A network fault prediction method and system

Abstract

The present invention relates to the field of data management technology, and discloses a network fault prediction method and system, the method comprising: intercepting network data within a preset time period, constructing a network fluctuation-time data chain; comparing the network fluctuation value with the fluctuation range, and splitting the network fluctuation-time data chain into an abnormal fluctuation data chain and a normal fluctuation data chain; extracting network features to construct the same type of network series, and obtaining the sub-fluctuation influence factors of the same type of network series; obtaining a set of fluctuation influence factors based on all sub-fluctuation influence factors; integrating the set of fluctuation influence factors to obtain the final influence factor of the network data, and judging whether to issue a network fault warning based on the final influence factor. This application solves the problems of poor accuracy and weak adaptability in the prior art by deeply analyzing historical data, refining fluctuation patterns, and multi-dimensional information fusion, and provides an efficient and intelligent network fault prediction solution.

Description

Technical Field

[0001] The present invention relates to the technical field of data management, and in particular to a network fault prediction method and system. Background Art

[0002] With the rapid development of the Internet and communication technologies, network systems have become an indispensable part of modern society. From enterprise data centers to home broadband, the stability and reliability of network services directly affect the normal operation of all industries. However, as the scale and complexity of networks expand, the frequency and types of network failures are becoming increasingly diverse, posing huge challenges to network operation and maintenance management. Network failures mainly include connection interruptions, packet loss, latency fluctuations, bandwidth anomalies, etc. These failures not only affect network performance, but may also trigger a series of chain reactions, such as reduced user experience and service unavailability.

[0003] Most existing network fault prediction methods are based on single monitoring indicators (such as latency, bandwidth, etc.) for anomaly detection. This method is easily affected by environmental noise and short-term fluctuations, resulting in low accuracy of fault warnings and inability to effectively distinguish between normal fluctuations and potential faults. As network architecture and traffic patterns continue to change, traditional methods based on static thresholds or fixed rules are difficult to adapt to real-time changing network conditions. In addition, existing methods do not fully utilize historical network data for in-depth analysis, especially the analysis of historical fluctuation patterns.

[0004] Therefore, it is necessary to design a network fault prediction method and system to solve the problems existing in the current technology. Summary of the invention

[0005] In view of this, the present invention proposes a network fault prediction method and system, aiming to solve the problems of low accuracy of current network fault early warning, poor adaptability in dynamic environment and lack of historical data analysis.

[0006] In one aspect, the present invention provides a network fault prediction method, comprising:

[0007] Intercepting network data within a preset period of time, analyzing the network data to construct a network fluctuation-time data chain;

[0008] Comparing the network fluctuation value of each time window in the network fluctuation-time data link with the fluctuation range, and splitting the network fluctuation-time data link into an abnormal fluctuation data link and a normal fluctuation data link according to the comparison result;

[0009] Extracting the network features of each time window in the abnormal fluctuation data chain, performing cluster analysis on the network data of each time window in the abnormal fluctuation data chain according to the network features, constructing a network sequence of the same type, and obtaining a sub-fluctuation influence factor of the network sequence of the same type according to the network sequence of the same type and the corresponding historical number of fluctuations of the same type;

[0010] Analyze the remaining network series of the same type in the abnormal fluctuation data chain to determine the corresponding sub-fluctuation influence factors, and obtain a fluctuation influence factor set according to all the sub-fluctuation influence factors;

[0011] The fluctuation impact factor set is integrated to obtain a final impact factor of the network data, and whether to issue a network fault warning is determined according to the final impact factor.

[0012] Further, when analyzing the network data to construct a network fluctuation-time data link, it includes:

[0013] Acquire a first blank data link and a second blank data link, wherein each of the blank data links is provided with a plurality of data link nodes and connection nodes;

[0014] Acquire the network fluctuation value of each time window according to the network data, and generate a chain switching mark for all network data whose network fluctuation value is not zero;

[0015] All network data carrying the link change mark are transferred to the first blank data link to obtain the network fluctuation-time data link.

[0016] Further, when the network fluctuation value of each time window in the network fluctuation-moment data link is compared with the fluctuation range, the fluctuation range is obtained by:

[0017] Collect historical operation data sets, and extract non-fault network fluctuation sets from the historical operation data sets;

[0018] Normalizing the non-fault network fluctuation concentrated data, wherein the normalization processing includes Min-Max normalization;

[0019] The normalized non-fault network fluctuation set is divided into training set and test set according to the time window, and the ratio of 4:1 is used to train the LSTM (Long Short-Term Memory) model to obtain the predicted value of each historical time window.

