Virtualized network fault rapid positioning method fusing multi-source information

Abstract

The invention provides a multi-source information fused virtualized network fault rapid positioning method, and relates to the technical field of electric digital data processing, and the method comprises the steps: classifying and sorting historical fault events, constructing a historical dynamic evaluation model, correcting a calibration index, capturing equipment performance changes and abnormities, and enhancing the fault recognition capability. Similar faults are accurately classified and preferentially processed according to severity; in the real-time monitoring stage, real-time multi-source and abnormal data are combined, a real-time dynamic evaluation model and a correction calibration index are calculated, a ratio is applied to calculate a fine adjustment strategy, the real-time performance and accuracy of fault positioning are remarkably improved, and network dynamic changes are quickly responded. And carrying out difference analysis on the adjusted real-time model and the historical model, calibrating a preliminary fault positioning result, and improving the positioning precision and reliability.

Description

Technical Field

[0001] The present invention relates to the technical field of electronic digital data processing, and in particular to a method for quickly locating virtualized network faults by integrating multi-source information. Background Art

[0002] With the rapid development of cloud computing and virtualization technology, virtualized networks have become an important part of modern information technology infrastructure. Virtualized networks achieve efficient resource utilization and flexible management by creating multiple virtual network environments on physical hardware resources. However, with the expansion of virtual network scale and the increase of complexity, the detection and location of network faults have become increasingly challenging. Traditional fault detection methods mostly rely on a single data source, such as network traffic monitoring or topology information analysis. This single-dimensional data analysis method is often difficult to fully reflect the network operation status when facing a complex and changing network environment. In addition, with the widespread application of the Internet of Things and user behavior data, the fusion analysis of multi-source information has gradually become a key means to improve the accuracy and response speed of network fault location. In recent years, multi-source information fusion methods based on big data analysis and machine learning technology have made certain progress in the field of network fault detection and location, but there are still many shortcomings in practical applications.

[0003] In the prior art, the publication number is CN107451040B, and the name is a method for locating the cause of a fault. The locating method is applied to a virtualization platform, and the virtualization environment in which the virtualization platform is located includes multiple physical devices and networks. The locating method includes: the virtualization platform obtains information generated in the virtualization environment, wherein the information includes historical alarm events and current operating status information; the obtained information is analyzed using a pre-stored analysis strategy; and the fault cause corresponding to the information is located through the analysis result. The present invention also discloses a device for locating the cause of a fault and a computer-readable storage medium. The present invention improves the efficiency of locating the cause of a fault and improves the accuracy of locating the cause of a fault.

[0004] The existing multi-source information fusion methods mainly face problems such as insufficient data heterogeneity processing, poor real-time performance, and low fault location accuracy in virtualized network fault location. First, there is a large heterogeneity between different data sources, and how to effectively integrate network traffic, topology information, environmental monitoring data, and user behavior data has become a major problem. Secondly, when processing large-scale real-time data, traditional methods have high computational complexity and are difficult to achieve rapid response, resulting in insufficient real-time performance of fault location. In addition, existing methods often lack a systematic dynamic adjustment mechanism in terms of fault classification and severity assessment, and are difficult to adapt to dynamic changes in the network environment. These deficiencies limit the application effect of existing technologies in complex virtualized network environments.

[0005] The above information disclosed in the above Background section is only for enhancement of understanding of the background of the present disclosure and therefore it may contain information that does not form the prior art that is already known to one of ordinary skill in the art. Summary of the invention

[0006] The purpose of the present invention is to provide a method for quickly locating virtualized network faults by integrating multi-source information, so as to solve the problems raised in the above-mentioned background technology.

[0007] To achieve the above object, the present invention provides the following technical solutions: A virtualized network fault rapid location method integrating multi-source information, the specific steps comprising: Step S1: in the previous monitoring time period, obtaining historical multi-source data and historical operation abnormality data of each virtual device in the virtualized network environment when a failure event occurs, wherein the historical multi-source data includes but is not limited to network traffic data, topology information, environment monitoring data and user behavior data; Historical operation abnormality data includes but is not limited to time synchronization deviation, network protocol abnormality indicators, and resource isolation status indicators; Step S2: classify and mark the fault events of each virtual device that occurred in the previous monitoring time period, classify the fault events of the same fault type into the same sequence set, and sort the fault events in each sequence set according to the severity of the fault events; Step S3: Under the fault event of the same sequence set, extract the multi-source data corresponding to the current virtual device from the historical multi-source data, analyze these multi-source data, and calculate a historical dynamic evaluation model for evaluating the performance change trend of the current virtual device; the historical dynamic evaluation model is composed of a traffic anomaly index, a topology change index, an environmental impact index, and a user behavior deviation index; Step S4: Under the fault event of the same sequence set, the operation abnormality data corresponding to the current virtual device is extracted from the historical operation abnormality data, and the operation abnormality data is analyzed to calculate the historical correction calibration index used to evaluate the abnormal change degree of the current virtual device; Step S5: In the current monitoring time period, the multi-source data and operation abnormality data collected by the current virtual device are analyzed, and the real-time dynamic evaluation model and the real-time correction calibration index corresponding to the current virtual device are calculated respectively, and the real-time correction calibration index is calculated by ratio with the historical correction calibration index, and based on the ratio calculation result, a fine-tuning strategy is provided for each index in the real-time dynamic evaluation model; Step S6: obtaining the real-time dynamic evaluation model adjusted by the fine-tuning strategy, and evaluating the severity of the fault type, thereby forming a preliminary fault location result; The adjusted real-time dynamic evaluation model is compared and analyzed with the historical dynamic evaluation model, and based on the comparison and analysis results, a calibration strategy is provided for the corresponding preliminary fault positioning results.

[0008] Furthermore, the calculation of the historical dynamic evaluation model specifically includes: Define the output value of the historical dynamic evaluation model of the i-th virtual device under the j-th fault type as , the calculation formula is as follows: ; in, It represents the comprehensive evaluation result of the i-th virtual device under the j-th fault type, and its value range is between (0,1); is the traffic anomaly index, which measures the degree of network traffic anomaly of the i-th virtual device under the j-th fault type; the value range is ; ; It is the topology change index, which indicates the degree of topology change of the i-th virtual device under the j-th fault type; the value range is ; Indicates the maximum value of the topology change index; ; is the environmental impact index, which reflects the degree of deviation of the environmental monitoring data of the i-th virtual device under the j-th fault type; the value range is ; ; is the user behavior deviation index, which indicates the abnormal degree of user behavior of the i-th virtual device under the j-th fault type; the value range is ; ; a1 is the flow anomaly weight coefficient, which determines the influence of the flow anomaly index in the comprehensive evaluation; the value range is 0 <a1<1; a2 is the topological change weight coefficient, which determines the influence of the topological change index in the comprehensive evaluation; the value range is 0 <a2<1; y is the nonlinear adjustment factor of the flow anomaly index, which enhances the nonlinear effect of the flow anomaly index on the evaluation; the value range is y>0; a3 is the environmental impact weight coefficient, which determines the influence of the environmental impact index in the comprehensive evaluation; the value range is 0 <a3<1; a4 is the user behavior deviation weight coefficient, which determines the influence of the user behavior deviation index in the comprehensive evaluation; the value range is 0 <a4<1; It is the maximum value of the topology change index, which is used to standardize the topology change index. Its value is the theoretical or empirical maximum value of the topology change index. It is the environmental impact benchmark value, which is used to standardize the environmental impact index; the value is the normal benchmark value of environmental monitoring data; when The closer it is to 0, the better the virtual device performs under this fault type. Historical data shows that the performance is stable without significant abnormalities. when The closer it is to 1, the more abnormal the virtual device is under this fault type, and historical data shows that the performance fluctuates greatly.

