System early warning grade determination method and related product

Abstract

The invention relates to a system early warning grade determination method and a related product. The method comprises: determining a topological graph of a network system, the topological graph comprising nodes and edges, the nodes being used for representing non-abnormal network devices in the network system, and the edges being used for representing a connection route of two non-abnormal network devices in the network system; determining a first index value between any two nodes based on the nodes and the edges, wherein the first index value is used for representing the capability and convenience of communication interaction between any two non-abnormal network devices; based on the plurality of first index values, determining a second index value of the network system, the second index value being used for representing communication performance and stability of the non-abnormal network device, and the second index value being positively correlated with the first index value; based on the second index value, the early warning level of the network system is determined, and the early warning level is in negative correlation with the second index value. By adopting the method, early warning can be carried out on the network system more accurately.

Description

Technical Field

[0001] The present application relates to the field of network operation and maintenance technology, and in particular to a system warning level determination method and related products. Background Art

[0002] Whether there are abnormal situations in the network system, such as whether there are abnormalities in the network equipment in the network system, has a significant impact on the operation of the network system. In the case of abnormal situations in the network system, it is necessary to accurately warn the network system so that the network system can be accurately and timely maintained to ensure that the network system can operate normally and efficiently. In traditional network operation and maintenance technologies, it is difficult to accurately assess the impact of abnormal situations in the network system, such as abnormal network equipment, on the operation of the network system. Furthermore, traditional network operation and maintenance technologies have the disadvantage that it is difficult to accurately warn the network system. Summary of the invention

[0003] Based on this, it is necessary to provide a system warning level determination method and related products for the above technical problems, so as to more accurately warn the network system. The related products include a system warning level determination device, a computer device, a computer readable storage medium and a computer program product.

[0004] In a first aspect, the present application provides a method for determining a system warning level, the method comprising:

[0005] Determine a topology graph of the network system, the topology graph comprising nodes and edges, the nodes are used to represent non-abnormal network devices in the network system, and the edges are used to represent connection routes between two non-abnormal network devices in the network system;

[0006] Determine a first index value between any two nodes based on the node and the edge, where the first index value is used to represent the ability and convenience of communication interaction between any two non-abnormal network devices;

[0007] Based on the multiple first indicator values, determining a second indicator value of the network system, the second indicator value is used to represent the communication performance and stability of the non-abnormal network device, and the second indicator value is positively correlated with the first indicator value;

[0008] Based on the second indicator value, a warning level of the network system is determined, and the warning level is negatively correlated with the second indicator value.

[0009] The method for determining the system warning level provided by the first aspect is adopted to first determine the topology map of the network system, wherein the topology map includes nodes and edges, the nodes are used to represent non-abnormal network devices in the network system, and the edges are used to represent the connection routes of two non-abnormal network devices in the network system. Then, based on the nodes and edges, a first index value between any two nodes is determined, which can be used to accurately represent the ability and convenience of communication interaction between any two non-abnormal network devices. Furthermore, a second index value of the network system is determined based on multiple first index values. Among them, the second index value is positively correlated with the first index value. This second index value can accurately represent the communication performance and stability of each non-abnormal network device in the network system. Furthermore, based on the second index value of the network system, the current performance of each non-abnormal network device in the network system is comprehensively considered. The better the current performance of each non-abnormal network device, the more abnormal situations exist in the network system. For example, if there are abnormal network devices, the smaller the impact on the non-abnormal network devices and the entire network system, the smaller the degree of failure of the network system, and the lower the warning level of the network system; the worse the current performance of each non-abnormal network device, the greater the impact of the abnormal situation in the network system on the non-abnormal network devices and the entire network system, the greater the degree of failure of the network system, and the higher the warning level of the network system. Therefore, based on the second indicator value of the network system, the warning level of the network system can be accurately determined, wherein the warning level of the network system is negatively correlated with the second indicator value.

[0010] By adopting the above-mentioned system warning level determination method, by accurately determining the current communication performance and stability of each non-abnormal network device in the network system, taking the current performance of each non-abnormal network device in the network system into consideration, and conducting in-depth analysis and comprehensive consideration of the current overall performance of the network system with abnormal situations, the warning level of the network system can be determined more accurately. In turn, it is conducive to achieving more accurate warning of the network system.

[0011] In a second aspect, the present application also provides a system warning level determination device, the device comprising:

[0012] A topology map determining module, used to determine a topology map of the network system, wherein the topology map includes nodes and edges, wherein the nodes are used to represent non-abnormal network devices in the network system, and the edges are used to represent connection routes between two non-abnormal network devices in the network system;

[0013] An index value determination module, used to determine a first index value between any two nodes based on the node and the edge, wherein the first index value is used to represent the ability and convenience of communication interaction between any two non-abnormal network devices;

[0014] The indicator value determination module is further used to determine a second indicator value of the network system based on the plurality of the first indicator values, wherein the second indicator value is used to represent the communication performance and stability of the non-abnormal network device, and the second indicator value is positively correlated with the first indicator value;

[0015] The level determination module is used to determine the warning level of the network system based on the second indicator value, and the warning level is negatively correlated with the second indicator value.

[0016] In a third aspect, the present application further provides a computer device, comprising: a memory and a processor, wherein the memory stores program instructions; when the program instructions are executed by the processor, the processor executes the method shown in the first aspect or any embodiment of the first aspect.

[0017] In a fourth aspect, the present application further provides a computer-readable storage medium, wherein a computer program is stored in the computer-readable storage medium; when the computer program runs on one or more processors, the method shown in the first aspect or any embodiment of the first aspect is executed.

[0018] In a fifth aspect, the present application also provides a computer program product, which includes a computer program or instructions; when the computer program or instructions are run on a computer, the computer is enabled to execute the method shown in the first aspect or any embodiment of the first aspect.

[0019] It can be understood that the system warning level determination device provided in the second aspect, the computer device provided in the third aspect, the computer readable storage medium provided in the fourth aspect, and the computer program product provided in the fifth aspect can be used to execute the system warning level determination method shown in the first aspect of the present application or any embodiment of the first aspect. Therefore, the beneficial effects that can be achieved can refer to the beneficial effects in the system warning level determination method, which will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the embodiments are introduced as follows.

[0021] Figure 1 One of the flow charts of the method for determining the system warning level provided in the embodiment of the present application;

[0022] Figure 2 A schematic diagram of a process for determining a first index value between any two nodes based on nodes and edges provided in an embodiment of the present application;

[0023] Figure 3A schematic diagram of a process for determining an early warning level of a network system based on a second indicator value provided in an embodiment of the present application;

[0024] Figure 4 A second flowchart of a method for determining a system warning level provided in an embodiment of the present application;

[0025] Figure 5 A schematic diagram of a flow chart of inputting time domain features and frequency domain features into a model and outputting anomaly levels of network devices, provided in an embodiment of the present application;

[0026] Figure 6 A schematic diagram of a residual structure provided in an embodiment of the present application;

[0027] Figure 7 A schematic diagram of the structure of the model provided in the embodiment of the present application;

[0028] Figure 8 A third flowchart of a method for determining a system warning level provided in an embodiment of the present application;

[0029] Fig. 9 A schematic diagram of the structure of a system warning level determination device provided in an embodiment of the present application;

[0030] Fig.10 A schematic diagram of the structure of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0031] In order to facilitate understanding of the embodiments of the present application, the embodiments of the present application will be described more fully below with reference to the relevant drawings. The preferred embodiments of the embodiments of the present application are given in the drawings. However, the embodiments of the present application can be implemented in many different forms and are not limited to the embodiments described herein. On the contrary, the purpose of providing these embodiments is to make the disclosure of the embodiments of the present application more thorough and comprehensive.

[0032] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art of the technical field of the embodiments of the present application. The terms used herein in the description of the embodiments of the present application are only for the purpose of describing specific embodiments and are not intended to limit the embodiments of the present application.