[0020] Obtaining an actual value of each historical time window according to the non-fault network fluctuation set, and obtaining a prediction deviation multiplier of each historical time window according to the predicted value of each historical time window and the actual value of each historical time window, wherein the prediction deviation multiplier is a ratio of the predicted value to the actual value;

[0021] The data in the network fluctuation-moment data chain is divided into time windows, each time window is used as the input of an LSTM model, the output result of the LSTM model is obtained, and the output result is combined with the prediction deviation multiplier of the corresponding historical time window to determine the fluctuation range of each time window.

[0022] Furthermore, when clustering analysis is performed on the network data of each time window in the abnormal fluctuation data chain according to the network characteristics, it includes:

[0023] The network characteristics include throughput, packet loss rate, and network traffic load;

[0024] Determine the initial neighborhood radius through the k-distance graph and set MinPts to 6;

[0025] Take each of the network features as a point, scan all points, and find the points whose number of points in the neighborhood is greater than or equal to MinPts as core points;

[0026] Starting from each core point, check the points in its neighborhood; if the point in the neighborhood is a core point, continue to expand the cluster; if the point in the neighborhood is a boundary point, add it to the current cluster; if a point is not in the neighborhood of any core point and cannot form a cluster with other points, it is marked as a noise point.

[0027] Furthermore, when obtaining the sub-fluctuation influence factor of the same type of network series according to the same type of network series and the corresponding historical number of same type of fluctuations, it includes:

[0028]

[0029] Among them, Gz represents the sub-fluctuation impact factor, N represents the number of network fluctuation values ​​in the same type of network series, Bi represents the ith network fluctuation value in the same type of network series, C represents the number of historical fluctuations, and B0 represents the right boundary value.

[0030] Furthermore, when obtaining a volatility impact factor set according to all the sub-volatility impact factors, it includes:

[0031] Determining the median and variance of all said sub-volatility impact factors;

[0032] Extracting the sub-volatility impact factors greater than the median from all the sub-volatility impact factors to construct a first data set;

[0033] Extracting sub-volatility impact factors greater than the variance from all the sub-volatility impact factors to construct a second data set;

[0034] Determine whether there is an intersection between the first data set and the second data set;

[0035] If yes, the intersection value is used as the fluctuation impact factor set;

[0036] If not, the first data set and the second data set are non-repetitively merged to construct the fluctuation influence factor set, wherein the non-repetitive fusion is to retain the non-repetitive sub-fluctuation influence factors in the first data set and the second data set, retain one repeated sub-fluctuation influence factor in the first data set and the second data set, and delete the remaining repeated sub-fluctuation influence factors.

[0037] Furthermore, when the set of fluctuation impact factors is integrated to obtain the final impact factor of the network data, it includes:

[0038] Comparing the fluctuation impact factor set with historical judgment data, wherein the historical judgment data includes a historical fluctuation impact factor set and a historical final impact factor;

[0039] When there is data in the historical judgment data whose similarity with the fluctuation influence factor set is greater than a similarity threshold, the historical final influence factor corresponding to the historical fluctuation influence factor set is used as the final influence factor;

[0040] When the similarities between the historical fluctuation influence factor set in the historical judgment data and the fluctuation influence factor set are both less than or equal to the similarity threshold, the final influence factor is determined according to the fluctuation influence factor set.

[0041] Furthermore, when determining the final impact factor according to the fluctuation impact factor set, it includes:

[0042]

[0043] Among them, Y represents the final impact factor, M represents the number of sub-volatility impact factors in the volatility impact factor set, represents the weight corresponding to the ith sub-volatility impact factor, represents the i-th sub-volatility impact factor, represents the minimum sub-volatility impact factor, is the maximum sub-volatility impact factor, For all The maximum value in .

[0044] Further, judging whether to perform a network fault warning according to the final impact factor includes:

[0045] Compare the final impact factor with the impact factor threshold, and determine whether to issue a network fault warning based on the comparison result;

[0046] When the final impact factor is greater than the impact factor threshold, it is determined to perform a network fault warning, and the difference between the final impact factor and the impact factor threshold is obtained, and the network fault warning level is determined according to the difference, and the network fault warning level is proportional to the difference.

