Data processing method of communication network, electronic equipment and storage medium

Abstract

The invention provides a data processing method of a communication network, electronic equipment and a storage medium. Comprising the steps of obtaining a first sample index sequence of a communication network; the first sample index sequence comprises index data of a plurality of windows corresponding to the communication network. And predicting a second sample index sequence of future time based on the first sample index sequence. And predicting a second sample index sequence at the future time based on the first sample index sequence. And performing index anomaly detection based on the first sample index sequence and the second sample index sequence, and determining an anomaly identification sequence. And training a classification model by taking a plurality of pieces of network element alarm data corresponding to the communication network in the second sample index sequence at the same time sequence as samples and taking the abnormal identification sequence as a label. And based on the training parameters of the classification model, determining the correlation degree between the multiple pieces of network element alarm data and the abnormal indexes.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a data processing method, electronic device and storage medium of a communication network. Background Art

[0002] When an abnormality occurs in an existing communication network, a lot of network element alarm data is usually generated. If manual troubleshooting is relied upon, network operation and maintenance will require a high time and manpower cost.

[0003] With the development of artificial intelligence, communication networks are evolving from expert operation and maintenance to intelligent operation and maintenance. When an abnormality occurs in the communication network, how to intelligently analyze the correlation of network element alarm data to assist operation and maintenance personnel in quickly troubleshooting is a technical problem that needs to be solved urgently. Summary of the invention

[0004] The purpose of the present application is to provide a data processing method, electronic device and storage medium for a communication network, which can perform root cause analysis on network element anomalies of the communication network.

[0005] In order to achieve the above purpose, the embodiment of the present application is implemented as follows:

[0006] In a first aspect, a method for processing data in a communication network is provided, comprising:

[0007] Acquire a first sample indicator sequence of a communication network; the first sample indicator sequence includes indicator data corresponding to a plurality of windows of the communication network;

[0008] Predicting a second sample indicator sequence at a future time based on the first sample indicator sequence;

[0009] Performing indicator anomaly detection based on the first sample indicator sequence and the second sample indicator sequence to determine an abnormal identification sequence;

[0010] Using the multiple network element alarm data corresponding to the second sample indicator sequence of the communication network as samples and the abnormal identification sequence as labels, training the classification model;

[0011] Based on the training parameters of the classification model, the correlation between the plurality of network element alarm data and the abnormal indicators is determined.

[0012] In a second aspect, an embodiment of the present application provides an electronic device, comprising: a processor; and a memory configured to store computer-executable instructions, wherein the computer-executable instructions, when executed, cause the processor to execute the method described in the first aspect.

[0013] According to a third aspect, a computer-readable storage medium is provided, wherein the computer-readable storage medium is used to store computer-executable instructions, and the computer-executable instructions implement the method described in the first aspect when executed by a processor.

[0014] The scheme of the present application uses artificial intelligence technology to predict the second sample indicator sequence in the future time according to the first sample indicator sequence of the communication network, and compares the second sample indicator sequence with the first sample indicator sequence to detect the indicator abnormality and determine the abnormal identification sequence. Next, multiple network element alarm data generated by the communication network at the same time as the second sample indicator sequence are used as samples, and the abnormal identification sequence is used as a label to train the classification model to use multiple network element alarm data as features to predict the ability of the abnormal identification sequence. This training can obtain the probability distribution of the relative abnormality of each network element alarm data relative to the indicator. The larger the probability distribution of a network element alarm data relative to the abnormal indicator, the higher the correlation between the network element alarm data and the abnormal indicator. In practical applications, after determining the correlation between each network element alarm data and the abnormal indicator, the root cause of the network element abnormality can be found in the network element alarm data with a higher correlation, thereby assisting the operation and maintenance personnel to quickly troubleshoot the fault in the communication network and reduce the time cost and manpower cost of network operation and maintenance. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0016] Figure 1 A flowchart of a method for processing data in a communication network according to an embodiment of the present application is provided.

[0017] Figure 2 This is a working diagram of the VAE_LSTM model.

[0018] Figure 3 A grid diagram showing the training weights of each network element alarm data.

[0019] Figure 4 A schematic diagram of the structure of a data processing device of a communication network according to an embodiment of the present application.

[0020] Figure 5 A schematic diagram of the structure of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0021] As mentioned above, when an abnormality occurs in an existing communication network, a lot of network element alarm data is usually generated. If manual troubleshooting is relied upon, network operation and maintenance will require high time and manpower costs.

[0022] Specifically, the key performance indicator (KPI) of the communication network is used to measure the operating status of the network element and is currently a common data source for monitoring and analyzing network quality. That is, once the KPI is abnormal, it indicates that the operating status of the network element is also abnormal.