[0033] The terms "first", "second", etc. used herein are used to distinguish different objects, rather than to describe a specific order. For the purpose of distinguishing different objects, the "first index value" can also be described as the "second index value", and the "second index value" can be described as the "first index value". When used, the singular expressions "one", "a kind of", "said", "above", "the" and "this" are intended to also include plural expressions, unless the context clearly indicates otherwise. It should also be understood that the term "includes / comprising" specifies the existence of the stated features, wholes, steps, operations, parts or their fusions, but does not exclude the possibility of the existence or addition of one or more other features, wholes, steps, operations, parts or their fusions.

[0034] Whether there is an abnormal situation in the network system, such as whether there is an abnormality in the network equipment in the network system, has a significant impact on the operation of the network system. In the case of an abnormal situation in the network system, it is necessary to accurately warn the network system so as to accurately and timely maintain the network system to ensure that the network system can operate normally and efficiently. In traditional network operation and maintenance technology, when it is determined that there is an abnormal situation in the network system, the warning of the network system may be ignored. Or, if the abnormal situation exists in the network system, the network system may be simply warned according to the importance of the abnormal network equipment in the network system. In this way, the warning of the network system only focuses on the performance of the abnormal network equipment, which is a local feature, lacks in-depth analysis and comprehensive consideration of the overall performance of the network system, and it is difficult to accurately evaluate the impact of the abnormal situation on the operation of the network system. The obtained warning result is one-sided, and it is difficult to accurately warn the network system. Based on this, the embodiment of the present application provides a system warning level determination method that can perform in-depth analysis and comprehensive consideration of the overall performance of the network system, so as to more accurately warn the network system.

[0035] like Figure 1 As shown, the system warning level determination method includes the following steps S101 to S104.

[0036] S101, determining a topology graph of a network system. The topology graph includes nodes and edges, wherein a node is used to represent a non-abnormal network device in the network system, and an edge is used to represent a connection route between two non-abnormal network devices in the network system.

[0037] The system warning level determination method in this embodiment strives to comprehensively and accurately evaluate the abnormal situations existing in the network system, such as the presence of abnormal network devices, and the impact on the operation of the network system. For this purpose, the performance of each non-abnormal network device in the network system is first determined. The performance of each non-abnormal network device in the network system can be used to characterize the current overall performance of the network system. The network availability of the network system is used as a parameter for characterizing the overall performance of the network system. This network availability can comprehensively and accurately reflect the impact of abnormal situations such as the presence of abnormal network devices on the operation of the network system. If the performance of each non-abnormal network device is good and the network availability is high, it means that the impact of the abnormal situation in the network system on the operation of the network system is relatively small, the degree of failure of the network system is relatively low, and the system warning level is relatively low; otherwise, it means that the impact of the abnormal situation in the network system on the operation of the network system is relatively large, the degree of failure of the network system is relatively high, and the system warning level is relatively high. Furthermore, based on the performance of each non-abnormal network device in the network system, that is, based on the network availability of the network system, the warning level of the network system is determined. Based on the warning level of the network system, the network system can be warned more accurately.

[0038] Specifically, a topology graph of the network system is first determined. The topology graph includes nodes and edges, where nodes are used to represent non-abnormal network devices in the network system, and edges are used to represent connection routes between two non-abnormal network devices in the network system.

[0039] Among them, network equipment refers to a dedicated hardware device that connects various servers, personal computers (PCs), application terminals and other nodes to each other to form an information communication network. Common network equipment includes switches, routers, servers, firewalls, bridges, hubs, gateways, network interface cards, wireless access points, modems, etc. In this embodiment, the method for determining whether a network device is abnormal can be: an abnormal identification model is used to identify the abnormality of the network device to determine whether the network device has an abnormal situation. Among them, the abnormal identification model is based on the abnormal situation of the network device marked manually, and the first model is trained with parameters to obtain the abnormal situation of the network device. It should be noted that the abnormal situation of the network device is defined manually. During the definition process, the abnormal situation of the network device is determined manually according to the application scenario, network environment, business requirements, etc. of the network device, which may also involve the analysis of the historical data of the network device, as well as the identification and marking of potential abnormal situations. After the abnormal situation of the network device is manually defined and marked, the machine learning model can be trained to enable it to identify the abnormal situation of the network device, that is, the above-mentioned abnormal identification model is obtained. It should be understood that the abnormal situations of different network devices may be different. For example, for a router, the abnormality may refer to a sudden increase in the loss rate of data packets, while for a server, the abnormality may be an abnormal peak in the CPU usage rate. The abnormal situations of the same network device under different application scenarios or business requirements may also be different. The meaning of "abnormal" is not limited in this embodiment. If the network device is set to be unavailable if there is an abnormality, then the abnormal network device refers to the network device with abnormalities, and the non-abnormal network device refers to the network device without abnormalities. If the network device is set to be unavailable if there is an abnormality and the abnormality level reaches the corresponding level threshold, then the abnormal network device refers to the network device with abnormalities and the abnormality level reaches the corresponding level threshold. The non-abnormal network device includes the network device without abnormalities and the network device with abnormalities but the abnormality level is lower than the corresponding level threshold. Among them, the abnormality level of the network device is related to the type and number of abnormal situations, and the abnormality level definition standards of different network devices are different. The abnormal network device corresponds to an unavailable network device, and the non-abnormal network device corresponds to an available network device. The specific definition of abnormal network devices and non-abnormal network devices can be determined according to factors such as specific network scenarios and specific services carried by each network device. A topology diagram generally refers to a network structure diagram composed of network devices and communication media, and is used to describe and display the structure and connection mode of a computer network. The topology diagram of the network system determined in this embodiment refers to a network structure diagram composed of non-abnormal network devices in the network system and the connection routes between two non-abnormal network devices.

[0040] S102, determining a first index value between any two nodes based on the nodes and the edges. The first index value is used to represent the ability and convenience of communication interaction between any two non-abnormal network devices.

[0041] Among them, the first index value used to represent the ability and convenience of communication interaction between any two non-abnormal network devices can be determined by the two parameters of path redundancy and path complexity between any two nodes, that is, it can be determined by the nodes and edges in the topological graph. Specifically, the path redundancy is reflected based on the number of connection paths between any two nodes. Among them, each connection path between any two nodes includes at least one edge. For example, between the first node and the third node, there is a connection path passing through the second node, then this connection path is composed of an edge connecting the first node and the second node and an edge connecting the second node and the third node, and this connection path includes two edges. The path redundancy can also be understood as the connection strength between any two nodes. The more connection paths there are, the higher the connection strength and the higher the path redundancy, and the stronger the communication performance of the non-abnormal network devices corresponding to these two nodes. If there are abnormal network devices in the network system, even if the unavailable abnormal network devices are eliminated, the non-abnormal network devices can still maintain a high communication capability. If a communication path fails, communication can still continue through other communication paths. The path complexity is reflected based on the number of nodes contained in the connection path between any two nodes. The fewer nodes a connection path contains, the lower the path complexity of the connection path is, and the fewer potential failure points it contains. The probability of network failures occurring in the non-abnormal network devices corresponding to any two nodes during communication is smaller, and the stability of the non-abnormal network devices is stronger. Based on the path redundancy and path complexity between any two nodes contained in the topology diagram, the first index value between any two nodes determined can accurately represent the ability and convenience of communication interaction between any two non-abnormal network devices, and can accurately characterize the communication performance and respective stability between any two non-abnormal network devices in the network system.

[0042] S103, based on the multiple first indicator values, determine a second indicator value of the network system. The second indicator value is used to represent the communication performance and stability of the non-abnormal network device, and the second indicator value is positively correlated with the first indicator value.

