the fault feature knowledge base.

[0110] Extract the key event sequence in the fault location process, including the time of abnormal discovery, fault diffusion process, and location operation steps. For example, record key events such as "Abnormal CPU utilization of server A was discovered at 9:00 am", "Server B also had an abnormality at 9:05 am", and "Database connection problems were located through log analysis". Use the template filling method to convert the extracted information into structured report content. Record the progress of fault handling in real time, including the executed operation steps, handling effect evaluation, and reasons for solution adjustment.

[0111] Summarize the fault cases that have been processed and extract the fault feature patterns and key points of the processing solutions. For example, summarize the fault feature pattern of "database connection problems usually lead to increased server CPU utilization". Continuous accumulation of fault handling knowledge is achieved through dynamic updates of multi-dimensional knowledge graphs. Calculate the evaluation score of the processing solution based on the repair time, business impact, and processing cost. For example, if the repair time is short, the business impact is small, and the processing cost is low, the processing solution will score higher. Optimize the processing solution in the fault feature knowledge base based on the difference between the processing effect and the expected goal. Finally, generate a fault tracking report that includes the fault location process, the root cause device of the fault, and the fault processing solution.

[0112] Beneficial effects:

[0113] 1. Improve fault location efficiency: Through timing analysis, Bayesian network reasoning and fault time correlation analysis, the root cause of the fault can be quickly and accurately located, shortening the troubleshooting time.

[0114] 2. Provide accurate processing solutions: Based on multi-dimensional knowledge graphs and graph neural network models, it can extract the processing solutions that best match the current fault from historical cases, thereby improving the efficiency and success rate of fault handling.

[0115] 3. Continuous accumulation of fault handling knowledge: By summarizing and analyzing the fault cases that have been handled, the fault feature knowledge base is continuously improved to achieve continuous accumulation and improvement of fault handling knowledge and enhance overall fault handling capabilities.

[0116] Figure 2 FIG. 1 is a schematic diagram of a communication network operation and maintenance fault location and tracking system according to an embodiment of the present invention. Figure 2 As shown, the system comprises: The first unit is used to collect historical operation data of multiple communication network devices, wherein the historical operation data includes network traffic data, device performance indicator data, and alarm log data; train a deep learning model based on the historical operation data to generate a fault feature vector; associate the fault feature vector with a corresponding fault handling solution and store it to form the fault feature knowledge base; and establish a fault handling model including fault location rules and fault propagation paths according to the fault feature knowledge base; The second unit is used to receive the operation data reported in real time by the communication network equipment, the operation data including network traffic data, equipment performance indicator data and alarm log data; use the deep learning model to extract features of the operation data to generate a real-time fault feature vector; perform similarity matching between the real-time fault feature vector and the fault feature vector in the fault feature knowledge base to determine the fault type; analyze the fault propagation path corresponding to the fault type according to the fault processing model to determine the fault impact range; The third unit is used to analyze the upstream and downstream devices of the faulty device in sequence based on the fault propagation path by using a graph traversal algorithm; calculate the fault probability score of each device node, and the fault probability score is weighted according to the number of abnormal indicators of the device, the alarm level and the fault duration; determine the device node with the highest fault probability score as the root cause device of the fault; extract the fault handling solution corresponding to the root cause device of the fault from the fault feature knowledge base; and generate a fault tracking report including the fault location process, the root cause device of the fault and the fault handling solution.

[0117] According to a third aspect of the embodiments of the present invention, An electronic device is provided, comprising: processor; a memory for storing processor-executable instructions; The processor is configured to call the instructions stored in the memory to execute the aforementioned method.

[0118] A fourth aspect of the embodiments of the present invention is: A computer-readable storage medium is provided, on which computer program instructions are stored. When the computer program instructions are executed by a processor, the aforementioned method is implemented.

[0119] The present invention may be a method, an apparatus, a system and / or a computer program product. The computer program product may include a computer-readable storage medium carrying computer-readable program instructions for executing various aspects of the present invention.