[0023] To this end, the present application aims to utilize artificial intelligence technology to perform explainable anomaly correlation analysis on different network element alarm data generated when the performance indicators (not limited to KPI) of the communication network are abnormal, and to find the root cause of the network element abnormality in the network element alarm data with higher correlation.

[0024] In order to enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this application will be clearly and completely described below in conjunction with the drawings in the embodiments of this application. Obviously, the described embodiments are only part of the embodiments of this specification, not all of the embodiments. Based on the embodiments in this specification, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of this specification.

[0025] On the one hand, an embodiment of the present application provides a data processing method for a communication network. Figure 1 The flowchart of the data processing method specifically includes the following steps:

[0026] S102, obtaining a first sample indicator sequence of a communication network; the first sample indicator sequence includes indicator data corresponding to a plurality of windows of the communication network.

[0027] In this embodiment, the sample indicator sequence of the communication network (including the first sample indicator sequence) is composed of sample indicators of multiple windows. The sample indicators are not limited to the KPIs mentioned above, which are specifically defined in the text here.

[0028] In an exemplary example, the window refers to a time window. For example, if the time window is 1 hour, the first sample indicator sequence may be composed of sample indicators for 24 hours a day; for another example, if the time window is 1 day, the first sample indicator sequence may be composed of sample indicators for 7 days a week.

[0029] S104, predicting a second sample indicator sequence in the future based on the first sample indicator sequence.

[0030] In this embodiment, artificial intelligence technology can be used to predict the second sample indicator sequence in the future based on the first sample indicator sequence. That is, the second sample indicator sequence is a prediction result and is not equivalent to the true value. The text defines the indicator data contained in the second sample indicator sequence as predicted indicator data.

[0031] In an illustrative example, this embodiment may use the VAE_LSTM model to predict the second sample indicator sequence.

[0032] The VAE_LSTM model is a composite model consisting of a Variational Auto-Encoder (VAE) model and a Long Short-Term Memory (LSTM) model.

[0033] In this step, after the first sample indicator sequence is input into the VAE_LSTM model, the first sample indicator sequence is first encoded by the VAE model to obtain the encoding sequence corresponding to the first sample indicator sequence; then, the encoding sequence corresponding to the first sample indicator sequence is passed through the LSTM model, and the LSTM model predicts the second sample indicator sequence.

[0034] The following is an introduction to the training principle of the LSTM model.

[0035] This embodiment uses the third sample indicator sequence of the communication network as training data for the LSTM model.

[0036] First, the third sample indicator sequence is input into LSTM for encoding to obtain the encoding sequence corresponding to the third sample indicator sequence;

[0037] Afterwards, the coding sequence corresponding to the third sample indicator sequence is split into a first sub-coding sequence with an earlier time and a second sub-coding sequence with a later time.

[0038] It should be noted that the splitting method of the first sub-coding sequence and the second sub-coding sequence is not unique and is not specifically limited herein.

[0039] For ease of understanding, let the encoding sequence corresponding to the third sample index sequence be [z1,z2...z k ], 1 to k represent the sequence numbers of the time windows respectively.

[0040] In an illustrative example, [z1,z2...z k ] is split into the first sub-coded sequence [z1,z2...z k-1 ], and the second sub-coded sequence [z2,z3...z k ]. That is [z2,z3...z k] relative to [z1,z2...z k-1 ] belongs to the sub-coding sequence that comes later in time.

[0041] In another exemplary example, assuming k = 2m, [z1,z2...z k ] is split into the first sub-coded sequence [z1,z2...z m ] and the second sub-coding sequence of the second half of the time window [z m+1 ,z3...z k ]. m+1 ,z3...z k ] relative to [z1,z2...z m ] belongs to the sub-coding sequence that comes later in time.

[0042] After obtaining the first sub-coding sequence and the second sub-coding sequence, the LSTM model is trained using the first sub-coding sequence as a sample and the second sub-coding sequence as a label.

[0043] In the training process of the above LSTM model, after the first sub-coding sequence is input into the LSTM model, it is encoded into a sub-coding sequence of the future time by the LSTM model, and then the coding sequence of the future time is decoded into the corresponding prediction indicator sequence. By calculating the loss (error) between the sub-coding sequence of the future time and the second sub-coding sequence as a label, and adjusting the parameters of the encoder for the purpose of reducing the loss, the sub-coding sequence encoded by the encoder at a later time is close to the second sub-coding sequence. By continuously iterating in this way, the encoder can obtain the ability to encode the sub-coding sequence at an earlier time into the sub-coding sequence at a later time.

[0044] The following is an introduction to the training principle of the VAE model.

[0045] In this embodiment, the fourth sample indicator sequence of the communication network is used as training data for the VAE model.

[0046] First, for the VAE model, a decoder is introduced to obtain the result of "VAE model + decoder". The introduced decoder can come from the LSTM model or be configured separately, which is not specifically limited here.