[0043] Based on the first index value between multiple arbitrary two nodes, the second index value of the network system for representing the communication performance and stability of each non-abnormal network device can be determined, and the second index value is positively correlated with the first index value. It should be understood that if there are three nodes in the topology diagram, through the combination of two by two, one first index value corresponds to any two nodes, and three first index values ​​can be obtained. The second index value thus determined can comprehensively and accurately reflect the impact of abnormal situations such as abnormal network devices on the operation of the network system. Specifically, the higher the first index value between any two nodes, the more stable the connection of the corresponding non-abnormal network device, and the stronger the communication performance and stability. The higher the second index value of the network system determined based on multiple first index values, the stronger the communication performance and stability of each non-abnormal network device in the network system, and the smaller the impact of abnormal situations such as abnormal network devices on the operation of the network system.

[0044] It should be noted that the previous text states that the performance of each non-abnormal network device in the network system can be used to characterize the current overall performance of the network system, and the network availability of the network system is used as a parameter for characterizing the overall performance of the network system. Therefore, network availability can be defined as the ability to maintain communication capabilities and stability between non-abnormal network devices in the network system during network operation and maintenance. Since the second indicator value is used to represent the communication performance and stability of non-abnormal network devices in the network system. Based on this, the second indicator value can be regarded as the numerical value of the parameter network availability.

[0045] S104: Determine the warning level of the network system based on the second indicator value. The warning level is negatively correlated with the second indicator value.

[0046] Furthermore, based on the second indicator value, that is, based on the network availability of the network system, the current communication performance and stability of each non-abnormal network device in the network system are comprehensively considered, and the overall performance of the network system is comprehensively considered, then the early warning level of the network system can be accurately determined. Among them, the better the current performance of each non-abnormal network device, the smaller the impact of the abnormal situation in the network system on the non-abnormal network device and the entire network system, the smaller the degree of failure of the network system, and the lower the early warning level of the network system; the worse the current performance of each non-abnormal network device, the greater the impact of the abnormal situation on the non-abnormal network device and the entire network system, the greater the degree of failure of the network system, and the higher the early warning level of the network system.

[0047] By adopting the system warning level determination method in this embodiment, by accurately determining the current communication performance and stability of each non-abnormal network device in the network system, the current performance of each non-abnormal network device in the network system is taken into consideration, and the current network availability of the network system with abnormal situations, such as the presence of abnormal network devices, is deeply analyzed and comprehensively considered, so that the warning level of the network system can be more accurately determined. For example, when the abnormal situation is the presence of abnormal network devices, by comprehensively and accurately evaluating the impact of abnormal network devices on the operation of the network system, the one-sidedness of determining the warning level of the network system based only on the performance of abnormal network devices is avoided. Furthermore, it is conducive to more accurate early warning of the network system. Further, by more comprehensively evaluating the network availability, more accurately reflecting the impact of abnormal situations on the operation of the network system, and more accurately early warning of the network system, it is conducive to providing more accurate and timely early warning information for operation and maintenance personnel, so as to accurately and timely maintain the network system, improve the accuracy of abnormal identification and the automation level of network operation and maintenance, and facilitate more accurate and efficient realization of network operation and maintenance automation; it is conducive to more rapid location and resolution of network abnormality problems by operation and maintenance personnel, and improves the efficiency of operation and maintenance; it has important positive significance for the development of the field of network operation and maintenance technology.

[0048] In one embodiment, if Figure 2 As shown, step S102, determining a first index value between any two nodes based on nodes and edges, includes the following steps S201 to S203.

[0049] S201, determining a connection path between any two nodes according to the edges. The connection paths do not intersect each other.

[0050] Referring to the foregoing embodiments, the number of connection paths between any two nodes is used to characterize the degree of path redundancy, and each connection path between any two nodes includes at least one edge. Thus, the connection path between any two nodes can be determined based on the edge. The number of connection paths determined at this time is at least one. The number of connection paths refers to the number of non-intersecting connection paths between any two nodes in the topological graph, that is, when the number of connection paths is at least two, there is no intersection of edges or nodes between at least two connection paths between any two nodes.

[0051] S202: Determine the number of nodes included in the connection path.

[0052] The number of nodes included in the connection path between any two nodes, i.e., the number of nodes, is used to characterize the path complexity of the corresponding connection path. It should be noted that the number of nodes included in the above connection path is the number of nodes that do not include any two nodes, that is, the number of nodes between any two nodes in the corresponding connection path. When there is at least one connection path, determining the number of nodes included in the connection path actually means determining the number of nodes included in each connection path between any two nodes.

[0053] S203: Obtain a first index value based on the number of nodes. The first index value is negatively correlated with the number of nodes.

[0054] Obtaining the first index value based on the number of nodes means obtaining the first index value based on the number of nodes contained in each connection path between any two nodes. This process not only involves the number of nodes contained in each connection path, but also involves the number of connection paths between any two nodes, that is, it not only combines the path complexity of each connection path between any two nodes, but also combines the path redundancy between any two nodes. This process can be understood as obtaining the first index value between any two nodes based on the path redundancy and path complexity between any two nodes. Referring to the above-mentioned embodiment, the higher the path redundancy, the stronger the communication performance of the non-abnormal network devices corresponding to any two nodes, and the higher the first index value; the lower the path complexity, the stronger the stability of the non-abnormal network devices corresponding to any two nodes, and the higher the first index value. That is, the first index value between any two nodes is positively correlated with the path redundancy, and the first index value is negatively correlated with the path complexity. Specifically, based on the number of nodes contained in each connection path between any two nodes, a first index value between any two nodes can be obtained, wherein the first index value is positively correlated with the number of connection paths between any two nodes, and the first index value is negatively correlated with the number of nodes contained in any connection path.

[0055] Exemplarily, the first index value between any two nodes is equal to the sum of the number of nodes included in each connection path plus the reciprocal of a constant. Specifically, it can be expressed by the following formula:

[0056]

[0057] Among them, v(i,j) represents the first index value between the i-th node and the j-th node in the topology graph. In this embodiment, it refers to the first index value between any two nodes. t represents the t-th connection path between any two nodes. q represents the number of non-intersecting connection paths between any two nodes as q. The larger the q, the stronger the connection strength between any two nodes, the higher the path redundancy, the higher the first index value, and the higher the availability and robustness of the network. Ms(t) represents the number of nodes in the interval contained in the t-th connection path. The smaller Ms(t), the lower the path complexity of the t-th connection path between any two nodes, the higher the first index value between the two nodes, and the higher the availability and reliability of the network. a is a constant greater than 0, which can take a value of 1.

[0058] Exemplarily, the first index value between any two nodes is equal to the weighted sum of the number of nodes included in each connection path plus the reciprocal of a constant. Specifically, based on the importance of each connection path between any two nodes in the communication process, the reciprocal of the number of nodes included in the connection path plus a constant is weighted. The importance of the connection path in the communication process can be determined based on factors such as the path complexity of the connection path, the services carried by the nodes in the interval included in the connection path, and the importance of the nodes in the interval in the network system.

[0059] In this embodiment, based on the number of nodes included in the connection path between any two nodes in the topology diagram, the first index value between any two nodes can be obtained. The first index value between any two nodes calculated by this calculation method can accurately characterize the communication performance and respective stability between any two non-abnormal network devices in the network system. Furthermore, the second index value determined based on multiple first index values ​​can accurately characterize the communication performance and stability of each non-abnormal network device in the network system, and can comprehensively and accurately reflect the impact of abnormal situations such as the existence of abnormal network devices on the operation of the network system, which is conducive to accurately determining the warning level of the network system and accurately warning the network system.

[0060] In one embodiment, the above step S103, determining the second indicator value of the network system based on the multiple first indicator values, includes the following steps:

[0061] The multiple first index values ​​are summed to obtain a second index value of the network system.

[0062] For example, if the topology graph contains three nodes, then based on the first index value between any two nodes contained in the topology graph, three different first index values ​​can be obtained by combining them in pairs, and the three different first index values ​​are summed to obtain the second index value of the network system. If the topology graph contains four nodes, six different first index values ​​can be obtained by combining them in pairs, and the six different first index values ​​are summed to obtain the second index value of the network system.

