Network abnormality diagnosis system, operation and maintenance management equipment and network diagnosis method thereof

Abstract

The invention discloses a network anomaly diagnosis system, operation and maintenance management equipment and a network diagnosis method thereof. According to the network diagnosis method, a network diagnosis model is used for detecting log data, the network diagnosis model is trained by using a log data set provided by the GAN neural network model trained by the method for training the GAN neural network model, and the method for training the GAN neural network model comprises the steps of obtaining data; performing data enhancement on the data by using a GAN neural network model, and outputting virtual data; and selecting important data with important features in the virtual data, and performing data synthesis on the important data through a loss function to realize sample enhancement of the important data.

Description

Technical Field

[0001] The present invention relates to the field of operation and maintenance management technology, and in particular to a network anomaly diagnosis system, operation and maintenance management equipment and a network diagnosis method thereof. Background Art

[0002] In today's highly computer network-dependent environment, network anomalies may lead to serious consequences. Therefore, it is necessary to detect, locate, analyze and evaluate abnormal behaviors, performance degradation, failures and other problems in computer networks through a series of technical means and methods. However, for network anomaly diagnosis scenarios, collecting anomaly log data required for diagnosis is an extremely difficult, time-consuming and labor-intensive project, making it difficult to obtain sufficient anomaly log data for machine learning and / or deep learning training.

[0003] In addition, the current network anomaly detection method only focuses on existing abnormal cases and samples, and cannot effectively perceive and detect unknown, sample-free, or rare abnormal events. That is, the abnormal log data samples are unbalanced, resulting in a lack of effective data support for precise performance optimization and intelligent fault management.

[0004] Therefore, the technical problem to be solved by the present invention is to solve the problem of small number of abnormal log data samples and incomplete types, and to provide support for accurate detection and prediction of network anomalies that have not occurred or rarely occurred. Summary of the invention

[0005] The object of the present invention is to provide a network anomaly diagnosis system, operation and maintenance management equipment and network diagnosis method thereof. The network diagnosis method detects abnormal events corresponding to log data through a network diagnosis model, and the network diagnosis model is trained using a log data set provided by a GAN neural network model trained by the present invention, so that the network diagnosis model finally trained can perfectly predict various abnormal events and attack types.

[0006] According to one aspect of the present invention, at least one embodiment provides a method for training a GAN neural network model, including: acquiring data; performing data enhancement on the data using a GAN network and outputting virtual data; selecting important data with important features in the virtual data, and performing data synthesis on the important data through a loss function to achieve sample enhancement of the important data. It can be seen that the GAN neural network model provides a solution for data enhancement of a variety of abnormal log data: by increasing the number of samples of abnormal log data to balance the log data set, it can not only generate abnormal log data with a large number of samples and a full range of types, but also effectively solve the problem of insufficient number and type of abnormal log data samples.

[0007] According to another aspect of the present invention, at least one embodiment also provides a network diagnosis method, including: obtaining log data; using a network diagnosis model to detect the log data, and detecting abnormal events corresponding to the log data, wherein the network diagnosis model is trained using a log data set provided by a GAN neural network model trained by the method for training a GAN neural network model developed by the present invention, and the GAN neural network model balances the log data set by increasing the number of samples of abnormal log data.

[0008] According to another aspect of the present invention, at least one embodiment also provides an operation and maintenance management device, including: a processor, suitable for implementing various instructions; and a memory, suitable for storing multiple instructions, wherein the instructions are suitable for being loaded and executed by the processor: the method for training the GAN neural network model developed by the present invention, and / or the network diagnosis method developed by the present invention.

[0009] According to another aspect of the present invention, at least one embodiment further provides a network anomaly diagnosis system, including: an operation and maintenance management device developed by the present invention.

[0010] According to another aspect of the present invention, at least one embodiment further provides a computer-readable non-volatile storage medium storing computer program instructions, and when the computer executes the program instructions, it executes: the method for training the GAN neural network model developed by the present invention, and / or the network diagnosis method developed by the present invention.

