Network traffic prediction method and device, electronic equipment and storage medium

Abstract

The invention provides a network traffic prediction method and device, electronic equipment and a storage medium, and relates to the technical field of network traffic prediction. The method comprises the following steps: determining a plurality of index sequences based on the change of a plurality of flow indexes of a plurality of network element devices along with time in a preset time period; inputting the plurality of index sequences into a spatial feature extraction layer of a network traffic prediction model to obtain a spatial feature vector output by the spatial feature extraction layer; the spatial feature extraction layer is used for pruning the splicing process of the plurality of index sequences according to the causal relationship knowledge between the plurality of network element devices and the plurality of traffic indexes; inputting the spatial feature vector into a time feature extraction layer of a network traffic prediction model to obtain a spatial-temporal feature vector output by the time feature extraction layer; and inputting the spatial-temporal feature vectors into a linear mapping layer of a network prediction model, and obtaining prediction values of a plurality of network indexes of the plurality of network element devices in a prediction period output by the linear mapping layer.

Description

Technical Field

[0001] The present invention relates to the technical field of network traffic prediction, and in particular to a network traffic prediction method, device, electronic device and storage medium. Background Art

[0002] Traffic prediction helps to evaluate the trend and scale of network traffic, so as to better plan network resources. So far, the traffic prediction problem of cellular networks can be roughly divided into two categories: time prediction problem and space-time prediction problem. The first category is the time prediction problem, which has only one base station and only considers the traffic of users or devices connected to the base station. The second is the space-time prediction problem, that is, the user connects from one base station to another, accompanied by a switching process. In the latter more complex problem, in addition to the time correlation, the traffic in multiple base stations or multiple areas and their spatial correlation must also be considered. However, the network traffic prediction in the prior art only extracts features from the network traffic data itself, and the accuracy of the traffic prediction obtained needs to be improved. Summary of the invention

[0003] Embodiments of the present invention provide a network traffic prediction method, device, electronic device and storage medium to improve the accuracy of network traffic prediction.

[0004] In a first aspect, an embodiment of the present invention provides a network traffic prediction method, comprising: determining a plurality of indicator sequences based on changes in a plurality of traffic indicators of a plurality of network element devices over time within a preset time period; wherein each of the indicator sequences corresponds to a traffic indicator of a network element device; inputting the plurality of indicator sequences into a spatial feature extraction layer of a network traffic prediction model to obtain a spatial feature vector output by the spatial feature extraction layer; wherein the network traffic prediction model is trained based on indicator sequence samples and traffic indicator label values ​​determined based on a plurality of traffic indicator values ​​of the plurality of network element devices within a historical period; and the spatial feature extraction layer is used to generate a spatial feature vector output by the spatial feature extraction layer according to the plurality of network element devices and the plurality of network element devices. The causal relationship knowledge between each of the flow indicators is used to prune the splicing process of the multiple indicator sequences, and spatial feature extraction is performed on the spliced ​​matrix based on the graph attention mechanism; the causal relationship knowledge between the multiple indicator sequences is determined based on the log event data of each of the multiple network element devices for each of the flow indicators; the spatial feature vector is input into the time feature extraction layer of the network flow prediction model to obtain the spatiotemporal feature vector output by the time feature extraction layer; the spatiotemporal feature vector is input into the linear mapping layer of the network prediction model to obtain the predicted values ​​of the multiple network indicators of each of the multiple network element devices within the prediction period output by the linear mapping layer.

[0005] In some embodiments, the causal relationship knowledge between the multiple network element devices and the multiple flow indicators is determined based on the following method: obtaining the start time and end time of the log event of each of the multiple network element devices for each of the flow indicators; based on the start time and end time of the log event, determining a first causal relationship directed weighted graph between the multiple network element devices and a second causal relationship directed weighted graph between the multiple flow indicators; wherein the first causal relationship directed weighted graph uses each of the network element devices as a node, and the possibility of the causal relationship between the network element devices is used as the edge weight between the nodes; the second causal relationship directed weighted graph uses each of the flow indicators as a node, and the possibility of the causal relationship between the flow indicators is used as the edge weight between the nodes; the second causal relationship directed weighted graph is used as the causal relationship knowledge between the multiple flow indicators, and the second causal relationship directed weighted graph is used as the causal relationship knowledge between the multiple flow indicators.

[0006] In some embodiments, based on the knowledge of the causal relationship between the multiple network element devices and the multiple traffic indicators, the splicing process of the multiple indicator sequences is pruned, including: determining the causal relationship between the multiple indicator sequences based on the first causal relationship directed weighted graph and the second causal relationship directed weighted graph; based on the causal relationship between the multiple indicator sequences, splicing the multiple indicator sequences to obtain the spliced ​​matrix.

[0007] As a possible implementation method, the causal relationship between the multiple indicator sequences is determined based on the first causal relationship directed weighted graph and the second causal relationship directed weighted graph, including: for each indicator sequence, determining the first network element device and the first flow indicator corresponding to the indicator sequence; based on the first causal relationship directed weighted graph, determining the second network element device that has a causal relationship with the first network element device; based on the second causal relationship directed weighted graph, determining the second flow indicator that has a causal relationship with the first flow indicator; based on the second network element device and the second flow indicator, determining the first indicator sequence that has a causal relationship with the indicator sequence from the multiple indicator sequences; and determining the causal relationship between the multiple indicator sequences and their respective corresponding first indicator sequences as the causal relationship between the multiple indicator sequences.

[0008] In some embodiments, the spatial feature extraction layer is also used to perform pruning on the splicing process of the multiple indicator sequences based on the knowledge of the causal relationship between the multiple network element devices and the multiple traffic indicators, and the similarity between the multiple indicator sequences.

[0009] As a possible implementation method, according to the knowledge of the causal relationship between the multiple network element devices and the multiple flow indicators, and the similarity between the multiple indicator sequences, the splicing process of the multiple indicator sequences is pruned, including: determining the causal relationship between the multiple indicator sequences based on the knowledge of the causal relationship between the multiple network element devices and the multiple flow indicators; determining the similarity relationship between the multiple indicator sequences based on the similarity between the multiple indicator sequences; for each of the indicator sequences, determining a second indicator sequence that has an association relationship with the indicator sequence from the multiple indicator sequences based on the causal relationship between the multiple indicator sequences and the similarity relationship between the multiple indicator sequences; splicing the multiple indicator sequences based on the association relationship between the multiple indicator sequences and their respective corresponding second indicator sequences to obtain the spliced ​​matrix.