[0009] Compared with the prior art, the present invention has the following beneficial effects: by collecting and cleaning multi-source data, including network traffic, topology information, environmental monitoring, and user behavior data, during the monitoring period before a fault occurs, the accuracy and consistency of the data are ensured; the integration of such multi-dimensional data improves the comprehensiveness of fault detection and can more meticulously reflect the operating status of the virtualized network; Secondly, by classifying and sorting historical fault events, a historical dynamic evaluation model and correction calibration index were constructed, which effectively captured the performance change trend and abnormal change degree of virtual equipment; this process enhanced the ability to identify fault events, so that similar faults can be accurately classified and prioritized according to severity; During the real-time monitoring stage, the real-time dynamic evaluation model and the correction calibration index are calculated by combining real-time multi-source data and operation abnormality data, and the fine-tuning strategy is applied through ratio calculation; this mechanism significantly improves the real-time and accuracy of fault location, and can quickly respond to dynamic changes in the network environment; in addition, through the difference analysis between the adjusted real-time dynamic evaluation model and the historical model, the calibration of the preliminary fault location results is achieved, further improving the positioning accuracy and reliability. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] Figure 1 The overall process flow diagram of the present invention is shown in FIG. DETAILED DESCRIPTION In order to make the objectives, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with specific embodiments.

[0011] It should be noted that, unless otherwise defined, the technical terms or scientific terms used in the present invention should be understood by people with ordinary skills in the field to which the present invention belongs. The words "first", "second" and similar words used in the present invention do not indicate any order, quantity or importance, but are only used to distinguish different components. "Include" or "comprise" and similar words mean that the elements or objects appearing before the word include the elements or objects listed after the word and their equivalents, without excluding other elements or objects. "Connect" or "connected" and similar words are not limited to physical or mechanical connections, but may include electrical connections, whether direct or indirect. "Up", "down", "left", "right" and the like are only used to indicate relative positional relationships. When the absolute position of the described object changes, the relative positional relationship may also change accordingly. Embodiment 1

[0012] See also Figure 1 , the present invention provides a technical solution: A method for quickly locating virtualized network faults, characterized in that the method comprises the following steps: Step S1: in the previous monitoring time period, obtaining historical multi-source data and historical operation abnormality data of each virtual device in the virtualized network environment when a failure event occurs, wherein the historical multi-source data includes but is not limited to network traffic data, topology information, environment monitoring data and user behavior data; Historical operation abnormality data includes but is not limited to time synchronization deviation, network protocol abnormality indicators, and resource isolation status indicators; Perform data cleaning on these data to ensure data accuracy and consistency; Step S2: classify and mark the fault events of each virtual device that occurred in the previous monitoring time period, classify the fault events of the same fault type into the same sequence set, and sort the fault events in each sequence set according to the severity of the fault events; Step S3: Under the fault event of the same sequence set, extract the multi-source data corresponding to the current virtual device from the historical multi-source data, analyze these multi-source data, and calculate a historical dynamic evaluation model for evaluating the performance change trend of the current virtual device; the historical dynamic evaluation model is composed of a traffic anomaly index, a topology change index, an environmental impact index, and a user behavior deviation index; Step S4: Under the fault event of the same sequence set, the operation abnormality data corresponding to the current virtual device is extracted from the historical operation abnormality data, and the operation abnormality data is analyzed to calculate the historical correction calibration index used to evaluate the abnormal change degree of the current virtual device; Step S5: In the current monitoring time period, the multi-source data and operation abnormality data collected by the current virtual device are analyzed, and the real-time dynamic evaluation model and the real-time correction calibration index corresponding to the current virtual device are calculated respectively, and the real-time correction calibration index is calculated by ratio with the historical correction calibration index, and based on the ratio calculation result, a fine-tuning strategy is provided for each index in the real-time dynamic evaluation model; Step S6: Obtain the real-time dynamic evaluation model after fine-tuning the strategy, and evaluate the severity of the fault type, thereby forming a preliminary fault location result.

[0013] The adjusted real-time dynamic evaluation model is compared and analyzed with the historical dynamic evaluation model, and based on the comparison and analysis results, a calibration strategy is provided for the corresponding preliminary fault positioning results.

[0014] Further explanation: the acquisition of historical multi-source data and historical operation abnormality data specifically includes: 1.1) Determine the monitoring time window: Select time period: Set the previous monitoring time period to the past week or year. The specific time is determined based on the occurrence of the fault event. It is necessary to ensure that the selected previous monitoring time period includes the possible fault problems of each virtual device in the virtualized network environment. Time stamp: record the specific time when the previous monitoring period starts and ends to ensure the consistency and integrity of the data; 1.2) Acquisition of multi-source data: Description of network traffic data: It is obtained through the network monitoring system. In this embodiment, it is obtained through NetFlow and sFlow; NetFlow is a network traffic monitoring protocol developed by Cisco that is designed to collect and analyze IP traffic information. By recording detailed information about data flows on network devices, such as source and destination IP addresses, transport protocols, port numbers, number of bytes, and number of packets, NetFlow helps network administrators monitor network performance, identify abnormal traffic, and perform bandwidth management. sFlow is an open standard network monitoring protocol that aims to provide real-time traffic and performance analysis through random sampling. It can be implemented on a variety of network devices. By sampling network traffic, sFlow can effectively monitor high-bandwidth environments and help administrators analyze network performance, user behavior, and security status with little impact on network performance. The network traffic data represents the number of packets per virtual device under the failure event; Description of topology information: extracted from the SDN controller of the network management system; The SDN controller is the core component of the network management system, responsible for the centralized management and control of network resources and traffic. It provides an abstraction layer that enables network administrators to dynamically configure and manage the network programmatically, thereby achieving flexible traffic management, automated configuration, real-time monitoring, and the ability to quickly adapt to changes in network requirements. The topology information indicates the number of times the connection relationship of the virtual devices changes; Description of environmental monitoring data: The data is obtained through physical and virtual environment monitoring tools. In this embodiment, Nagios and Zabbix are used to obtain the data. Nagios is a monitoring system based on a master-slave architecture. It uses its core monitoring engine to periodically send requests to the monitored object to obtain its status information. By using the plug-in mechanism, Nagios can perform various checks and determine the health status of the system through preset thresholds and conditions, thereby achieving fault detection and performance monitoring; Zabbix is ​​a monitoring solution based on agent and agentless models. It adopts a distributed architecture and collects performance data from monitored devices through the Zabbix server. It combines active and passive data collection methods, uses a time series database to store monitoring data, and analyzes data through predefined triggers and thresholds to monitor and alert system status in real time. Environmental monitoring data, including: CPU usage, memory usage, network latency; Description of user behavior data: collected through the log analysis tool ELKStack; User behavior data indicates the frequency of user requests; 1.3) Acquisition of abnormal operation data: The time synchronization deviation is the time difference between the internal clock of the virtual device and the standard time. In this embodiment, the standard time is based on the NTP server. The time synchronization deviation is calculated as follows: time synchronization deviation = virtual device clock time - standard time. When the deviation is within ±10 milliseconds, the time synchronization is normal; when the deviation exceeds ±10 milliseconds but is less than ±100 milliseconds, the time synchronization is slightly abnormal; When the deviation exceeds ±100 milliseconds, time synchronization is seriously abnormal; Obtain the time synchronization deviation of each virtual device through the time synchronization protocol monitoring tool; specifically, obtain it through Chrony and NTP monitoring; Chrony is a tool for network time synchronization, mainly used to maintain the accuracy of system time in unstable or unreliable network environments. It obtains standard time information from the NTP server regularly and calculates the deviation between the system time and the real time. Chrony uses a complex algorithm to adjust the system clock, which can quickly adapt to network delays or clock drifts. It also supports fast synchronization of time at system startup, and continuously monitors and corrects time deviations, thereby ensuring high accuracy and stability of system time. NTP (Network Time Protocol): NTP is a protocol used to synchronize time in computer networks. It works by coordinating the clocks of various devices through a hierarchical time source structure, namely a time server. The NTP client sends a request to the NTP server, and the server returns its current time information. The client calculates the time deviation based on the received timestamp and network delay, and adjusts the local system clock accordingly. The NTP protocol adopts a hierarchical structure and is divided into multiple levels, from stratum0 to stratum15. The closer the server is to stratum0, the more accurate the time is, thus meeting a wide range of time synchronization needs. The network protocol anomaly index is the abnormal packet rate of abnormal behavior in the network protocol stack; abnormal packet rate = (abnormal packet number / total packet number) × 100%; abnormal packets include: format error packets, illegal protocol packets, and duplicate packets; Abnormal packet rate <1%: normal; 1%≤abnormal packet rate <5%: slight abnormality; abnormal packet rate ≥5%: serious abnormality; Monitor and record abnormal protocol events through protocol analysis tools such as Wireshark and Snort; Wireshark is a network protocol analysis tool that analyzes the behavior of various protocols by capturing and recording network traffic. Its working principle is to set the network interface to promiscuous mode and obtain all data packets passing through the interface. Wireshark captures these data packets in real time and stores them as packet capture files. Users can use Wireshark's powerful parsing function to view detailed information about each data packet, including protocol headers, data content, and timestamps, so as to identify and analyze abnormal behaviors and potential problems in network traffic. In addition, Wireshark provides a variety of filters and statistical functions, allowing users to efficiently focus on specific traffic or abnormal events. Snort is an open source intrusion detection and prevention system, which is mainly used for real-time monitoring and analysis of network traffic to detect abnormal protocol events. Its working principle is to monitor the traffic in and out of the network by capturing network packets, and compare it with the preset rule set. Snort can identify a variety of network attacks and abnormal behaviors, such as protocol errors, malicious data packets, etc. When the captured traffic matches the rules, Snort will generate an alarm and record relevant information and events. By configuring different detection rules, users can customize the monitoring scope of Snort to effectively detect and respond to various network security threats.

