A knowledge graph-based analysis method for network capacity health

Abstract

The present invention discloses a method for analyzing the health of network capacity based on a knowledge graph, which relates to the technical field of network health analysis. The method includes: determining a data source and collecting data on the number of alarm links of a scoring item; constructing a knowledge graph according to an alarm rule; using a graph neural network model to perform weighted calculation for model training; and obtaining a network capacity health score. The present invention constructs a knowledge graph ontology based on the alarm rules of the alarm rule scenario, and uses a GNN graph neural network model to perform weighted calculation for model training, and finally comprehensively and accurately analyzes the true situation of the health of the network capacity.

Description

Technical Field

[0001] The present invention relates to the technical field of network health analysis, and in particular to a method for analyzing network capacity health based on a knowledge graph. Background Art

[0002] In the existing network capacity process evaluation methods, basic dimensions such as capacity assessment, anomaly detection, and performance evaluation are usually used to deduce the health status of network capacity.

[0003] The Chinese invention patent with publication number CN112565007A discloses a system health evaluation method and device, which includes: planning the evaluation object category, defining the evaluation object, defining the evaluation dimension, defining the evaluation item, defining the scoring template, defining the evaluation cycle, executing the evaluation, outputting the evaluation results and visualizing the evaluation results. The method and device achieve unified health evaluation of devices and systems in the network by constructing a multi-dimensional and flexibly expandable health evaluation model, which facilitates managers and optimization personnel to conveniently and efficiently grasp the health status of the network, system and equipment, thereby improving the network service quality and overall network security of the entire network.

[0004] However, these methods are often only applicable to the general network capacity health, and cannot fully and accurately reflect the true situation of network capacity health under special alarm rules. Therefore, it is necessary to develop a network capacity process anomaly evaluation and analysis method based on knowledge graph to more accurately reflect the network capacity health. Summary of the invention

[0005] In view of the problems existing in the prior art, the present invention provides a method for analyzing the health of network capacity based on a knowledge graph.

[0006] To achieve the above purpose, the technical solution adopted by the present invention is as follows:

[0007] A method for analyzing the health of network capacity based on a knowledge graph comprises the following steps: step 1, determining the data source and collecting the number of alarm links of the scoring item; step 2, constructing a knowledge graph according to the alarm rule; step 3, using a graph neural network model to perform weighted calculation for model training; the calculation process is: step 31, setting weights; step 32, setting a 100-point indicator link number threshold; step 33, setting a non-deductible indicator link number threshold; step 34, setting a full deduction value; step 35, calculating the alarm link deduction value; step 36, calculating the link weighted deduction value; step 37, calculating the full deduction value after weighting; step 4, obtaining a network capacity health score.

[0008] Based on the above technical solution, further, in step 1, the data source of the number of alarm links of the scoring item is: according to the 5-minute granularity table data of the real-time single-link alarm information, when the alarm type is an over-limit link alarm, the over-limit link needs to determine the corresponding range based on the link peak utilization, and count the corresponding number of alarm links; according to the 5-minute granularity table data of the real-time single-link alarm information, when the alarm type is other 5-minute granularity alarms, the number of alarm links is counted according to the corresponding alarm type; according to the day granularity table data of the real-time single-link alarm information, the number of alarm links is counted according to the corresponding alarm type, and when the alarm type is a link load imbalance alarm, the number of alarm link groups is counted.

[0009] Based on the above technical solution, further, in step 2, the construction process is: step 21, define entities and attributes; step 22, define relationships; step 23, extract knowledge from alarm rules to form a knowledge graph.

[0010] Based on the above technical solution, further, in step 2, the alarm rules include at least link over-limit alarm rules, link sudden increase or decrease alarm rules, link zero traffic alarm rules, link peak clipping alarm rules, link load imbalance alarm rules, link weekly year-on-year alarm rules, and link daily year-on-year alarm rules.