[0011] In view of the fact that the GAN neural network model performs data expansion on data sets with uneven sample distribution, it is a widely used data enhancement method for deep learning. However, the traditional GAN ​​neural network model is only suitable for the enhancement of image and text data, and has a poor effect on the enhancement of abnormal data. The GAN neural network model is improved by the above-mentioned implementation method of the present invention, and important features are screened based on the feature recursive elimination algorithm, focusing on several features, strengthening the processing of local features, and enhancing the fitting effect of the GAN neural network model for local features. Then, the network diagnosis model has enough log data sets for training, so as to achieve the beneficial effect of perfect prediction of various abnormal events and attack types by the operation and maintenance management equipment. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings in the following description are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0013] Figure 1 is a schematic diagram of a network anomaly diagnosis system according to an embodiment of the present invention;

[0014] Figure 2 is a schematic diagram of an operation and maintenance management device according to an embodiment of the present invention;

[0015] Figure 3 is a flow chart of a network diagnosis method according to an embodiment of the present invention;

[0016] Figure 4 is a flow chart of a method for training a GAN neural network model according to an embodiment of the present invention;

[0017] Figure 5 A schematic diagram of the generator operation according to an embodiment of the present invention;

[0018] Figure 6 A schematic diagram of the discriminator according to an embodiment of the present invention;

[0019] Figure 7 A schematic diagram of the working of a classifier according to an embodiment of the present invention;

[0020] Figure 8 DDoS abnormal data comparison diagram according to an embodiment of the present invention [left: original data (CICIDS2017 dataset), right: enhanced data];

[0021] Fig. 9 This is a comparison diagram of DoS Hulk abnormal data according to an embodiment of the present invention [left: original data (CICIDS2017 dataset), right: enhanced data]. DETAILED DESCRIPTION

[0022] The technical solution of the present invention will be described clearly and completely below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0023] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0024] At present, the network anomaly detection method lacks effective data support for accurate performance optimization and intelligent fault management due to the imbalance of abnormal log data samples. When processing unbalanced abnormal log data, the oversampling method is generally used, that is, balancing the abnormal log data set (referred to as "data set") by increasing the number of samples of the minority class data set to improve the processing effect of the unbalanced data set. Among them, the SMOTE (FINCH Synthetic Minority Oversampling Technique) algorithm is one of the oversampling algorithms. It has conducted data-level research on unbalanced data sets and achieved good results. As an improved SMOTE method, the FSMOTE method uses the nearest neighbor efficient parameter-free clustering algorithm and the multi-layer perceptron combined with the SMOTE algorithm to rebalance the network traffic data set, ultimately achieving the effect of improving network anomaly detection.

[0025] The above oversampling methods all have certain defects: if the selected minority class samples are surrounded by minority class samples, the newly synthesized samples will not provide much useful information; if the selected minority class samples are surrounded by majority class samples, such samples may be noise, then the newly synthesized samples will have a large overlap with the surrounding majority class samples, making classification difficult.

[0026] In view of the wide application of deep learning in the fields of image recognition, text processing, anomaly detection, etc., in order to solve the problem of insufficient abnormal log data (or abnormal alarm log data), at least one embodiment of the present invention provides a network anomaly diagnosis system, such as Figure 1 As shown, the network anomaly diagnosis system includes: an operation and maintenance management device 100 and a computer network 200. There is a communication link between the operation and maintenance management device 100 and the computer network 200, and this link can be established based on Ethernet, Wi-Fi or other network protocols. The operation and maintenance management device 100 operates the computer network 200 through corresponding instructions, so that the network traffic and log data of the devices in the computer network 200 can be collected and the faults of the devices in the computer network 200 can be checked.

[0027] The operation and maintenance management device 100, such as Figure 2 As shown, it includes: a processor 202, suitable for implementing various instructions; and a memory 204, suitable for storing multiple instructions, and the instructions are suitable for being loaded and executed by the processor 202: the method for training the GAN neural network model developed by the present invention, and / or, the network diagnosis method developed by the present invention (this article will be elaborated in detail later and will not be repeated here).

