Network communication fault early warning system based on machine learning

Abstract

The invention relates to the technical field of network communication, and discloses a network communication fault early warning system based on machine learning, which comprises a machine learning module, and the module uses historical operation data to train a model so as to predict the change trend of future communication parameters. The data monitoring module is responsible for monitoring communication parameters of network equipment in real time and performing data cleaning. And the curve fitting module is used for drawing the real-time data and the predicted data into a curve and carrying out visual comparison. And the residual analysis module calculates the residual of the two curves and marks abnormal points. And finally, the early warning notification module judges potential fault risks according to the abnormal points and the evaluation rules and sends early warning information. The system does not depend on a fixed threshold value, can adapt to dynamic changes of a network environment, accurately captures subtle changes and trends of communication parameters, and effectively avoids false alarms and missing alarms. Through the application of the system, the accuracy and timeliness of network communication fault early warning can be remarkably improved, and economic loss and inconvenience are reduced.

Description

Technical Field

[0001] The present invention relates to the technical field of network communication, and in particular to a network communication failure early warning system based on machine learning. Background Art

[0002] In the power system, single-phase grounding fault is a common fault type. Its rapid and accurate positioning is crucial to ensure the stable operation of the power system and timely restoration of power supply.

[0003] At present, the single-phase grounding fault location method mainly relies on manual inspection and simple fault indicators. Manual inspection is time-consuming and laborious, and is greatly affected by external factors such as weather and terrain, and it is often difficult to find the fault point in a timely and accurate manner. Although the fault indicator can provide certain fault information, its accuracy and reliability are limited, especially in the complex and changeable power system environment, and its positioning effect is often unsatisfactory. For example, in a single-phase grounding fault that occurred in an actual power system, because the fault point was located in a remote mountainous area, it was difficult for manual inspection to arrive in time, resulting in a fault location time of up to several hours, which seriously affected the normal operation of the power system and the user's electricity experience. At the same time, due to the false alarm and missed alarm of the fault indicator, the accuracy of fault location is greatly reduced, further extending the time for fault handling.

[0004] The existing single-phase grounding fault location method still lacks the effective fusion and utilization of data from different sources. There are many types of monitoring equipment in the power system, including power system monitoring devices, fault recorders and distributed sensors. The data collected by these devices covers all aspects of the power system. By fusing and analyzing these data, the accuracy of fault location and the early warning capability of faults can be improved. Summary of the invention

[0005] The purpose of the present invention is to provide a network communication failure early warning system based on machine learning to solve the problems raised in the above background technology.

[0006] To achieve the above object, the present invention provides the following technical solution: a network communication failure early warning system based on machine learning, comprising:

[0007] The machine learning module is used to use the machine learning model combined with the historical operation data of the network equipment to predict the change trend of the communication parameters of the network equipment in the future;

[0008] The data monitoring module is used to monitor the communication parameters of network devices in real time, obtain data on actual bandwidth utilization, delay, packet loss rate, retransmission rate, and throughput, and clean the original monitoring data to remove outliers and noise;

[0009] The curve fitting module obtains the real-time communication parameter data output by the data monitoring module and the predicted communication parameter data output by the machine learning module, draws the real-time and predicted curves of each set of communication parameter data over time, and aligns the timestamps of the two curve data and puts them into the same coordinate system;

[0010] The residual analysis module is used to calculate the residual curve of the two curves generated by each set of communication parameter data, and determine whether each point on the residual curve has a deviation exceeding the threshold according to a preset threshold, and if so, mark it as an abnormal point;

[0011] The early warning notification module is used to evaluate the network communication status based on the discovered abnormal points and preset evaluation rules, determine whether there is a potential failure risk, and send the evaluation results and early warning information to relevant personnel.

[0012] Preferably, the machine learning module includes:

[0013] A data collection unit is used to collect the communication parameter time series data of different types of network devices in historical operation, as well as the network environment and device hardware parameters during operation, to obtain a basic data set;

[0014] A data preprocessing unit, used for cleaning and normalizing the original communication parameter data in the basic data set;

[0015] The feature extraction unit, based on the preprocessed basic data set, identifies the potential relationship between network communication anomalies and service requests, as well as the feature differences between different types of network devices through statistical analysis methods and clustering algorithms, and merges the association rules and clustering result data obtained from the analysis with the preprocessed basic data set to form a training data set;

[0016] The model training unit is used to build a parameter change prediction model for network communication. The model is based on the training data set and combined with the machine learning algorithm to predict the communication parameter change trend of the network equipment in the future.