[0047] Next, the fourth sample indicator sequence is input into the VAE model to obtain the encoding sequence corresponding to the fourth sample indicator sequence.

[0048] Afterwards, the encoding sequence corresponding to the fourth sample pointer sequence is input into the decoder, and a decoding sequence corresponding to the fourth sample pointer sequence decoded by the decoder is obtained.

[0049] It should be understood that, assuming that the VAE model has encoding capabilities, the decoded sequence decoded by the decoder should be consistent with the fourth sample indicator sequence. To this end, the process of training the VAE model is to calculate the loss loss1 between the decoded sequence output by the decoder and the fourth sample indicator sequence, and adjust the parameters of the VAE model with the purpose of reducing the loss loss1, so that the decoded sequence output by the decoder approaches the fourth sample indicator sequence. By continuously iterating in this way, the VAE model can obtain the encoding capability for the sample indicator sequence.

[0050] In addition, during the training process of the VAE model, other classification tasks based on the encoding results of the VAE model can also be introduced. By calculating the error between the output result of the classification task and the expected result, the loss loss2 between the VAE model output (the encoding sequence corresponding to the fourth sample index sequence) and the decoder output (decoding sequence) with respect to the standard normal distribution can be quantified, and the parameters of the VAE model can be adjusted with the purpose of reducing the loss loss1+loss2, which can also make the decoded sequence output by the decoder close to the fourth sample index sequence.

[0051] S106, performing indicator anomaly detection based on the first sample indicator sequence and the second sample indicator sequence to determine an abnormal identification sequence.

[0052] In this embodiment, the second sample indicator sequence is the future trend of the first sample indicator sequence. By comparing the first sample indicator sequence with the second sample indicator sequence, a window for future indicator deterioration (indicator abnormality) can be found from the first sample indicator sequence.

[0053] As an exemplary introduction, this embodiment can determine the first error between the indicator data of at least part of the windows in the first sample indicator sequence and the corresponding predicted indicator data in the second sample indicator sequence, and determine the window in the first sample indicator sequence whose first error reaches the first threshold as a suspicious window.

[0054] For example, the predicted index data of the first window in the second sample index sequence is predicted based on the index data of the first window in the first sample index sequence, and the first error between the index data of the first window in the first sample index sequence and the predicted index data of the first window in the second sample index sequence is calculated. If the first error reaches a first threshold, the first window in the first sample index sequence is determined to be a usable window.

[0055] Of course, this embodiment may also select indicator data of a part of windows from the first sample indicator sequence to calculate the first error between the indicator data and the corresponding predicted indicator data in the second sample indicator sequence.

[0056] For example, starting from the second window in the first sample indicator sequence, the first error between the indicator data calculated and the corresponding predicted indicator data in the second sample indicator sequence is selected.

[0057] Afterwards, the second error between the indicator data of each suspicious window in the first sample indicator sequence and the true value result of the corresponding predicted indicator data is determined, and the indicator data in the first sample indicator sequence whose second error reaches the second threshold is determined as an abnormal indicator, and the indicator data whose second error does not reach the second threshold is determined as a normal indicator.

[0058] For example, the predicted index data of the second window in the second sample index sequence is predicted based on the index data of the second window in the first sample index sequence, and the second error between the true value results corresponding to the index data of the first window in the first sample index sequence and the predicted index data of the second window in the second sample index sequence is calculated. If the second error reaches the second threshold, the index data of the second window in the first sample index sequence is marked as an abnormal detection result identifier of an abnormal indicator; conversely, if the second error does not reach the second threshold, the index data of the second window in the first sample index sequence is marked as an abnormal detection result identifier of a normal indicator.

[0059] In this embodiment, the abnormality identification sequence includes the abnormality detection result identification of each window. As an example, the abnormality detection result identification of 0 indicates that no abnormality has occurred, and the abnormality detection result identification of 1 indicates that an abnormality has occurred. Let k be the number of windows, then the abnormality identification sequence can be expressed as [01, 12...0 k ]. Among them, 01 means that no abnormality occurs in the first window, 12 means that an abnormality occurs in the second window, ..., 0 k Indicates that no exception occurred in the kth window.

[0060] The above is an introduction to performing anomaly detection on the first sample indicator sequence to determine the anomaly identification sequence. Of course, the present embodiment can also perform anomaly detection on the second sample indicator sequence to determine the anomaly identification sequence. That is, determine the first error between the indicator data of at least part of the windows in the second sample indicator sequence and the corresponding predicted indicator data in the first sample indicator sequence, and determine the window in the second sample indicator sequence where the first error reaches the first threshold as a suspicious window; then, determine the second error between the indicator data of each suspicious window in the second sample indicator sequence and the true value result of the corresponding predicted indicator data, so as to determine the indicator data in the second sample indicator sequence where the second error reaches the second threshold as an indicator abnormality, and determine the indicator data in the second sample indicator sequence where the second error does not reach the second threshold as an indicator normal.