[0028] The processor 202 may be any suitable processor, for example, implemented in the form of a central processing unit, a microprocessor, an embedded processor, etc., and may adopt an architecture such as X86, ARM, etc.

[0029] Among them, the memory 204 can be various applicable storage devices, such as non-volatile storage devices, including but not limited to magnetic storage devices, semiconductor storage devices, optical storage devices, etc., and can be arranged as a single storage device, a storage device array or a distributed storage device, and the embodiments of the present invention do not limit these. Optionally, corresponding to the memory 204, at least one embodiment of the present invention also provides a computer-readable non-volatile storage medium that stores computer program instructions. When the computer executes the program instructions, it executes: the method for training the GAN neural network model developed by the present invention, and / or the network diagnosis method developed by the present invention (this article will be elaborated in detail later, so it will not be repeated here).

[0030] Those skilled in the art will appreciate that the above structure of the operation and maintenance management device 100 is only for illustration and does not limit the structure of the operation and maintenance management device 100. Figure 2 The transmission device is used to receive or send data via a network. In one embodiment, the transmission device is a radio frequency (RF) module, which is used to communicate with the computer network 200 wirelessly.

[0031] The computer network 200 is composed of multiple computer devices and communication links. These computer devices include servers, clients (such as personal computers, smart phones), routers, switches, etc., which are connected together by wired (such as Ethernet cables) or wirelessly, with the purpose of realizing resource sharing and information exchange. The wireless method includes but is not limited to: wide area network, metropolitan area network, local area network or mobile data network. Typically, the mobile data network includes but is not limited to: global mobile communication (GSM) network, code division multiple access (CDMA) network, wideband code division multiple access (WCDMA) network, long-term evolution (LTE) communication network, WIFI network, ZigBee network, network based on Bluetooth technology, etc. Different types of communication networks may be operated by different operators. The type of communication network does not constitute a limitation on the embodiments of the present invention.

[0032] Among them, servers, clients (such as personal computers, smart phones), routers, switches, etc. will generate logs to record the operation, events and error information of the devices. Therefore, the operation and maintenance management device 100 of the present invention can accurately detect and predict network anomalies by monitoring and analyzing the log data of the computer network 200.

[0033] Through the above-mentioned implementation mode of the present invention, a trained GAN neural network model is installed on the operation and maintenance management device (the model can perform data enhancement on abnormal log data), and the operation and maintenance management device is used to monitor and analyze the log data of the computer network, which can perfectly predict various abnormal events and attack types in the computer network.

[0034] In the above-mentioned hardware and software environment, at least one embodiment of the present invention provides a network diagnosis method, which is applicable to the operation and maintenance management device 100, such as Figure 3 It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although the logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in a different order than here. The network diagnosis method may include the following steps:

[0035] Step S301, obtaining log data;

[0036] Step S303, using a network diagnostic model to detect log data and detect abnormal events corresponding to the log data, wherein the network diagnostic model is trained using a log data set provided by a GAN neural network model trained by the method for training a GAN neural network model of the present invention, and the GAN neural network model balances the log data set by increasing the number of samples of abnormal log data.

[0037] Through the above-mentioned implementation of the present invention, the GAN neural network model balances the log data set by increasing the number of samples of abnormal log data, so that the network diagnosis model has sufficient log data set for training, thereby achieving the beneficial effect of the operation and maintenance management equipment perfectly predicting various abnormal events and attack types.

[0038] Under the above-mentioned software and hardware environment, at least one embodiment of the present invention provides a method for training a GAN neural network model, which can also be referred to as a method for generating unstructured abnormal data based on GAN (or: a method for generating multiple network abnormal data based on GAN), and can also be referred to as a new GAN network architecture and loss calculation method, which is a network traffic anomaly detection technology. The method for training a GAN neural network model generates abnormal log data (or: some data types with a small proportion), increases the proportion of this part of the data type in the entire log data set, that is, enhances the abnormal log data, and then the network diagnosis model has enough log data sets for training, so as to achieve the beneficial effect of the operation and maintenance management equipment perfectly predicting various abnormal events and attack types. Figure 4 As shown, the method for training the GAN neural network model includes:

[0039] Step S402, obtaining data;

[0040] Step S404, using the GAN neural network model to perform data enhancement on the data and output virtual data;

[0041] Step S406, selecting important data with important features in the virtual data, and performing data synthesis on the important data through a loss function to achieve sample enhancement of the important data.