[0017] Preferably, the data preprocessing unit identifies and removes outliers and missing values ​​in the data by statistical methods, and then uses a normalization algorithm to normalize the data so that data with different characteristics have similar scales; specifically, for each communication parameter, the following formula is used for normalization:

[0018]

[0019] Where x is the original data, min(x) and max(x) are the minimum and maximum values ​​of the parameter data, respectively, and x′ is the normalized data.

[0020] Preferably, the implementation steps of the feature extraction unit include:

[0021] Step 1: Perform statistical analysis on the preprocessed basic data set and calculate the basic statistics of each communication parameter, including mean, variance, maximum, minimum and median, to understand the distribution and characteristics of the data;

[0022] Step 2: Use a clustering algorithm to perform cluster analysis on the preprocessed basic data set to identify the feature differences between different network device types and the potential relationship between communication parameters; specifically, use the K-means clustering algorithm to calculate the distance from each data point to the cluster center through the following formula, and assign the data point to the cluster to which the nearest cluster center belongs:

[0023]

[0024] Among them, represents the i-th data point, represents the j-th cluster center, and n represents the characteristic x of the data point. i c j

[0025] The feature dimension represents the kth eigenvalue of the i-th data point and the kxth feature value of the j-th cluster center. ik c jk

[0026] eigenvalues;

[0027] Step 3: Analyze the distribution and characteristics of communication parameters in different clusters through clustering results, identify the potential relationship between network communication anomalies and service requests, and the characteristic differences between different network device types;

[0028] Step 4: Merge the association rules and clustering result data obtained from the analysis with the preprocessed basic data set to form a training data set containing rich features.

[0029] Preferably, the step of constructing the parameter change prediction model by the model training unit includes:

[0030] Step 1: Divide the training data set into a training set and a validation set for model training and performance evaluation;

[0031] Step 2: Select the long short-term memory network LSTM model to build a network communication parameter change prediction model, and initialize the parameters of the model; the prediction model consists of an input layer, multiple LSTM hidden layers and an output layer; the input layer receives the network equipment operation data characteristics, including network equipment type, network environment parameters, equipment hardware parameters and historical communication parameters; the LSTM hidden layer is used to learn the time series dependency in the data; the output layer outputs the change trend of bandwidth utilization, delay, packet loss rate, retransmission rate and throughput of the network equipment in the future period;

[0032] Step 3: Use the training set data to iteratively train the LSTM model. In each iteration, a batch of input data is sent to the LSTM model, and the values ​​of the input layer, LSTM hidden layer, and output layer are calculated using the following formula, and the memory units and hidden states are updated to finally obtain the predicted output sequence:

[0033] Input layer: Multiply the input data xi with the weight matrix Wx and the bias vector bx to get the output h of the input layer iinput =W x xi+bx;

[0034] LSTM hidden layer: According to the output h of the input layer iinput , the hidden state h at the previous moment t-1 and the memory cell state c t-1 , calculate the hidden state h at the current moment through the forget gate, input gate and output gate of LSTM t and the memory cell state c t ;

[0035] Output layer: The output h of the LSTM hidden layer t With the weight matrix w y and the bias vector b t Multiply them together to get the predicted output sequence

[0036] During training, regularly use the validation set to evaluate model performance and adjust the learning rate or stop training early as needed to prevent overfitting.

[0037] Step 4: After training is completed, save the weights and biases of the LSTM model and deploy the model for subsequent prediction of network communication parameter change trends.

[0038] Preferably, during the parameter change prediction model training process, the mean square error (MSE) algorithm is used to evaluate the model performance, and the specific implementation steps include:

[0039] Step 1: After each training iteration, use the validation set data to evaluate the performance of the LSTM model.

[0040] Step 2: Calculate the mean square error (MSE) between the predicted output of the LSTM model and the actual output of the validation set. The calculation formula for MSE is:

[0041]

[0042] Among them, N is the number of samples in the validation set, y i is the actual output value of the i-th sample in the validation set, is the predicted output value of the LSTM model for the i-th sample;

[0043] Step 3: Evaluate the performance of the LSTM model based on the calculated MSE value. The smaller the MSE value, the higher the prediction accuracy of the model and the better the performance.

[0044] Step 4: Based on the changing trend of the MSE value and the preset performance threshold, decide whether to continue training the model, adjust the model parameters, or stop training early to prevent the model from overfitting.