[0120] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for locating and tracking faults in communication network operation and maintenance, characterized in that: include: Collecting historical operation data of multiple communication network devices, wherein the historical operation data includes network traffic data, device performance indicator data and alarm log data; Training a deep learning model based on the historical operation data to generate a fault feature vector; The fault feature vector is associated with the corresponding fault processing solution and stored to form the fault feature knowledge base; Establishing a fault handling model including fault location rules and fault propagation paths according to the fault feature knowledge base; Receive the operation data reported in real time by the communication network equipment, the operation data including network traffic data, equipment performance indicator data and alarm log data; use the deep learning model to extract features from the operation data to generate a real-time fault feature vector; perform similarity matching between the real-time fault feature vector and the fault feature vector in the fault feature knowledge base to determine the fault type; analyze the fault propagation path corresponding to the fault type according to the fault processing model to determine the fault impact range; Based on the fault propagation path, a graph traversal algorithm is used to analyze the upstream and downstream devices of the faulty device in turn; a fault probability score of each device node is calculated, and the fault probability score is weighted according to the number of abnormal indicators of the device, the alarm level and the fault duration; Determine the device node with the highest fault probability score as the root cause device of the fault; extract the fault handling solution corresponding to the root cause device of the fault from the fault feature knowledge base; Generate a fault tracing report that includes the fault location process, the device that caused the fault, and the fault handling solution.

2. The method according to claim 1, characterized in that Training a deep learning model based on the historical operation data to generate a fault feature vector; associating the fault feature vector with a corresponding fault handling solution to form the fault feature knowledge base; Establishing a fault handling model including fault location rules and fault propagation paths according to the fault feature knowledge base includes: Acquire historical operation data of the communication network equipment, the historical operation data including bandwidth utilization data, packet loss rate data, latency data, CPU usage data, memory occupancy data, disk IO data, alarm level data, alarm type data, and alarm duration data; align the historical operation data according to the time series and construct a data input matrix; A long short-term memory network is used to extract time series features from the data input matrix, wherein the long short-term memory network includes three layers of recurrent units, each layer of recurrent units includes one hundred and twenty-eight neurons, and each layer of recurrent units in the long short-term memory network uses a hyperbolic tangent function as an activation function; a forty-eight-hour time window is set by the long short-term memory network, and sliding sampling is performed on the data input matrix to obtain time series pattern features; A multilayer perceptron is used to perform index correlation learning on the time series pattern features, the multilayer perceptron includes four fully connected layers, the number of neurons in the four fully connected layers is 512, 256, 128, and 64, respectively, the first three fully connected layers of the multilayer perceptron use a rectified linear unit function as an activation function, and the last fully connected layer of the multilayer perceptron uses a normalized exponential function for normalization to obtain normalized features; The time series pattern feature and the normalized feature are subjected to feature fusion, and a 64-dimensional fault feature vector is generated by dimensionality reduction processing; a graph database is constructed, the fault feature vector is stored as attribute information of a graph node in the graph database, and the fault handling solution is stored as association information of the graph node; An association rule mining algorithm is used to analyze the association pattern between the fault feature vectors, wherein the minimum support of the association rule mining algorithm is 0.05 and the minimum confidence is 0.

8. Frequent item sets are mined by the association rule mining algorithm to generate fault location rules; a hierarchical fault propagation model is established based on the fault location rules, wherein the hierarchical fault propagation model includes physical connection relationships and business dependency relationships; When a new fault case is received, the fault feature vector in the graph database is updated, and the rule weight of the fault location rule is adjusted online according to the fault repair time using a reinforcement learning method. The fault repair time is used as a reward signal of the reinforcement learning method to achieve dynamic optimization of the fault location strategy.