[0047] Compared with the prior art, the beneficial effect of the present invention is that by intercepting network data within a preset time period and constructing a fluctuation-time data chain, the dynamic changes of the network can be captured, avoiding the problem that the traditional method relies only on a single network indicator. By comparing the fluctuation range, the data chain is split into an abnormal fluctuation data chain and a normal fluctuation data chain, effectively distinguishing normal fluctuations from potential faults, thereby improving the accuracy of fault warning. By extracting network features in the abnormal fluctuation data chain and performing cluster analysis, different types of fluctuation patterns are further refined, and the sub-fluctuation influence factors are calculated in combination with the number of historical fluctuations of the same type, making fault prediction more accurate. By integrating the set of fluctuation influence factors, the final influence factor of the network data is generated, which can accurately determine whether the network has a failure risk and issue a warning in time, improving the efficiency and response speed of network operation and maintenance.

[0048] On the other hand, the present application also provides a network fault prediction system, which is used to apply the above network fault prediction method, including:

[0049] A collection unit is configured to intercept network data within a preset period of time, analyze the network data and construct a network fluctuation-time data chain;

[0050] A processing unit is configured to compare the network fluctuation value of each time window in the network fluctuation-time data link with the fluctuation range, and split the network fluctuation-time data link into an abnormal fluctuation data link and a normal fluctuation data link according to the comparison result;

[0051] An execution unit is configured to extract network features of each time window in the abnormal fluctuation data chain, perform cluster analysis on the network data of each time window in the abnormal fluctuation data chain according to the network features, construct a network sequence of the same type, and obtain a sub-fluctuation influence factor of the network sequence of the same type according to the network sequence of the same type and the corresponding historical number of fluctuations of the same type;

[0052] An analysis unit is configured to analyze the remaining network series of the same type in the abnormal fluctuation data chain, determine the corresponding sub-fluctuation influence factors, and obtain a fluctuation influence factor set according to all the sub-fluctuation influence factors;

[0053] The early warning unit is configured to integrate the fluctuation impact factor set to obtain a final impact factor of the network data, and determine whether to issue a network failure early warning according to the final impact factor.

[0054] It is understandable that the above-mentioned network fault prediction method and system have the same beneficial effects, which will not be described in detail here. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present invention. Moreover, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:

[0056] Figure 1 A flowchart of a network fault prediction method provided by an embodiment of the present invention;

[0057] Figure 2 This is a functional block diagram of a network fault prediction system provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0058] Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments described herein. On the contrary, these embodiments are provided in order to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art. It should be noted that, in the absence of conflict, the embodiments of the present invention and the features described in the embodiments can be combined with each other. The present invention will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0059] In some embodiments of the present application, see Figure 1 As shown, a network fault prediction method includes:

[0060] S100: intercepting network data within a preset period, analyzing the network data and constructing a network fluctuation-time data chain.

[0061] S200: Compare the network fluctuation value of each time window in the network fluctuation-time data chain with the fluctuation range, and split the network fluctuation-time data chain into an abnormal fluctuation data chain and a normal fluctuation data chain according to the comparison result.

[0062] S300: extract the network features of each time window in the abnormal fluctuation data chain, perform cluster analysis on the network data of each time window in the abnormal fluctuation data chain according to the network features, construct the same type of network series, and obtain the sub-fluctuation influence factor of the same type of network series according to the same type of network series and the corresponding historical number of same type fluctuations.

[0063] S400: Analyze the remaining network series of the same type in the abnormal fluctuation data chain, determine the corresponding sub-fluctuation influence factors, and obtain a fluctuation influence factor set based on all the sub-fluctuation influence factors.

[0064] S500: Integrate the set of fluctuation impact factors to obtain a final impact factor of the network data, and determine whether to issue a network fault warning according to the final impact factor.

[0065] Specifically, in S100, network data within a certain period of time is intercepted from the latest network data, covering multiple network features (such as bandwidth, delay, packet loss rate, etc.). By analyzing these data, the network data of each time window is organized in chronological order to form a "network fluctuation-moment data chain". In S200, the network fluctuation values ​​of each time window are compared to identify which fluctuations are abnormal fluctuations. The comparison process determines whether the network fluctuation is within the normal range by comparing with the fluctuation range. According to the comparison results, the data chain is split into "abnormal fluctuation data chain" and "normal fluctuation data chain" to analyze potential faults in the network. In S300, key network features are extracted from the abnormal fluctuation data chain, and the data of each time window is classified by cluster analysis method, and the moments with similar fluctuation patterns are classified into the same category. A "same type network series" is constructed, and the "sub-fluctuation impact factor" of each network series is calculated by combining the historical number of same type fluctuations. These factors reflect the potential impact of each type of fluctuation pattern on network fault prediction. In S400, the remaining network series of the same type are further analyzed to calculate their corresponding sub-fluctuation impact factors, and all sub-fluctuation impact factors are integrated into a set of fluctuation impact factors. This set includes the impact factors of various fluctuation modes, reflecting the complexity and diversity of network fluctuations. In S500, all sub-fluctuation impact factors are integrated to obtain a comprehensive "final impact factor". This factor reflects the current network status and is used to determine whether the network has a failure risk. If the final impact factor reaches a certain threshold, a network failure warning is triggered, and the network operation and maintenance personnel are notified in time to handle it.