[0061] S108, using the multiple network element alarm data corresponding to the second sample indicator sequence in the communication network as samples and the abnormal identification sequence as labels to train the classification model.

[0062] In this embodiment, the network element alarm data are used to warn the abnormal situation of the network element, such as: high usage rate of the database table, exceeding the performance limit, control plane protocol link disconnection, connection detection failure, etc., which are not specifically limited in this article. The multiple network element alarm data described in this step are generated in sequence at the same time as the second sample indicator sequence.

[0063] It should be understood that using multiple network element alarm data as samples and abnormal identification sequences as labels to train the classification model is equivalent to training the classification model with multiple network element alarm data as features and the ability to predict abnormal identification sequences (predicting abnormal detection result identifications of 0 or 1). This kind of training can obtain the probability distribution of abnormalities of the relative indicators of each network element alarm data.

[0064] When the probability distribution of a network element alarm data relative to the abnormal index is larger, it means that the correlation between the network element alarm data and the abnormal index is higher, and the abnormal situation of the alarm is more likely to be the abnormal root cause.

[0065] It should be noted that the present invention does not specifically limit the classification model. As long as it is a model suitable for sequence data and has a classification function, such as a random forest model, a logistic regression model, etc., it can be applied to the solution of this embodiment.

[0066] S110, determining the correlation between the multiple network element alarm data and the abnormal indicators based on the training parameters of the classification model.

[0067] After the classification model training is completed, the probability distribution of each network element alarm data relative to the abnormal index is determined by its corresponding training weight (a training parameter). To this end, this step can determine the correlation between multiple network element alarm data and abnormal indicators based on the trained weights for multiple network element alarm data in the classification model, and execute preset abnormality handling measures for the network elements corresponding to the network element alarm data with higher correlation.

[0068] For example, the network elements corresponding to the alarm data of one or two network elements with the highest correlation, or the network elements corresponding to the meta alarm data with a correlation reaching a certain threshold, are reported and processed to notify the operation and maintenance personnel to solve the problem in time.

[0069] In summary, the method of this embodiment uses artificial intelligence technology to predict the second sample indicator sequence in the future time according to the first sample indicator sequence of the communication network, and compares the second sample indicator sequence with the first sample indicator sequence to perform indicator anomaly detection and determine the abnormal identification sequence. Next, multiple network element alarm data generated by the communication network at the same time as the second sample indicator sequence are used as samples, and the abnormal identification sequence is used as a label to train the classification model to use multiple network element alarm data as features to predict the ability of the abnormal identification sequence. This training can obtain the probability distribution of the relative abnormality of each network element alarm data relative to the indicator. The larger the probability distribution of a network element alarm data relative to the abnormal indicator, the higher the correlation between the network element alarm data and the abnormal indicator. In practical applications, after determining the correlation between each network element alarm data and the abnormal indicator, the root cause of the network element abnormality can be found in the network element alarm data with a higher correlation, thereby assisting the operation and maintenance personnel to quickly troubleshoot the fault in the communication network and reduce the time cost and manpower cost of network operation and maintenance.

[0070] The method of this embodiment is exemplarily introduced below in conjunction with the application scenario of communication network operation and maintenance.

[0071] This application scenario uses the VAE_LSTM model to predict the KPI sequence trend of the communication network to determine the KPI sequence of a certain target period; next, the KPI sequence of the target period is tested for indicator anomalies to obtain an abnormal identification sequence. After that, the abnormal identification sequence is used as the label of various network element alarm data generated in the target period to perform supervised training on the RF model, thereby determining the correlation between various network element alarm data and abnormal indicators, and then finding the network element alarm data with the root cause of the abnormality.

[0072] Here, the above process is divided into five stages: KPI data set preprocessing, VAE_LSTM model training, KPI trend prediction, KPI anomaly detection, and alarm correlation analysis. The specific steps are as follows:

[0073] Phase 1: KPI dataset preprocessing

[0074] In this stage, considering that different KPI data often have different dimensions, in order to eliminate the dimensional impact between indicators, the minimum-maximum normalization method is used to normalize the KPI data set so that all KPI data are confined to a unified description range.

[0075] Phase 2, VAE_LSTM model training:

[0076] First, we need to train the VAE model:

[0077] Based on the above, we first need to configure a decoder at the output of the VAE model;

[0078] After that, a part of KPI data is divided from the KPI data set as the training set of the VAE_LSTM model, and the training set is windowed. That is, the KPI data in the training set is converted into a KPI sequence of continuous windows [w1,w2...w k ], where k is the number of windows; the KPI sequence [w1,w2...w k ]That is, the third sample indicator sequence and the fourth sample indicator sequence described in this article.