[0011] Based on the above technical solution, further, in step 2, the link over-limit alarm rule is: if the link peak utilization falls within the set over-limit level range, an over-limit alarm record is made for the link; the link sudden increase or drop alarm rule is: if the absolute value of the difference between the peak utilization of the link (A time) and the peak utilization of the previous 5-minute granularity link (B time) exceeds 20%, and the peak utilization of the link (B time) is exceeded by more than 20% for three consecutive granularities, a sudden increase / drop alarm record is made for the link; the link zero flow alarm rule is: if the peak utilization of the link (A time) suddenly changes to 0% compared with the peak utilization of the previous 5-minute granularity link (B time), and the peak utilization remains at 0% for three consecutive granularities, a zero flow alarm record is made for the link (B time); the link peak clipping alarm rule is: if the peak utilization of the link (A time) exceeds 95% or more , and three consecutive granularities exceed the peak utilization of the link (A time) between 0% and 2%, then a peak shaving alarm record is made for the link (A time); the link load imbalance alarm rule is: the absolute value of the difference between the peak utilization polling comparisons of all links under the same link group, if the absolute value of the difference between two or more links exceeds 10%, then a load imbalance alarm record is made for the links of the link group; the link weekly year-on-year alarm rule is: if the absolute value of the difference between the peak utilization of the link (A time) and the peak utilization of the link (B time) on the same day last week with a daily granularity exceeds 20%, then a weekly year-on-year alarm record is made for the link (A time); the link daily year-on-year alarm rule is: if the absolute value of the difference between the peak utilization of the link (A time) and the peak utilization of the link (B time) with the previous day granularity exceeds 20%, then a daily year-on-year alarm record is made for the link (A time).

[0012] Based on the above technical solution, further, in step 31, the weight corresponding to the over-limit link peak utilization of (50%-70%) is 3%; the weight corresponding to the link load imbalance is 3%; the weight corresponding to the link weekly year-on-year alarm is 3%; the weight corresponding to the link daily year-on-year alarm is 3%; the weight corresponding to the over-limit link peak utilization of (70%-80%) is 10%; the weight corresponding to the link sudden increase or decrease alarm is 9%; the weight corresponding to the link peak clipping alarm is 9%; the weight corresponding to the over-limit link peak utilization of (80%-90%) is 15%; the weight corresponding to the link zero traffic alarm is 20%; the weight corresponding to the over-limit link peak utilization of (90%-100%) is 25%.

[0013] Based on the above technical solution, further, in step 32, the threshold value corresponding to the over-limit link peak utilization of (50%-70%) is 300; the threshold value corresponding to the link load imbalance is 10; the threshold value corresponding to the link weekly year-on-year alarm is 50; the threshold value corresponding to the link daily year-on-year alarm is 50; the threshold value corresponding to the over-limit link peak utilization of (70%-80%) is 20; the threshold value corresponding to the link sudden increase or decrease alarm is 20; the threshold value corresponding to the link peak clipping alarm is 20; the threshold value corresponding to the over-limit link peak utilization of (80%-90%) is 20; the threshold value corresponding to the link zero traffic alarm is 10; the threshold value corresponding to the over-limit link peak utilization of (90%-100%) is 10.

[0014] Based on the above technical solution, further, in step 33, the threshold corresponding to the over-limit link peak utilization of (50%-70%) is 50; the threshold corresponding to the link load imbalance is 0; the threshold corresponding to the link weekly year-on-year alarm is 0; the threshold corresponding to the link daily year-on-year alarm is 0; the threshold corresponding to the over-limit link peak utilization of (70%-80%) is 0; the threshold corresponding to the link sudden increase or decrease alarm is 0; the threshold corresponding to the link peak clipping alarm is 0; the threshold corresponding to the over-limit link (80%-90%) is 0; the threshold corresponding to the link zero traffic alarm is 0; the threshold corresponding to the over-limit link peak utilization of (90%-100%) is 0.

[0015] Based on the above technical solution, further, in step 34, the full deduction value corresponding to the over-limit link peak utilization rate of (50%-70%) is 10; the full deduction value corresponding to the link load imbalance is 10; the full deduction value corresponding to the link weekly year-on-year alarm is 10; the full deduction value corresponding to the link daily year-on-year alarm is 10; the full deduction value corresponding to the over-limit link peak utilization rate of (70%-80%) is 10; the full deduction value corresponding to the link sudden increase or decrease alarm is 10; the full deduction value corresponding to the link peak clipping alarm is 10; the full deduction value corresponding to the over-limit link peak utilization rate of (80%-90%) is 10; the full deduction value corresponding to the link zero traffic alarm is 10; the full deduction value corresponding to the over-limit link peak utilization rate of (90%-100%) is 10.