[0063] The first index value between any two nodes is used to characterize the communication performance and respective stability between any two non-abnormal network devices in the network system. The higher the first index value, the higher the communication performance and respective stability between any two non-abnormal network devices, and the higher the communication performance and stability of each non-abnormal network device in the network system. It can be seen that the second index value of the network system is positively correlated with the first index value between any two nodes.

[0064] Specifically, the second index value of the network system can be calculated by the following formula:

[0065]

[0066] Among them, V refers to the second index value of the network system, that is, the value of the network availability of the network system. v(i,j) represents the first index value between the i-th node and the j-th node in the topology graph, and the i-th node and the j-th node are any two nodes in the topology graph. n is the total number of nodes in the topology graph, that is, the number of non-abnormal network devices contained in the network system. The higher the first index value between any two nodes, the more stable the connection between any two nodes, and the higher the network availability of the network system.

[0067] Exemplarily, a weighted sum of multiple first index values ​​is performed to obtain a second index value of the network system. Specifically, based on the importance of two nodes in network communication, a weighted coefficient of the first index value between the two nodes is determined. The importance of the two nodes in network communication can be determined based on factors such as the services carried by the two nodes and the importance of the nodes in the network system.

[0068] In the case where the first index value v(i, j) between any two nodes is determined by the path redundancy and path complexity between any two nodes, the second index value of the network system calculated based on the method in this embodiment, that is, the value of network availability, comprehensively considers multiple factors such as the number of non-abnormal network devices in the network system, the communication performance between any two non-abnormal network devices and the stability of each non-abnormal network device, the number of communication paths between any two non-abnormal network devices, and the number of non-abnormal network devices in the intervals contained in each communication path. Among them, the number of non-abnormal network devices is related to the total number of network devices and the number of abnormal network devices in the network system. Based on in-depth analysis and comprehensive consideration, the network availability of the network system can comprehensively and accurately evaluate the impact of abnormal situations such as the existence of abnormal network devices on the network system. Furthermore, based on the network availability of the network system, the warning level of the network system can be accurately determined to more accurately warn the network system.

[0069] In one embodiment, the network system includes a non-abnormal network device and an abnormal network device. Figure 3 As shown, the above step S104, based on the second indicator value, determines the warning level of the network system, including the following steps S301 to S303.

[0070] S301, determining a third index value of the abnormal network device according to the performance index of the abnormal network device. The third index value is used to indicate the importance of the abnormal network device to the network system.

[0071] The importance of network equipment in the network system refers to the criticality and influence of network equipment in the network, which can usually be measured by the following performance indicators of network equipment. Performance indicators include bandwidth, delay, throughput, frequency range, frequency resolution, test port output frequency characteristics, output characteristics, test port input characteristics, group delay characteristics and measurement parameters.

[0072] S302: Perform weighted summation on the second index value and the third index value to obtain a fourth index value.

[0073] With reference to the above-mentioned embodiments, based on in-depth analysis and comprehensive consideration, the network availability of the network system can comprehensively and accurately evaluate the impact of abnormal situations such as the presence of abnormal network devices on the network system. On this basis, when the abnormal situation in the network device is the presence of an abnormal network device, the performance of the abnormal network device can be further considered, combined with the importance of the abnormal network device in the network system, to determine the warning level of the network system.

[0074] Specifically, the second index value used to represent the network availability and the third index value used to represent the importance of the abnormal network device are weighted and summed. In the case of multiple abnormal network devices, the second index value and the third index value of each abnormal network device are weighted and summed to obtain the fourth index value. The weighting coefficients of the second index value and the third index value of each abnormal network device can be obtained by analyzing historical network data. Based on the relationship between the second index value of the network system, the third index value of the abnormal network device, and the actual warning level of the network system in historical situations, the corresponding weighting coefficients are learned.

[0075] S303: Obtain the warning level of the network system according to the indicator threshold interval to which the fourth indicator value belongs. The indicator threshold interval corresponds to the warning level one by one.

[0076] According to the indicator threshold interval to which the fourth indicator value belongs, the corresponding warning level of the network system can be obtained. The indicator threshold interval corresponds to the warning level one by one, and the larger the indicator threshold interval, the higher the warning level.

[0077] In this embodiment, the fourth indicator value obtained by weighted summing the second indicator value used to represent the network availability and the third indicator value used to represent the importance of the abnormal network device can comprehensively and accurately evaluate the impact of the abnormal network device on the network system, and also considers the performance of the abnormal network device. Through the corresponding relationship between the indicator threshold interval to which the fourth indicator value belongs and the warning level, the warning level of the network system can be accurately determined, which is conducive to more accurate warning of the network system.

[0078] In one embodiment, the above step S104, based on the second indicator value, determines the warning level of the network system, including the following steps: according to the preset threshold interval to which the second indicator value belongs, obtain the warning level of the network system, and the preset threshold interval corresponds to the warning level one by one. Among them, the preset threshold interval refers to the threshold interval of the value of network availability, and the larger the preset threshold interval, the lower the warning level.

[0079] In this embodiment, based on in-depth analysis and comprehensive consideration, the second indicator value used to represent the numerical value of the network availability of the network system can comprehensively and accurately evaluate the impact of abnormal situations such as the presence of abnormal network devices on the network system. Through the corresponding relationship between the preset threshold interval to which the second indicator value belongs and the warning level, the warning level of the network system can be accurately determined, which is conducive to more accurate warning of the network system.

[0080] In order to accurately give an early warning to a network system containing abnormal network devices, before determining the topology map of the network system and determining the second indicator value of the network system based on the information contained in the topology map, it is necessary to first determine which network devices in the network system are unavailable. In order to distinguish the unavailable network devices in the network system, a topology map is obtained based on the available non-abnormal network devices. That is, the abnormal network devices need to be determined first. Based on this, the system early warning level determination method in the following embodiment supplements the description of the technical process of determining abnormal network devices when the network system contains abnormal network devices.

[0081] In one embodiment, the network system includes a non-abnormal network device and an abnormal network device. Figure 4 As shown, the system warning level determination method also includes the following steps S401 to S407. Among them, steps S404 to S407 correspond one-to-one to steps S101 to S104 in the aforementioned embodiment. The specific discussion of steps S404 to S407 in this embodiment can refer to the specific discussion of steps S101 to S104 in the aforementioned embodiment, and will not be repeated in this embodiment.

[0082] S401, preprocessing operation and maintenance data of network devices in the network system to obtain time domain characteristics and frequency domain characteristics of the network devices.

[0083] Operation and maintenance data refers to periodic data generated by network devices during the operation of the network system. Under the condition that the operation and maintenance data is periodic data generated by network devices, the specific data type of the operation and maintenance data is not limited in this embodiment. For example, the operation and maintenance data can be traffic data, memory usage, CPU usage, etc. generated by network devices. Time domain features and frequency domain features are data features of operation and maintenance data in different modes. Based on the periodic characteristics of operation and maintenance data, the operation and maintenance data can usually describe the changing trend in the form of curves. By performing feature extraction on the operation and maintenance data of network devices in the network system, its data features in the time domain and frequency domain can be extracted. Among them, the time domain features are sequence features, and the frequency domain features are graph features. The information contained in the time domain features and frequency domain features is rich and diverse.

[0084] For ease of description, in this embodiment, the operation and maintenance data is taken as flow data as an example. When the operation and maintenance data is periodic data generated by other network devices, the processing method of the corresponding data can refer to the processing method of flow data. Taking the operation and maintenance data as flow data as an example, the time domain feature can be understood as the data feature in the time domain obtained by extracting features from the flow data of the network device. The time domain feature is a sequence feature, including at least one of the flow time series, the flow change rate series, the flow periodic component series and the flow protocol proportion series. The flow time series is the most basic flow and time sequence feature, which directly records the network flow value at each time point. The flow change rate series records the flow change rate between each time point and the previous time point. The flow periodic component series extracts the periodic components of the flow through time series analysis, such as daily cycles, weekly cycles, etc. If the daily cycle component of the flow is extracted, the unit of the time axis is defined as every day. The flow protocol proportion series records the proportion of different network protocol flows at each time point. The frequency domain feature can be understood as the data feature in the frequency domain obtained by extracting features from the flow data of the network device. Frequency domain features are graph features, including traffic spectrum graphs.