[0042] Through the above-mentioned implementation mode of the present invention, relying on the generative adversarial network model (GAN neural network model), more data is generated for the original small sample data set (such as abnormal log data set or abnormal alarm log data), and the sample enhancement of unstructured data (such as abnormal log data or abnormal alarm log data) is better achieved, thereby alleviating the problem of insufficient abnormal alarm log data in anomaly detection and correlation analysis.

[0043] In step S402, data is obtained, including but not limited to log data and / or network data with labels and clear real results, which are collectively referred to as data, for example, a data table of log data is obtained.

[0044] In step S404, the data is enhanced using a GAN neural network model to output virtual data. The GAN neural network model includes a generator G, a discriminator D, a classifier C, and a loss function, for example: the data table is segmented to form at least one data matrix; the generator G uses at least one data matrix to generate at least one generated data, and sends the at least one generated data to the discriminator D and the classifier C, wherein the discriminator D discriminates at least one generated data to form a prediction result, and feeds back the discrimination error between the prediction result and the true result to the discriminator D through a first back propagation mechanism; the classifier C distinguishes whether at least one generated data is compatible with the label, and feeds back the classification error between at least one generated data and the label to the classifier C through a second back propagation mechanism; virtual data is generated based on at least one generated data, and the overall loss of the virtual data is fed back to the generator G through a third back propagation mechanism, wherein the overall loss is obtained based on the discrimination error and the classification error.

[0045] The following are examples: Figure 5 , 6 As shown in Figure 7, the present invention divides the data table of the input log data and converts each row of data into a matrix as the input of the GAN neural network model.

[0046] (1) The generator G uses a set of random numbers (or raw data) to generate generated data. At the same time, the loss function in the generator itself (such as ) will evaluate whether the currently generated data is realistic.

[0047] (2) The discriminator D detects the original data and the generated data. The loss function in the discriminator D evaluates whether the current discriminator has a strong discrimination ability. After the discriminator is trained, the prediction for the real data after the last sigmoid layer is 1, and the prediction for the synthetic data is 0; the error between the discriminator's prediction result and the real result is fed back to the generator G through the back-propagation mechanism, which in turn prompts the generator G to make changes to generate more realistic data.

[0048] (3) The loss function in the classifier evaluates whether the current generated data is compatible with the label.

[0049] (4) Finally, false data is generated row by row to synthesize a virtual data table of virtual data. The identification error of the discriminator D and the classification error of the classifier C are fed back to the generator G through the back propagation mechanism.

[0050] In step S406, important data with important features in the virtual data is selected, and data synthesis is performed on the important data through a loss function to achieve sample enhancement of the important data. It can be seen that the important data is abnormal alarm log data, or abnormal log data.

[0051] First, selecting important data with important features in the virtual data may include: sorting the importance of feature information of the virtual data based on a feature recursive elimination algorithm; and selecting important data corresponding to the most important N features from the virtual data, where N is a natural number. For example, sorting the importance of feature information of the virtual data in the synthesized virtual data table based on a feature recursive elimination algorithm, and selecting the most important N features.

[0052] Second, data synthesis of important data through loss functions may include: performing normalization operations on important data based on BatchNorm, adjusting the data distribution of important data to form first data; cleaning the first data to form second data, wherein the second data is label encoded based on One-Hot; performing data synthesis based on the second data to form synthetic data, and correcting the synthetic data through the overall loss function, original loss function, and information loss function corresponding to the overall loss.