[0015] The resource isolation status indicator is the effectiveness of resource isolation between virtual devices, which is expressed by the resource isolation degree. The resource isolation degree is calculated as follows: CPU isolation = (CPU resources dedicated to virtual devices / total allocated CPU resources) × 100%; Memory isolation = (virtual device dedicated memory / total allocated memory) × 100%; Storage isolation = (virtual device dedicated storage space / total allocated storage space) × 100%; Resource isolation = (CPU isolation + memory isolation + storage isolation) / 3; Resource isolation degree ≥ 95%: efficient isolation; 90%≤Resource isolation<95%: medium isolation; Resource isolation degree < 90%: inefficient isolation; And the resource isolation status indicators also include CPU usage and memory usage; Obtain resource allocation and usage through VMware vSphere and KVM monitoring tools on the virtualization management platform, and calculate isolation metrics; VMware vSphere is a comprehensive virtualization management platform designed to provide virtual machine creation, management and monitoring capabilities. Its core components include ESXi virtualization hosts and vCenter Server management tools. vSphere uses the concept of resource pools to divide the CPU, memory and storage resources of physical servers into multiple virtual resource pools for use by different virtual machines. Through the vSphere Client, administrators can monitor the resource usage of each virtual machine in real time and analyze resource allocation and usage efficiency through performance charts and reports. In addition, vSphere also supports resource allocation policies such as resource limits, sharing and reservations to ensure resource isolation between different virtual machines, thereby improving the stability and performance of the overall environment. KVM (Kernel-based Virtual Machine): KVM is a virtualization technology based on the Linux kernel that allows the Linux system to be transformed into a virtualization host. KVM implements resource isolation by treating each virtual machine as an independent process. It uses the scheduler and memory management functions of Linux to ensure that each virtual machine has independent resource allocation in terms of CPU, memory, and storage. When used with the management tools libvirt and OpenStack, KVM can provide detailed resource monitoring and management capabilities. Administrators can view the resource usage of each virtual machine and make dynamic adjustments; the isolation effectiveness of KVM can be further enhanced through control groups represented by cgroups, allowing the system to have more fine-grained control over resource limits to ensure that different virtual machines do not affect each other.

[0016] Data cleaning and preprocessing: 2.1 Data cleaning: De-duplicate data: Identify and delete duplicate records to ensure that each piece of data is unique; Filling missing values: Use interpolation, mean filling or prediction model to fill missing data. The specific method is selected according to the data type and the degree of missingness; Correct erroneous data: Set a reasonable threshold range, identify and correct abnormal data points that exceed the range; network traffic should not be negative, and time synchronization deviation should not exceed the preset maximum value; 2.2 Data formatting: Unified data format: Convert all data into a unified CSV or JSON format to ensure that field names and data types are consistent; Standardize or normalize numerical data to eliminate the impact of dimension and facilitate subsequent analysis; 2.3 Data Synchronization: Timestamp alignment: align multi-source data according to a unified timestamp, use interpolation to fill in missing time points, and ensure time consistency of different data sources; Time window division: Divide the data into time windows of fixed length to facilitate subsequent time series analysis.

[0017] Each virtual device is assigned a unique identifier to form {1,2,…,i,…,n}, where i represents the index of virtual device i, n represents the total number of virtual devices, and i∈{1,2,…,n}.

[0018] Establish a mapping relationship between the virtual device number and the device name, IP address, and related information to facilitate subsequent data association and query; The identifier of each virtual device is associated with its corresponding multi-source data and operation abnormality data to form a structured data set.

[0019] Use NoSQL database in relational database to store associated data to ensure data accessibility and query efficiency; Further explanation: the fault events of each virtual device that occurred in the previous monitoring period are classified and marked and sorted, including: Based on experimental demonstration or expert group system analysis, set corresponding fault judgment thresholds for the time synchronization deviation, network protocol abnormality index and resource isolation status index of virtual device i in the previous monitoring period ; Marking Exceeded Any event that exceeds the fault judgment threshold is regarded as a fault event; In this embodiment, the fault judgment thresholds corresponding to the time synchronization deviation, the network protocol abnormality index, and the resource isolation status index are respectively set as follows: the time synchronization deviation exceeds 5 seconds, the network protocol abnormality packet rate exceeds 1%, and the resource isolation degree is less than 90%; Record the detected fault events in the fault event table, including the event occurrence time, virtual device number, fault type, and abnormal operation data; The K-Means clustering algorithm is used to determine the optimal number of clusters K through the Elbow Method to ensure that the fault events within each cluster have high similarity; Cluster these fault events and classify the fault events with similar characteristics into the same category; Use the Silhouette Coefficient to evaluate the clustering effect and ensure the rationality of the clustering; Professionals will review the clustering results to ensure the accuracy and practical significance of the classification; The specific clustering steps are as follows: Step 1: Data Preparation: Data collection: Based on marking over Any event that exceeds a fault judgment threshold is regarded as a fault event; the fault event data include fault type, fault duration, number of affected devices, and fault frequency characteristics.

[0020] Data preprocessing: Cleaning data: handling missing values, duplicate data, and outliers to ensure data integrity and accuracy.

[0021] Standardized data: Each feature is standardized to eliminate the impact of different feature scales on the clustering results and ensure that the comparison of each fault event is reasonable.

[0022] Step 2: Determine the optimal number of clusters K: Select K value range: Select a reasonable K value range. In this embodiment, the K value range is 1 to 10.

[0023] Calculate clustering results: For each K value, run the K-Means clustering algorithm and record the total variance within the cluster (SSE, SumofSquaredErrors) corresponding to each K.

[0024] Elbow rule analysis: Plot the K value and the corresponding SSE into a graph and observe the trend in the graph that the SSE decreases as the K value increases.

[0025] The K value at the elbow is the best choice, after which the reduction in SSE decreases significantly, indicating diminishing returns from increasing the number of clusters.

[0026] Step 3: K-Means Clustering: Select the optimal K value: The K value selected according to the elbow rule is used as the number of clusters.

[0027] Run the K-Means algorithm: initialize K cluster centers.

[0028] Assign each failure event to its nearest cluster center.

[0029] Update the cluster center to the mean of all fault events currently assigned to the cluster.

[0030] Repeat the assignment and update until the cluster center no longer changes or the change is less than the set threshold.

[0031] Step 4: Result analysis and visualization: Clustering result analysis: Check the members of each cluster to ensure that the fault events within each cluster have high similarity, especially focusing on the characteristics of the fault type.

[0032] The number of fault events in each cluster and the distribution of fault types in each cluster are counted, and the relationship between fault types is analyzed.

[0033] Visualize clustering results: Use scatter plots, heat maps, or other visualization tools to display clustering results, making it easier to observe the distribution and characteristics of clusters, especially the distribution of different fault types in clusters.

[0034] Step 5: Apply clustering results: Fault type classification: According to the clustering results, fault events in the same cluster are classified into the same fault type, and each cluster represents a fault feature.