[0045] Preferably, the residual analysis module is implemented as follows:

[0046] For each set of communication parameter data, including real-time data and predicted data, a curve changing over time, i.e., a real-time curve and a predicted curve, is drawn respectively, and the two curves are placed in the same coordinate system for comparison;

[0047] Calculate the residual between the real-time curve and the predicted curve to generate a residual curve; the calculation formula of the residual curve is:

[0048] e(t)=y real (t)-y pred (t)

[0049] Among them, e(t) represents the residual at timestamp t, y real (t) represents the real-time communication parameter value at timestamp t, y pred (t) represents the predicted communication parameter value at timestamp t;

[0051] According to the preset threshold, each point on the residual curve is judged. If the absolute value of the residual exceeds the threshold, the point is marked as an outlier, and the number, location and timestamp of the outlier are recorded.

[0052] Preferably, the early warning notification module is implemented as follows:

[0053] Obtain the outlier information output by the residual analysis module, including the number, location and timestamp of outliers;

[0054] According to the preset evaluation rules, analyze the abnormal point information to determine whether there is a potential failure risk in the network communication status; when the evaluation results show that there is a potential failure risk, trigger the early warning mechanism and generate early warning information; the early warning information includes the type of failure risk, risk level, abnormal point details and recommended treatment measures;

[0055] The warning information is sent to relevant personnel via preset communication methods, which may include email, text messages and mobile apps.

[0056] Preferably, the evaluation rules are set based on the number of abnormal points, the duration of continuous abnormal point appearance, and the absolute value of the residual of the abnormal points.

[0057] Compared with the prior art, the present invention has the following beneficial effects:

[0058] Through the learning and analysis of historical operation data by the machine learning module, this system can accurately predict the trend of communication parameter changes of network equipment in the future. This predictive ability enables the system to detect potential anomalies in time before a failure occurs, improve the accuracy and timeliness of early warning, and effectively reduce the economic losses and inconvenience caused by network communication failures. Compared with traditional threshold alarm systems, this system does not rely on fixed threshold settings. Through the dynamic learning and adjustment of the machine learning model, the system can adapt to the dynamic changes of the network environment and accurately capture the subtle changes and trends of communication parameters, thereby avoiding the occurrence of false alarms and missed alarms. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] Figure 1 It is the overall structure diagram of the present invention;

[0060] Figure 2 Flowchart for the construction of parameter change prediction model;

[0061] Figure 3 It is a design schematic diagram of the feature extraction unit;

[0062] Figure 4 This is the workflow diagram of the residual analysis module. DETAILED DESCRIPTION

[0063] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0064] See also Figure 1-4The present invention provides a technical solution: a network communication failure early warning system based on machine learning, the system comprising:

[0065] Machine learning module: The core function of this module is to use machine learning models and historical operation data of network devices to predict the change trend of communication parameters of network devices in the future. This module further includes:

[0066] The data collection unit is used to collect the communication parameter time series data of different types of network devices in historical operation, as well as the network environment and device hardware parameters during operation, to obtain a basic data set.

[0067] The data preprocessing unit is used to clean and normalize the original communication parameter data in the basic data set.

[0068] The feature extraction unit, based on the preprocessed basic data set, identifies the potential relationship between network communication anomalies and service requests, as well as the feature differences between different network device types through statistical analysis methods and clustering algorithms, and merges the association rules and clustering result data obtained from the analysis with the preprocessed basic data set to form a training data set.

[0069] The model training unit is used to build a parameter change prediction model for network communication. The model is based on the training data set and combined with the machine learning algorithm to predict the communication parameter change trend of the network equipment in the future.

[0070] Data monitoring module: The data monitoring module is responsible for real-time communication parameter monitoring of network devices. Through sensors deployed in the network or network management software, the communication parameter data of network devices can be obtained in real time.

[0071] Curve fitting module,The curve fitting module receives the real-time communication parameter data output by the data monitoring module and the predicted communication parameter data output by the machine learning module. For each set of communication parameter data, the module draws the real-time curve and the predicted curve over time. In order to ensure the comparability of the two curves, the module aligns the timestamps of the two curve data and displays them in the same coordinate system.

[0072] Residual analysis module, the residual analysis module is used to calculate the residual curve of the two curves generated by each set of communication parameter data. The residual curve is obtained by comparing the difference between the real-time curve and the predicted curve at each time point. Then, according to the preset threshold, it is judged whether each point on the residual curve has a deviation exceeding the threshold. If there is a deviation exceeding the threshold, the point is marked as an abnormal point. The number and distribution of abnormal points will be used for subsequent early warning notifications and network communication status assessment.