[0066] It can be understood that this embodiment distinguishes between normal network fluctuations and potential failures, avoiding the defects of traditional methods that are prone to misjudgment. By finely splitting and analyzing network fluctuation data, not only the instantaneous characteristics of network fluctuations are considered, but also historical data and fluctuation patterns are combined. Compared with the existing technology, this solution can cope with complex and changeable network environments, monitor network conditions in real time, and accurately predict potential risks before failures occur, thereby achieving more effective network failure warning. This method can take preventive measures before a failure occurs, improve the reliability and stability of the network, and reduce the risk of service interruption.

[0067] In some embodiments of the present application, when analyzing network data to construct a network fluctuation-time data link, the method includes: obtaining a first blank data link and a second blank data link, wherein each blank data link is provided with a plurality of data link nodes and connection nodes. According to the network data, the network fluctuation value of each time window is obtained, and a link change mark is generated for all network data whose network fluctuation value is not zero. All network data carrying the link change mark is transferred to the first blank data link to obtain a network fluctuation-time data link.

[0068] It can be understood that two "blank data links" are first created, namely the first blank data link and the second blank data link. These data links themselves do not have any initial data and are mainly used as containers for subsequent storage of network fluctuation data. Multiple data link nodes and connection nodes are set on each data link, which provide structured support for subsequent data storage and fluctuation analysis. By acquiring network data (such as bandwidth, delay, packet loss rate, etc.) in real time, and calculating the network fluctuation value of each time window. The fluctuation value reflects the performance status of the network in each time window. The moment when the network fluctuation value is not zero means that the network state has changed, and fluctuations or anomalies have occurred. By introducing blank data links and chain change marks, network fluctuation data can be dynamically transferred between two independent data links, avoiding the mixing of normal fluctuations and abnormal fluctuations in one data link, and ensuring the accuracy of subsequent analysis. By generating chain change marks, abnormal fluctuation data can be automatically marked and processed, which improves the efficiency and accuracy of abnormal fluctuation identification. It can automatically filter out valuable information in network data, providing high-quality data support for subsequent fluctuation pattern analysis, cluster analysis and fault prediction.

[0069] In some embodiments of the present application, when the network fluctuation value of each time window in the network fluctuation-moment data link is compared with the fluctuation range, the fluctuation range is obtained by:

[0070] Collect historical operation data sets, and extract non-fault network fluctuation sets from the historical operation data sets;

[0071] Normalize the concentrated data of non-fault network fluctuations, including Min-Max normalization;

[0072] The normalized non-fault network fluctuation set is divided into a training set and a test set at a ratio of 4:1. The LSTM model is trained to obtain the predicted value of each historical time window.

[0073] The actual value of each historical time window is obtained according to the non-fault network fluctuation set, and the prediction deviation ratio of each historical time window is obtained according to the predicted value of each historical time window and the actual value of each historical time window, and the prediction deviation ratio is the ratio of the predicted value to the actual value;

[0074] The data in the network fluctuation-moment data chain is divided into time windows, each time window is used as the input of an LSTM model, the output result of the LSTM model is obtained, and the output result is combined with the prediction deviation multiplier of the corresponding historical time window to determine the fluctuation range of each time window.