[0053] Among them, the overall loss function is α, σ, and β are setting parameters: they adjust the impact of various loss values ​​on the generator C. Represents the loss value of the generated data in the discriminator D: used to avoid the mismatch between the generated features and the generated labels, Represents the loss value of the generated data in the classifier C, Represents the loss value of the generator G itself.

[0054] Among them, l(·) represents the function that returns the label attribute value of the input data, represents the function of the label attribute value generated based on the generated data, remove(·) represents the input feature of removing the label, represents the generated data without labels, C(·) represents the label predicted by the classifier C, and this loss measures the difference between the label of the generated record and the label predicted by the classifier for the record; if there are multiple labels, the classifier neural network can be expanded to perform multi-classification learning to generate a variety of different types of data. in, represents the characteristic standard deviation, Represents the characteristic standard deviation of the vector generated by the real result after passing through the discriminator D, Represents the characteristic standard deviation of the vector generated by the generated data after passing through the discriminator D, Second-order statistics for comparing real results and synthetic data characteristics, First-order statistics used to compare the characteristics of real results and synthetic data, and The real results and synthetic data have statistically the same characteristics.

[0055] Among them, the original loss function is p data (z) is the generated data A prior distribution of Indicates that the generated data z is from its prior distribution Randomly sampled from, x~p data (x) indicates that the real data x is obtained from its prior distribution p data (x) is randomly sampled, G(·) is the function of the generator G, and D(·) is the function of the discriminator D: the output span is [0,1], D(x) = 0 means that the discriminator D classifies the real data x as generated data, x represents the real data, represents the mean of all features in the dataset, It means that we expect the discriminator D to correctly identify the real data x as the real result. It means that we expect the discriminator D to correctly identify the generated data z as the generated result.

[0056] Among them, the information loss function is f represents the features extracted from the last layer of the discriminator D: that is, a high-dimensional vector, Represents the mean of all features in the data set: that is, the centroid of the vector, f x Represents the features of the real data x extracted by the last layer of the discriminator D, Represents the features of the generated data z extracted by the last layer of the discriminator D after being output by the generator G, Represents the mean of the vector generated by the real data x after passing through the discriminator D, Represents the mean or centroid of the vector generated by the generated data z after the generator G passes through the discriminator D. ||.||2 indicates that the L-2 norm (Euclidean norm) is used to measure the difference between two mean features. Is to generate data A prior distribution of First-order statistics used to compare characteristics of real results and synthetic data.

[0057] In addition, the normalization operation, the algorithm flow is as follows: forward propagation Back Propagation Multi-layer gradient back propagation It can be seen that a matrix based on standard deviation is added during the back propagation of each layer of the network using BatchNorm Weight W i If the weight W i Smaller, then is small, so that its standard deviation σ i Smaller, relatively Larger, so Compared to the original W i It is amplified, avoiding the attenuation of gradient; similarly, if the weight W i Larger and easier to get Compared to the original W i The gradient is reduced and the expansion of the gradient is avoided. When adding BatchNorm to the back propagation process, the gradient is less likely to disappear or explode, and the gradient will always remain within a reasonable range. The performance improvement is reflected in the fact that the gradient-based training process can be carried out more effectively, that is, the convergence speed is accelerated and the problem of being unable to train due to gradient disappearance or explosion is alleviated.

[0058] Through the above-mentioned implementation of the present invention, the generator G, the discriminator D, the classifier C, the original loss function, the information loss function, and the overall loss function work together to jointly enhance unstructured data (such as abnormal log data) in terms of data samples and data types. At the same time, based on the feature recursive elimination algorithm, important features are screened, focusing on several features, strengthening the processing of local features, and enhancing the fitting effect of the GAN neural network model on local features.