3. The method according to claim 1, characterized in that Receiving operation data reported in real time by the communication network equipment, the operation data including network traffic data, equipment performance indicator data and alarm log data; extracting features from the operation data using the deep learning model to generate a real-time fault feature vector includes: Deploy a collection agent on the communication network equipment to collect network traffic data through the simple network management protocol, the network traffic data includes interface throughput data, message forwarding rate data, and protocol message statistics data; collect device performance indicator data through the network configuration protocol, the device performance indicator data includes CPU load data, memory usage data, and hardware temperature data; collect alarm log data through the system log protocol, the alarm log data includes device alarm information data, system log data, and operation record data; The collection agent dynamically adjusts the sampling frequency according to the load status of the communication network device. When the communication network device is in a normal state, the sampling interval is five minutes. When the device performance indicator data is detected to be abnormal, the sampling interval is adjusted to one minute; the collected network traffic data, the device performance indicator data, and the alarm log data are deduplicated, zero-filled, and normalized to obtain pre-processed data; The pre-processed data is aligned using a data alignment algorithm based on a time window; missing data in the pre-processed data is compensated by a linear interpolation method; integrity indicators, timeliness indicators, and accuracy indicators of the pre-processed data are calculated to generate a data quality assessment result; The preprocessed data is standardized and a data batch is constructed using a ten-minute sliding time window; the data batch is input into a long short-term memory network to extract time series features; the hidden state of the long short-term memory network is used to maintain historical information; Construct a multi-head self-attention layer, assign attention weights to the network traffic data, the device performance indicator data, and the alarm log data respectively; maintain the original feature information through a residual connection structure; perform feature fusion on the temporal features extracted by the long short-term memory network and the weighted features of the multi-head self-attention layer; The fused features are mapped to a 64-dimensional feature space through a fully connected layer to generate a real-time fault feature vector; the model parameter accuracy is reduced to an eight-bit fixed-point number using a model quantization technique; the density distribution data and variance data of the real-time fault feature vector are calculated; Anomaly detection is performed on the real-time fault feature vector using an anomaly detection algorithm based on Mahalanobis distance. When the Mahalanobis distance of the real-time fault feature vector exceeds a preset threshold, a resampling process and a feature extraction process are triggered. When a new fault mode is detected, model parameters are updated through online learning. Historical version data of the real-time fault feature vector is maintained to trace the feature extraction results.

4. The method according to claim 1, characterized in that: Performing similarity matching between the real-time fault feature vector and the fault feature vector in the fault feature knowledge base to determine the fault type; analyzing the fault propagation path corresponding to the fault type according to the fault processing model to determine the fault impact range includes: Calculate the cosine similarity between the real-time fault feature vector and the historical fault feature vector in the fault feature knowledge base, the cosine similarity is obtained by dividing the dot product of the two feature vectors by the product of the module lengths of the two feature vectors; calculate the weighted Euclidean distance between the real-time fault feature vector and the historical fault feature vector, the weighted Euclidean distance is calculated based on the square root of the sum of the squares of the differences in each dimension of the two feature vectors; calculate the Mahalanobis distance between the real-time fault feature vector and the historical fault feature vector, the Mahalanobis distance is calculated by introducing the covariance matrix; perform weighted fusion of the cosine similarity, the weighted Euclidean distance, and the Mahalanobis distance to obtain a comprehensive similarity score; Sorting the historical fault feature vectors in the fault feature knowledge base in descending order according to the comprehensive similarity score, and selecting a preset number of candidate fault types with the highest scores; calculating the confidence of each candidate fault type according to the comprehensive similarity score and the frequency of occurrence of the candidate fault type in the historical data; Input the comprehensive similarity score and the occurrence frequency into a support vector machine classifier to obtain a probability prediction value of the candidate fault type; when the confidence of the candidate fault type with the highest confidence exceeds a preset confidence threshold, determine the candidate fault type as the current fault type; when the confidence of all the candidate fault types is lower than the preset confidence threshold, mark the current fault as a new fault type; A physical layer propagation graph is constructed based on network topology information, wherein nodes of the physical layer propagation graph represent communication network devices, and edges of the physical layer propagation graph represent physical link connection relationships; propagation probability weights are assigned to the physical link connection relationships based on statistical characteristics of fault propagation in historical fault data; Building a service layer propagation graph based on the service call chain and resource sharing information, wherein the service layer propagation graph describes the dependency relationship between network services; defining a propagation delay parameter for the service dependency relationship in the service layer propagation graph, wherein the propagation delay parameter indicates the time required for a fault to propagate from a source service to a target service; Mapping the current fault type to the source node in the physical layer propagation graph and the business layer propagation graph; performing fault propagation simulation in parallel in the physical layer propagation graph and the business layer propagation graph using an improved breadth-first search algorithm; calculating the spatiotemporal range of fault impact based on the propagation probability weight, the business dependency, and the propagation delay parameter; Maintain a priority queue and prioritize the propagation paths based on the risk factor; predict the spread of the fault at a future time point based on the current propagation state and the historical propagation pattern; compare the predicted impact range with the actual observed fault spread, and update the propagation probability weight and the propagation delay parameter.