[0010] In a second aspect, an embodiment of the present invention provides a network traffic prediction device, comprising: a first determination module, used to determine a plurality of indicator sequences based on changes in a plurality of traffic indicators of a plurality of network element devices over time within a preset time period; wherein each of the indicator sequences corresponds to a traffic indicator of a network element device; a first acquisition module, used to input the plurality of indicator sequences into a spatial feature extraction layer of a network traffic prediction model, and obtain a spatial feature vector output by the spatial feature extraction layer; wherein the network traffic prediction model is trained based on indicator sequence samples and traffic indicator label values ​​determined based on a plurality of traffic indicator values ​​of the plurality of network element devices within a historical period; the spatial feature extraction layer is used to obtain a spatial feature vector output by the spatial feature extraction layer according to the plurality of network element devices and the plurality of network element devices; The causal relationship knowledge between each of the flow indicators is used to prune the splicing process of the multiple indicator sequences, and spatial feature extraction is performed on the spliced ​​matrix based on the graph attention mechanism; the causal relationship knowledge between the multiple indicator sequences is determined based on the log event data of each of the multiple network element devices for each of the flow indicators; a second acquisition module is used to input the spatial feature vector into the time feature extraction layer of the network flow prediction model to obtain the spatiotemporal feature vector output by the time feature extraction layer; a third acquisition module is used to input the spatiotemporal feature vector into the linear mapping layer of the network prediction model to obtain the predicted values ​​of the multiple network indicators of each of the multiple network element devices within the prediction period output by the linear mapping layer.

[0011] In a third aspect, an embodiment of the present invention provides an electronic device, comprising a processor and a memory storing a computer program, wherein when the processor executes the program, the network traffic prediction method described in the first aspect is implemented.

[0012] In a fourth aspect, an embodiment of the present invention provides a non-transitory computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the network traffic prediction method described in the first aspect is implemented.

[0013] In a fifth aspect, an embodiment of the present invention provides a computer program product, including a computer program, which, when executed by a processor, implements the network traffic prediction method described in the first aspect.

[0014] The network traffic prediction method, device, electronic device and storage medium provided by the embodiments of the present invention determine multiple indicator sequences based on the changes of multiple traffic indicators of multiple network element devices over time within a preset time period; input the multiple indicator sequences into the spatial feature extraction layer of the network traffic prediction model to obtain the spatial feature vector output by the spatial feature extraction layer; wherein the network traffic prediction model is obtained by training the indicator sequence samples and traffic indicator label values ​​determined based on the multiple traffic indicator values ​​of multiple network element devices within a historical period; the spatial feature extraction layer is used to prune the splicing process of the multiple indicator sequences according to the causal relationship knowledge between the multiple network element devices and the multiple traffic indicators, and extract spatial features from the spliced ​​matrix based on the graph attention mechanism; the causal relationship knowledge between the multiple indicator sequences is determined based on the log event data of each traffic indicator of the multiple network element devices; the spatial feature vector is input into the time feature extraction layer of the network traffic prediction model to obtain the spatiotemporal feature vector output by the time feature extraction layer; the spatiotemporal feature vector is input into the linear mapping layer of the network prediction model to obtain the predicted values ​​of the multiple network indicators of the multiple network element devices within the prediction period output by the linear mapping layer. When extracting spatial features, the present invention combines the causal relationship knowledge determined based on log event data, which can not only greatly reduce the computational complexity but also improve the accuracy of network traffic prediction. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0016] Figure 1 One of the flow charts of the network traffic prediction method provided by the embodiment of the present invention; Figure 2 A second flowchart of a network traffic prediction method provided by an embodiment of the present invention; Figure 3 This is an example diagram of processing log event data in an embodiment of the present invention; Figure 4 An example diagram of a first causal relationship directed weighted graph and a second causal relationship directed weighted graph in an embodiment of the present invention; Figure 5 A third flowchart of a network traffic prediction method provided by an embodiment of the present invention; Figure 6 A schematic diagram of the architecture of a network traffic prediction method according to an embodiment of the present invention; Figure 7 A fourth flowchart of a network traffic prediction method provided by an embodiment of the present invention; Figure 8 A schematic diagram of the structure of a network traffic prediction device provided by an embodiment of the present invention; Fig. 9 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0017] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0018] With the popularization of smart mobile terminals and the rapid development of communication networks, the number of cellular communication services has exploded in recent years. With the further development of cellular networks, the scope of network connection is getting wider and wider, new application scenarios and business models such as edge computing and virtual reality are constantly emerging, and a large number of devices and sensors can also access the network, forming a huge IoT ecosystem. Cellular network applications require highly stable network support, which puts higher requirements on network service quality and network control. Cellular traffic prediction is the premise of intelligent 5G. First of all, the resource allocation of demand-aware networks depends to a large extent on accurate cellular traffic prediction. In order to allow users to experience highly stable cellular network support, operators must accurately deploy and maintain base stations at the lowest possible cost; at the same time, in order to provide better service quality at a smaller resource cost, technologies such as active dormancy of base stations and meaningless capacity expansion have been proposed. All these technical requirements make accurate traffic prediction essential, because it helps network operators and service providers understand the current network traffic demand and better cope with future traffic demand.

[0019] Traffic forecasting helps to assess the trend and scale of network traffic, so as to better plan network resources. So far, the traffic forecasting problems in cellular networks can be roughly divided into two categories: temporal forecasting problems and spatiotemporal forecasting problems. They arise in two different scenarios. The first category is the temporal forecasting problem, which has only one base station and only considers the traffic of users or devices connected to the base station. The second is the spatiotemporal forecasting problem, that is, users connect from one base station to another, accompanied by a switching process. In the latter, a more complex problem, in addition to the temporal correlation, the traffic in multiple base stations or multiple areas and their spatial correlation must also be considered.

[0020] Many traffic prediction schemes proposed by researchers at home and abroad mainly use deep learning models including recurrent neural networks and their variants, graph convolutional neural networks, and Transformer networks to extract data features from cellular networks and perform traffic prediction. However, the main disadvantage of these deep learning methods is that they have high requirements for data and computing resources. For real network scenarios, deep learning methods have the following two significant disadvantages: First, network traffic fluctuations are caused by changes in network activities and are highly random, which makes it difficult for neural networks to collect enough pattern features to cope with changes in network traffic; second, deep learning methods are completely based on historical data to explore traffic patterns. Therefore, in order to make the model perform better, an extremely large data set is often required for training, which makes the threshold for model training very high. Both of these greatly limit the practical application of such algorithms in real network scenarios.

[0021] In order to solve the above problems, embodiments of the present invention provide a network traffic prediction method, device, electronic device and storage medium.

[0022] Figure 1 This is a flow chart of a network traffic prediction method provided by an embodiment of the present invention. Figure 1 As shown, the method may include the following steps.

[0023] Step 101: Determine a plurality of indicator sequences based on changes in a plurality of flow indicators of a plurality of network element devices over time within a preset time period; wherein each indicator sequence corresponds to a flow indicator of a network element device.