[0079] Next, the KPI sequence [w1,w2...w k ]After entering the VAE model, hidden variables [z1,z2...z k ], hidden variables [z1,z2...z k ]The output of the VAE model will be obtained after passing through the decoder of the VAE model.

[0080] Among them, the loss of the VAE model consists of two parts. One part is the mean square error loss1 between the VAE model input and the decoder output, and the other part is the relative entropy loss2 of the normal distribution related to the VAE model decoder output and the VAE model input. The sum of loss1 and loss2 is the overall loss of the VAE model.

[0081] The training process uses the Adam optimizer to iteratively optimize the VAE model with the goal of reducing the overall loss of the VAE model, or iteratively optimize the "VAE model + decoder". After the iteration, the trained VAE model can be obtained.

[0082] It should be noted that the trained VAE model no longer needs to configure the decoder.

[0083] Secondly, we need to train the LSTM model:

[0084] All training sets are passed through the encoder of the trained VAE model to obtain the latent variable set [z1,z2...z k ].

[0085] Take the first k-1 latent variables [z1,z2...z k-1 ] as the input of the LSTM model, and the k-1 latent variables [z2,z3...z k ] as the label of the LSTM model and train the LSTM model.

[0086] Among them, the loss of the LSTM model is [z1,z2...z k-1 ] and [z2,z3...z k ] is the mean square error between .

[0087] Here, the Adam optimizer is used to iteratively optimize the LSTM model to reduce the loss of the LSTM model. After the iteration, the trained LSTM model can be obtained.

[0088] It should be noted that if the VAE model + decoder is iteratively optimized in stage one, the decoder of the LSTM model can use the decoder of stage one.

[0089] Phase 3, KPI trend forecast:

[0090] In this stage, another part of KPI data is divided from the KPI data set as the prediction set for KPI trend prediction.

[0091] Correspondingly, in the same manner, the KPI data in the prediction set is converted into KPI sequences of multiple continuous windows.

[0092] Afterwards, the original KPI sequence in the prediction set is input into the VAE_LSTM model.

[0093] refer to Figure 2 As shown, it is assumed that the original KPI sequence (i.e., the first sample indicator sequence described in this article) consists of the original KPI data of the t-k+1th window to the original KPI data of the tth window. The original KPI sequence first passes through the VAE model, and the VAE model encodes it with the window as the granularity to obtain the encoding sequence corresponding to the original KPI sequence, which consists of the KPI encoding result of the t-k+1th window to the KPI encoding result of the tth window. Afterwards, the encoding sequence passes through the LSTM model again, and the LSTM model predicts the KPI data of the next window with the window as the granularity to obtain the predicted KPI sequence (i.e., the second sample indicator sequence described in this article) whose time series is offset to the next window, and the KPI sequence consists of the predicted KPI data of the t-k+2th window to the predicted KPI data of the t+1th window.

[0094] Phase 4: KPI anomaly detection:

[0095] In this stage, the predicted KPI data of each window in all predicted KPI sequences is subtracted from the actual KPI data corresponding to the window, and then the average is taken to obtain k-1 differences. The absolute values ​​of these k-1 differences are taken and the maximum value is selected. This maximum value is set as the window threshold θ1 for KPI anomaly detection.

[0096] At the same time, the predicted KPI data of each window in a single predicted KPI sequence is subtracted from the actual data, and then the absolute value is taken and the maximum value is selected, and this maximum value is set as the anomaly point threshold θ2 for KPI anomaly detection.

[0097] Afterwards, for each original KPI number sequence, the original KPI data of each window is subtracted from the corresponding predicted KPI data and the average is taken to obtain the average difference d1; if there is a suspicious window in the original KPI sequence where d1 is greater than θ1, it is considered that there may be indicator data with abnormal points.

[0098] Then, for each original KPI sequence that may have an outlier, the original KPI data of each window is further subtracted from the true value of the predicted KPI data corresponding to the window to obtain the difference d2, and the indicator data of the window in the original KPI sequence where d2 is greater than θ2 is determined as an outlier.

[0099] Phase 5: Alarm correlation analysis:

[0100] In this stage, the abnormal points determined in the predicted KPI sequence are marked as 1, and the other abnormal points are marked as 0, so that the abnormal identification sequence of the predicted KPI sequence can be obtained.

[0101] After that, multiple network element alarm data generated by the communication network while predicting the KPI sequence are collected, and the random forest model is supervised trained with multiple network element alarm data samples and the abnormal identification sequence as labels. The training weight of each network element alarm data sample relative to the abnormal point can be determined. The training weight of each network element alarm data reflects its distribution probability relative to the abnormal point.

[0102] For ease of understanding, assume that this application scenario has 10 types of network element alarm data, and each type of network element alarm data reflects an abnormal condition factor, such as: high utilization rate of database tables, exceeding performance limits, control plane protocol link disconnection, connection detection failure, etc. Figure 3 As shown, Figure 3 The following is a grid diagram showing the arrangement of the factors of the 10 types of network element alarm data according to the size of the training weights.