[0016] Based on the above technical solution, further, in step 4, the scoring process is:

[0017] Case 1: When the number of alarm links of the scoring item is less than the threshold number of links of the non-deductible indicator, the scoring item score = 0;

[0018] The second case: When the number of alarm links of the scoring item is greater than the 100-point indicator link number threshold, the scoring item score = the full deduction value after weighting;

[0019] Other cases: Scoring item score = (number of scoring item alarm links - threshold number of links without deduction indicator) × link weighted deduction value.

[0020] Compared with the prior art, the present invention has the following beneficial effects:

[0021] (1) The present invention provides a method for comprehensively and accurately analyzing the health of network capacity. According to the alarm rules of the alarm rule scenario, a knowledge graph ontology is constructed, and a GNN graph neural network model is used to perform model training weighted calculation, ultimately comprehensively and accurately analyzing the actual situation of the network capacity health.

[0022] (2) The evaluation method of the present invention can more accurately meet the application scenarios of network capacity evaluation by associating link over-limit alarm, link sudden increase / drop alarm, link zero traffic alarm, link peak shaving alarm, link load imbalance, link week-on-week alarm, and link day-on-day alarm rules. A knowledge graph is established based on the alarm rules, a graph data structure is constructed, and a graph data algorithm is used to perform model training and weighted calculation, and finally a network capacity health score is calculated, making the network capacity health score more accurate and rigorous, and strongly associated with actual business. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 The figure is a flowchart of the method of the present invention. DETAILED DESCRIPTION

[0024] The present invention is further described and illustrated below in conjunction with the accompanying drawings and specific embodiments. The technical features of each embodiment of the present invention can be combined accordingly without conflicting with each other.

[0025] In order to make the above-mentioned purpose, features and advantages of the present invention more obvious and easy to understand, the specific implementation mode of the present invention is described in detail below in conjunction with the accompanying drawings. In the following description, many specific details are set forth to facilitate a full understanding of the present invention. However, the present invention can be implemented in many other ways different from those described herein, and those skilled in the art can make similar improvements without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below. The technical features in each embodiment of the present invention can be combined accordingly without conflicting with each other.

[0026] Example 1

[0027] This embodiment provides a network capacity process anomaly evaluation and analysis method based on a knowledge graph, comprising the following steps:

[0028] Step 1: Determine the data source and collect the number of alarm links of the scoring item; specifically, the process is as follows:

[0029] 1. According to the 5-minute granularity table data of the real-time single-link alarm information, when the alarm type is "over-limit link alarm", the over-limit link needs to determine the corresponding range based on the link peak utilization, and count the corresponding alarm link number.

[0030] 2. According to the 5-minute granularity table data of the real-time single-link alarm information, when the alarm type is other 5-minute granularity alarm, the number of alarm links is counted according to the corresponding alarm type.

[0031] 3. According to the daily granularity table data of the real-time single-link alarm information, the number of alarm links is counted according to the corresponding alarm type. When the alarm type is "link load imbalance alarm", the number of alarm link groups is counted.

[0032] Step 2: Build a knowledge graph based on the alarm rules;

[0033] 1. Define entities and attributes. Define the network capacity process network link as a node entity, and define the attributes of the link entity as follows: monitoring event, alarm type, data granularity, egress, office direction, link group, link, bandwidth, cumulative alarm number, and latest alarm time.

[0034] 2. Define relationships. Establish associations between entities and dependencies between attributes based on alarm rules. In this embodiment, the alarm rules at least include link overlimit alarm rules, link sudden increase or drop alarm rules, link zero traffic alarm rules, link peak shaving alarm rules, link load imbalance alarm rules, link week-on-week alarm rules, and link day-on-day alarm rules.

[0035] Specifically, the link over-limit alarm rule is: if the link peak utilization falls within the set over-limit level range, an over-limit alarm record is made for the link.

[0036] The link sudden increase or decrease alarm rule is: if the difference (absolute value) between the peak utilization of the link (A time) and the peak utilization of the link (B time) at the previous 5-minute granularity exceeds 20%, and the peak utilization of the link (B time) for three consecutive granularities (including the link (A time)) exceeds 20%, then a sudden increase / drop alarm record will be made for the link.