[0024] In some embodiments, the network element device may be a router, switch or other device in a wired network, or a base station or other network device in a wireless network. The multiple network element devices may be network element devices in a preset area, or network element devices for traffic prediction determined based on actual needs.

[0025] Among them, the multiple flow indicators may include bandwidth, delay, transmission rate, number of connections, etc., which can be obtained by the observation tool of the network element device itself. The multiple flow indicators of the multiple network element devices include multiple flow indicators of each network element device, such as flow indicator a, flow indicator b, flow indicator c and flow indicator d of network element device 1, flow indicator a, flow indicator b, flow indicator c and flow indicator d of network element device 2, flow indicator a, flow indicator b, flow indicator c and flow indicator d of network element device c, etc.

[0026] In some embodiments, the change of multiple flow indicators of multiple network element devices over time within a preset time period refers to the indicator values ​​of multiple flow indicators of multiple network element devices at each moment within the preset time period. The preset time period can be a period of time before the current moment, such as one hour before the current moment. The selection of the preset time period is related to the relationship between the time period of the training sample and the prediction time period when the network flow prediction model is trained.

[0027] As a possible implementation method, based on the changes of multiple flow indicators of multiple network element devices over time within a preset time period, the implementation process of determining multiple indicator sequences includes: for each network element device, arranging the indicator values ​​of each flow indicator of the network element device at each moment within the preset time period in chronological order, obtaining the indicator sequence corresponding to each flow indicator of the network element device, and finally obtaining the indicator sequence corresponding to each flow indicator of each network element device. In other words, each indicator sequence corresponds to a flow indicator of a network element device. For example, the multiple network element devices are network element device 1, network element device 2 and network element device 3, and the multiple flow indicators of each network element device are flow indicator a, flow indicator b, flow indicator c and flow indicator d, then the number of multiple indicator sequences is 3*4=12, namely indicator sequence 1 composed of the indicator values ​​of flow indicator a of network device 1 at each moment in a preset time period, indicator sequence 2 composed of the indicator values ​​of flow indicator b of network device 1 at each moment in the preset time period, indicator sequence 3 composed of the indicator values ​​of flow indicator c of network device 1 at each moment in the preset time period, indicator sequence 4 composed of the indicator values ​​of flow indicator d of network device 1 at each moment in the preset time period, indicator sequence 5 composed of the indicator values ​​of flow indicator a of network device 2 at each moment in the preset time period, and so on.

[0028] Step 102, input multiple indicator sequences into the spatial feature extraction layer of the network traffic prediction model to obtain the spatial feature vector output by the spatial feature extraction layer; wherein the network traffic prediction model is trained based on the indicator sequence samples and traffic indicator label values ​​determined based on the multiple traffic indicator values ​​of each of the multiple network element devices in the historical period; the spatial feature extraction layer is used to prune the splicing process of the multiple indicator sequences according to the causal relationship knowledge between the multiple network element devices and the multiple traffic indicators, and extract spatial features from the spliced ​​matrix based on the graph attention mechanism; the causal relationship knowledge between the multiple indicator sequences is determined based on the log event data of each of the multiple network element devices for each traffic indicator.

[0029] In some embodiments, the network traffic prediction model may be a neural network model, including a spatial feature extraction layer, a temporal feature extraction layer, and a linear mapping layer. The spatial feature extraction layer is used to extract the relationship between different indicator sequences, the temporal feature extraction layer is used to extract the time series features in each indicator sequence, and the linear mapping layer is used to perform linear mapping based on the extracted feature information to obtain the predicted values ​​of multiple traffic indicators of multiple network element devices within the prediction period.

[0030] The log event data of each flow index of each of the multiple network element devices refers to the log event data that affects the changes of each flow index during the operation of each network element device, such as the log event data that affects the changes of flow index a during the operation of network element device 1, the log event data that affects the changes of flow index c during the operation of network element device 2, and the log event data that affects the changes of flow index b during the operation of network device 1. Each log event data may include the start time, end time, and impact cause category of the business event. The log event data of each of the multiple network element devices for each flow index can be obtained based on the log data of each network element device in a historical time period, and the historical time period can be pre-set.

[0031] The causal relationship knowledge between the multiple network element devices and the multiple flow indicators refers to the causal relationship between the multiple network element devices and the causal relationship between the multiple flow indicators. The causal relationship between the multiple network element devices can be the degree of mutual influence between the multiple network element devices, and the causal relationship between the multiple flow indicators can be the degree of mutual influence between the multiple flow indicators. Both of them can be represented by an undirected weighted graph or a directed weighted graph.

[0032] In some embodiments, the causal relationship knowledge between network element devices and multiple flow indicators can be static data, that is, it is pre-determined based on the log event data of each of the multiple network element devices for each flow indicator. For example, it can be based on the order of occurrence of log events of each of the multiple network element devices for each flow indicator; taking the network device as the dimension, based on the above order, determine the causal relationship between the log events of multiple network devices, and then taking the flow indicator as the dimension, based on the above order, determine the causal relationship between the log events of multiple flow indicators; determine the causal relationship between the log events of multiple network devices as the causal relationship knowledge between multiple network devices, and determine the causal relationship between the log events of multiple flow indicators as the causal relationship knowledge between multiple flow indicators.

[0033] In some embodiments, the spatial feature extraction layer can be a graph attention neural network. Usually, the graph attention neural network constructs multiple input sequences based on a fully connected manner. However, in the embodiments of the present invention, although the traffic data between network element devices will have mutual influence, it is not necessarily the case that multiple indicator sequences will have mutual influence. Therefore, directly composing the map in a fully connected manner is not suitable for this solution. Therefore, in order to reduce the interference of irrelevant information caused by the learning of the attention mechanism, the splicing of multiple indicator sequences is pruned based on causal knowledge.

[0034] That is to say, when performing spatial feature extraction, the embodiment of the present invention combines the explicit knowledge of causal relationship knowledge with the graph attention mechanism to realize the extraction of spatial features between indicator sequences, which can not only improve the effectiveness of feature extraction, but also reduce resource consumption and improve the accuracy of traffic prediction.

[0035] As a possible implementation method, the spatial feature extraction layer prunes the splicing process of multiple indicator sequences according to the knowledge of the causal relationship between multiple network element devices and multiple flow indicators, which may include: for each indicator sequence, determining the first network element device and the first flow indicator corresponding to the indicator sequence; based on the knowledge of the causal relationship between multiple network element devices, determining the second network element device with the strongest causal relationship with the first network element device; based on the knowledge of the causal relationship between multiple flow indicators, determining the second flow indicator with the strongest causal relationship with the first flow indicator; determining the first indicator sequence corresponding to the second flow indicator of the second network element device in the multiple indicator sequences as the indicator sequence that has a causal relationship with the indicator sequence; based on the causal relationship between each indicator sequence and its corresponding first indicator sequence, pruning the splicing of indicator sequences without causal relationship when multiple indicator sequences are spliced ​​to obtain a matrix after splicing.