[0103] In application scenarios, a waterline can be set for the training weights as a threshold for determining the root cause of anomalies. Figure 3 It can be seen that the training weights of Factor1 and Factor2 reach the waterline, and Factor1 and Factor2 are determined as the root causes of the abnormality.

[0104] For example, Factor 1 indicates high utilization of the database table; Factor 2 indicates exceeding the performance limit. In the time period corresponding to the predicted KPI sequence, the direct root causes of the network element abnormality are the high utilization of the database table by the network element and the network element exceeding the performance limit.

[0105] Based on the above content, it can be seen that this application scenario can automatically find the root cause of network element anomalies in the communication network without relying on manual analysis; at the same time, in the artificial intelligence technology part, the training of the model does not rely on manual labeling, and the entire process of the solution can be automatically executed, realizing the intelligent operation and maintenance of the communication network.

[0106] Corresponds to Figure 1 In addition to the data processing method shown, another embodiment of the present application also provides a data processing device for a communication network. Figure 4 It is a structural schematic diagram of the data processing device, comprising:

[0107] The acquisition module 410 is used to acquire a first sample indicator sequence of the communication network; the first sample indicator sequence includes indicator data corresponding to multiple windows of the communication network.

[0108] The prediction module 420 is used to predict a second sample indicator sequence at a future time based on the first sample indicator sequence.

[0109] The detection module 430 is used to perform indicator anomaly detection based on the first sample indicator sequence and the second sample indicator sequence to determine an abnormal identification sequence.

[0110] The training module 440 is used to train the classification model using the multiple network element alarm data corresponding to the second sample indicator sequence of the communication network in sequence as samples and the abnormal identification sequence as a label.

[0111] The analysis module 450 is used to determine the correlation between the multiple network element alarm data and the abnormal indicators based on the training parameters of the classification model.

[0112] The device of this embodiment uses artificial intelligence technology to predict the second sample indicator sequence in the future time according to the first sample indicator sequence of the communication network, and compares the second sample indicator sequence with the first sample indicator sequence to detect the indicator abnormality and determine the abnormal identification sequence. Next, multiple network element alarm data generated by the communication network at the same time as the second sample indicator sequence are used as samples, and the abnormal identification sequence is used as a label to train the classification model to use multiple network element alarm data as features to predict the ability of the abnormal identification sequence. This training can obtain the probability distribution of the relative abnormality of each network element alarm data. When the probability distribution of a network element alarm data relative to the abnormal indicator is larger, it means that the correlation between the network element alarm data and the abnormal indicator is higher. In practical applications, after determining the correlation between each network element alarm data and the abnormal indicator, the root cause of the network element abnormality can be found in the network element alarm data with a higher correlation, so as to assist the operation and maintenance personnel to quickly troubleshoot the fault in the communication network and reduce the time cost and manpower cost of network operation and maintenance.

[0113] Optionally, the prediction module 420 predicts a second sample indicator sequence in the future based on the first sample indicator sequence, including: inputting the first sample indicator sequence into the autoencoder model for encoding to obtain a coding sequence corresponding to the first sample indicator sequence; inputting the coding sequence corresponding to the first sample indicator sequence into the long short-term memory model to obtain the second sample indicator sequence predicted by the long short-term memory model.

[0114] Optionally, before the prediction module 420 inputs the coding sequence corresponding to the first sample indicator sequence into the long short-term memory model, the training module 440 is also used to: input the third sample indicator sequence of the communication network into the autoencoder model for encoding to obtain the coding sequence corresponding to the third sample indicator sequence; split the coding sequence corresponding to the third sample indicator sequence into a first sub-coding sequence in the front and a second sub-coding sequence in the back; and train the long short-term memory model using the first sub-coding sequence as a sample and the second sub-coding sequence as a label.

[0115] Optionally, before the prediction module 420 inputs the first sample indicator sequence into the autoencoder model for encoding to obtain the encoding sequence corresponding to the first sample indicator sequence, the training module 440 is also used to: input the fourth sample indicator sequence of the communication network into the autoencoder model to obtain the encoding sequence corresponding to the fourth sample indicator sequence; input the encoding sequence corresponding to the fourth sample indicator sequence into the decoder to obtain the decoding sequence corresponding to the fourth sample indicator sequence; and train the autoencoder model based on the loss between the decoding sequence corresponding to the fourth sample indicator and the fourth sample indicator sequence.