[0073] The early warning notification module evaluates the network communication status according to the abnormal points output by the residual analysis module and the preset evaluation rules. When the evaluation results show that there is a potential failure risk, the module triggers the early warning mechanism, generates early warning information, and sends the early warning information to relevant personnel through the preset communication method so that timely measures can be taken to prevent the occurrence of failures.

[0074] The present invention will be further described below in conjunction with Examples 1 to 3:

[0075] Embodiment 1:

[0076] The data preprocessing unit identifies and removes abnormal values ​​and missing values ​​in the data by statistical methods, and the specific method is:

[0077] Outliers are data points that deviate from the normal data distribution range, which may be caused by measurement errors or special events. Statistical methods are used to detect outliers, such as using Z-score standardized data for threshold judgment: Z = (x-μ) / σ, where x is the original data point, μ is the data mean, and σ is the data standard deviation. If the absolute value of the Z-score of a data point exceeds a certain threshold (such as 3), it is considered an outlier and deleted or replaced with the mean, median, etc.

[0078] In the collected original communication parameter data, there may be missing values ​​due to equipment failure, transmission error, etc. For missing values, the following strategies are used to handle them:

[0079] Interpolation method: For continuous missing values ​​in time series data, linear interpolation or Lagrange interpolation methods are used for estimation and filling.

[0080] Deletion method: For records containing a large number of missing values ​​(such as exceeding a certain threshold), delete the record directly to avoid adverse effects on subsequent analysis.

[0081] The normalization algorithm is used to normalize the data so that data with different characteristics have similar scales; specifically, for each communication parameter, the following formula is used for normalization:

[0082]

[0083] Where x is the original data, min(x) and max(x) are the minimum and maximum values ​​of the parameter data, respectively, and x′ is the normalized data.

[0084] The feature extraction unit collects the communication parameter time series data of different types of network devices in historical operation, as well as the network environment and device hardware parameters during operation, through the data collection unit to form a basic data set, which covers multiple dimensions such as bandwidth utilization, delay, packet loss rate, device temperature, CPU usage, etc. In the feature extraction unit, the pre-processed basic data set is statistically analyzed. For example, for the communication parameter of bandwidth utilization, its mean, variance, maximum value, minimum value and median are calculated, which are helpful to understand the overall distribution of bandwidth utilization and potential outliers or fluctuations.

[0085] A clustering algorithm is used to perform cluster analysis on the preprocessed basic data set. Taking the K-means clustering algorithm as an example, a reasonable number of clusters K (such as 3 or 5) is set, and K data points are randomly selected as the initial cluster centers. By calculating the distance from each data point to the cluster center, the data point is assigned to the cluster to which the nearest cluster center belongs. In the iterative process, the cluster center is continuously updated until the clustering result is stable; the distance calculation formula to the cluster center is:

[0086]

[0087] Among them, x i represents the i-th data point, c j represents the jth cluster center, and n represents the characteristics of the data point.

[0088] The feature dimension represents the kth eigenvalue of the i-th data point and the kxth feature value of the j-th cluster center. ik c jk

[0089] feature values.

[0090] Cluster analysis can be used to identify the differences in characteristics between different types of network devices. For example, it may be found that a certain type of network device is more likely to have communication anomalies in a specific network environment, or that the performance of a certain device will significantly decrease when it is running under high load for a long time.

[0091] Based on cluster analysis, we further explore the potential relationship between network communication anomalies and service requests. For example, we analyze whether in a cluster, when bandwidth utilization exceeds a certain threshold, it is more likely to increase latency or packet loss.

[0092] Finally, the association rules and clustering result data obtained from the analysis are merged with the preprocessed basic data set to obtain a training data set containing rich features.

[0093] The step of constructing a parameter change prediction model by the model training unit includes:

[0094] Step 1: Divide the training data set into a training set and a validation set for model training and performance evaluation.

[0095] Step 2: Select the long short-term memory network LSTM model to build a network communication parameter change prediction model and initialize the parameters of the model; the prediction model consists of an input layer, multiple LSTM hidden layers and an output layer; the input layer receives the network equipment operation data features, including network equipment type, network environment parameters, equipment hardware parameters and historical communication parameters; the LSTM hidden layer is used to learn the time series dependencies in the data; the output layer outputs the change trends of the bandwidth utilization, delay, packet loss rate, retransmission rate and throughput of the network equipment in the future; for example, a model containing two layers of LSTM hidden layers is constructed, each layer containing 64 LSTM units. The input layer receives 10 features, and the output layer outputs the change trends of 5 communication parameters in the next hour.