[0037] The link zero traffic alarm rule is: if the peak utilization of the link (A time) suddenly changes to 0% compared with the peak utilization of the link (B time) at the previous 5-minute granularity, and the peak utilization remains at 0% for 3 consecutive granularities (including the link (A time)), a zero traffic alarm record will be made for the link (B time).

[0038] The link peak clipping alarm rule is: if the peak utilization of the link (A time) exceeds 95%, and three consecutive granularities (including the link (A time)) exceed the peak utilization of the link (A time) between 0% and 2%, then a peak clipping alarm record will be made for the link (A time).

[0039] The link load imbalance alarm rule is: the peak utilization polling comparison difference (absolute value) of all links under the same link group of link (A time) is greater than 10% if there are more than two links with a difference (absolute value) of more than 10%, then a load imbalance alarm record will be made for the links in the link group.

[0040] The link weekly year-on-year alarm rule is: if the difference (absolute value) between the peak utilization of the link (A time) and the peak utilization of the link (B time) on the same day last week (for example: this Monday compared with last Monday) exceeds 20%, a weekly year-on-year alarm record will be made for the link (A time).

[0041] The daily link comparison alarm rule is: if the difference (absolute value) between the peak utilization of the link (time A) and the peak utilization of the link (time B) of the previous day exceeds 20%, a daily link comparison alarm record will be made for the link (time A).

[0042] 3. Extract knowledge from alarm rules to form a knowledge graph. Use natural language processing (NLP) technology to extract entity, attribute and relationship information from alarm rules.

[0043] Step 3: Use the graph neural network model to perform weighted calculation for model training;

[0044] Specifically, the graph neural network model is an autoencoder network with a graph convolutional layer, and its reconstruction error is the abnormality score of the node. Given an input dataset X, the encoder Enc(·) first maps the data to a latent low-dimensional feature space, and then the decoder Dec(·) tries to restore the original data based on the latent data. The learning process can be described as minimizing the following loss function: min E[dist(X,Dec(Enc(X)))].

[0045] In this embodiment, the process of weighted calculation of the graph neural network model is as follows:

[0046] Step 31, set weights; in this embodiment, the weights corresponding to the various scoring items are: the weight corresponding to the peak utilization rate of the over-limit link is (50%-70%) is 3%; the weight corresponding to the link load imbalance is 3%; the weight corresponding to the link week-on-week alarm is 3%; the weight corresponding to the link day-on-day alarm is 3%; the weight corresponding to the peak utilization rate of the over-limit link is (70%-80%) is 10%; the weight corresponding to the link sudden increase or drop alarm is 9%; the weight corresponding to the link peak clipping alarm is 9%; the weight corresponding to the peak utilization rate of the over-limit link is (80%-90%) is 15%; the weight corresponding to the link zero flow alarm is 20%; the weight corresponding to the peak utilization rate of the over-limit link is (90%-100%) is 25%. It should be noted that the over-limit link needs to determine the corresponding range and weight according to the link peak utilization rate.

[0047] Step 32, set the 100-point indicator link number threshold; specifically, the 100-point indicator link number threshold corresponding to the scoring item is as shown in Table 1 below. It should be noted that the over-limit link needs to determine the corresponding range and weight based on the link peak utilization.

[0048] Table 1

[0049]

[0050]

[0051] Step 33, set the threshold of the number of links of the non-deductible indicator; specifically, the threshold of the number of links of the non-deductible indicator corresponding to the scoring items is as shown in Table 2 below. It should be noted that the corresponding range and weight of the over-limit link need to be determined according to the peak utilization rate of the link.

[0052] Table 2

[0053]

[0054] Step 34, set the full deduction value; specifically, the full deduction values ​​corresponding to the scoring items are shown in Table 3 below. It should be noted that the over-limit link needs to determine the corresponding range and weight based on the link peak utilization.

[0055] Table 3

[0056]

[0057]

[0058] Step 35, calculate the deduction value of the alarm link; the specific calculation formula is: full deduction value / (100-point indicator link number threshold-no deduction indicator link number threshold);

[0059] Step 36, calculate the weighted deduction value of the link; the specific calculation formula is: alarm link deduction value × weight;

[0060] Step 37, calculate the full deduction value after weighting; the specific calculation formula is: full deduction value × weight.