[0036] For example, if multiple indicator sequences are indicator sequence 1, indicator sequence 2, and indicator sequence 3, based on the knowledge of the causal relationship between multiple network element devices and multiple traffic indicators, it is determined that indicator sequence 1 has a causal relationship with indicator sequence 2, indicator sequence 2 has a causal relationship with indicator sequence 3, and indicator sequence 3 has a causal relationship with indicator sequence 1. Then, when splicing the indicator sequences, indicator sequence 1 is spliced ​​with indicator sequence 1, indicator sequence 1 is spliced ​​with indicator sequence 2, indicator sequence 2 is spliced ​​with indicator sequence 2, indicator sequence 2 is spliced ​​with indicator sequence 3, indicator sequence 3 is spliced ​​with indicator sequence 3, and indicator sequence 3 is spliced ​​with indicator sequence 1, to obtain a 6×n matrix, where n is twice the length of each indicator sequence.

[0037] In some embodiments, the spatial feature extraction layer performs spatial feature extraction on the spliced ​​matrix based on the graph attention mechanism, which is a process in which the graph attention neural network performs feature extraction on the spliced ​​matrix, which is consistent with the feature extraction process of the graph attention neural network in the related art.

[0038] Step 103: input the spatial feature vector to the time feature extraction layer of the network traffic prediction model to obtain the spatiotemporal feature vector output by the time feature extraction layer.

[0039] In some embodiments, the time feature extraction layer is used to extract time series features in each indicator sequence. The time feature extraction layer can be a model of a recursive neural network architecture, such as a GRU (Gated Recurrent Unit).

[0040] Step 104: input the spatiotemporal feature vector to the linear mapping layer of the network prediction model to obtain the predicted values ​​of the multiple network indicators of the multiple network element devices within the prediction period output by the linear mapping layer.

[0041] Among them, the linear mapping layer is used to realize the mapping of spatiotemporal feature vectors and output multiple prediction indicator sequences. Each prediction indicator sequence is the predicted value of a certain traffic indicator of a certain network element device at each moment in the prediction period. Based on multiple prediction indicator sequences, the predicted values ​​of multiple network indicators of multiple network element devices in the prediction period are obtained.

[0042] In some embodiments, the predicted period may be a period of time after the current period, and the length of the predicted period may be consistent with or inconsistent with the length of the preset period, which may be determined based on actual needs.

[0043] Next, the training process of the network traffic prediction model is introduced in the form of an example. For example, the duration of the preset period is 10 minutes, the duration of the prediction period is 15 minutes, and each set of preset periods and prediction periods are continuous, that is, the application scenario is based on the change of multiple traffic indicators of multiple network element devices over time within 10 minutes before the current moment (including the current moment), multiple indicator sequences are determined, and the multiple indicator sequences are input into the network traffic prediction model to obtain the predicted values ​​of multiple traffic indicators of multiple network element devices at each moment within 15 minutes after the current moment. The training process includes: constructing an initial network traffic prediction model, which includes an initial spatial feature extraction layer, an initial temporal feature extraction layer and an initial linear mapping layer, wherein the initial spatial feature extraction layer is a graph convolutional neural network, and the initial temporal feature extraction layer is a GRU model; based on the indicator values ​​of multiple traffic indicators of multiple network element devices at various times in the past three months, the time windows are divided into 25-minute windows to obtain multiple groups of traffic indicator data, each group of traffic indicator data includes the indicator values ​​of multiple traffic indicators of multiple network element devices at various times within 25 consecutive minutes; for each group of traffic indicator data, based on the data of the first 10 minutes of the traffic indicator data, an indicator sequence sample is determined, and the label value corresponding to the indicator sequence sample is determined based on the data of the last 15 minutes; the obtained indicator sequence sample is input into the initial network traffic prediction model to obtain the output prediction result, and the loss value is calculated based on the prediction result and the corresponding label value to continuously update the model parameters, and finally a trained network traffic prediction model is obtained.

[0044] According to the network traffic prediction method provided by the embodiment of the present invention, based on the changes of multiple traffic indicators of multiple network element devices over time within a preset time period, multiple indicator sequences are determined; the multiple indicator sequences are input into the spatial feature extraction layer of the network traffic prediction model to obtain the spatial feature vector output by the spatial feature extraction layer; wherein the network traffic prediction model is obtained by training the indicator sequence samples and traffic indicator label values ​​determined based on the multiple traffic indicator values ​​of multiple network element devices within a historical period; the spatial feature extraction layer is used to prune the splicing process of the multiple indicator sequences according to the knowledge of the causal relationship between the multiple network element devices and the multiple traffic indicators, and extract spatial features from the spliced ​​matrix based on the graph attention mechanism; the knowledge of the causal relationship between the multiple indicator sequences is determined based on the log event data of each traffic indicator of the multiple network element devices; the spatial feature vector is input into the time feature extraction layer of the network traffic prediction model to obtain the spatiotemporal feature vector output by the time feature extraction layer; the spatiotemporal feature vector is input into the linear mapping layer of the network prediction model to obtain the predicted values ​​of the multiple network indicators of the multiple network element devices within the prediction period output by the linear mapping layer. When extracting spatial features, the present invention combines the causal relationship knowledge determined based on log event data, which can not only greatly reduce the computational complexity but also improve the accuracy of network traffic prediction.

[0045] Figure 2 The second flow chart of the network traffic prediction method provided by the embodiment of the present invention. Figure 2 As shown, the knowledge of the causal relationship between the multiple network element devices and the multiple flow indicators in the above embodiment can be determined based on the following steps.

[0046] Step 201: Obtain the start time and end time of the log event for each flow indicator of each of the multiple network element devices.

[0047] That is, the start time and end time of the log event of each flow indicator are extracted from the log event data of multiple network element devices. It can be understood that the log event data is usually textual data. By extracting the start time and end time of the log event of each flow indicator of the network element device, the log event data is converted into a symbolic form to facilitate the subsequent extraction of causal relationship knowledge.

[0048] As an example, each log event data can be converted into the form of (a, M1, [s, t]), where a represents the identifier of the traffic indicator, M1 identifies the identifier of the network element device, s is the start time of the log event, and t is the end time of the log data.

[0049] Step 202, based on the start time and end time of the log event, determine a first causal directed weighted graph between multiple network element devices and a second causal directed weighted graph between multiple traffic indicators; wherein the first causal directed weighted graph uses each network element device as a node, and the possibility of the causal relationship between the network element devices is used as the edge weight between the nodes; the second causal directed weighted graph uses each traffic indicator as a node, and the possibility of the causal relationship between the traffic indicators is used as the edge weight between the nodes.