[0075] Specifically, before using the LSTM model, collect the historical operation data set, and extract the non-fault network fluctuation set from the historical operation data set. The data related to network fluctuations include delay, bandwidth, packet loss rate, throughput, etc. Normalize the extracted data in the non-fault network fluctuation set. Min-Max normalization can be used to scale the data to the range of [0,1]. Divide the data set into a training set and a test set. The training set is used for model training, and the input layer inputs the original time series data into the LSTM model. Use one or more LSTM layers to learn the time dependency in the data. Use multiple LSTM units and stacked LSTM layers to capture time dependencies at different levels. The output of the LSTM layer is connected to a fully connected Dense layer, and finally outputs the prediction result. In the output layer, a linear activation function can be used. Use the training set data to train the LSTM model. During the training process, select an optimization algorithm (such as Adam or SGD), and adjust the model's hyperparameters (such as learning rate, number of LSTM layer units, time window length, etc.) through cross-validation. Use the test set to evaluate the trained model, such as mean square error and root mean square error. After the model is trained, the predicted value of each historical time window is obtained and the predicted deviation multiplier is obtained based on the actual value. The data in the current network fluctuation-moment data chain is divided into time windows, and each time window is used as the input of an LSTM model to obtain the prediction result. The product of the prediction result and the prediction deviation multiplier of the corresponding historical time window is used as the fluctuation range.

[0076] It is understandable that the accuracy and real-time performance of network fault prediction are improved through the LSTM model, dynamic fluctuation range adjustment, normalization processing, and prediction deviation multiplier. The interference of fault data on training is reduced, and the accuracy of model prediction is improved. The fluctuation range is adjusted dynamically to make the prediction more consistent with the actual network fluctuation trend. By introducing the prediction deviation multiplier, the calculation of the fluctuation range is optimized, and the flexibility and adaptability of the system are enhanced. More accurate network fault warning is achieved, and the stability and availability of the network are improved.

[0077] In some embodiments of the present application, when clustering analysis is performed on network data of each time window in the abnormal fluctuation data chain according to network characteristics, the network characteristics include throughput, packet loss rate, and network traffic load.

[0078] Specifically, the initialization neighborhood radius is determined by the k-distance graph, and MinPts is determined to be 6. Take each network feature as a point, scan all points, and find the points with the number of points in the neighborhood greater than or equal to MinPts as core points. Starting from each core point, check the points in its neighborhood. If the point in the neighborhood is a core point, continue to expand the cluster. If the point in the neighborhood is a boundary point, add it to the current cluster. If a point is not a point in the neighborhood of any core point and cannot form a cluster with other points, it is marked as a noise point.

[0079] It can be understood that by applying the density clustering algorithm, combined with network characteristics (throughput, packet loss rate, network traffic load), the classification of abnormal fluctuation data is achieved. Compared with traditional clustering methods, DBSCAN can automatically identify different fluctuation patterns and effectively handle noise and outliers in network data. There is no need to preset the number of clusters, avoiding the problem of over-clustering or under-clustering that may occur in traditional methods. Through this dynamic clustering analysis, abnormal fluctuations can be more accurately identified and distinguished.

[0080] In some embodiments of the present application, when obtaining the sub-fluctuation influence factor of the same type of network series according to the same type of network series and the corresponding historical number of same type fluctuations, it includes:

[0081]

[0082] Among them, Gz represents the sub-fluctuation impact factor, N represents the number of network fluctuation values ​​in the same type of network series, Bi represents the ith network fluctuation value in the same type of network series, C represents the number of historical fluctuations, and B0 represents the right boundary value.

[0083] It is understandable that by combining the fluctuation data, historical fluctuation times, right boundary values ​​and other information in the same type of network series, the sub-fluctuation impact factor is calculated, which provides a more quantitative and accurate basis for network fault prediction. Compared with traditional fault prediction methods, it can deeply analyze the historical laws of network fluctuations and the abnormal degree of current fluctuations, thereby providing an effective early warning mechanism. By introducing the influence of historical fluctuation times, it is possible to identify which types of fluctuations have a higher risk of failure, thereby assisting in making more accurate network fault predictions and reducing the losses caused by network failures.

[0084] In some embodiments of the present application, when obtaining a set of volatility influence factors according to all sub-volatility influence factors, the method includes: determining the median and variance of all sub-volatility influence factors. Extracting sub-volatility influence factors greater than the median from all sub-volatility influence factors to construct a first data set. Extracting sub-volatility influence factors greater than the variance from all sub-volatility influence factors to construct a second data set.

[0085] Specifically, it is determined whether there is an intersection between the first data set and the second data set. If so, the intersection value is used as the set of fluctuation influence factors. If not, the first data set and the second data set are non-repeatedly fused to construct a set of fluctuation influence factors, wherein the non-repeated fusion is to retain the non-repeating sub-fluctuation influence factors in the first data set and the second data set, retain one repeated sub-fluctuation influence factor in the first data set and the second data set, and delete the remaining repeated sub-fluctuation influence factors.