[0061] Step 4: Get the network capacity health score. Specifically, the final score calculation method is:

[0062] Case 1: When the number of alarm links of the scoring item is less than the threshold number of links of the non-deductible indicator, the scoring item score = 0;

[0063] The second case: When the number of alarm links of the scoring item is greater than the 100-point indicator link number threshold, the scoring item score = the full deduction value after weighting;

[0064] Other cases: Scoring item score = (number of scoring item alarm links - threshold of number of links without penalty indicator) × weighted penalty value of link. The larger the score, the healthier the link status, and the more stable and reliable the overall network.

[0065] Finally, it should be noted that the above content is only used to illustrate the technical solution of the present invention, rather than to limit the scope of protection of the present invention. Simple modifications or equivalent substitutions of the technical solution of the present invention by ordinary technicians in this field do not deviate from the essence and scope of the technical solution of the present invention.

Claims

1. A method for analyzing network capacity health based on knowledge graph, characterized in that: The following steps are involved: Step 1: Determine the data source and collect the number of alarm links of the scoring item; Step 2: Build a knowledge graph based on the alarm rules; Step 3: Use the graph neural network model to perform weighted calculation for model training; The calculation process is: Step 31, setting weights; Step 32, setting a 100-point index link number threshold; Step 33, setting the threshold of the number of links for which no points are deducted; Step 34, set the full deduction value; Step 35, calculating the deduction value of the alarm link; Step 36, calculating the link weighted deduction value; Step 37, calculate the weighted full deduction value; Step 4: Get the network capacity health score.

2. According to claim 1, a method for analyzing network capacity health based on knowledge graph is characterized in that: In step 1, the data source of the number of alarm links in the scoring item is: According to the 5-minute granularity table data of the real-time single-link alarm information, when the alarm type is an over-limit link alarm, the over-limit link needs to determine the corresponding range based on the link peak utilization rate, and count the corresponding alarm links; According to the 5-minute granularity table data of real-time single-link alarm information, when the alarm type is other 5-minute granularity alarm, the number of alarm links is counted according to the corresponding alarm type; According to the daily granularity table data of the real-time single-link alarm information, the number of alarm links is counted according to the corresponding alarm type. When the alarm type is a link load imbalance alarm, the number of alarm link groups is counted.

3. According to claim 1, a method for analyzing network capacity health based on knowledge graph, characterized in that: In step 2, the construction process is: Step 21, define entities and attributes; Step 22: Define the relationship. Step 23: Extract knowledge from the alarm rules to form a knowledge graph.

4. According to claim 1, a method for analyzing network capacity health based on knowledge graph, characterized in that: In step 2, the alarm rules include at least link over-limit alarm rules, link sudden increase or decrease alarm rules, link zero traffic alarm rules, link peak shaving alarm rules, link load imbalance alarm rules, link week-on-week alarm rules, and link day-on-day alarm rules.

5. According to claim 4, a method for analyzing network capacity health based on knowledge graph is characterized in that: In step 2, the link over-limit alarm rule is: if the link peak utilization falls within the set over-limit level range, an over-limit alarm record is made for the link; The rule for link sudden increase or decrease alarm is: if the absolute value of the difference between the link peak utilization and the link peak utilization of the previous 5-minute granularity exceeds 20%, and the link peak utilization exceeds 20% for three consecutive granularities, a sudden increase / drop alarm record will be made for the link; The link zero traffic alarm rule is: if the link peak utilization rate suddenly changes to 0% compared with the previous 5-minute granularity link peak utilization rate, and the peak utilization rate remains at 0% for three consecutive granularities, a zero traffic alarm record will be made for the link; The link peak shaving alarm rule is: if the link peak utilization exceeds 95% and the link peak utilization exceeds 0% to 2% for three consecutive granularities, a peak shaving alarm record will be made for the link; The link load imbalance alarm rule is: the absolute value of the peak utilization rate of all links in the same link group is compared and compared. If the absolute value of the difference between two or more links exceeds 10%, a load imbalance alarm record will be made for the links in the link group. The link week-on-week alarm rule is: if the absolute value of the difference between the link peak utilization rate and the link peak utilization rate on the same day last week at the year-on-day granularity exceeds 20%, a week-on-week alarm record will be made for the link; The daily link comparison alarm rule is: if the absolute value of the difference between the peak utilization of the link and the peak utilization of the link at the previous day granularity exceeds 20%, a daily link comparison alarm record will be made for the link.