[0050] In some embodiments, the sequence of log events between network element devices and the sequence of log data between traffic indicators can be determined based on the start time and end time of the log events, and the connection between the nodes in the first causal directed weighted graph and the second causal directed weighted graph can be determined based on the above sequence, and the edge weights between the nodes can be determined based on the number of log events with potential causal relationships between the nodes.

[0051] As an example, if the multiple network element devices are M1, M2 and M3, and the multiple traffic indicators are a, b, c and d, such as Figure 3As shown in the figure, during the historical period, M1 had four log events, namely (c, M1, [1, 4]), (a, M1, [2, 3]), (c, M1, [7, 11]) and (d, M1, [10, 15]); M2 had three log events, namely (b, M2, [3, 5]), (d, M2, [6, 9]) and (b, M2, [13, 15]); M3 has four log events, namely (a, M3, [4, 6]), (a, M3, [8, 10]), (b, M3, [9, 12]) and (c, M3, [14, 15]). In terms of network element device dimension, M1 includes two consecutive periods of log events, namely [1, 4] and [7, 15]. M2 includes three consecutive periods of log events, namely [3, 5], [6, 8] and [13, 15]. M3 includes three consecutive periods of log events, namely [4, 6], [8, 12] and [14, 1 5]; Compare the start time and end time of the log event of each network element device with the start time and end time of the log event of the continuous period of other network element devices in turn. If the start time of the continuous period of the log event of network element device 1 is earlier than the start time of the log event of network element device 2, and the end time of the continuous period of the log event of network element device 1 is later than the start time of the log event of network element device 2, it is determined that the occurrence of the log event of network element device 1 will cause the occurrence of the log event of network element device 2, establish an edge from the node of network element device 1 to the node of network element device 2, and connect the nodes that meet the above conditions to the node of network element device 2. The number of log events in the continuous period of the condition is determined as the weight of the edge; based on the above judgment principle, it can be determined that there are two log events in M2 (b, M2, [3, 5]) and (b, M2, [13, 15]) whose start time is later than the start time of the continuous period log event of M1 and earlier than the end time of the continuous period log event of M1, then an edge from the M1 node to the M2 node is established in the first causal directed weighted graph, and the weight of the edge is 2; there are three log events in M3 (a, M3, [8, 10]), (b, M3, [9, 12]) and (c, M3, [14, 15]) has a start time later than the start time of the continuous period log event of M1 and earlier than the end time of the continuous period log event of M1, then an edge from M1 node to M3 node is established in the first causal directed weighted graph, and the weight of the edge is 3; there is a log event (a, M3, [8, 10]) in M3, whose start time is later than the start time of the continuous period log event of M2 and earlier than the end time of the continuous period log event of M2, then an edge from M2 node to M3 node is established in the first causal directed weighted graph, and the weight of the edge is 1, and the result is as follows Figure 4 The first causal directed weighted graph is shown.

[0052] Based on the above example, the start time and end time of the log events of different traffic indicators are analyzed in the flow indicator dimension, and the start time and end time of the log events of different traffic indicators are compared in pairs. If the start time of the log event of flow indicator 1 is later than the start time of the log event of flow indicator 2 and earlier than the end time of the log event of flow indicator 2, it is considered that the log event of flow indicator 2 may cause the log event of flow indicator 1. In the second causal directed weighted graph, an edge is established from the flow indicator 2 node to the flow indicator 1 node, and the weight of the edge is the number of flow indicators 2 that meet the above conditions; Figure 2 As shown in the figure, the start time of (a, M1, [2, 3]) is later than the start time of (c, M1, [1, 4]) and earlier than the end time of (c, M1, [1, 4]). The start time of (a, M3, [8, 10]) is later than the start time of (c, M1, [7, 11]) and earlier than the end time of (c, M1, [7, 11]). In the second causal directed weighted graph, an edge is established from node c to node a, and the edge weight is 2. By analogy, other log events are compared to obtain the following: Figure 4 The second causal directed weighted graph shown. The start time of (d, M1, [10, 15]) is later than the start time of and earlier than the end time of (c, M1, [7, 11]), then an edge from node c to node d is established, and the edge weight is reset to 1; continue to analyze M2, there is no log event in M2 that meets the above conditions; continue to analyze M3, M3 and the flow indicators in each network element device are sequentially Step 203: Use the second causal relationship directed weighted graph as the causal relationship knowledge between the multiple flow indicators. Use the second causal relationship directed weighted graph as the causal relationship knowledge between the multiple flow indicators.

[0053] It should be noted that the causal relationship knowledge between multiple traffic indicators can be regularly updated as log event data is supplemented to ensure the applicability of the causal relationship knowledge.

[0054] According to the network traffic prediction method of the embodiment of the present invention, by extracting the network element equipment, traffic index, start time and end time of the log data, the causal relationship between the log events is analyzed with the network element equipment dimension and the traffic index dimension respectively, to obtain a first causal relationship directed weighted graph and a second causal relationship directed weighted graph, and based on the first causal relationship directed weighted graph and the second causal relationship directed weighted graph, the display causal knowledge is determined, and spatial features are extracted in combination with the graph attention mechanism, which can not only reduce the interference of irrelevant information on the calculation of the graph attention mechanism, but also reduce the calculation complexity and improve the accuracy of network traffic prediction.

[0055] Next, the process of pruning the splicing process of multiple indicator sequences based on the knowledge of the causal relationship between multiple network element devices and multiple traffic indicators at the spatial feature extraction layer will be introduced in detail.

[0056] Figure 5 The third flow chart of the network traffic prediction method provided by the embodiment of the present invention. Figure 3 As shown, in combination with the above embodiments, the process of pruning the splicing process of multiple indicator sequences according to the knowledge of the causal relationship between multiple network element devices and multiple traffic indicators at the spatial feature extraction layer includes the following steps.

[0057] Step 501 : determining the causal relationship between a plurality of indicator sequences based on the first causal relationship directed weighted graph and the second causal relationship directed weighted graph.

[0058] In some embodiments, based on the first causal directed weighted graph and the second causal directed weighted graph, the implementation process of determining the causal relationship between multiple indicator sequences may include: for each indicator sequence, determining the first network element device and the first flow indicator corresponding to the indicator sequence; based on the first causal directed weighted graph, determining the second network element device that has a causal relationship with the first network element device; based on the second causal directed weighted graph, determining the second flow indicator that has a causal relationship with the first flow indicator; based on the second network element device and the second flow indicator, determining the first indicator sequence that has a causal relationship with the indicator sequence from multiple indicator sequences; determining the causal relationship between multiple indicator sequences and their respective corresponding first indicator sequences as the causal relationship between multiple indicator sequences.

[0059] That is, the causal relationship between multiple indicator sequences can be determined for each indicator sequence, including the causal relationship between each indicator sequence and other indicator sequences.