[0035] The thresholds and other values ​​required in the above clustering process are determined based on the expert group system through experimental data and will not be described in detail. According to the clustering results, the fault events of the same fault type are divided into the same sequence set; Each sequence set represents a fault type and contains all fault events belonging to this type. The number of all fault types divided is set to M, and the index of any fault type is represented by j, so j∈{1,2,…,M}; The sequence set of fault events is represented as {1, 2, ..., h, ..., M}; where h represents the index of the h-th fault event, H represents the H-th fault event, and H is the total number of fault events in the sequence set; The fault events in each sequence set are sorted according to the sorting indicators, which include: impact duration score, impact range score, and fault frequency score; The impact duration score refers to the degree of impact of the fault duration on the sorting results. The longer the fault duration, the higher the impact duration score, which reflects that the fault has a greater impact on the system. Value range: Score 0: The fault duration is 0, indicating no impact.

[0036] The score is 0.2: the fault duration is short, which is less than 1 hour in this embodiment, and the impact is limited.

[0037] The score is 0.4: the fault duration is medium, which is set to 1 hour to 2 hours in this embodiment, and has a certain impact on the system.

[0038] The score is 0.6: the fault duration is relatively long, which is set to 2 to 4 hours in this embodiment, and the impact is significant.

[0039] The score is 0.8: the fault duration is very long, which is set to 4 to 8 hours in this embodiment, and has a large impact.

[0040] The score is 1: the fault duration is extremely long, which is set to exceed 8 hours in this embodiment, causing serious impact on the system.

[0041] The impact range score is the number of virtual devices affected by the fault. The more virtual devices affected, the higher the corresponding score, indicating that the fault has a wider impact on the system. Value range: Score of 0: No virtual device is affected, indicating that the fault impact is 0.

[0042] Score 0.2: Affects 1 virtual device, which is a very limited impact.

[0043] Score of 0.4: 2-3 virtual devices are affected, which is a minor impact.

[0044] The score is 0.6: 4 to 6 virtual devices are affected, which is a medium impact.

[0045] The score is 0.8: 7 to 9 virtual devices are affected, which is a large impact.

[0046] Score of 1: 10 or more virtual devices are affected, with a wide impact range.

[0047] The fault frequency score refers to the number of times a fault occurred during the previous monitoring period, reflecting the commonness of the fault. The more times a fault occurs, the higher the corresponding score, indicating that the fault affects the ranking results more frequently. Value range: Score 0: The number of fault occurrences is 0, indicating no faults.

[0048] Score 0.2: Failure occurred 1-2 times with minor impact.

[0049] Score 0.4: Failures occurred 3-4 times with moderate impact.

[0050] Score 0.6: Failures occurred 5-6 times and had significant impact.

[0051] Score of 0.8: Failures occurred 7-9 times, with a significant impact.

[0052] Score 1: The fault occurs 10 times or more and frequently affects the system.

[0053] According to actual needs and business importance, weights are set for each indicator in the sorting indicator corresponding to the jth fault type under the i-th virtual device. The formula is as follows: ; in represents the comprehensive score of the jth fault type under the i-th virtual device, are the impact duration score, impact range score, and fault frequency score of the jth fault type under the i-th virtual device, respectively, and The value range of is [0,1]; is the weight of each indicator, ;and The value range is in the interval (0,1); According to the comprehensive score results of fault events of the same fault type, the fault events in each sequence set are sorted in descending order, and fault events with high scores are processed first.

[0054] Design a dedicated fault event database, including the following table structure: Fault event table: records detailed information of each fault event; Sequence set table: records the fault type and fault event number of each sequence set; Sorting result table: records the sorting results and comprehensive scores of fault events in each sequence set; The data storage tool uses the relational database PostgreSQL for storage to ensure data structuring and query efficiency.

[0055] To further illustrate, the calculation of the historical dynamic evaluation model specifically includes: Define the output value of the historical dynamic evaluation model of the i-th virtual device under the j-th fault type as , the calculation formula is as follows: ; in, It represents the comprehensive evaluation result of the i-th virtual device under the j-th fault type, and its value range is between (0,1); is the traffic anomaly index, which measures the degree of network traffic anomaly of the i-th virtual device under the j-th fault type; the value range is ; ; represents the average value of network traffic data of all fault events under the jth fault type of the i-th virtual device; represents the standard deviation of network traffic data under the jth fault type of the i-th virtual device; It indicates the fluctuation degree of network traffic index around the mean value, reflecting the discrete degree of traffic data; represents the network traffic data of the hth fault event under the jth fault type of the i-th virtual device; Indicates the larger of the normalized value and 0; The role is to suppress negative values: if the flow of a fault event is lower than the average level, that is, , then it is taken as 0; this means that only the abnormal traffic above the average level is focused on, while the situation below the average is ignored; By considering only positive deviations, fault events where the flow rate is significantly higher than the average can be highlighted, helping to identify potential anomalies or critical issues; It is the topology change index, which indicates the degree of change of the topology information of the i-th virtual device under the j-th fault type; the value range is ; Indicates the maximum value of the topology change index; ; represents the average value of the topology information of all fault events under the jth fault type of the i-th virtual device; represents the standard deviation of the topology information under the jth fault type of the i-th virtual device; Indicates the number of times the virtual device connection relationship corresponding to the topology information of the hth fault event changes under the jth fault type of the i-th virtual device; Indicates the larger of the normalized value and 0; Indicates that the smaller value is selected; is the environmental impact index, which reflects the degree of deviation of the environmental monitoring data of the i-th virtual device under the j-th fault type; the value range is ; ; represents the average value of the environmental monitoring data of all fault events under the jth fault type of the i-th virtual device; represents the standard deviation of the environmental monitoring data under the jth fault type of the i-th virtual device; It represents the environmental monitoring data of the hth fault event under the jth fault type of the i-th virtual device. The calculation formula of the environmental monitoring data is: ; They represent the CPU usage, memory usage, and network delay of the i-th virtual device under the j-th fault type; is the user behavior deviation index, which indicates the abnormal degree of user behavior of the i-th virtual device under the j-th fault type; the value range is ; ; represents the average value of the request access frequency of all fault events under the jth fault type of the i-th virtual device; represents the standard deviation of the request access frequency under the jth fault type of the i-th virtual device; represents the request access frequency of the hth fault event under the jth fault type of the i-th virtual device; Indicates the larger of the normalized value and 0; a1 is the flow anomaly weight coefficient, which determines the influence of the flow anomaly index in the comprehensive evaluation; the value range is ; a2 is the topological change weight coefficient, which determines the influence of the topological change index in the comprehensive evaluation; the value range is ; y is the nonlinear adjustment factor of the flow anomaly index, which enhances the nonlinear effect of the flow anomaly index on the evaluation; the value range is y>0; a3 is the environmental impact weight coefficient, which determines the influence of the environmental impact index in the comprehensive evaluation; the value range is ; a4 is the user behavior deviation weight coefficient, which determines the influence of the user behavior deviation index in the comprehensive evaluation; the value range is ; It is the maximum value of the topology change index, which is used to standardize the topology change index. Its value is the theoretical or empirical maximum value of the topology change index. Based on historical data analysis, an acceptable maximum value is determined by counting the number of topology changes under similar circumstances in the previous monitoring period; It can also be set through expert experience or domain knowledge, reflecting the maximum topology change experienced by the virtual device under the current type of failure; It is the environmental impact benchmark value, which is used to standardize the environmental impact index; the value is the normal benchmark value of environmental monitoring data; Logical functions :By introducing the nonlinear adjustment factor y, the flow anomaly index Converted to a nonlinear ratio, enhancing its influence; Hyperbolic tangent function :The topology change index After normalization, it is mapped to the (-1,1) interval through the hyperbolic tangent function to reflect the impact of topological changes on the evaluation index; Logarithmic function Environmental Impact Index After standardization, the influence range is compressed through the logarithmic function to avoid excessive influence of extreme values ​​on the evaluation index; Square root function : Processing user behavior deviation index through square root function , weakening its impact on the comprehensive evaluation index while retaining its basic trend; Logistic function Format: Convert the linear combination result x to the output value of the historical dynamic evaluation model in the range of (0,1) , ensure that the output value range meets the technical requirements; :These weight coefficients are determined through historical data analysis and expert experience to ensure that each index has a reasonable influence in the comprehensive evaluation; y>0: According to the distribution characteristics of the flow anomaly index, the optimal value is determined through experiments to enhance its nonlinear effect; and Ensure the rationality of standardized processing through historical data statistics; High flow abnormality: When The bigger the The closer it is to 1, the greater the The value of reflects the significant impact of high flow abnormality on equipment evaluation; High topology change: When The closer hour, The closer it is to 1, the higher The value of High environmental impact: The bigger the The value will increase and improve The value of High user behavior deviation: When The larger the The value of when The closer it is to 0, the better the virtual device performs under this fault type. Historical multi-source data shows that the performance fluctuation is more stable and the degree of abnormal change is smaller. when The closer it is to 1, the greater the abnormality of the virtual device under this fault type, and the greater the performance fluctuation shown by historical multi-source data.