6. According to claim 1, a method for analyzing network capacity health based on knowledge graph, characterized in that: In step 31, when the peak utilization of the over-limit link is 50%-70%, the corresponding weight is 3%; The weight corresponding to the link load imbalance is 3%; the weight corresponding to the link weekly year-on-year alarm is 3%; The weight corresponding to the link daily month-on-month alarm is 3%; the corresponding weight when the peak utilization of the over-limit link is 70%-80% is 10%; the weight corresponding to the link sudden increase or decrease alarm is 9%; the weight corresponding to the link peak clipping alarm is 9%; the weight corresponding to the link peak utilization when the over-limit link is 80%-90% is 15%; the weight corresponding to the link zero traffic alarm is 20%; the weight corresponding to the link peak utilization when the over-limit link is 90%-100% is 25%.

7. According to claim 1, a method for analyzing network capacity health based on knowledge graph, characterized in that: In step 32, when the peak utilization of the over-limit link is 50%-70%, the corresponding threshold is 300; the threshold corresponding to the link load imbalance is 10; The threshold corresponding to the link weekly year-on-year alarm is 50; the threshold corresponding to the link daily year-on-year alarm is 50; the threshold corresponding to the link peak utilization exceeding the limit is 70%-80% is 20; the threshold corresponding to the link sudden increase or decrease alarm is 20; the threshold corresponding to the link peak clipping alarm is 20; the threshold corresponding to the link peak utilization exceeding the limit is 80%-90% is 20; the threshold corresponding to the link zero traffic alarm is 10; the threshold corresponding to the link peak utilization exceeding the limit is 90%-100% is 10.

8. According to claim 1, a method for analyzing network capacity health based on knowledge graph, characterized in that: In step 33, when the peak utilization rate of the over-limit link is 50%-70%, the corresponding threshold is 50; the threshold value corresponding to the link load imbalance is 0; the threshold value corresponding to the link week-on-week alarm is 0; the threshold value corresponding to the link day-on-day alarm is 0; when the peak utilization rate of the over-limit link is 70%-80%, the corresponding threshold value is 0; the threshold value corresponding to the link sudden increase or decrease alarm is 0; the threshold value corresponding to the link peak clipping alarm is 0; when the peak utilization rate of the over-limit link is 80%-90%, the corresponding threshold value is 0; the threshold value corresponding to the link zero flow alarm is 0; when the peak utilization rate of the over-limit link is 90%-100%, the corresponding threshold value is 0.

9. According to claim 1, a method for analyzing network capacity health based on knowledge graph, characterized in that: In step 34, when the peak utilization rate of the over-limit link is 50%-70%, the corresponding full deduction value is 10; the corresponding full deduction value for the link load imbalance is 10; the corresponding full deduction value for the link weekly year-on-year alarm is 10; the corresponding full deduction value for the link daily year-on-year alarm is 10; when the peak utilization rate of the over-limit link is 70%-80%, the corresponding full deduction value is 10; the corresponding full deduction value for the link sudden increase or decrease alarm is 10; the corresponding full deduction value for the link peak clipping alarm is 10; when the peak utilization rate of the over-limit link is 80%-90%, the corresponding full deduction value is 10; the corresponding full deduction value for the link zero traffic alarm is 10; when the peak utilization rate of the over-limit link is 90%-100%, the corresponding full deduction value is 10.

10. The method for analyzing network capacity health based on knowledge graph according to claim 1, characterized in that: In step 4, the scoring process is: Case 1: When the number of alarm links of the scoring item is less than the threshold number of links of the non-deductible indicator, the scoring item score = 0; The second case: When the number of alarm links of the scoring item is greater than the 100-point indicator link number threshold, the scoring item score = the full deduction value after weighting; Other cases: Scoring item score = (number of scoring item alarm links - threshold number of links without deduction indicator) × link weighted deduction value.

Images