[0060] Among them, the number of second network element devices can be one or more. When determining the second network element device that has a causal relationship with the first network element device based on the first causal directed weighted graph, multiple edges pointing to the first network element device can be first obtained based on the first causal directed weighted graph, and the weights of the multiple edges can be sorted from large to small, the first n edges can be taken from the sorting results, and the n network element devices referred to by the starting nodes of the n edges are taken as the second network element devices, where n can be determined based on actual needs.

[0061] Among them, the number of second flow indicators can be one or more. When determining the second flow indicator that has a causal relationship with the first flow indicator based on the second causal directed weighted graph, multiple edges pointing to the first flow indicator can be first obtained based on the second causal directed weighted graph, and the weights of these multiple edges can be sorted from large to small, and the first m edges can be taken from the sorting results, and the m flow indicators referred to by the starting nodes of the m edges are used as the second flow indicators, and m can be determined based on actual needs.

[0062] In some embodiments, based on the second network element device and the second flow indicator, the implementation method of determining the first indicator sequence that has a causal relationship with the indicator sequence from multiple indicator sequences includes: if the number of the second network element device and the second flow indicator is both 1, then the indicator sequence corresponding to the second flow indicator of the second network element device in the multiple indicator sequences can be determined as the first indicator sequence; if the number of the second network element device and the second flow indicator is greater than 1, then the second network element device and the second flow indicator can be combined, for example, if the second network element device includes network element device a and network element device b, and the second flow indicator includes flow indicator a and flow index b, then combine the two to obtain four combinations of (network element device a, flow index a), (network element device a, flow index b), (network element device b, flow index a), and (network element device b, flow index b). The indicator sequence corresponding to each combination is taken as the first indicator sequence, that is, the indicator sequence a corresponding to the flow index a of network element device a, the indicator sequence b corresponding to the flow index b of network element device a, the indicator sequence c corresponding to the flow index a of network element device b, and the indicator sequence d corresponding to the flow index b of network element device b in the multiple indicator sequences are all determined as the first indicator sequence.

[0063] Step 502: Based on the causal relationship between the multiple indicator sequences, the multiple indicator sequences are spliced ​​to obtain a spliced ​​matrix.

[0064] It can be understood that the sequence splicing step of the graph convolutional neural network is usually performed in a fully connected form, while the indicator sequence splicing process in this scheme is based on the causal relationship between multiple indicator sequences, so that the splicing of indicator sequences without causal relationship can be pruned, and only the splicing between indicator sequences with causal relationship is retained. In this way, the subsequent graph attention mechanism only targets these indicator sequences with relationship, reducing the interference of irrelevant information.

[0065] For example, if multiple indicator sequences are indicator sequence 1, indicator sequence 2, and indicator sequence 3, based on the first causal relationship directed weighted graph and the second causal relationship directed weighted graph, it is determined that indicator sequence 1 has a causal relationship with indicator sequence 2, indicator sequence 2 has a causal relationship with indicator sequence 3, and indicator sequence 3 has a causal relationship with indicator sequence 1. Then, when splicing the indicator sequences, indicator sequence 1 is spliced ​​with indicator sequence 1, indicator sequence 1 is spliced ​​with indicator sequence 2, indicator sequence 2 is spliced ​​with indicator sequence 2, indicator sequence 2 is spliced ​​with indicator sequence 2, indicator sequence 2 is spliced ​​with indicator sequence 3, indicator sequence 3 is spliced ​​with indicator sequence 3, and indicator sequence 3 is spliced ​​with indicator sequence 1, and the splicing between indicator sequence 1 and indicator sequence 3 is pruned, the splicing between indicator sequence 2 and indicator sequence 1 is pruned, and the splicing between indicator sequence 3 and indicator sequence 2 is pruned, to obtain a 6×n matrix, where n is twice the length of each indicator sequence.

[0066] Figure 6 FIG. 1 is a schematic diagram of the architecture of a network traffic prediction method according to an embodiment of the present invention. Figure 6 As shown, multiple indicator sequences and causal relationship knowledge are input into the spatial feature extraction layer of the network traffic prediction model, the output result of the spatial feature extraction layer is input into the temporal feature extraction layer, and the output result of the temporal feature extraction layer is input into the linear mapping layer, and finally the prediction sequence is obtained.

[0067] In some embodiments, in order to improve the accuracy of pruning during the splicing of indicator sequences, the similarity between multiple indicator sequences may also be introduced. The spatial feature extraction layer is also used to perform pruning on the splicing process of multiple indicator sequences based on the knowledge of the causal relationship between multiple network element devices and multiple traffic indicators, and the similarity between multiple indicator sequences.

[0068] Figure 7 The fourth flowchart of the network traffic prediction method provided by the embodiment of the present invention is as follows. Figure 7 As shown, the spatial feature extraction layer can include the following steps to implement the pruning process of the splicing process of multiple indicator sequences based on the knowledge of the causal relationship between multiple network element devices and multiple traffic indicators, as well as the similarity between multiple indicator sequences.

[0069] Step 701: determine the causal relationship between multiple indicator sequences based on the knowledge of the causal relationship between multiple network element devices and multiple flow indicators.

[0070] Step 702: Determine the similarity relationship between the multiple indicator sequences based on the similarities between the multiple indicator sequences.

[0071] In some embodiments, the similarity between two indicator sequences may be calculated based on the DTW algorithm, and the similarity between each indicator sequence and other indicator sequences may be determined as the similarity relationship between the multiple indicator sequences.

[0072] Step 703 : for each indicator sequence, based on the causal relationship between the multiple indicator sequences and the similarity relationship between the multiple indicator sequences, determine a second indicator sequence that has an associated relationship with the indicator sequence from the multiple indicator sequences.

[0073] In some embodiments, for each indicator sequence, a first indicator sequence is determined based on a causal relationship between multiple indicator sequences; based on a similarity relationship between multiple indicator sequences, the similarity between the indicator sequence and other indicator sequences is ranked from large to small, and based on the ranking result and a preset number, the first s indicator sequences are taken out and determined as a third indicator sequence; the third indicator sequence and the first indicator sequence are intersected, and based on the result of the intersection, a second indicator sequence is determined.

[0074] In some embodiments, the number of first indicator sequences, the number of second indicator sequences, and the number of third indicator sequences can be preset. If the number of indicators in the result after taking the intersection is less than the preset number of the second indicator sequence, the indicator sequence can continue to be taken out based on the similarity sorting results between the indicator sequence and other indicator sequences to complete the second indicator sequence.

[0075] Step 704 , based on the association relationship between the multiple indicator sequences and their respective corresponding second indicator sequences, the multiple indicator sequences are concatenated to obtain a concatenated matrix.

[0076] That is to say, when multiple indicator sequences are concatenated, the concatenation of indicator sequences that have no correlation relationship can be pruned, and only the concatenation of each indicator sequence and its corresponding second indicator sequence is retained to obtain a concatenated matrix.