[0085] S402, respectively inputting the time domain features and the frequency domain features into the model, and outputting the abnormality level of the network device. The model is used to fuse the time domain features and the frequency domain features of the network device, and map the abnormality level of the network device based on the fused features.

[0086] The traditional method of identifying abnormal network devices mainly relies on a single modal feature for anomaly assessment, which has obvious limitations. First, it ignores the complementarity of information between different modalities and the importance of modal fusion for anomaly assessment, and fails to fully utilize the rich information provided by multimodal data features. Second, when performing anomaly assessment, it only focuses on local features and lacks comprehensive consideration of the overall network status.

[0087] Based on this, after extracting the time domain features and frequency domain features of the operation and maintenance data of the network equipment under different modes, this embodiment fully considers the complementarity of the time domain features and frequency domain features under different modes and the importance of modal fusion to abnormality assessment. The time domain features and frequency domain features are respectively input into the model, and the multimodal features of the network equipment are feature fused through the model, that is, the time domain features and frequency domain features are feature fused. Then, an abnormality assessment is performed based on the fused features to determine the abnormality level of the network equipment. This process makes full use of the rich information provided by the multimodal data features. Moreover, compared with only a single, local modal feature, this embodiment is based on the time domain features and frequency domain features under different modes, and can make a more comprehensive consideration of the overall network status from different levels and angles.

[0088] S403: When the abnormality level is greater than or equal to the level threshold, determine the network device as an abnormal network device.

[0089] Referring to the above-mentioned embodiment, if the network device is set to be unavailable if the abnormality exists and the abnormality level reaches the corresponding level threshold, then the abnormal network device refers to a network device with an abnormality and the abnormality level reaches the corresponding level threshold. Among them, the abnormality level reaches the level threshold, which means that the abnormality level is greater than or equal to the level threshold, which is used to indicate that the abnormality degree of the network device is greater than or equal to the abnormality degree corresponding to the level threshold. If the abnormality level is divided into three levels of 0, 1, and 2 with increasing abnormality levels, and level 1 is the level threshold, then the abnormality level is greater than or equal to the level threshold, including the abnormality level of level 1 and level 2. If the abnormality level is divided into three levels of 0, 1, and 2 with decreasing abnormality levels, and level 1 is the level threshold, then the abnormality level is greater than or equal to the level threshold, including the abnormality level of level 1 and level 0. Based on this, after determining the abnormality level of the network device, if the abnormality level is greater than or equal to the level threshold, then this network device can be determined as an abnormal network device. It can be understood that if the level threshold corresponding to the network device is the lowest level, it can be understood that this network device can be considered as an unavailable abnormal network device when there is an abnormality.

[0090] S404, determining a topology graph of the network system. The topology graph includes nodes and edges, where a node is used to represent a non-abnormal network device in the network system, and an edge is used to represent a connection route between two non-abnormal network devices in the network system.

[0091] S405: Determine a first index value between any two nodes based on the nodes and the edges. The first index value is used to indicate the capability and convenience of communication interaction between any two non-abnormal network devices.

[0092] S406: Determine a second indicator value of the network system based on the multiple first indicator values. The second indicator value is used to represent the communication performance and stability of the non-abnormal network device, and the second indicator value is positively correlated with the first indicator value.

[0093] S407: Determine the warning level of the network system based on the second indicator value. The warning level is negatively correlated with the second indicator value.

[0094] This embodiment fully considers the complementarity of time domain features and frequency domain features under different modes and the importance of modal fusion for abnormal assessment. The model is used to fuse the time domain features and frequency domain features of network devices, and then an abnormal assessment is performed based on the fused features to determine the abnormal level of the network device. The information coverage of the time domain features and frequency domain features is wide and diverse. By extracting the time domain features and frequency domain features of the operation and maintenance data of the network device, the rich information provided by the time domain features and frequency domain features is fully utilized, which is conducive to a more comprehensive consideration of the overall network status from different levels and angles, and can more comprehensively capture abnormal behaviors in network operation and maintenance, and reduce omissions and false alarms. It is conducive to enriching the information contained in the fused features, and is conducive to more accurately evaluating the abnormality of network devices and determining the abnormality level of network devices, and then more accurately determining unavailable abnormal network devices. By accurately determining abnormal network devices, it is conducive to more accurately warning the network system. The system warning level determination method in this embodiment combines multimodal information fusion technology and network availability evaluation method. In addition to being able to more accurately evaluate the abnormality of network devices and network systems and conduct comprehensive and accurate warnings of network systems, it also has the following technical effects. It can realize the automatic acquisition and preprocessing of target operation and maintenance data, reduce manual intervention, and help improve the automation level and efficiency of network operation and maintenance; through multimodal information fusion technology and network availability evaluation methods, it can provide comprehensive and accurate early warning for network systems, so that operation and maintenance personnel can locate and solve network anomalies more quickly, which is also conducive to improving the automation level and efficiency of network operation and maintenance, and realizing network operation and maintenance automation more accurately and efficiently; it has important positive significance for the development of network operation and maintenance technology.

[0095] In one embodiment, if Figure 5 As shown, the above step S402 inputs the time domain features and the frequency domain features into the model respectively, and outputs the abnormal level of the network device, including the following steps S501 to S503.

[0096] S501, respectively inputting the time domain feature and the frequency domain feature into the neural network in the model to extract the features of the high-dimensional data, and outputting the first feature of the time domain feature and the second feature of the frequency domain feature.

[0097] In order to improve the accuracy of determining the abnormal level of network equipment based on the fused features, it can be achieved by making the fused features reflect the essential information and structural information of the operation and maintenance data of the network equipment as much as possible. In other words, the richer and more comprehensive the information contained in the fused features is, the more accurate the abnormal level of the network equipment determined based on this feature is. Based on this, this embodiment uses a convolutional neural network to extract features of high-dimensional data, and automatically extracts the characteristics of data features that contain the essential information and structural information of the data. Among them, high-dimensional data refers to data with a large dimension. When the time domain features and the frequency domain features are input into the model respectively, the time domain features and the frequency domain features are input into the neural network of the model respectively, and the features of the two high-dimensional data, the time domain features and the frequency domain features, are extracted by the neural network respectively, and the first feature of the time domain features and the second feature of the frequency domain features are output. In this way, the first feature that can effectively represent the intrinsic structure and pattern of the time domain features and the second feature that can effectively represent the intrinsic structure and pattern of the frequency domain features are obtained, and the first feature and the second feature contain the essential information and structural information of the operation and maintenance data.

[0098] Specifically, the time domain features and the frequency domain features are input in parallel to the two neural networks in the model, and the features of the high-dimensional data are extracted through the two neural networks. The first neural network in the two neural networks outputs the first feature of the time domain features, and the second neural network in the two neural networks outputs the second feature of the frequency domain features. The two neural networks include a first neural network and a second neural network. The number of neural networks in the model is the same as the number of input features, so that the model can simultaneously capture and analyze data features from different modes, which is conducive to enhancing the model's ability to understand and process data, and is conducive to the model's more comprehensive understanding and analysis of the behavior of network devices, thereby improving the accuracy and efficiency of abnormal assessment of network devices.

[0099] The neural network in the model includes a residual structure. By introducing jump connections, the depth of the network is fully utilized to learn more complex and deep feature representations, thereby generating first and second features containing essential information and structural information of the data. With the purpose of being able to learn more complex and deep feature representations, thereby generating features of high-dimensional data containing essential information and structural information of the data, this embodiment does not specifically limit the residual structure.