[0056] To further illustrate, the calculation of the historical correction calibration index specifically includes: The formula for defining the historical correction calibration index of the i-th virtual device under the j-th fault type in the previous monitoring period is: ; in, is the historical correction calibration index of the ith virtual device under the jth fault type; it is used to evaluate the abnormal change degree of the current virtual device under the jth fault type; k is the index of the abnormal operation indicator type, ranging from , corresponding to time synchronization deviation, network protocol anomaly index and resource isolation status index respectively; is the value of the kth abnormal operation index of the i-th virtual device under the j-th fault type; is the average value of the kth abnormal operation index under all fault events, and the calculation formula is: ; Where H is the total number of fault events, represents the value of the operation abnormality index of the hth fault event corresponding to the kth operation abnormality index of the i-th virtual device under the jth fault type; is the standard deviation of the kth abnormal operation index under all fault events; the calculation formula is as follows: ; is the power adjustment coefficient of the kth abnormal operation indicator, with a range of ; Set the contribution of the overall abnormality according to the abnormal operation index; When the time synchronization deviation has a greater impact on the overall anomaly, ; Set to 0.2, 0.6 respectively; b3 is the overall index adjustment factor, ranging from b3∈(0,1]; set according to the overall abnormal growth trend, in this embodiment, b3=0.5 is taken to balance the index impact; The larger of the normalized index value and 0 is taken; only outliers above the average level are considered, negative deviations are suppressed, and abnormal upward trends are focused; It is a natural logarithmic function; it acts on the relative value of the adjusted indicator; it introduces nonlinear adjustment to enhance the sensitivity to high outliers and smooth the overall score; It is an exponential function, acting on the relative sum of all indicators; when : ; When all indicators are at the average level, Basically reflects The cumulative impact of Not zero, maintain a certain basic score; when Approaching : ; ; Infinite increase reflects an extremely abnormal state, which meets the sensitivity requirement of the technical goal to high outliers; when : ; At this time, only the abnormalities above the average level are adjusted, and negative deviations do not affect , in line with actual needs; By limiting The value range ensures that when the parameters change to an extreme, the formula output still maintains a reasonable growth trend and does not have a negative value or a sharp drop; , The larger it is, the higher the degree of abnormal change; against Apply the Sigmoid function or the normalization function (Min-Max Normalization) to adjust the Recorded as , The value range of is [0,1]; when The closer it is to 0, the lower the abnormal change degree of the current i-th virtual device under the j-th fault type, and the more stable the operation status; when The closer it is to 1, the more serious the abnormal change of the current i-th virtual device under the j-th fault type is, and the higher the demand for emergency positioning and processing is.

[0057] Further explanation: respectively calculating the real-time dynamic evaluation model and the real-time correction calibration index corresponding to the current virtual device includes: 3.1) In the current monitoring period, the output value of the real-time dynamic evaluation model of the current virtual device i under the jth fault type is defined as ; The calculation formula is as follows: ; in, It represents the comprehensive evaluation result of the i-th virtual device under the j-th fault type in the current monitoring time period, and its value range is between (0,1); is the traffic anomaly index, which measures the degree of network traffic anomaly of the i-th virtual device under the j-th fault type during the current monitoring period; the value range is ; It is the topology change index, which indicates the degree of change of the topology information of the i-th virtual device under the j-th fault type in the current monitoring time period; the value range is ; Indicates the maximum value of the topology change index; It is the environmental impact index, which reflects the degree of deviation of the environmental monitoring data of the i-th virtual device under the j-th fault type in the current monitoring time period; the value range is ; is the user behavior deviation index, which indicates the abnormal degree of user behavior of the i-th virtual device under the j-th fault type in the current monitoring period; the value range is ; d1, d2, d3 and d4 are weight coefficients of the corresponding parameter indexes, and d1+d2+d3+d4=1; d1 is the flow anomaly weight coefficient, which determines the influence of the flow anomaly index in the comprehensive evaluation; the value range is ; d2 is the topological change weight coefficient, which determines the influence of the topological change index in the comprehensive evaluation; the value range is ; y is the nonlinear adjustment factor of the flow anomaly index, which enhances the nonlinear effect of the flow anomaly index on the evaluation; the value range is y>0; d3 is the environmental impact weight coefficient, which determines the influence of the environmental impact index in the comprehensive evaluation; the value range is ; d4 is the user behavior deviation weight coefficient, which determines the influence of the user behavior deviation index in the comprehensive evaluation; the value range is ; It is the maximum value of the topology change index, which is used to standardize the topology change index. Its value is the theoretical or empirical maximum value of the topology change index. It is the environmental impact benchmark value, which is used to standardize the environmental impact index; the value is the normal benchmark value of environmental monitoring data; when The closer it is to 0, the better the virtual device performs under this fault type, the more stable the performance fluctuation indicated by the multi-source data in the current monitoring period, and the smaller the degree of abnormal change; when The closer it is to 1, the greater the abnormal change degree of the virtual device under this fault type, and the greater the performance fluctuation indicated by the multi-source data in the current monitoring time period; 3.2) In the current monitoring period, the real-time correction calibration index of the current virtual device i under the jth fault type is defined as ,Will The normalized value is recorded as ; The calculation formula is as follows: ; in, is the real-time correction calibration index of the ith virtual device under the jth fault type; it is used to evaluate the abnormal change degree of the current virtual device under the jth fault type during the current monitoring period; k is the index of the abnormal operation indicator type, ranging from , corresponding to time synchronization deviation, network protocol anomaly index and resource isolation status index respectively; is the value of the kth abnormal operation index of the i-th virtual device under the j-th fault type in the current monitoring time period; is the average value of the kth abnormal operation index under all fault events in the current monitoring period, and the calculation formula is: ; Where H is the total number of fault events, Indicates the value of the operation abnormality index of the hth fault event corresponding to the kth operation abnormality index of the i-th virtual device under the j-th fault type in the current monitoring time period; is the standard deviation of the kth abnormal operation indicator under all fault events in the current monitoring period; the calculation formula is as follows: ; is the power adjustment coefficient of the kth abnormal operation indicator, with a range of ; is the logarithmic function adjustment factor of the kth indicator, with a range of ; c3 is the overall index adjustment factor, ranging from c3∈(0,1]; It is the larger of the normalized index value and 0; is the natural logarithm function; It is an exponential function, acting on the relative sum of all indicators; , The larger it is, the higher the degree of abnormal change; against Apply the Sigmoid function or normalization function (Min-MaxNormalization) to adjust the Recorded as , The value range of is [0,1]; when The closer it is to 0, the lower the abnormal change degree of the current i-th virtual device under the j-th fault type, and the more stable the operation status; when The closer it is to 1, the more serious the abnormal change of the current i-th virtual device under the j-th fault type is, and the higher the demand for emergency positioning and processing is.

[0058] Further explanation: the real-time correction calibration index is calculated by ratio with the historical correction calibration index, and based on the ratio calculation result, a fine-tuning strategy is provided for each index in the real-time dynamic evaluation model, specifically including: The ratio of the current virtual device i under the jth fault type is recorded as , the calculation formula is as follows: ; in, It is the normalized output value of the real-time correction calibration index; is the normalized output value of the historical correction calibration index; and The value range is [0,1]; Based on historical data statistics, set , when the ratio of the current real-time correction calibration index to the historical correction calibration index is set to 1, it is used as the neutral threshold; and the neutral threshold can be changed according to the application scenario; Adjust according to specific application scenarios ; The following are different scenarios Adjustment strategy: 4.1) Highly sensitive monitoring scenarios: Business characteristics: The system has extremely high requirements for performance and stability. Even small abnormal changes may cause large-scale impacts, such as financial transaction systems, medical diagnosis support systems, and real-time quality control systems for factory production lines.