[0086] In some embodiments of the present application, when integrating the fluctuation impact factor set to obtain the final impact factor of the network data, it includes: comparing the fluctuation impact factor set with the historical judgment data, and the historical judgment data includes the historical fluctuation impact factor set and the historical final impact factor.

[0087] Specifically, when there is data in the historical judgment data whose similarity with the volatility impact factor set is greater than the similarity threshold, the historical volatility impact factor set corresponding to the maximum similarity is selected, and the historical final impact factor corresponding to the historical volatility impact factor set is used as the final impact factor. When the similarity between the historical volatility impact factor set in the historical judgment data and the volatility impact factor set is less than or equal to the similarity threshold, the final impact factor is determined based on the volatility impact factor set.

[0088] In some embodiments of the present application, when determining the final impact factor according to the fluctuation impact factor set, it includes:

[0089]

[0090] Among them, Y represents the final impact factor, M represents the number of sub-volatility impact factors in the volatility impact factor set, represents the weight corresponding to the ith sub-volatility impact factor, represents the i-th sub-volatility impact factor, represents the minimum sub-volatility impact factor, is the maximum sub-volatility impact factor, For all The maximum value in .

[0091] It can be understood that the weight value range corresponding to the sub-fluctuation impact factor is (0, 1), and the weight is proportional to the value of the sub-fluctuation impact factor. By comprehensively analyzing the set of fluctuation impact factors and combining historical data with the current fluctuation pattern, a more accurate basis for fault prediction can be provided. Through data extraction and fusion, similarity comparison and weighted calculation methods, the limitations of relying solely on historical data or current data are avoided, making the final fault impact factor calculation more comprehensive and accurate. The data fusion and deduplication part can effectively reduce the interference of redundant data and ensure that the final impact factor set contains the most representative and influential fluctuation factors. By comparing with historical data, the credibility of the prediction is further improved, which can better adapt to the dynamic changes of the network, thereby achieving more efficient and accurate network fault warning.

[0092] In some embodiments of the present application, when determining whether to issue a network fault warning based on the final impact factor, the method includes comparing the final impact factor with an impact factor threshold, and determining whether to issue a network fault warning based on the comparison result.

[0093] Specifically, when the final impact factor is greater than the impact factor threshold, a network fault warning is determined, and the difference between the final impact factor and the impact factor threshold is obtained. The network fault warning level is determined according to the difference, and the network fault warning level is proportional to the difference.

[0094] It is understandable that by comparing the final impact factor with the preset impact factor threshold, it is determined whether the network needs to trigger a fault warning, which can respond to the dynamic changes of the network in real time and flexibly determine the warning level according to the severity of the fluctuation. The proportional relationship between the difference and the warning level provides a refined warning system. When the difference is large, a high-level warning is issued to indicate a potential serious fault; when the difference is small, a low-level warning is provided to help administrators understand potential risks in a timely manner. It helps to take measures in advance to prevent network failures and further ensure the continuity and stability of services.

[0095] In the above embodiment, by intercepting the network data within the preset time period and constructing the fluctuation-time data chain, the dynamic changes of the network can be captured, avoiding the problem that the traditional method only relies on a single network indicator. By comparing the fluctuation range, the data chain is split into an abnormal fluctuation data chain and a normal fluctuation data chain, effectively distinguishing normal fluctuations from potential faults, thereby improving the accuracy of fault warning. By extracting the network features in the abnormal fluctuation data chain and performing cluster analysis, different types of fluctuation patterns are further refined, and the sub-fluctuation influence factors are calculated in combination with the number of historical fluctuations of the same type, making fault prediction more accurate. By integrating the set of fluctuation influence factors, the final influence factor of the network data is generated, which can accurately determine whether the network has a risk of failure and issue a warning in time, improving the efficiency and response speed of network operation and maintenance.

[0096] In another preferred embodiment based on the above embodiment, refer to Figure 2 As shown, this embodiment provides a network fault prediction system, which is used to apply the above network fault prediction method, including:

[0097] A collection unit is configured to intercept network data within a preset period of time, analyze the network data and construct a network fluctuation-time data chain;

[0098] The processing unit is configured to compare the network fluctuation value of each time window in the network fluctuation-time data link with the fluctuation range, and split the network fluctuation-time data link into an abnormal fluctuation data link and a normal fluctuation data link according to the comparison result;

[0099] An execution unit is configured to extract network features of each time window in the abnormal fluctuation data chain, perform cluster analysis on the network data of each time window in the abnormal fluctuation data chain according to the network features, construct a network sequence of the same type, and obtain a sub-fluctuation influence factor of the network sequence of the same type according to the network sequence of the same type and the corresponding historical number of fluctuations of the same type;

[0100] The analysis unit is configured to analyze the remaining network series of the same type in the abnormal fluctuation data chain, determine the corresponding sub-fluctuation influence factors, and obtain a fluctuation influence factor set according to all the sub-fluctuation influence factors;

[0101] The early warning unit is configured to integrate the set of fluctuation influencing factors to obtain the final influencing factor of the network data, and determine whether to issue a network fault early warning according to the final influencing factor.