5. The method according to claim 1, characterized in that Based on the fault propagation path, the upstream and downstream devices of the faulty device are analyzed in sequence using a graph traversal algorithm; the fault probability score of each device node is calculated, and the fault probability score is weightedly calculated according to the number of abnormal indicators of the device, the alarm level and the fault duration, including: A depth-first search method is used to traverse the upstream device of the faulty device, loop traversal is avoided by maintaining access marks, and the traversal depth is recorded to control the analysis scope; when the traversal depth exceeds the preset level, the current path information is temporarily stored and backtracked; an improved breadth-first search algorithm is used to traverse the downstream device of the faulty device, and the nodes to be visited are managed through a priority queue, and the priority is determined based on the business importance of the node and the link bandwidth; Count the number of abnormal indicators of the upstream device and the downstream device, and map the continuous indicator values ​​of CPU usage, memory occupancy, and interface packet loss rate into discrete abnormal levels through multi-level threshold intervals; extract the alarm information of the upstream device and the downstream device, and classify the alarm information into emergency alarm, important alarm, and minor alarm according to the severity; calculate the duration and repetition frequency of each level of alarm; The sigmoid function is used to map the number of abnormal indicators to the interval from zero to one to obtain the indicator abnormality score; the hierarchical analysis method is used to construct a judgment matrix, and the relative importance of the emergency alarm, the important alarm, and the minor alarm is calculated to obtain the alarm level weight; the time decay factor is introduced to gradually weaken the influence of the earlier alarm information on the current fault probability; The piecewise function model is used to process the fault duration. For short-term faults, the linear growth rate is increased, for medium-term faults, the growth rate is slowed down. For long-term faults, the self-repair capability of the equipment is considered to make the probability growth tend to be smooth, and the duration score is obtained. The indicator abnormality score, the product of the alarm level weight and the time attenuation factor, and the duration score are respectively multiplied by the corresponding weight coefficient and summed to obtain a fault probability score; the weight coefficient is regularly updated using a sliding time window mechanism; The fault probability score is adjusted based on the physical connection relationship between devices. The devices in series relationship adopt the cumulative effect of fault probability, and the devices in parallel relationship adopt the fault probability supplement mechanism. A fault probability transmission attenuation model is established to reduce the impact of faults as the propagation distance increases. Establish a time series of equipment failure probability, trigger an early warning when the failure probability score of a certain equipment continues to rise; mark the equipment as a high-risk node when the failure probability score exceeds a preset threshold; compare the predicted failure probability score with the actual failure situation, and optimize the weight coefficient.