[0059] Adjust logic: It is set to 0.95, which is lower than 1, so that as long as the current abnormal change index increases slightly compared with the historical value, it is more likely to be considered a significant change, thereby triggering the corresponding strategy in time; Reason and expected effect: Lowering the threshold makes the system more sensitive and can detect potential anomalies more quickly. At the same time, since such scenarios emphasize rigor and accuracy, a lower threshold means that a slightly increased ratio is identified as a potential problem, which is conducive to early prevention and control of problems. 4.2) Moderate sensitivity, robust scenario: Business characteristics: The system normally runs relatively smoothly, but we still need to be vigilant against abnormal fluctuations, such as data center operation and maintenance monitoring, real-time interactive quality monitoring of online education platforms, etc. In such scenarios, the system must maintain a certain degree of sensitivity and cannot be disturbed by too many slight fluctuations.

[0060] Adjustment logic: Maintain It remains unchanged close to 1.0, or only fluctuates within a range of 0.01 to 0.02 based on 1.0; at this time, 1.0 as a neutral value can ensure that the system maintains a baseline judgment near the historical mean and does not overreact to slight positive or negative fluctuations.

[0061] Reason and expected effect: The neutral threshold enables the system to distinguish normal fluctuations from real performance degradation or improvement, thereby ensuring the stability and reliability of strategy execution.

[0062] 4.3) Low sensitivity or macro trend scenarios: Business characteristics: The system operating environment itself is complex and changeable, and many small fluctuations are normal, so it is not advisable to be too sensitive; for example, long-term performance evaluation of large distributed systems or IoT data collection applications with high environmental noise.

[0063] Adjust logic: Set to 1.05 which is higher than 1, the strategy adjustment will be triggered only when the current abnormal change index is 5% or more higher than the historical value.

[0064] Reason and expected effect: A higher threshold can prevent the system from constantly changing its strategy due to frequent small fluctuations, thereby reducing the risk of overreaction. It is suitable for scenarios that require observing longer-term trend changes.

[0065] 4.4) Targeting The further adjustment strategy is: using regular review of historical data: At regular intervals, which in this embodiment is set to one week, the performance of the system under the threshold is evaluated: If minor fluctuations occur multiple times but adjustments are frequently triggered, raise the threshold to 1.02 or 1.05 to reduce overreaction; If severe faults occur multiple times but are not captured in time, the threshold is lowered to 0.98 or 0.95 to increase sensitivity; The above multiple occurrences must be at least 3 times, and the specific number is determined based on experimental data by the expert group; According to the ratio With threshold Based on the comparison results, the following fine-tuning strategy is formulated: 5.1) When ,and , indicating that virtual device i performs well under fault type j, with stable performance fluctuations and low abnormal changes; It indicates that the degree of abnormal changes is reduced and the operating status is more stable; The corresponding fine-tuning strategy is: ; is the reduced traffic anomaly index weight in the real-time dynamic evaluation model, is the adjustment factor, ; because The smaller it is, the smaller the reduction of the original weight d1 is, and vice versa, ensuring that the weight is reduced when the performance is good; Since the current state is stable, the weight d2 of the topology change index in the real-time dynamic evaluation model remains unchanged: is the weight of the reduced environmental impact index, is the adjustment factor, ; according to The value of is adjusted dynamically to ensure that the weight is reduced when it is stable; is the increased user behavior deviation index weight, is the adjustment factor, ; when The closer it is to 0, the greater the increase in d4 is, so as to further optimize the system stability.

[0066] By reducing the weights of the traffic anomaly index and the environmental impact index and increasing the weight of the user behavior deviation index, the system stability can be further optimized; 5.2) When hour, It indicates that virtual device i performs moderately under fault type j, with level one performance fluctuation and abnormal changes; Indicates that the abnormal change degree of virtual device i in the current monitoring period is the same as that in the previous monitoring period, and the status quo needs to be maintained; The corresponding fine-tuning strategy is: ; Maintain the current weight coefficients of each index unchanged to ensure the stability of system operation; when hour, It means that virtual device i performs poorly under fault type j, and there are secondary performance fluctuations and abnormal changes; and the primary performance fluctuations and abnormal changes are smaller than the secondary performance fluctuations and abnormal changes; Indicates that the abnormal change degree of virtual device i has increased; urgent processing is required.

[0067] The corresponding fine-tuning strategy is: ; is the increased traffic anomaly index weight, is the adjustment factor, ; The larger it is, the more weight is added to strengthen the detection of traffic anomalies; is the increased topological change index weight, is the adjustment factor, ; according to Dynamic increase, improving sensitivity to topology changes; is the added weight of the environmental impact index, is the adjustment factor, ; Increase the weight of the environmental impact index to better reflect system anomalies; is the reduced user behavior deviation index weight, is the adjustment factor, ; When the abnormal situation is serious, reduce the weight of the user behavior deviation index and concentrate resources to deal with the system abnormality; By increasing the weights of the traffic anomaly index, topology change index, and environmental impact index, and reducing the weight of the user behavior deviation index, the ability to detect and respond to system anomalies is enhanced.

[0068] Further explanation: Preliminary positioning of the sequence set to which the fault event of the virtual device in the current monitoring period belongs, and evaluation of the severity of the fault type, thereby forming a preliminary fault positioning result, specifically including: The adjusted real-time dynamic evaluation model for the jth fault type under the i-th virtual device is expressed as , and its calculation formula is: ; Calculate the comprehensive score of the jth fault type under the i-th virtual device in the current monitoring time period. The calculation formula is as follows: ; in It represents the comprehensive score of the jth fault type under the i-th virtual device in the current monitoring time period. are the impact duration score, impact range score, and fault frequency score of the jth fault type under the i-th virtual device in the current monitoring time period, and The value range of is [0,1]; is the weight of each indicator, ;and The value range is in the interval (0,1); The value range is [0,1]; Set separately and The judgment thresholds are ;and ; This embodiment of the The initial values ​​of are 0.5 and 0.53 respectively; The specific value is determined by the expert group system through experimental data; 6.1) When ,and When , it means that the severity of the jth fault type under the current i-th virtual device is large, and the abnormal change degree of the i-th virtual device is large, and the j-th fault type is taken as the preliminary fault location result; 6.2) When ,and When , it means that the severity of the jth fault type under the current i-th virtual device is large, and the abnormal change degree of the i-th virtual device is small, and the jth fault type is taken as the preliminary fault location result; and the priority level of the fault type in step 6.2) is lower than that in step 6.1); 6.3) When When , it means that the severity of the jth fault type under the current i-th virtual device is small, and there is no need to take the jth fault type as the preliminary fault location result.

[0069] Further explanation: the adjusted real-time dynamic evaluation model is compared and analyzed with the historical dynamic evaluation model. Based on the comparison and analysis results, a calibration strategy is provided for the corresponding preliminary fault location results, including: Calculate the ratio of the real-time dynamic evaluation model to the historical dynamic evaluation model ; 7.1) If If it is greater than 1, it means that the virtual device has a tendency to perform worse under this fault type, and the degree of abnormal change also has an increasing trend. In this case, it is necessary to reduce , in order to improve the sensitivity of judging abnormal changes in virtual devices; the calculation formula is as follows: ; 7.2) If If it is equal to 1, it does not target Make adjustments; 7.3) If , it means that the virtual device has a better performance under this fault type, and the abnormal change degree also has a decreasing trend. In this case, it is necessary to increase , in order to reduce the sensitivity of judging abnormal changes in virtual devices; the calculation formula is as follows: ; in, It is the judgment threshold corresponding to the adjusted real-time dynamic evaluation model.

[0070] The above content is determined by the judgment threshold corresponding to the preliminary fault location result. Adjustments are made to implement a calibration strategy for the preliminary fault positioning results.

[0071] The above formulas are all dimensionless and numerical calculations. The formula is a formula for the most recent real situation obtained by collecting a large amount of data and performing software simulation. The preset parameters in the formula are set by technicians in this field according to actual conditions.