[0100] For example, for the residual structure, since odd-numbered convolution kernels help maintain the symmetry of the spatial hierarchy, too few channels are not conducive to capturing more feature information. Increasing the number of channels usually means that more feature information can be captured, but it also increases the amount of calculation and the risk of overfitting. Therefore, we can use Figure 6 The residual structure shown in Figure 1 is used to extract features from high-dimensional data. Figure 6As shown in the figure, ReLU represents the activation function, "1×1,32" represents a convolution layer with a convolution kernel of 1×1 and 32 channels, "3×3,64" represents a convolution layer with a convolution kernel of 3×3 and 64 channels, and "1×1,64" represents a convolution layer with a convolution kernel of 1x1 and 64 channels. The two 1×1 convolution kernels in this residual structure are used for dimensionality reduction and dimensionality increase to reduce the number of parameters, and the middle convolution layer uses an odd convolution kernel of 3×3, which helps to maintain the symmetry of the spatial hierarchy. In addition, the number of channels of 32 and 64 are both appropriate, which can better balance the expression ability and computational efficiency of the model.

[0101] Based on the characteristics of the residual structure, the residual structure directly connects the input to the subsequent layer by introducing a jump connection. The output feature of the residual structure is the sum of the input feature input to the residual structure and the feature obtained after a series of convolution operations on the input feature. Based on this, the dimension of the first feature generated by the residual structure is related to the dimension of the time domain feature, and the dimension of the second feature is related to the dimension of the frequency domain feature. The dimensions of the first feature and the second feature are usually represented in the form of a one-dimensional vector after being processed by the fully connected layer of the residual structure, such as 1×128, 1×1024. Among them, the dimension of the feature is usually set according to actual needs. The larger the amount of data, the larger the information dimension; the smaller the amount of data, the smaller the information dimension.

[0102] S502, fusing the first feature and the second feature through the joint architecture in the model, and outputting the fused feature.

[0103] After extracting the first and second features that contain the essential information and structural information of the operation and maintenance data, the complementarity of time domain features and frequency domain features under different modes and the importance of modal fusion for anomaly assessment are considered, so that the model also includes a joint architecture. The joint architecture is used to combine the outputs of the fully connected layers of the residual structures of the two neural networks, that is, to combine the first and second features and output a fused feature. Exemplarily, if the fully connected layers of the two residual structures respectively output a first feature with a one-dimensional vector of 1×128 and a second feature with a one-dimensional vector of 1×1024, a fused feature vector with a dimension of 1×1152 is obtained after fusion.

[0104] Specifically, the joint architecture includes a concatenation layer, a fully connected layer, an activation function, and a batch normalization layer. The concatenation layer is used to concatenate the first feature and the second feature along the feature dimension; the fully connected layer is used to perform further nonlinear transformation on the features concatenated by the concatenation layer; activation functions such as ReLU introduce nonlinearity to the model to enhance the feature expression capability; and the batch normalization layer is used to normalize the features output by the aforementioned structure to improve training efficiency and model stability. The concatenation layer, the fully connected layer, the activation function, and the batch normalization layer jointly realize the effective fusion of the first feature and the second feature, and output the fused feature.

[0105] The first feature and the second feature contain the essential information and structural information of the data, and the fused feature obtained by fusing the first feature and the second feature also contains the essential information and structural information of the data. It can effectively represent the time domain features, frequency domain features and the inherent structure and pattern of the operation and maintenance data of network equipment, provide richer feature representation, and help improve the accuracy of determining the abnormal level of network equipment based on fused features.

[0106] S503, mapping the fused features to anomaly levels through the normalization layer in the model, and outputting the anomaly levels of the network devices.

[0107] Furthermore, the model includes a normalization layer (Softmax) to map the abnormality level of the network device based on the fused features and accurately determine the abnormality level of the network device.

[0108] Specifically, the fusion features output by the joint architecture are mapped to the probability distribution of each abnormal level of the network device through the normalization layer, that is, the probability of each abnormal level is calculated based on the information of the fusion features, and the probability distribution vector is output. Then, the abnormal level with the highest probability is taken as the prediction result, that is, it is output as the current abnormal level of the network device.

[0109] For example, Figure 7 This is a schematic diagram of the structure of the model provided in the embodiment of the present application. Figure 7 As shown in the figure, the model includes a neural network, a joint architecture, and a normalization layer (Softmax). The time domain features and frequency domain features are used as data features of the operation and maintenance data of the network equipment in two different modes, and are respectively input into the neural network in the model. The neural network extracts the first feature of the time domain feature and the second feature of the frequency domain feature; the joint architecture fuses the first feature and the second feature output by the neural network to obtain a fused feature; the normalization layer maps the abnormal level of the network equipment based on the fused feature output by the joint architecture, so that the model accurately outputs the abnormal level of the network equipment.

[0110] Exemplarily, the model can be trained in the following manner: the historical time domain features and historical frequency domain features extracted from the historical operation and maintenance data of the network device are used as training data and input into the initial model. Then, after feature extraction and feature fusion of high-dimensional data and mapping of abnormal levels of network devices, the abnormal level of the network device corresponding to the historical operation and maintenance data is predicted based on the initial model. Furthermore, the actual abnormal level of the network device is used as supervision data, and the initial model is trained with parameters based on the predicted abnormal level and the actual abnormal level to obtain the model.

[0111] In this embodiment, the complementarity of time domain features and frequency domain features under different modes, the importance of modal fusion to abnormal assessment, and the features obtained by extracting features from high-dimensional data by neural networks can contain the essential information and structural information of the data, and can effectively represent the characteristics of the internal structure and pattern of the data, so that the model includes a neural network, a joint architecture, and a normalization layer. After the model extracts the features of high-dimensional data from the time domain features and the frequency domain features respectively, the extracted features are fused, so that the information of the fused features obtained by fusion is rich and comprehensive, and the internal structure and pattern of the operation and maintenance data of the network device can be effectively represented. Furthermore, the mapping of the abnormal level of the network device based on the fused features can accurately determine the abnormal level of the network device, which is conducive to more accurately determining the unavailable abnormal network device. In addition, the number of neural networks in the model is the same as the number of input features, so that the model can simultaneously capture and analyze data features from different modes, which is conducive to enhancing the model's understanding and processing capabilities of the data, so that the model can more comprehensively understand and analyze the behavior of the network device, thereby improving the accuracy and efficiency of abnormal assessment of the network device.

[0112] In one embodiment, the network system includes a non-abnormal network device and an abnormal network device. Figure 8 As shown, the system warning level determination method also includes the following steps S801 to S808.

[0113] Among them, steps S801, S804 to S808 correspond one-to-one to steps S401, S403 to S407 in the aforementioned embodiment. The specific discussion of steps S801, S804 to S808 in this embodiment can refer to the specific discussion of steps S401, S403 to S407 in the aforementioned embodiment, and will not be repeated in this embodiment.

[0114] S801, preprocessing operation and maintenance data of network devices in the network system to obtain time domain characteristics and frequency domain characteristics of the network devices.

[0115] S802, calculate the feature distance between the time domain feature and the reference feature to obtain a difference feature. The reference feature refers to a time domain data feature obtained by preprocessing the operation and maintenance data of the network device without abnormality in the time domain.

[0116] When evaluating the abnormality of network equipment, the deviation between the operation and maintenance data of the network equipment to be evaluated for abnormality level and the operation and maintenance data of the network equipment without abnormality can also be considered to determine the abnormality level of the network equipment based on the deviation of the operation and maintenance data of the network equipment to be evaluated. This method is conducive to more intuitive and efficient abnormality evaluation of network equipment, and can also accurately determine the abnormality level of the network equipment.

[0117] In order to determine the deviation between the operation and maintenance data of the network equipment to be evaluated and the operation and maintenance data of the network equipment without abnormalities, the data features of the operation and maintenance data in the time domain can be processed based on the characteristic of time series data that is easy to compare. That is, the deviation between the time domain features of the operation and maintenance data of the network equipment to be evaluated and the data features of the operation and maintenance data of the network equipment without abnormalities in the time domain is determined. The difference between the operation and maintenance data is fed back through the deviation between the data features in the time domain, and then the difference between the network equipment is fed back. Based on this, the data features of the operation and maintenance data of the network equipment without abnormalities in the time domain are used as reference features, and the difference between the time domain features and the reference features is determined by calculating the feature distance between the time domain features and the reference features. This difference is represented by the difference feature.