[0096] Step 3: Use the training set data to iteratively train the LSTM model. In each iteration, a batch of input data is sent to the LSTM model, and the values ​​of the input layer, LSTM hidden layer, and output layer are calculated using the following formula, and the memory units and hidden states are updated to finally obtain the predicted output sequence:

[0097] Input layer: input data x i With the weight matrix w x and the bias vector b x Multiply them together to get the output h of the input layer iinput =W x xi+bx.

[0098] LSTM hidden layer: According to the output h of the input layer iinput , the hidden state h at the previous moment t-1 and the memory cell state c t-1 , calculate the hidden state h at the current moment through the forget gate, input gate and output gate of LSTM t and the memory cell state c t .

[0099] Output layer: The output h of the LSTM hidden layer t With the weight matrix W y and the bias vector b y Multiply them together to get the predicted output sequence

[0100] During the parameter change prediction model training process, the mean square error (MSE) algorithm is used to evaluate the model performance. The specific implementation steps include:

[0101] Step 3.1: After each training iteration, use the validation set data to evaluate the performance of the LSTM model.

[0102] Step 3.2: Calculate the mean square error (MSE) between the predicted output of the LSTM model and the actual output of the validation set. The calculation formula for MSE is:

[0103]

[0104] Among them, N is the number of samples in the validation set, y i is the actual output value of the i-th sample in the validation set, is the predicted output value of the LSTM model for the i-th sample.

[0105] Step 3.3: Evaluate the performance of the LSTM model based on the calculated MSE value. The smaller the MSE value, the higher the prediction accuracy of the model and the better the performance.

[0106] Step 3.4: Based on the changing trend of the MSE value and the preset performance threshold, decide whether to continue training the model, adjust the model parameters, or stop training early to prevent the model from overfitting.

[0107] For example, divide the dataset into training set and validation set in a ratio of 8:2. Set the learning rate to 0.001, the batch size to 32, and the number of training rounds to 100. During the training process, use the validation set to evaluate the model performance every 10 rounds, and adjust the learning rate based on the error on the validation set. When the error on the validation set no longer decreases, stop the training early.

[0108] Step 4: After training is completed, save the weights and biases of the LSTM model and deploy the model for subsequent prediction of network communication parameter change trends.

[0109] The following is an example code of an LSTM model built based on Python and TensorFlow / Keras framework for predicting the trend of network communication parameter changes. The code example includes data preprocessing, model building, compilation, training, and saving steps.

[0110] #A CSV file containing network device operation data

[0111] data_file='network_data.Csv'

[0112] #Read data

[0113] data = pd.read_csv(data_file)

[0114] # Clean the data and deal with missing values ​​and outliers

[0115] data.dropna(inplace=True)#delete rows with missing values

[0116] data = data[(np.abs(data['delay']) <= 1000)&(data['packet_loss']> = 0)&(data['packet_loss'] <= 100)] # Assume that the delay does not exceed 1000ms and the packet loss rate is between 0-100%

[0117] #Extract features and target variables

[0118] features=data[['bandwidth_utilization','delay','packet_loss','retransmission_rate','throughput']]#Feature column

[0119] target = data[['bandwidth_utilization', 'delay', 'packet_loss', 'retransmission_rate', 'throughput']].shift(-1).fillna(0) # Target column, use the data of the next moment as the prediction target

[0120] # Split the dataset into training and validation sets

[0121] X_train, X_val, y_train, y_val=train_test_split(features_scaled, target_scaled, test_size=0.2, random_state=42)

[0122] #Reshape the data into the shape accepted by LSTM [samples, time_steps, features]

[0123] time_steps = 10 # Use the data of the first 10 time steps to predict the data of the next time step; this value should be adjusted according to the actual situation

[0124] X_train=X_train.reshape((X_train.shape[0], time_steps, X_train.shape[1]))

[0125] X_val=X_val.reshape((X_val.shape[0], time_steps, X_val.shape[1]))

[0126] #Build LSTM model

[0127] model=Sequential()

[0128] model.add(LSTM(50, return_sequences = True, input_shape = (time_steps, X_train.shape[2]))) #LSTM layer, 50 hidden units; adjust the number of hidden units and time steps as needed