[0072] The above embodiments may be implemented in whole or in part by software, hardware, firmware or any other combination thereof. When implemented by software, the above embodiments may be implemented in whole or in part in the form of a computer program product. Those skilled in the art may appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein may be implemented by electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed by hardware or software methods depends on the specific application and design constraints of the technical solution.

[0073] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, and may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0074] The above description is only a specific implementation manner of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application.

Claims

1. A virtualized network fault rapid location method integrating multi-source information, characterized in that: The specific steps include: Step S1: in the previous monitoring time period, obtaining historical multi-source data and historical operation abnormality data of each virtual device in the virtualized network environment when a failure event occurs, wherein the historical multi-source data includes but is not limited to network traffic data, topology information, environment monitoring data and user behavior data; Historical operation abnormality data includes but is not limited to time synchronization deviation, network protocol abnormality indicators, and resource isolation status indicators; Step S2: classify and mark the fault events of each virtual device that occurred in the previous monitoring time period, classify the fault events of the same fault type into the same sequence set, and sort the fault events in each sequence set according to the severity of the fault events; Step S3: Under the fault event of the same sequence set, extract the multi-source data corresponding to the current virtual device from the historical multi-source data, analyze these multi-source data, and calculate a historical dynamic evaluation model for evaluating the performance change trend of the current virtual device; the historical dynamic evaluation model is composed of a traffic anomaly index, a topology change index, an environmental impact index, and a user behavior deviation index; Step S4: Under the fault event of the same sequence set, the operation abnormality data corresponding to the current virtual device is extracted from the historical operation abnormality data, and the operation abnormality data is analyzed to calculate the historical correction calibration index used to evaluate the abnormal change degree of the current virtual device; Step S5: In the current monitoring time period, the multi-source data and operation abnormality data collected by the current virtual device are analyzed, and the real-time dynamic evaluation model and the real-time correction calibration index corresponding to the current virtual device are calculated respectively, and the real-time correction calibration index is calculated by ratio with the historical correction calibration index, and based on the ratio calculation result, a fine-tuning strategy is provided for each index in the real-time dynamic evaluation model; Step S6: obtaining the real-time dynamic evaluation model adjusted by the fine-tuning strategy, and evaluating the severity of the fault type, thereby forming a preliminary fault location result; The adjusted real-time dynamic evaluation model is compared and analyzed with the historical dynamic evaluation model, and based on the comparison and analysis results, a calibration strategy is provided for the corresponding preliminary fault positioning results.

2. According to claim 1, a virtualized network fault rapid location method integrating multi-source information is characterized in that: The acquisition of historical multi-source data and historical operation abnormality data includes: The network traffic data represents the number of packets per virtual device under the failure event; The topology information indicates the number of times the connection relationship of the virtual devices changes; Environmental monitoring data, including: CPU usage, memory usage, network latency; User behavior data indicates the frequency of user requests and accesses; To obtain abnormal operation data: Time synchronization deviation is the time difference between the internal clock of the virtual device and the standard time; The time synchronization deviation is calculated as follows: time synchronization deviation = virtual device clock time - standard time; The network protocol anomaly index is the abnormal packet rate of abnormal behavior in the network protocol stack; abnormal packet rate = (number of abnormal packets / total number of packets) × 100%; The resource isolation status indicator is the effectiveness of resource isolation between virtual devices, which is expressed by the resource isolation degree. The resource isolation degree is calculated as follows: CPU isolation = (CPU resources dedicated to virtual devices / total allocated CPU resources) × 100%; Memory isolation = (virtual device dedicated memory / total allocated memory) × 100%; Storage isolation = (virtual device dedicated storage space / total allocated storage space) × 100%; Resource isolation = (CPU isolation + memory isolation + storage isolation) / 3; Each virtual device is assigned a unique identifier to form {1,2,…,i,…,n}, where i represents the index of virtual device i, n represents the total number of virtual devices, and i∈{1,2,…,n}.

3. According to claim 2, a virtualized network fault rapid location method integrating multi-source information is characterized in that: Classify and mark the fault events that occurred in each virtual device during the previous monitoring period, including: Set corresponding fault judgment thresholds for the time synchronization deviation, network protocol anomaly index, and resource isolation status index of virtual device i in the previous monitoring period. ; Marking Exceeded Any event that exceeds the fault judgment threshold is regarded as a fault event; The K-Means clustering algorithm is used to determine the optimal number of clusters K through the elbow rule to ensure that the fault events within each cluster have high similarity; Cluster these fault events and classify the fault events with similar characteristics into the same category; According to the clustering results, the fault events of the same fault type are divided into the same sequence set; Each sequence set represents a fault type and contains all fault events belonging to this type. The number of all fault types divided is set to M, and the index of any fault type is represented by j, so j∈{1,2,…,M}; The sequence set of fault events is represented as {1, 2, ..., h, ..., M}; where h represents the index of the h-th fault event, H represents the H-th fault event, and H is the total number of fault events in the sequence set; The fault events in each sequence set are sorted according to the sorting indicators, which include: impact duration score, impact range score, and fault frequency score; The impact duration score refers to the degree of impact of the fault duration on the sorting results. The longer the fault duration, the higher the impact duration score. The impact range score is the number of virtual devices affected by the fault. The more virtual devices affected, the higher the corresponding score. The fault frequency score refers to the number of times a fault occurred during the previous monitoring period. The more times a fault occurs, the higher the corresponding score. The weights of the various indicators in the sorting indicators corresponding to the j-th fault type under the i-th virtual device are set as follows: ； in represents the comprehensive score of the jth fault type under the i-th virtual device, are the impact duration score, impact range score, and fault frequency score of the jth fault type under the i-th virtual device, respectively, and The value range of is [0,1]; is the weight of each indicator, ;and The value range is in the interval (0,1); According to the comprehensive score results of fault events of the same fault type, the fault events in each sequence set are sorted in descending order, and fault events with high scores are processed first.

4. The method for quickly locating virtualized network faults by integrating multi-source information according to claim 3 is characterized in that: The calculation of the historical dynamic evaluation model includes: Define the output value of the historical dynamic evaluation model of the i-th virtual device under the j-th fault type as , the calculation formula is as follows: ； in, It represents the comprehensive evaluation result of the i-th virtual device under the j-th fault type, and its value range is between (0,1); is the traffic anomaly index, which measures the degree of network traffic anomaly of the i-th virtual device under the j-th fault type; the value range is ; It is the topology change index, which indicates the degree of change of the topology information of the i-th virtual device under the j-th fault type; the value range is Indicates the maximum value of the topology change index; is the environmental impact index, which reflects the degree of deviation of the environmental monitoring data of the i-th virtual device under the j-th fault type; the value range is ; is the user behavior deviation index, which indicates the abnormal degree of user behavior of the i-th virtual device under the j-th fault type; the value range is ; a1 is the flow anomaly weight coefficient, which determines the influence of the flow anomaly index in the comprehensive evaluation; the value range is ; a2 is the topological change weight coefficient, which determines the influence of the topological change index in the comprehensive evaluation; the value range is ; It is the nonlinear adjustment factor of the flow anomaly index, which enhances the nonlinear effect of the flow anomaly index on the evaluation; the value range is y>0; a3 is the environmental impact weight coefficient, which determines the influence of the environmental impact index in the comprehensive evaluation; the value range is 0 <a3<1; a4 is the user behavior deviation weight coefficient, which determines the influence of the user behavior deviation index in the comprehensive evaluation; the value range is 0 <a4<1; It is the maximum value of the topology change index, which is used to standardize the topology change index. Its value is the theoretical or empirical maximum value of the topology change index. It is the environmental impact benchmark value, which is used to standardize the environmental impact index; the value is the normal benchmark value of environmental monitoring data; when The closer it is to 0, the better the virtual device performs under this fault type. Historical multi-source data shows that the performance fluctuation is more stable and the degree of abnormal change is smaller. when The closer it is to 1, the greater the abnormality of the virtual device under this fault type, and the greater the performance fluctuation shown by historical multi-source data.