[0118] The purpose is to calculate the feature distance between the time domain feature and the reference feature. The calculation method is not limited in this embodiment. Exemplarily, the calculation can be performed by a dynamic time warping (DTW) algorithm. Specifically, the sequences of the time domain feature and the reference feature are p and q, respectively, and the elements contained are u and v, respectively, that is:

[0119]

[0120] The DTW algorithm can be used to align the time domain features with the sequence of reference features. First, a u×v matrix is ​​constructed. The element at the matrix position (i, j) is the Euclidean distance d between the two features. e (p i ,q j ). Where, i=1,2,……,u;j=1,2,……,v. At this time, the cumulative distortion distance from the starting position i=1,j=1 to i=u,j=v is:

[0121] D e =min{D e (i-1,j-1),D e (i-1,j),D e (i,j-1)}+d e (i,j)

[0122] Among them, a set of i and j values ​​corresponds to a cumulative distortion distance D e , which is a sequence element in the difference feature. Thus, the difference feature can be determined.

[0123] S803, respectively input the difference feature and the frequency domain feature into the model, and output the abnormal level of the network device. The model is used to perform feature fusion on the difference feature and the frequency domain feature of the network device, and map the abnormal level of the network device based on the fused features.

[0124] For example, the specific implementation process of inputting the difference feature and the frequency domain feature into the model to obtain the abnormal level of the network device can refer to the above Figure 5 In the illustrated embodiment, the specific implementation process of inputting the time domain features and the frequency domain features into the model to obtain the abnormal level of the network device is shown. The abnormal level of the network device can be accurately obtained by processing the difference features and the frequency domain features through the neural network, the joint architecture and the normalization layer in the model in turn, which will not be repeated in this example.

[0125] S804: When the abnormality level is greater than or equal to the level threshold, determine the network device as an abnormal network device in the network system.

[0126] S805, determining a topology graph of the network system. The topology graph includes nodes and edges, where a node is used to represent a non-abnormal network device in the network system, and an edge is used to represent a connection route between two non-abnormal network devices in the network system.

[0127] S806: Determine a first index value between any two nodes based on the nodes and the edges. The first index value is used to indicate the capability and convenience of communication interaction between any two non-abnormal network devices.

[0128] S807: Determine a second indicator value of the network system based on the multiple first indicator values. The second indicator value is used to represent the communication performance and stability of the non-abnormal network device, and the second indicator value is positively correlated with the first indicator value.

[0129] S808: Determine the warning level of the network system based on the second indicator value. The warning level is negatively correlated with the second indicator value.

[0130] In this embodiment, based on the characteristic that time series data is easy to compare, the data features of the operation and maintenance data of the network device to be evaluated for abnormal level in the time domain are processed to determine the deviation between the time domain features of the operation and maintenance data of the network device to be evaluated and the data features of the operation and maintenance data of the network device without abnormality in the time domain. The deviation between the data features in the time domain is used to feedback the difference between the operation and maintenance data, and then the difference between the network devices is fed back. The feature distance between the time domain features and the reference features of the operation and maintenance data of the network device without abnormality in the time domain is determined. That is, the difference features are determined. Then, the deviation between the current network device to be evaluated and the network device without abnormality is reflected through the difference features. Further, the network device to be evaluated is evaluated for abnormality based on the difference features and frequency domain features under different modes. Considering the deviation between the current network device to be evaluated and the network device without abnormality is conducive to accurately evaluating the abnormality of the network device while more intuitively and efficiently evaluating the abnormality of the network device.

[0131] The present application embodiment also provides a system warning level determination device 900. Fig. 9 As shown, the system warning level determination device 900 includes a topology map determination module 901, an index value determination module 902 and a level determination module 903. The topology map determination module 901 is used to determine the topology map of the network system. The topology map includes nodes and edges. The nodes are used to represent non-abnormal network devices in the network system, and the edges are used to represent the connection routes of two non-abnormal network devices in the network system. The index value determination module 902 is used to determine the first index value between any two nodes based on the nodes and edges. The first index value is used to represent the ability and convenience of communication interaction between any two non-abnormal network devices. The index value determination module 902 is also used to determine the second index value of the network system based on multiple first index values. The second index value is used to represent the communication performance and stability of the non-abnormal network device. The second index value is positively correlated with the first index value. The level determination module 903 is used to determine the warning level of the network system based on the second index value. The warning level is negatively correlated with the second index value.

[0132] In one embodiment, the above-mentioned index value determination module 902 is also used to determine the connection path between any two nodes based on the edges, and the connection paths do not intersect each other; determine the number of nodes included in the connection path; based on the number of nodes, obtain a first index value, and the first index value is negatively correlated with the number of nodes.

[0133] In one embodiment, the indicator value determination module 902 is further configured to sum a plurality of first indicator values ​​to obtain a second indicator value of the network system.

[0134] In one embodiment, the network system includes a non-abnormal network device and an abnormal network device. The level determination module 903 is further used to determine a third indicator value of the abnormal network device according to the performance indicator of the abnormal network device, the third indicator value is used to indicate the importance of the abnormal network device to the network system; perform weighted summation on the second indicator value and the third indicator value to obtain a fourth indicator value; obtain the warning level of the network system according to the indicator threshold interval to which the fourth indicator value belongs, and the indicator threshold interval corresponds to the warning level one by one.

[0135] In one of the embodiments, the above-mentioned system warning level determination device 900 also includes a preprocessing module, a model application module and an abnormality determination module. The preprocessing module is used to preprocess the operation and maintenance data of the network equipment in the network system to obtain the time domain characteristics and frequency domain characteristics of the network equipment. The model application module is used to input the time domain characteristics and frequency domain characteristics into the model respectively, and output the abnormality level of the network equipment. The model is used to perform feature fusion on the time domain characteristics and frequency domain characteristics of the network equipment, and map the abnormality level of the network equipment based on the fused features. The abnormality determination module is used to determine the network device as an abnormal network device when the abnormality level is greater than or equal to the level threshold.

[0136] In one of the embodiments, the above-mentioned model application module is also used to input the time domain features and the frequency domain features into the neural network in the model respectively to perform feature extraction of high-dimensional data, and output the first feature of the time domain features and the second feature of the frequency domain features; fuse the first feature and the second feature through the joint architecture in the model, and output the fused feature; map the fused features to anomaly levels through the normalization layer in the model, and output the anomaly level of the network device.

[0137] In one embodiment, the system warning level determination device 900 further includes a distance calculation module for calculating the characteristic distance between the time domain feature and the reference feature to obtain the difference feature, where the reference feature refers to the time domain data feature obtained by preprocessing the operation and maintenance data of the network device without abnormality in the time domain. The model application module is also used to input the difference feature and the frequency domain feature into the model respectively, and output the abnormality level of the network device.

[0138] For explanations of the terms, please refer to the relevant descriptions in the aforementioned system warning level determination method embodiment, which will not be elaborated here.

[0139] It should be noted that the specific execution process of the above-mentioned system warning level determination device 900 can be found in Figures 1 to 8 The specific description of the illustrated embodiment will not be repeated here.

[0140] Each module in the above-mentioned system warning level determination device 900 can be implemented in whole or in part by software, hardware or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each module above.

[0141] like Fig.10As shown, the embodiment of the present application further provides a computer device 1000. Exemplarily, the computer device 1000 may include a processor 1001, a communication interface 1002, a communication bus 1003, and a memory 1004. Specifically, the computer device 1000 may include:

[0142] At least one processor 1001, such as a CPU, at least one communication interface 1002, a memory 1004, and at least one communication bus 1003. The communication bus 1003 is used to realize the connection and communication between these components. The communication interface 1002 may optionally include a standard wired interface, a wireless interface (such as a WI-FI interface or a Bluetooth interface, etc.). The memory 1004 may be a high-speed RAM memory, or a non-volatile memory (non-volatile memory), such as at least one disk storage. The memory 1004 may optionally be at least one storage device located away from the aforementioned processor 1001. Fig.10 As shown, the memory 1004 as a computer storage medium may include an operating system and program instructions.