[0116] Optionally, the detection module 430 performs indicator anomaly detection based on the first sample indicator sequence and the second sample indicator sequence to determine an abnormal identification sequence, including: determining a first error between indicator data of at least part of the windows in the first sample indicator sequence and corresponding predicted indicator data in the second sample indicator sequence, and determining the windows in the first sample indicator sequence whose first error reaches a first threshold as suspicious windows; determining a second error between indicator data of each suspicious window in the first sample indicator sequence and the true value result of the corresponding predicted indicator data, and determining indicator data in the first sample indicator sequence whose second error reaches a second threshold as abnormal indicators, and determining indicator data whose second error does not reach the second threshold as normal indicators.

[0117] Optionally, the indicator data includes a key performance indicator (KPI).

[0118] Optionally, the device of this embodiment further includes: a processing module. The processing module is used to execute preset abnormality processing measures for the network element corresponding to the target network element alarm data when the correlation between the target network element alarm data and the abnormality index in the multiple network element alarm data reaches a correlation threshold.

[0119] Optionally, the analysis module 450 determines the correlation between the multiple network element alarm data and the abnormal indicators based on the training parameters of the classification model, including: determining the correlation between the multiple network element alarm data and the abnormal indicators based on the trained weights for the multiple network element alarm data in the classification model.

[0120] Figure 5 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. Figure 5 At the hardware level, the electronic device includes a processor, and optionally also includes an internal bus, a network interface, and a memory. The memory may include a memory, such as a high-speed random access memory (RAM), and may also include a non-volatile memory (non-volatile memory), such as at least one disk storage. Of course, the electronic device may also include hardware required for other services.

[0121] The processor, network interface and memory can be interconnected through an internal bus, which can be an ISA (Industry Standard Architecture) bus, a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 5 Only one bidirectional arrow is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0122] The memory is used to store the computer program. Specifically, the computer program may include a program code, and the program code includes a computer operation instruction. The memory may include a memory and a non-volatile memory, and provides the computer program to the processor.

[0123] Optionally, the processor reads the corresponding computer program from the non-volatile memory into the memory and then runs it, forming the above-mentioned Figure 4 The data processing device of the communication network shown in the figure. Correspondingly, the processor executes the program stored in the memory and is specifically used to perform the following operations:

[0124] A first sample indicator sequence of a communication network is obtained; the first sample indicator sequence includes indicator data corresponding to a plurality of windows of the communication network.

[0125] A second sample indicator sequence is predicted at a future time based on the first sample indicator sequence.

[0126] An indicator anomaly detection is performed based on the first sample indicator sequence and the second sample indicator sequence to determine an anomaly identification sequence.

[0127] The classification model is trained using a plurality of network element alarm data corresponding to the communication network in the same sequence as the second sample indicator sequence as samples and the abnormal identification sequence as a label.

[0128] Based on the training parameters of the classification model, the correlation between the plurality of network element alarm data and the abnormal indicators is determined.

[0129] The electronic device of this embodiment uses artificial intelligence technology to predict the second sample indicator sequence in the future time according to the first sample indicator sequence of the communication network, and compares the second sample indicator sequence with the first sample indicator sequence to detect the indicator abnormality and determine the abnormal identification sequence. Next, multiple network element alarm data generated by the communication network at the same time as the second sample indicator sequence are used as samples, and the abnormal identification sequence is used as a label to train the classification model to use multiple network element alarm data as features to predict the ability of the abnormal identification sequence. This training can obtain the probability distribution of the relative abnormality of each network element alarm data. When the probability distribution of a network element alarm data relative to the abnormal indicator is larger, it means that the correlation between the network element alarm data and the abnormal indicator is higher. In practical applications, after determining the correlation between each network element alarm data and the abnormal indicator, the root cause of the network element abnormality can be found in the network element alarm data with a higher correlation, so as to assist the operation and maintenance personnel to quickly troubleshoot the fault in the communication network and reduce the time cost and manpower cost of network operation and maintenance.

[0130] The data processing method of the communication network in the embodiment shown in this specification can be applied to a processor and implemented by a processor. The processor may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by an integrated logic circuit of hardware in the processor or an instruction in the form of software. The above processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present application can be implemented or executed. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc. The steps of the method disclosed in the embodiment of the present application can be directly embodied as a hardware decoding processor for execution, or a combination of hardware and software modules in the decoding processor for execution. The software module can be located in a storage medium mature in the art such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory, and the processor reads the information in the memory and completes the steps of the above method in combination with its hardware.

[0131] Of course, in addition to software implementation, the electronic device of this specification does not exclude other implementation methods, such as logic devices or a combination of software and hardware, etc., that is to say, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

[0132] In addition, the present application also provides a computer-readable storage medium, which stores one or more computer programs, wherein the one or more computer programs include instructions. When the instructions are executed by a portable electronic device including multiple application programs, the portable electronic device can execute Figure 1 The steps corresponding to the first mechanism in the method shown include:

[0133] A first sample indicator sequence of a communication network is obtained; the first sample indicator sequence includes indicator data corresponding to a plurality of windows of the communication network.

[0134] A second sample indicator sequence is predicted at a future time based on the first sample indicator sequence.