6. The method according to claim 1, characterized in that Determine the device node with the highest fault probability score as the root cause device of the fault; extract the fault handling solution corresponding to the root cause device of the fault from the fault feature knowledge base; Generate a fault tracing report that includes the fault location process, the device that caused the fault, and the fault handling solution, including: Establish a time series analysis model for fault probability scores, calculate the changing trend of the fault probability of each device node, and identify the device node that first experiences an abnormality based on the time sequence of the rise in fault probability; construct a Bayesian network based on the physical connection relationship and business dependency relationship of the devices, and evaluate the probability distribution of each device as the root cause of the fault through a backward reasoning algorithm; calculate the correlation coefficient matrix of device failure time to identify device groups with significant time correlation, and perform weighted fusion of the Bayesian reasoning results and the fault probability score to determine the root cause device; Semantically annotate the historical processing solutions in the fault feature knowledge base to establish a multi-dimensional knowledge graph that includes equipment type, fault phenomenon, processing steps, and processing effect; learn the association features between knowledge entities through the graph neural network model; calculate the attribute similarity between the current fault root cause equipment and the equipment in the historical case, extract the key features of the fault indicator and the alarm information, and calculate the matching degree of the fault phenomenon; The execution process of the historical processing scheme is modeled as a state-action sequence, and the optimal processing strategy is learned through the Q-learning algorithm; based on the importance of the equipment, the scope of business impact, and the repair time requirement, the constraint conditions are constructed, and the fault processing scheme with the highest matching degree with the fault root cause equipment is extracted from the fault feature knowledge base; Extract the key event sequence in the fault location process, including the abnormal discovery time, fault diffusion process, and location operation steps; use the template filling method to convert the extracted information into structured report content; record the progress of fault handling in real time, including the executed operation steps, handling effect evaluation, and reasons for solution adjustment; Summarize the fault cases that have been processed, extract fault feature patterns and key points of the processing solutions, and realize the continuous accumulation of fault processing knowledge through dynamic updating of the multi-dimensional knowledge graph; calculate the evaluation score of the processing solution based on the repair time, business impact, and processing cost; optimize the processing solution in the fault feature knowledge base based on the difference between the processing effect and the expected goal; generate a fault tracking report including the fault location process, the fault root cause equipment, and the fault processing solution.

7. A communication network operation and maintenance fault location and tracking system, used to implement the method according to any one of claims 1 to 6, characterized in that: include: The first unit is used to collect historical operation data of multiple communication network devices, wherein the historical operation data includes network traffic data, device performance indicator data and alarm log data; train a deep learning model based on the historical operation data to generate a fault feature vector; The fault feature vector is associated with the corresponding fault processing solution and stored to form the fault feature knowledge base; Establishing a fault handling model including fault location rules and fault propagation paths according to the fault feature knowledge base; The second unit is used to receive the operation data reported in real time by the communication network equipment, the operation data including network traffic data, equipment performance indicator data and alarm log data; use the deep learning model to extract features of the operation data to generate a real-time fault feature vector; perform similarity matching between the real-time fault feature vector and the fault feature vector in the fault feature knowledge base to determine the fault type; analyze the fault propagation path corresponding to the fault type according to the fault processing model to determine the fault impact range; The third unit is used to analyze the upstream and downstream devices of the faulty device in sequence based on the fault propagation path by using a graph traversal algorithm; calculate the fault probability score of each device node, wherein the fault probability score is weightedly calculated according to the number of abnormal indicators of the device, the alarm level and the fault duration; Determine the device node with the highest fault probability score as the root cause device of the fault; extract the fault handling solution corresponding to the root cause device of the fault from the fault feature knowledge base; Generate a fault tracing report that includes the fault location process, the device that caused the fault, and the fault handling solution.

8. An electronic device, characterized in that: include: processor; a memory for storing processor-executable instructions; The processor is configured to call the instructions stored in the memory to execute the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having computer program instructions stored thereon, characterized in that: When the computer program instructions are executed by a processor, the method according to any one of claims 1 to 6 is implemented.

Images