[0077] According to the network traffic prediction method of an embodiment of the present invention, the spatial feature extraction layer is also used to prune the splicing process of multiple indicator sequences based on the knowledge of the causal relationship between multiple network element devices and multiple traffic indicators, and the similarity between multiple indicator sequences, so as to improve the accuracy of spatial feature extraction, thereby further improving the accuracy of network traffic prediction.

[0078] The following describes a distribution network data topology restoration device provided by an embodiment of the present invention. The distribution network data topology restoration device described below and the distribution network data topology restoration method described above can correspond to each other.

[0079] Figure 8 This is one of the structural diagrams of the network traffic prediction device provided by the embodiment of the present invention. Figure 8 As shown, the device includes: a first determining module 810 , a first acquiring module 820 , a second acquiring module 830 and a third acquiring module 840 .

[0080] A first determination module 810 is used to determine a plurality of indicator sequences based on changes in a plurality of flow indicators of a plurality of network element devices over time within a preset time period; wherein each indicator sequence corresponds to a flow indicator of a network element device; The first acquisition module 820 is used to input multiple indicator sequences into the spatial feature extraction layer of the network traffic prediction model to obtain the spatial feature vector output by the spatial feature extraction layer; wherein the network traffic prediction model is obtained by training the indicator sequence samples and traffic indicator label values ​​determined based on multiple traffic indicator values ​​of multiple network element devices in a historical period; the spatial feature extraction layer is used to prune the splicing process of multiple indicator sequences according to the causal relationship knowledge between multiple network element devices and multiple traffic indicators, and extract spatial features from the spliced ​​matrix based on the graph attention mechanism; the causal relationship knowledge between multiple indicator sequences is determined based on the log event data of each traffic indicator of multiple network element devices; The second acquisition module 830 is used to input the spatial feature vector into the time feature extraction layer of the network traffic prediction model to obtain the spatiotemporal feature vector output by the time feature extraction layer; The third acquisition module 840 is used to input the spatiotemporal feature vector into the linear mapping layer of the network prediction model to obtain the predicted values ​​of multiple network indicators of multiple network element devices within the prediction period output by the linear mapping layer.

[0081] In some embodiments, the device can also use a second determination module 850 to: based on the spatial feature extraction layer, obtain the start time and end time of the log events of each of the multiple network element devices for each flow indicator; based on the start time and end time of the log event, determine the first causal directed weighted graph between the multiple network element devices, and the second causal directed weighted graph between the multiple flow indicators; wherein the first causal directed weighted graph uses each network element device as a node, and the possibility of causal relationship between the network element devices is used as the edge weight between the nodes; the second causal directed weighted graph uses each flow indicator as a node, and the possibility of causal relationship between the flow indicators is used as the edge weight between the nodes. The second causal directed weighted graph is used as the causal relationship knowledge between the multiple flow indicators, and the second causal directed weighted graph is used as the causal relationship knowledge between the multiple flow indicators.

[0082] In some embodiments, the first acquisition module 820 is also used to: determine the causal relationship between multiple indicator sequences based on the spatial feature extraction layer, based on the first causal relationship directed weighted graph and the second causal relationship directed weighted graph; based on the causal relationship between the multiple indicator sequences, splice the multiple indicator sequences to obtain a spliced ​​matrix.

[0083] Specifically, the first acquisition module 820 is also used to: based on the spatial feature extraction layer, for each indicator sequence, determine the first network element device and the first flow indicator corresponding to the indicator sequence; based on the first causal relationship directed weighted graph, determine the second network element device that has a causal relationship with the first network element device; based on the second causal relationship directed weighted graph, determine the second flow indicator that has a causal relationship with the first flow indicator; based on the second network element device and the second flow indicator, determine the first indicator sequence that has a causal relationship with the indicator sequence from multiple indicator sequences; determine the causal relationship between multiple indicator sequences and their respective corresponding first indicator sequences as a causal relationship between multiple indicator sequences.

[0084] In some embodiments, the spatial feature extraction layer is also used to prune the splicing process of multiple indicator sequences based on the knowledge of the causal relationship between multiple network element devices and multiple traffic indicators, and the similarity between multiple indicator sequences.

[0085] Specifically, the first acquisition module 820 is also used to: determine the causal relationship between multiple indicator sequences based on the spatial feature extraction layer and the knowledge of the causal relationship between multiple network element devices and multiple traffic indicators; determine the similarity relationship between multiple indicator sequences based on the similarity between multiple indicator sequences; for each indicator sequence, determine a second indicator sequence that has an association relationship with the indicator sequence from multiple indicator sequences based on the causal relationship between multiple indicator sequences and the similarity relationship between multiple indicator sequences; and splice the multiple indicator sequences based on the association relationship between the multiple indicator sequences and their respective corresponding second indicator sequences to obtain a spliced ​​matrix.

[0086] Fig. 9 An example of a physical structure diagram of an electronic device is shown in FIG. Fig. 9As shown, the electronic device may include: a processor 910, a communication interface 920, a memory 930 and a communication bus 940, wherein the processor 910, the communication interface 920 and the memory 930 communicate with each other via the communication bus 940. The processor 910 may call the computer program in the memory 930 to execute the steps of the network traffic prediction method provided in the above-mentioned embodiments, including: determining multiple indicator sequences based on the changes of multiple traffic indicators of multiple network element devices over time within a preset time period; wherein each indicator sequence corresponds to a traffic indicator of a network element device; inputting the multiple indicator sequences into the spatial feature extraction layer of the network traffic prediction model to obtain the spatial feature vector output by the spatial feature extraction layer; wherein the network traffic prediction model is obtained by training the indicator sequence samples and traffic indicator label values ​​determined based on the multiple traffic indicator values ​​of multiple network element devices within a historical period; the spatial feature The extraction layer is used to prune the splicing process of multiple indicator sequences according to the knowledge of the causal relationship between multiple network element devices and multiple flow indicators, and extract spatial features of the spliced ​​matrix based on the graph attention mechanism; the knowledge of the causal relationship between multiple indicator sequences is determined based on the log event data of each flow indicator of multiple network element devices; the spatial feature vector is input into the time feature extraction layer of the network flow prediction model to obtain the spatiotemporal feature vector output by the time feature extraction layer; the spatiotemporal feature vector is input into the linear mapping layer of the network prediction model to obtain the predicted values ​​of multiple network indicators of multiple network element devices within the prediction period output by the linear mapping layer.

[0087] In addition, the logic instructions in the above-mentioned memory 930 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0088] On the other hand, an embodiment of the present invention also provides a computer program product, which includes a computer program. The computer program can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the steps of the network traffic prediction method provided in the above embodiments.