[0102] It is understandable that by intercepting network data within a preset period of time and constructing a fluctuation-time data chain, the dynamic changes of the network can be captured, avoiding the problem of traditional methods relying only on a single network indicator. By comparing the fluctuation range, the data chain is split into an abnormal fluctuation data chain and a normal fluctuation data chain, effectively distinguishing normal fluctuations from potential faults, thereby improving the accuracy of fault warning. By extracting network features from abnormal fluctuation data chains and performing cluster analysis, different types of fluctuation patterns are further refined, and the sub-fluctuation influence factors are calculated in combination with the number of historical fluctuations of the same type, making fault prediction more accurate. By integrating the set of fluctuation influence factors, the final influence factor of network data is generated, which can accurately determine whether the network has a risk of failure and issue warnings in a timely manner, improving the efficiency and response speed of network operation and maintenance.

[0103] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems or computer program products. Therefore, the present application may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0104] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems) and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0105] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0106] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0107] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the relevant field should understand that the specific implementation methods of the present invention can still be modified or replaced by equivalents. Any modification or equivalent replacement that does not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A network fault prediction method, characterized in that: include: Intercepting network data within a preset period of time, analyzing the network data to construct a network fluctuation-time data chain; Comparing the network fluctuation value of each time window in the network fluctuation-time data link with the fluctuation range, and splitting the network fluctuation-time data link into an abnormal fluctuation data link and a normal fluctuation data link according to the comparison result; Extracting the network features of each time window in the abnormal fluctuation data chain, performing cluster analysis on the network data of each time window in the abnormal fluctuation data chain according to the network features, constructing a network sequence of the same type, and obtaining a sub-fluctuation influence factor of the network sequence of the same type according to the network sequence of the same type and the corresponding historical number of fluctuations of the same type; Analyze the remaining network series of the same type in the abnormal fluctuation data chain to determine the corresponding sub-fluctuation influence factors, and obtain a fluctuation influence factor set according to all the sub-fluctuation influence factors; The fluctuation impact factor set is integrated to obtain a final impact factor of the network data, and whether to issue a network fault warning is determined according to the final impact factor.

2. The network fault prediction method according to claim 1, characterized in that: When analyzing the network data to construct a network fluctuation-time data chain, it includes: Acquire a first blank data link and a second blank data link, wherein each of the blank data links is provided with a plurality of data link nodes and connection nodes; Acquire the network fluctuation value of each time window according to the network data, and generate a chain switching mark for all network data whose network fluctuation value is not zero; All network data carrying the link change mark are transferred to the first blank data link to obtain the network fluctuation-time data link.

3. The network fault prediction method according to claim 1, characterized in that: When comparing the network fluctuation value of each time window in the network fluctuation-moment data link with the fluctuation range, the fluctuation range is obtained by: Collect historical operation data sets, and extract non-fault network fluctuation sets from the historical operation data sets; Normalizing the non-fault network fluctuation concentrated data, wherein the normalization processing includes Min-Max normalization; The normalized non-fault network fluctuation set is divided into a training set and a test set at a ratio of 4:

1. The LSTM model is trained to obtain the predicted value of each historical time window. Obtaining an actual value of each historical time window according to the non-fault network fluctuation set, and obtaining a prediction deviation multiplier of each historical time window according to the predicted value of each historical time window and the actual value of each historical time window, wherein the prediction deviation multiplier is a ratio of the predicted value to the actual value; The data in the network fluctuation-moment data chain is divided into time windows, each time window is used as the input of an LSTM model, the output result of the LSTM model is obtained, and the output result is combined with the prediction deviation multiplier of the corresponding historical time window to determine the fluctuation range of each time window.