[0129] model.add(LSTM(50))# You can add multiple LSTM layers

[0130] model.add(Dense(X_train.shape[2]))#Output layer, same as the number of features

[0131] # Compile the model

[0132] model.compile(optimizer = 'adam', loss = 'mse') #Use Adam optimizer and mean square error loss function

[0133] #Train model

[0134] epochs=50#Train for 50 rounds; adjust the number of rounds as needed

[0135] model.fit(X_train, y_train, epochs=epochs, validation_data=(X_val, y_val), batch_size=32)

[0136] #Use training set and validation set for training; adjust batch size as needed

[0137] #Save model

[0138] model.save(′network_fault_prediction_lstm.h5′)

[0139] Embodiment 2:

[0140] The specific implementation of the residual analysis module is as follows:

[0141] First, obtain the real-time communication parameter data of the network equipment in the current time window from the data monitoring module, including bandwidth utilization, delay, packet loss rate, retransmission rate, and throughput. At the same time, obtain the predicted communication parameter data in the corresponding time window from the machine learning module. Ensure that the timestamps of the real-time data and the predicted data correspond one-to-one to facilitate the subsequent residual calculation.

[0142] For each set of communication parameters (such as bandwidth utilization, latency, etc.), we plot the curves of real-time communication parameters changing over time (real-time curve) and predicted communication parameters changing over time (predicted curve). Put these two curves in the same coordinate system to intuitively compare the actual operation and the predicted situation.

[0143] According to the residual calculation formula, the residual between the real-time curve and the predicted curve is calculated to generate a residual curve. Taking bandwidth utilization as an example, the residual calculation formula is:

[0145] e bondwidth (t) = y real,bondwidth (t)- y pred,bondwidth (t)

[0146] Among them, e bondwidth (t) represents the residual of bandwidth utilization at timestamp t, y real,bondwidth (t) represents the real-time value of bandwidth utilization at timestamp t, y pred,bondwidth (t) represents the predicted value of bandwidth utilization at timestamp t. For other communication parameters such as delay, packet loss rate, retransmission rate and throughput, the same residual calculation formula is also used to generate corresponding residual curves.

[0149] A reasonable threshold is preset to determine whether a point on the residual curve is an abnormal point. The threshold can be set based on historical data, performance specifications of network equipment, and actual operation requirements.

[0150] For each residual curve, check whether the absolute value of the residual exceeds the preset threshold point by point. If the absolute value of the residual at a point exceeds the threshold, the point is marked as an abnormal point, indicating that at this timestamp, the actual operation of the network device is significantly different from the predicted situation.

[0151] Record the locations, timestamps, and corresponding residual values ​​of all anomalies that are marked as outliers. These anomalies may indicate potential problems or failure risks in network communications.

[0152] Further analysis of the distribution pattern of anomalies, quantity change trends, and correlations with other communication parameters will help to more accurately judge the network communication status and take corresponding early warning and response measures.

[0153] Assuming that the current time window is from 9:00 to 10:00 in the morning, the real-time bandwidth utilization data within the time window is obtained from the data monitoring module, and the corresponding predicted bandwidth utilization data is obtained from the machine learning module. After drawing the real-time curve and the predicted curve, it is found that the absolute value of the residual at a certain moment (such as 9:30) exceeds the preset threshold (such as 10%). At this time, the point is marked as an abnormal point, and its position, timestamp (9:30) and residual value are recorded. By analyzing the residual curves in multiple time windows, it is found that the abnormal points are mainly concentrated in certain specific time periods or network devices, which may indicate that there is a potential risk of communication failure in these time periods or network devices. Based on this, the early warning notification module can send early warning information to relevant personnel in a timely manner so that further troubleshooting and repair measures can be taken.

[0154] Embodiment 3:

[0155] The following is a detailed description of the implementation of the warning notification module in the present invention in conjunction with specific examples:

[0156] The early warning notification module first obtains abnormal point information from the residual analysis module. For example, in a certain monitoring, the residual analysis module finds that the residual of bandwidth utilization exceeds the preset threshold continuously between timestamps t1 and t5, and these time points are marked as abnormal points.

[0157] The early warning notification module analyzes the acquired abnormal point information according to the preset evaluation rules. The evaluation rules can be set as follows: when abnormalities occur at three or more consecutive time points and the absolute values ​​of the residuals are all greater than a certain threshold, it is considered that there is a potential failure risk in the network communication status.