[0135] An indicator anomaly detection is performed based on the first sample indicator sequence and the second sample indicator sequence to determine an anomaly identification sequence.

[0136] The classification model is trained using a plurality of network element alarm data corresponding to the communication network in the same sequence as the second sample indicator sequence as samples and the abnormal identification sequence as a label.

[0137] Based on the training parameters of the classification model, the correlation between the plurality of network element alarm data and the abnormal indicators is determined.

[0138] Those skilled in the art will appreciate that the embodiments of this specification may be provided as methods, systems or computer program products. Therefore, this specification may take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0139] The above is a description of a specific embodiment of the specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0140] The above are only embodiments of this specification and are not intended to limit this specification. For those skilled in the art, this specification may be subject to various changes and modifications. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of this specification shall be included in the scope of the claims of this specification. In addition, all other embodiments obtained by ordinary technicians in this field without creative work shall fall within the scope of protection of this document.

Claims

1. A data processing method for a communication network, characterized in that: include: Acquire a first sample indicator sequence of a communication network; the first sample indicator sequence includes indicator data corresponding to a plurality of windows of the communication network; Predicting a second sample indicator sequence at a future time based on the first sample indicator sequence; Performing indicator anomaly detection based on the first sample indicator sequence and the second sample indicator sequence to determine an abnormal identification sequence; Using the multiple network element alarm data corresponding to the second sample indicator sequence of the communication network as samples and the abnormal identification sequence as labels, training the classification model; Based on the training parameters of the classification model, the correlation between the plurality of network element alarm data and the abnormal indicators is determined.

2. The method according to claim 1, characterized in that The predicting of a second sample indicator sequence in the future based on the first sample indicator sequence includes: Inputting the first sample indicator sequence into the autoencoder model for encoding to obtain an encoding sequence corresponding to the first sample indicator sequence; The coding sequence corresponding to the first sample indicator sequence is input into the long short-term memory model to obtain the second sample indicator sequence predicted by the long short-term memory model.

3. The method according to claim 2, characterized in that Before inputting the coding sequence corresponding to the first sample indicator sequence into the long short-term memory model, the method further includes: Inputting the third sample indicator sequence of the communication network into the autoencoder model for encoding to obtain an encoding sequence corresponding to the third sample indicator sequence; Splitting the coding sequence corresponding to the third sample indicator sequence into a first sub-coding sequence with an earlier time and a second sub-coding sequence with a later time; The long short-term memory model is trained using the first sub-coding sequence as a sample and the second sub-coding sequence as a label.

4. The method according to claim 2, characterized in that: Before inputting the first sample indicator sequence into the autoencoder model for encoding to obtain an encoding sequence corresponding to the first sample indicator sequence, the method further includes: Inputting the fourth sample index sequence of the communication network into the autoencoder model to obtain a coding sequence corresponding to the fourth sample index sequence; Inputting the encoding sequence corresponding to the fourth sample index sequence into the decoder to obtain a decoding sequence corresponding to the fourth sample index sequence; The autoencoder model is trained based on the loss between the decoding sequence corresponding to the fourth sample indicator and the fourth sample indicator sequence.

5. The method according to claim 1, characterized in that The performing indicator anomaly detection based on the first sample indicator sequence and the second sample indicator sequence to determine an abnormal identification sequence includes: Determine a first error between the indicator data of at least part of the windows in the first sample indicator sequence and the corresponding prediction indicator data in the second sample indicator sequence, and determine the windows in the first sample indicator sequence whose first error reaches a first threshold as suspicious windows; Determine the second error between the indicator data of each suspicious window in the first sample indicator sequence and the true value result of the corresponding predicted indicator data, and determine the indicator data in the first sample indicator sequence whose second error reaches a second threshold as an abnormal indicator, and determine the indicator data whose second error does not reach the second threshold as a normal indicator.

6. The method according to any one of claims 1 to 5, characterized in that The indicator data includes key performance indicators.

7. The method according to any one of claims 1 to 5, characterized in that Also includes: When the correlation between the target network element alarm data and the abnormal index in the plurality of network element alarm data reaches a correlation threshold, a preset abnormality handling measure is executed for the network element corresponding to the target network element alarm data.

8. The method according to any one of claims 1 to 5, characterized in that Determining the correlation between the plurality of network element alarm data and the abnormal indicators based on the training parameters of the classification model includes: Based on the trained weights for the multiple network element alarm data in the classification model, the correlation between the multiple network element alarm data and the abnormal indicators is determined.

9. An electronic device, characterized in that: The device comprises: A processor; and a memory configured to store computer executable instructions, which, when executed, cause the processor to perform the method according to any one of claims 1 to 8.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium is used to store computer-executable instructions, and the computer-executable instructions implement the method according to any one of claims 1 to 8 when executed by a processor.

Images