4. The network fault prediction method according to claim 1, characterized in that: When clustering analysis is performed on the network data of each time window in the abnormal fluctuation data chain according to the network characteristics, it includes: The network characteristics include throughput, packet loss rate, and network traffic load; Determine the initial neighborhood radius through the k-distance graph and set MinPts to 6; Take each of the network features as a point, scan all points, and find the points whose number of points in the neighborhood is greater than or equal to MinPts as core points; Starting from each core point, check the points in its neighborhood; if the point in the neighborhood is a core point, continue to expand the cluster; if the point in the neighborhood is a boundary point, add it to the current cluster; if a point is not in the neighborhood of any core point and cannot form a cluster with other points, it is marked as a noise point.

5. The network fault prediction method according to claim 3, characterized in that: When obtaining the sub-fluctuation influence factor of the same type of network series according to the same type of network series and the corresponding historical number of same type of fluctuations, it includes: Among them, Gz represents the sub-fluctuation impact factor, N represents the number of network fluctuation values ​​in the same type of network series, Bi represents the ith network fluctuation value in the same type of network series, C represents the number of historical fluctuations, and B0 represents the right boundary value.

6. The network fault prediction method according to claim 5, characterized in that: When a volatility impact factor set is obtained according to all the sub-volatility impact factors, it includes: Determining the median and variance of all said sub-volatility impact factors; Extracting the sub-volatility impact factors greater than the median from all the sub-volatility impact factors to construct a first data set; Extracting sub-volatility impact factors greater than the variance from all the sub-volatility impact factors to construct a second data set; Determine whether there is an intersection between the first data set and the second data set; If yes, the intersection value is used as the fluctuation impact factor set; If not, the first data set and the second data set are non-repetitively merged to construct the fluctuation influence factor set, wherein the non-repetitive fusion is to retain the non-repetitive sub-fluctuation influence factors in the first data set and the second data set, retain one repeated sub-fluctuation influence factor in the first data set and the second data set, and delete the remaining repeated sub-fluctuation influence factors.

7. The network fault prediction method according to claim 6, characterized in that: When the set of fluctuation impact factors is integrated to obtain the final impact factor of the network data, it includes: Comparing the fluctuation impact factor set with historical judgment data, wherein the historical judgment data includes a historical fluctuation impact factor set and a historical final impact factor; When there is data in the historical judgment data whose similarity with the fluctuation influence factor set is greater than a similarity threshold, the historical final influence factor corresponding to the historical fluctuation influence factor set is used as the final influence factor; When the similarities between the historical fluctuation influence factor set in the historical judgment data and the fluctuation influence factor set are both less than or equal to the similarity threshold, the final influence factor is determined according to the fluctuation influence factor set.

8. The network fault prediction method according to claim 7, characterized in that: When determining the final impact factor according to the set of fluctuation impact factors, it includes: Among them, Y represents the final impact factor, M represents the number of sub-volatility impact factors in the volatility impact factor set, represents the weight corresponding to the ith sub-volatility impact factor, represents the i-th sub-volatility impact factor, represents the minimum sub-volatility impact factor, is the maximum sub-volatility impact factor, For all The maximum value in .

9. The network fault prediction method according to claim 8, characterized in that: When judging whether to issue a network fault warning according to the final impact factor, it includes: Compare the final impact factor with the impact factor threshold, and determine whether to issue a network fault warning based on the comparison result; When the final impact factor is greater than the impact factor threshold, it is determined to perform a network fault warning, and the difference between the final impact factor and the impact factor threshold is obtained, and the network fault warning level is determined according to the difference, and the network fault warning level is proportional to the difference.

10. A network fault prediction system, used for applying the network fault prediction method according to any one of claims 1 to 9, characterized in that: include: A collection unit is configured to intercept network data within a preset period of time, analyze the network data and construct a network fluctuation-time data chain; A processing unit is configured to compare the network fluctuation value of each time window in the network fluctuation-time data link with the fluctuation range, and split the network fluctuation-time data link into an abnormal fluctuation data link and a normal fluctuation data link according to the comparison result; An execution unit is configured to extract network features of each time window in the abnormal fluctuation data chain, perform cluster analysis on the network data of each time window in the abnormal fluctuation data chain according to the network features, construct a network sequence of the same type, and obtain a sub-fluctuation influence factor of the network sequence of the same type according to the network sequence of the same type and the corresponding historical number of fluctuations of the same type; An analysis unit is configured to analyze the remaining network series of the same type in the abnormal fluctuation data chain, determine the corresponding sub-fluctuation influence factors, and obtain a fluctuation influence factor set according to all the sub-fluctuation influence factors; The early warning unit is configured to integrate the fluctuation impact factor set to obtain a final impact factor of the network data, and determine whether to issue a network failure early warning according to the final impact factor.

Images