[0158] In this example, since abnormalities occur at five consecutive time points from timestamps t1 to t5 and the absolute values ​​of the residuals are all greater than the threshold, the early warning notification module determines that there is a potential failure risk in the network communication status.

[0159] When the evaluation results indicate that there is a potential risk of failure, the early warning notification module generates early warning information. The early warning information includes the type of failure risk (such as abnormal bandwidth utilization), risk level (such as high, medium, and low), abnormal point details (such as timestamps t1 to t5, corresponding residual values), and recommended treatment measures (such as checking network equipment, adjusting network configuration, etc.).

[0160] The warning notification module sends the generated warning information to relevant personnel through a preset communication method. For example, the warning information can be sent to the mailbox of the network administrator via email, or to the mobile phone of the technical support personnel via SMS. In this example, the warning information is sent by both email and SMS to ensure that the relevant personnel can receive and process it in time.

[0161] The warning notification module also records the time when the warning information is sent, the recipient, and the subsequent processing results. This information is stored in the database for subsequent reference and analysis of network communication failure warnings and processing.

[0162] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device.

[0163] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A network communication fault early warning system based on machine learning, characterized in that: The system comprises: The machine learning module is used to use the machine learning model combined with the historical operation data of the network equipment to predict the change trend of the communication parameters of the network equipment in the future; The data monitoring module is used to monitor the communication parameters of network devices in real time, obtain data on actual bandwidth utilization, delay, packet loss rate, retransmission rate, and throughput, and clean the original monitoring data to remove outliers and noise; The curve fitting module obtains the real-time communication parameter data output by the data monitoring module and the predicted communication parameter data output by the machine learning module, draws the real-time and predicted curves of each set of communication parameter data over time, and aligns the timestamps of the two curve data and puts them into the same coordinate system; The residual analysis module is used to calculate the residual curve of the two curves generated by each set of communication parameter data, and determine whether each point on the residual curve has a deviation exceeding the threshold according to a preset threshold, and if so, mark it as an abnormal point; The early warning notification module is used to evaluate the network communication status based on the discovered abnormal points and preset evaluation rules, determine whether there is a potential failure risk, and send the evaluation results and early warning information to relevant personnel.

2. The network communication failure early warning system based on machine learning according to claim 1 is characterized in that: The machine learning module includes: A data collection unit is used to collect the communication parameter time series data of different types of network devices in historical operation, as well as the network environment and device hardware parameters during operation, to obtain a basic data set; A data preprocessing unit, used for cleaning and normalizing the original communication parameter data in the basic data set; The feature extraction unit, based on the preprocessed basic data set, identifies the potential relationship between network communication anomalies and service requests, as well as the feature differences between different types of network devices through statistical analysis methods and clustering algorithms, and merges the association rules and clustering result data obtained from the analysis with the preprocessed basic data set to form a training data set; The model training unit is used to build a parameter change prediction model for network communication. The model is based on the training data set and combined with the machine learning algorithm to predict the communication parameter change trend of the network equipment in the future.

3. The network communication failure early warning system based on machine learning according to claim 2 is characterized in that: The data preprocessing unit identifies and removes outliers and missing values ​​in the data by statistical methods, and then uses a normalization algorithm to normalize the data so that data with different characteristics have similar scales; specifically, for each communication parameter, the following formula is used for normalization: Where x is the original data, min(x) and max(x) are the minimum and maximum values ​​of the parameter data, respectively, and x′ is the normalized data.

4. The network communication failure early warning system based on machine learning according to claim 3 is characterized in that: The implementation steps of the feature extraction unit include: Step 1: Perform statistical analysis on the preprocessed basic data set and calculate the basic statistics of each communication parameter, including mean, variance, maximum, minimum and median, to understand the distribution and characteristics of the data; Step 2: Use a clustering algorithm to perform cluster analysis on the preprocessed basic data set to identify the feature differences between different network device types and the potential relationship between communication parameters; specifically, use the K-means clustering algorithm to calculate the distance from each data point to the cluster center through the following formula, and assign the data point to the cluster to which the nearest cluster center belongs: Among them, represents the i-th data point, represents the j-th cluster center, and n represents the characteristic x of the data point. i c j The feature dimension represents the kth eigenvalue of the i-th data point and the kxth feature value of the j-th cluster center. ik c jk eigenvalues; Step 3: Analyze the distribution and characteristics of communication parameters in different clusters through clustering results, identify the potential relationship between network communication anomalies and service requests, and the characteristic differences between different network device types; Step 4: Merge the association rules and clustering result data obtained from the analysis with the preprocessed basic data set to form a training data set containing rich features.