[0143] Exemplarily, the processor 1001 may be used to implement the above Fig. 9 The steps or methods executed by the topology map determination module 901, the index value determination module 902 and the level determination module 903 in FIG.

[0144] It is understandable that the above method is only an example, and the processor 1001 and other modules in the above computer device 1000 may also cooperate to perform the above method. Fig. 9 The steps or methods executed by the topology map determination module 901, the index value determination module 902 and the level determination module 903 are not limited in this document.

[0145] exist Fig.10 In the computer device 1000 shown, the processor 1001 may be used to load program instructions stored in the memory 1004 and specifically perform the following operations:

[0146] Determine a topology graph of the network system, the topology graph includes nodes and edges, the nodes are used to represent non-abnormal network devices in the network system, and the edges are used to represent connection routes between two non-abnormal network devices in the network system;

[0147] Determine a first index value between any two nodes based on the nodes and the edges, where the first index value is used to represent the ability and convenience of communication interaction between any two non-abnormal network devices;

[0148] Based on the multiple first indicator values, determining a second indicator value of the network system, the second indicator value is used to represent the communication performance and stability of the non-abnormal network device, and the second indicator value is positively correlated with the first indicator value;

[0149] Based on the second indicator value, an early warning level of the network system is determined, and the early warning level is negatively correlated with the second indicator value.

[0150] For explanations of the terms, please refer to the relevant descriptions in the aforementioned system warning level determination method embodiment, which will not be elaborated here.

[0151] It should be noted that the specific implementation process can be found in Figures 1 to 8 The specific description of the illustrated embodiment will not be repeated here.

[0152] The present application also provides a computer-readable storage medium, which can store a plurality of instructions, and the instructions are suitable for being loaded and executed by a processor as described above. Figures 1 to 8 The method steps of the embodiment shown in the figure can be found in the specific execution process. Figures 1 to 8 The specific description of the illustrated embodiment will not be repeated here.

[0153] As used in the above embodiments, the term "when..." may be interpreted to mean "if..." or "after..." or "in response to determining..." or "in response to detecting...", depending on the context. Similarly, the phrases "upon determining..." or "if (the stated condition or event) is detected" may be interpreted to mean "if determining..." or "in response to determining..." or "upon detecting (the stated condition or event)" or "in response to detecting (the stated condition or event)", depending on the context.

[0154] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any fusion thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from a website site, a computer, a server or a data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or a data center that includes one or more available media integration. The available medium can be a magnetic medium, (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state hard disk), etc.

[0155] Those skilled in the art can understand that to implement all or part of the processes in the above-mentioned embodiments, the processes can be completed by computer programs to instruct related hardware, and the programs can be stored in computer-readable storage media. When the programs are executed, they can include the processes of the above-mentioned method embodiments. The aforementioned storage media include: ROM or random access memory RAM, magnetic disk or optical disk and other media that can store program codes.

[0156] The technical features of the above embodiments may be arbitrarily combined. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0157] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A method for determining a system warning level, characterized in that: The method comprises: Determine a topology graph of the network system, the topology graph comprising nodes and edges, the nodes are used to represent non-abnormal network devices in the network system, and the edges are used to represent connection routes between two non-abnormal network devices in the network system; Determine a first index value between any two nodes based on the node and the edge, where the first index value is used to represent the ability and convenience of communication interaction between any two non-abnormal network devices; Based on the multiple first indicator values, determining a second indicator value of the network system, the second indicator value is used to represent the communication performance and stability of the non-abnormal network device, and the second indicator value is positively correlated with the first indicator value; Based on the second indicator value, a warning level of the network system is determined, and the warning level is negatively correlated with the second indicator value.

2. The method according to claim 1, characterized in that The determining a first index value between any two nodes based on the nodes and the edges includes: Determine a connection path between the arbitrary two nodes according to the edge, wherein the connection paths do not intersect each other; Determining the number of nodes included in the connection path; Based on the number of nodes, the first index value is obtained, and the first index value is negatively correlated with the number of nodes.

3. The method according to claim 1 or 2, characterized in that: The determining, based on the plurality of the first indicator values, a second indicator value of the network system comprises: The second index value of the network system is obtained by summing up the multiple first index values.

4. The method according to claim 1 or 2, characterized in that: The network system includes the non-abnormal network device and the abnormal network device; and determining the warning level of the network system based on the second indicator value includes: Determine a third index value of the abnormal network device according to the performance index of the abnormal network device, wherein the third index value is used to indicate the importance of the abnormal network device to the network system; Performing a weighted summation on the second index value and the third index value to obtain a fourth index value; The warning level of the network system is obtained according to the indicator threshold interval to which the fourth indicator value belongs, and the indicator threshold interval corresponds to the warning level one by one.

5. The method according to claim 1 or 2, characterized in that: The network system includes the non-abnormal network device and the abnormal network device; Before determining the topology map of the network system, the method further includes: Preprocessing the operation and maintenance data of the network equipment in the network system to obtain the time domain characteristics and frequency domain characteristics of the network equipment; The time domain features and the frequency domain features are respectively input into the model, and the abnormality level of the network device is output, wherein the model is used to perform feature fusion on the time domain features and the frequency domain features of the network device, and map out the abnormality level of the network device based on the fused features; When the abnormality level is greater than or equal to a level threshold, the network device is determined as the abnormal network device.

6. The method according to claim 5, characterized in that The step of inputting the time domain features and the frequency domain features into a model respectively and outputting the abnormality level of the network device comprises: Inputting the time domain feature and the frequency domain feature into the neural network in the model respectively to extract features of high-dimensional data, and outputting a first feature of the time domain feature and a second feature of the frequency domain feature; fusing the first feature and the second feature through a joint architecture in the model, and outputting a fused feature; The fused features are mapped to an abnormality level through a normalization layer in the model, and the abnormality level of the network device is output.

7. The method according to claim 5, characterized in that Before respectively inputting the time domain features and the frequency domain features into the model and outputting the abnormality level of the network device, the method further includes: Calculating a feature distance between the time domain feature and a reference feature to obtain a difference feature, wherein the reference feature refers to a time domain data feature obtained by preprocessing operation and maintenance data of a network device that does not have an abnormality in the time domain; The step of inputting the time domain features and the frequency domain features into a model respectively and outputting the abnormality level of the network device comprises: The difference feature and the frequency domain feature are respectively input into the model, and the abnormality level of the network device is output.

8. A system warning level determination device, characterized in that: The device comprises: A topology map determining module, used to determine a topology map of the network system, wherein the topology map includes nodes and edges, wherein the nodes are used to represent non-abnormal network devices in the network system, and the edges are used to represent connection routes between two non-abnormal network devices in the network system; An index value determination module, used to determine a first index value between any two nodes based on the node and the edge, wherein the first index value is used to represent the ability and convenience of communication interaction between any two non-abnormal network devices; The indicator value determination module is further used to determine a second indicator value of the network system based on the plurality of the first indicator values, wherein the second indicator value is used to represent the communication performance and stability of the non-abnormal network device, and the second indicator value is positively correlated with the first indicator value; The level determination module is used to determine the warning level of the network system based on the second indicator value, and the warning level is negatively correlated with the second indicator value.

9. A computer device, characterized in that: include: A memory and a processor, wherein the memory stores program instructions; when the program instructions are executed by the processor, the processor executes the method as claimed in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program; when the computer program is run on one or more processors, the method according to any one of claims 1 to 7 is executed.

11. A computer program product, characterized in that The computer program product comprises a computer program or instructions; when the computer program or instructions are run on a computer, the computer is caused to execute the method according to any one of claims 1 to 7.

Images