5. The method for quickly locating virtualized network faults by integrating multi-source information according to claim 4 is characterized in that: The calculation of the historical correction calibration index includes: The formula for defining the historical correction calibration index of the i-th virtual device under the j-th fault type in the previous monitoring period is: ; in, is the historical correction calibration index of the ith virtual device under the jth fault type; it is used to evaluate the abnormal change degree of the current virtual device under the jth fault type; k is the index of the abnormal operation indicator type, ranging from , which correspond to time synchronization deviation, network protocol anomaly index, and resource isolation status index respectively; is the value of the kth abnormal operation index of the i-th virtual device under the j-th fault type; is the average value of the kth abnormal operation index under all fault events, and the calculation formula is: ； Where H is the total number of fault events, represents the value of the operation abnormality index of the hth fault event corresponding to the kth operation abnormality index of the i-th virtual device under the jth fault type; is the standard deviation of the kth abnormal operation index under all fault events; the calculation formula is as follows: ; is the power adjustment coefficient of the kth abnormal operation index, ranging from {b1}_{k}\in (1,3] ; is the logarithmic function adjustment factor of the kth indicator, ranging from {b2}_{k}\in \left [ {0.1,1} \right ] ; b3 is the overall index adjustment factor, ranging from b3∈(0,1]; The larger of the normalized index value and 0 , The larger it is, the higher the degree of abnormal change; against Apply the Sigmoid function or normalization function to adjust the Recorded as , The value range of is [0,1]; when The closer it is to 0, the lower the abnormal change degree of the current i-th virtual device under the j-th fault type, and the more stable the operation status; when The closer it is to 1, the more serious the abnormal change of the current i-th virtual device under the j-th fault type is, and the higher the demand for emergency positioning and processing is.

6. A virtualized network fault rapid location method integrating multi-source information according to claim 5, characterized in that: Calculate the real-time dynamic evaluation model and real-time correction calibration index corresponding to the current virtual device respectively, including: 3.1) In the current monitoring period, the output value of the real-time dynamic evaluation model of the current virtual device i under the jth fault type is defined as ; The calculation formula is as follows: ； in, It represents the comprehensive evaluation result of the i-th virtual device under the j-th fault type in the current monitoring time period, and its value range is between (0,1); is the traffic anomaly index, which measures the degree of network traffic anomaly of the i-th virtual device under the j-th fault type during the current monitoring period; the value range is ; It is the topology change index, which indicates the degree of change of the topology information of the i-th virtual device under the j-th fault type in the current monitoring time period; the value range is ; Indicates the maximum value of the topology change index; It is the environmental impact index, which reflects the degree of deviation of the environmental monitoring data of the i-th virtual device under the j-th fault type in the current monitoring time period; the value range is ; is the user behavior deviation index, which indicates the abnormal degree of user behavior of the i-th virtual device under the j-th fault type in the current monitoring period; the value range is ; d1, d2, d3 and d4 are weight coefficients of the corresponding parameter indexes, and d1+d2+d3+d4=1; when The closer it is to 0, the better the virtual device performs under this fault type, the more stable the performance fluctuation indicated by the multi-source data in the current monitoring period, and the smaller the degree of abnormal change; when The closer it is to 1, the greater the abnormal change degree of the virtual device under this fault type, and the greater the performance fluctuation indicated by the multi-source data in the current monitoring time period; 3.2) In the current monitoring period, the real-time correction calibration index of the current virtual device i under the jth fault type is defined as ,Will The normalized value is recorded as .

7. A virtualized network fault rapid location method integrating multi-source information according to claim 6, characterized in that: The real-time correction calibration index is calculated by ratio with the historical correction calibration index, and based on the ratio calculation result, a fine-tuning strategy is provided for each index in the real-time dynamic evaluation model, including: The ratio of the current virtual device i under the jth fault type is recorded as , the calculation formula is as follows: ； in, It is the normalized output value of the real-time correction calibration index; is the normalized output value of the historical correction calibration index; and The value range is [0,1]; When the ratio of the current real-time correction calibration index to the historical correction calibration index is set to 1, it is used as the neutral threshold; and the neutral threshold can be changed according to the application scenario; According to the ratio With threshold Based on the comparison results, the following fine-tuning strategy is formulated: 5.1) When ,and , indicating that virtual device i performs well under fault type j, with stable performance fluctuations and low abnormal changes; It indicates that the degree of abnormal changes is reduced and the operating status is more stable; The corresponding fine-tuning strategy is: ； is the reduced traffic anomaly index weight in the real-time dynamic evaluation model, is the adjustment factor, ; Since the current state is stable, the weight d2 of the topology change index in the real-time dynamic evaluation model remains unchanged: is the weight of the reduced environmental impact index, is the adjustment factor, ; is the increased user behavior deviation index weight, is the adjustment factor, ; By reducing the weights of the traffic anomaly index and the environmental impact index and increasing the weight of the user behavior deviation index, the system stability can be further optimized; 5.2) When , It indicates that virtual device i performs moderately under fault type j, with level one performance fluctuation and abnormal changes; Indicates that the abnormal change degree of virtual device i in the current monitoring period is the same as that in the previous monitoring period, and the status quo needs to be maintained; The corresponding fine-tuning strategy is: ; Maintain the current weight coefficients of each index unchanged to ensure the stability of system operation; when hour, It means that virtual device i performs poorly under fault type j, and there are secondary performance fluctuations and abnormal changes; and the primary performance fluctuations and abnormal changes are smaller than the secondary performance fluctuations and abnormal changes; It indicates that the abnormal change degree of virtual device i increases; The corresponding fine-tuning strategy is: ； is the increased traffic anomaly index weight, is the adjustment factor, ; is the increased topological change index weight, is the adjustment factor, ; is the added weight of the environmental impact index, is the adjustment factor, ; is the reduced user behavior deviation index weight, is the adjustment factor, ; By increasing the weights of the traffic anomaly index, topology change index, and environmental impact index, and reducing the weight of the user behavior deviation index, the ability to detect and respond to system anomalies is enhanced.

8. The method for quickly locating virtualized network faults by integrating multi-source information according to claim 7, characterized in that: Preliminarily locate the sequence set to which the fault events of the virtual device during the current monitoring period belong, and evaluate the severity of the fault type, so as to form a preliminary fault location result, including: The adjusted real-time dynamic evaluation model for the jth fault type under the i-th virtual device is expressed as The calculation formula is: ; Calculate the comprehensive score of the jth fault type under the i-th virtual device in the current monitoring time period. The calculation formula is as follows: ; in It represents the comprehensive score of the jth fault type under the i-th virtual device in the current monitoring time period. are the impact duration score, impact range score, and fault frequency score of the jth fault type under the i-th virtual device in the current monitoring time period, and The value range of is [0,1]; is the weight of each indicator, ;and The value range is in the interval (0,1); The value range is [0,1]; Set separately and The judgment thresholds are ;and ; 6.1) When ,and When , it means that the severity of the jth fault type under the current i-th virtual device is large, and the abnormal change degree of the i-th virtual device is large, and the j-th fault type is taken as the preliminary fault location result; 6.2) When ,and When , it means that the severity of the jth fault type under the current i-th virtual device is large, and the abnormal change degree of the i-th virtual device is small, and the jth fault type is taken as the preliminary fault location result; and the priority level of the fault type in step 6.2) is lower than that in step 6.1); 6.3) When When , it means that the severity of the jth fault type under the current i-th virtual device is small, and there is no need to take the jth fault type as the preliminary fault location result.

9. The method for quickly locating virtualized network faults by integrating multi-source information according to claim 8, characterized in that: The adjusted real-time dynamic evaluation model is compared and analyzed with the historical dynamic evaluation model. Based on the comparison and analysis results, a calibration strategy is provided for the corresponding preliminary fault location results, including: Calculate the ratio of the real-time dynamic evaluation model to the historical dynamic evaluation model ; 7.1) If If it is greater than 1, it means that the virtual device has a tendency to perform worse under this fault type, and the degree of abnormal change also has an increasing trend. In this case, it is necessary to reduce , in order to improve the sensitivity of judging abnormal changes in virtual devices; the calculation formula is as follows: ； 7.2) If If it is equal to 1, it does not target Make adjustments; 7.3) If , it means that the virtual device has a better performance under this fault type, and the degree of abnormal change also has a decreasing trend. In this case, it is necessary to increase , in order to reduce the sensitivity of judging abnormal changes in virtual devices; the calculation formula is as follows: ； in, It is the judgment threshold corresponding to the adjusted real-time dynamic evaluation model.

Images