5. The network communication failure early warning system based on machine learning according to claim 4 is characterized in that: The step of constructing a parameter change prediction model by the model training unit includes: Step 1: Divide the training data set into a training set and a validation set for model training and performance evaluation; Step 2: Select the long short-term memory network LSTM model to build a network communication parameter change prediction model, and initialize the parameters of the model; the prediction model consists of an input layer, multiple LSTM hidden layers and an output layer; the input layer receives the network equipment operation data characteristics, including network equipment type, network environment parameters, equipment hardware parameters and historical communication parameters; the LSTM hidden layer is used to learn the time series dependency in the data; the output layer outputs the change trend of bandwidth utilization, delay, packet loss rate, retransmission rate and throughput of the network equipment in the future period; Step 3: Use the training set data to iteratively train the LSTM model. In each iteration, a batch of input data is sent to the LSTM model, and the values ​​of the input layer, LSTM hidden layer, and output layer are calculated using the following formula, and the memory units and hidden states are updated to finally obtain the predicted output sequence: Input layer: input data x i With the weight matrix W x and the bias vector b x Multiply them together to get the output h of the input layer iinput =W x x i +b x ; LSTM hidden layer: According to the output h of the input layer iinput , the hidden state h at the previous moment t-1 and the memory cell state c t-1 , calculate the hidden state h at the current moment through the forget gate, input gate and output gate of LSTM t and the memory cell state c t ; Output layer: The output h of the LSTM hidden layer t With the weight matrix W y and the bias vector b y Multiply them together to get the predicted output sequence During training, regularly use the validation set to evaluate model performance and adjust the learning rate or stop training early as needed to prevent overfitting. Step 4: After training is completed, save the weights and biases of the LSTM model and deploy the model for subsequent prediction of network communication parameter change trends.

6. The network communication failure early warning system based on machine learning according to claim 5 is characterized by: During the parameter change prediction model training process, the mean square error (MSE) algorithm is used to evaluate the model performance. The specific implementation steps include: Step 1: After each training iteration, use the validation set data to evaluate the performance of the LSTM model. Step 2: Calculate the mean square error (MSE) between the predicted output of the LSTM model and the actual output of the validation set. The calculation formula for MSE is: Among them, N is the number of samples in the validation set, y i is the actual output value of the i-th sample in the validation set, is the predicted output value of the LSTM model for the i-th sample; Step 3: Evaluate the performance of the LSTM model based on the calculated MSE value. The smaller the MSE value, the higher the prediction accuracy of the model and the better the performance. Step 4: Based on the changing trend of the MSE value and the preset performance threshold, decide whether to continue training the model, adjust the model parameters, or stop training early to prevent the model from overfitting.

7. The network communication failure early warning system based on machine learning according to claim 1 is characterized in that: The residual analysis module is implemented as follows: For each set of communication parameter data, including real-time data and predicted data, a curve changing over time, i.e., a real-time curve and a predicted curve, is drawn respectively, and the two curves are placed in the same coordinate system for comparison; Calculate the residual between the real-time curve and the predicted curve to generate a residual curve; the calculation formula of the residual curve is: e(t)=y real (t)-y pred (t) Among them, e(t) represents the residual at timestamp t, y real (t) represents the real-time communication parameter value at timestamp t, y pred (t) represents the predicted communication parameter value at timestamp t; According to the preset threshold, each point on the residual curve is judged. If the absolute value of the residual exceeds the threshold, the point is marked as an outlier, and the number, location and timestamp of the outlier are recorded.

8. The network communication failure early warning system based on machine learning according to claim 1 is characterized in that: The implementation method of the early warning notification module is: Obtain the outlier information output by the residual analysis module, including the number, location and timestamp of outliers; According to the preset evaluation rules, analyze the abnormal point information to determine whether there is a potential failure risk in the network communication status; when the evaluation results show that there is a potential failure risk, trigger the early warning mechanism and generate early warning information; The early warning information includes the type of fault risk, risk level, abnormal point details and recommended treatment measures; The warning information is sent to relevant personnel via preset communication methods, which may include email, text messages and mobile apps.

9. The network communication failure early warning system based on machine learning according to claim 8 is characterized in that: The evaluation rules are set based on the number of abnormal points, the duration of continuous abnormal point appearance, and the absolute value of the residual of the abnormal points.

Images