[0089] On the other hand, an embodiment of the present invention further provides a processor-readable storage medium, wherein the processor-readable storage medium stores a computer program, and the computer program is used to enable the processor to execute the steps of the network traffic prediction method provided in the above embodiments.

[0090] The processor-readable storage medium can be any available medium or data storage device that can be accessed by the processor, including but not limited to magnetic storage (such as floppy disks, hard disks, magnetic tapes, magneto-optical disks (MO), etc.), optical storage (such as CD, DVD, BD, HVD, etc.), and semiconductor storage (such as ROM, EPROM, EEPROM, non-volatile memory (NANDFLASH), solid-state drive (SSD)), etc.

[0091] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0092] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0093] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A network traffic prediction method, characterized in that: include: Determine multiple indicator sequences based on changes in multiple flow indicators of multiple network element devices over time within a preset time period; wherein each of the indicator sequences corresponds to a flow indicator of a network element device; The multiple indicator sequences are input into the spatial feature extraction layer of the network traffic prediction model to obtain the spatial feature vector output by the spatial feature extraction layer; wherein the network traffic prediction model is trained based on the indicator sequence samples and traffic indicator label values ​​determined based on the multiple traffic indicator values ​​of each of the multiple network element devices in the historical period; the spatial feature extraction layer is used to prune the splicing process of the multiple indicator sequences according to the causal relationship knowledge between the multiple network element devices and the multiple traffic indicators, and extract spatial features from the spliced ​​matrix based on the graph attention mechanism; the causal relationship knowledge between the multiple indicator sequences is determined based on the log event data of each of the multiple network element devices for each of the traffic indicators; Inputting the spatial feature vector into the temporal feature extraction layer of the network traffic prediction model to obtain the spatiotemporal feature vector output by the temporal feature extraction layer; The spatiotemporal feature vector is input into the linear mapping layer of the network prediction model to obtain the predicted values ​​of the plurality of network indicators of the plurality of network element devices within the prediction period output by the linear mapping layer.

2. The method according to claim 1, characterized in that The knowledge of the causal relationship between the plurality of network element devices and the plurality of flow indicators is determined based on the following method: Obtaining the start time and end time of the log event of each of the plurality of network element devices for each of the flow indicators; Based on the start time and end time of the log event, determine a first causal directed weighted graph between the multiple network element devices and a second causal directed weighted graph between the multiple flow indicators; wherein the first causal directed weighted graph uses each of the network element devices as a node, and uses the possibility of causal relationships between the network element devices as the edge weights between the nodes; the second causal directed weighted graph uses each of the flow indicators as a node, and uses the possibility of causal relationships between the flow indicators as the edge weights between the nodes; The second causal relationship directed weighted graph is used as the causal relationship knowledge between the multiple flow indicators. The second causal relationship directed weighted graph is used as the causal relationship knowledge between the multiple flow indicators.

3. The method according to claim 1, characterized in that: The spatial feature extraction layer performs pruning processing on the splicing process of the multiple indicator sequences according to the causal relationship knowledge between the multiple network element devices and the multiple traffic indicators, including: Determining a causal relationship between the plurality of indicator sequences based on the first causal relationship directed weighted graph and the second causal relationship directed weighted graph; Based on the causal relationship between the multiple indicator sequences, the multiple indicator sequences are spliced ​​to obtain the spliced ​​matrix.

4. The method according to claim 3, characterized in that The spatial feature extraction layer determines the causal relationship between the multiple indicator sequences based on the first causal relationship directed weighted graph and the second causal relationship directed weighted graph, including: For each indicator sequence, determining a first network element device and a first flow indicator corresponding to the indicator sequence; Determine, based on the first causal relationship directed weighted graph, a second network element device that has a causal relationship with the first network element device; Determine, based on the second causal relationship directed weighted graph, a second flow indicator having a causal relationship with the first flow indicator; Based on the second network element device and the second traffic indicator, determining a first indicator sequence having a causal relationship with the indicator sequence from the multiple indicator sequences; The causal relationship between the multiple indicator sequences and their respective corresponding first indicator sequences is determined as the causal relationship between the multiple indicator sequences.

5. The method according to claim 1, characterized in that The spatial feature extraction layer is also used to perform pruning processing on the splicing process of the multiple indicator sequences according to the knowledge of the causal relationship between the multiple network element devices and the multiple traffic indicators, and the similarity between the multiple indicator sequences.

6. The method according to claim 5, characterized in that The spatial feature extraction layer performs pruning processing on the splicing process of the multiple indicator sequences according to the causal relationship knowledge between the multiple network element devices and the multiple flow indicators, and the similarity between the multiple indicator sequences, including: Determine the causal relationship between the multiple indicator sequences based on the knowledge of the causal relationship between the multiple network element devices and the multiple flow indicators; Determining a similarity relationship between the multiple indicator sequences based on the similarities between the multiple indicator sequences; For each of the indicator sequences, based on the causal relationship between the multiple indicator sequences and the similarity relationship between the multiple indicator sequences, determine a second indicator sequence that has an association relationship with the indicator sequence from the multiple indicator sequences; Based on the association relationship between the multiple indicator sequences and their respective corresponding second indicator sequences, the multiple indicator sequences are spliced ​​to obtain the spliced ​​matrix.

7. A network traffic prediction device, characterized in that: include: A first determination module is used to determine a plurality of indicator sequences based on changes in a plurality of flow indicators of a plurality of network element devices over time within a preset time period; wherein each of the indicator sequences corresponds to a flow indicator of a network element device; The first acquisition module is used to input the multiple indicator sequences into the spatial feature extraction layer of the network traffic prediction model to obtain the spatial feature vector output by the spatial feature extraction layer; wherein the network traffic prediction model is obtained by training the indicator sequence samples and traffic indicator label values ​​determined based on the multiple traffic indicator values ​​of each of the multiple network element devices in the historical period; the spatial feature extraction layer is used to prune the splicing process of the multiple indicator sequences according to the causal relationship knowledge between the multiple network element devices and the multiple traffic indicators, and extract spatial features from the spliced ​​matrix based on the graph attention mechanism; the causal relationship knowledge between the multiple indicator sequences is determined based on the log event data of each of the multiple network element devices for each of the traffic indicators; A second acquisition module is used to input the spatial feature vector into the time feature extraction layer of the network traffic prediction model to obtain the spatiotemporal feature vector output by the time feature extraction layer; The third acquisition module is used to input the spatiotemporal feature vector into the linear mapping layer of the network prediction model to obtain the predicted values ​​of the multiple network indicators of the multiple network element devices within the prediction period output by the linear mapping layer.

8. An electronic device comprising a processor and a memory storing a computer program, characterized in that: When the processor executes the computer program, the network traffic prediction method according to any one of claims 1 to 6 is implemented.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the network traffic prediction method according to any one of claims 1 to 6 is implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the network traffic prediction method according to any one of claims 1 to 6 is implemented.

Images