[0059] The following are examples: Figure 8 , 9As shown, the distribution of the number of attack types in the original data CICIDS2017 data set is very different. The four attack types of BENIGN, DoS Hulk, PortScan, and DdoS account for 99% of the data volume of the entire data set. It is foreseeable that if the data set is used directly to train the machine learning model, the model will eventually have only good prediction results for the above four large-proportion data, but for other data types that only account for 1% of the entire data set, its accuracy is bound to be very low. However, the present invention learns the sequence relationship and characteristics of abnormal log data through a generative adversarial network model, so that the generative adversarial network generates reasonable data and then expands the abnormal data set; relying on the generative adversarial network model, more abnormal alarm log data can be generated in the scenario of a small sample of network anomalies, and data processing is performed on this basis to form a large-scale, highly reliable data set that can be used for deep model training, which can not only generate abnormal log data with a large number of samples and a full range of types, but also effectively solve the problem of insufficient number and type of abnormal log data samples.

[0060] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for training a GAN neural network model, characterized in that: include: Get data; Performing data enhancement on the data using a GAN neural network model to output virtual data; Important data with important features in the virtual data are selected, and data synthesis is performed on the important data through a loss function to achieve sample enhancement of the important data.

2. The method according to claim 1, characterized in that The data is labeled log data with clear real results. The acquired data includes: Get the data table of log data.

3. The method according to claim 2, characterized in that The GAN neural network model includes a generator G, a discriminator D, a classifier C and a loss function. Using the GAN neural network model to perform data enhancement on the data includes: Splitting the data table to form at least one data matrix; The generator G generates at least one generated data using the at least one data matrix, and sends the at least one generated data to the discriminator D and the classifier C, wherein the discriminator D discriminates the at least one generated data to form a prediction result, and feeds back the discrimination error between the prediction result and the true result to the discriminator D through a first back-propagation mechanism; the classifier C distinguishes whether the at least one generated data is compatible with the label, and feeds back the classification error between the at least one generated data and the label to the classifier C through a second back-propagation mechanism; Generate virtual data based on the at least one generated data, and feed back the overall loss of the virtual data to the generator G through a third back-propagation mechanism, wherein the overall loss is obtained based on the identification error and the classification error.

4. The method according to claim 1, characterized in that The important data with important features selected from the virtual data include: The importance of feature information of virtual data is ranked based on feature recursive elimination algorithm; Important data corresponding to the most important N features are selected from the virtual data, where N is a natural number.

5. The method according to claim 4, characterized in that The data synthesis of the important data by using the loss function includes: Performing a normalization operation on the important data based on BatchNorm to adjust the data distribution of the important data to form first data; Cleaning the first data to form second data, wherein the second data is label encoded based on One-Hot; Data synthesis is performed according to the second data to form synthetic data, and the synthetic data is corrected by the overall loss function, the original loss function, and the information loss function corresponding to the overall loss, wherein the overall loss function is α, σ, β are setting parameters, Represents the loss value of the generated data in the discriminator D, Represents the loss value of the generated data in the classifier C, Represents the loss value of the generator G itself. The original loss function is z~p data (z) indicates that the generated data z is from its prior distribution p data (z) is randomly sampled, x~p data (x) indicates that the real data x is obtained from its prior distribution p data (x) is randomly sampled, G(·) is the function of the generator G, D(·) is the function of the discriminator D, Represents the mean of all features in the data set, and the information loss function is f x Represents the features of the real data x extracted by the last layer of the discriminator D, represents the features of the generated data z extracted by the last layer of the discriminator D after being output by the generator G, ||.||2 represents the L-2 norm: used to measure the difference between two mean features, p(z) is the prior distribution of the generated data z, First-order statistics used to compare characteristics of real results and synthetic data.

6. The method according to claim 5, characterized in that: in, Represents a function that returns the label attribute value of the input data. represents the function of the label attribute value generated based on the generated data, remove(·) represents the input feature of the label, remove(G(z)) represents the generated data of the label, and C(·) represents the label predicted by the classifier C; in, represents the characteristic standard deviation, Second-order statistics for comparing real results and synthetic data characteristics, and The real results and synthetic data have statistically the same characteristics.

7. A network diagnosis method, characterized in that: include: Get log data; Use a network diagnostic model to detect the log data and detect abnormal events corresponding to the log data, wherein the network diagnostic model is trained using a log data set provided by a GAN neural network model trained by the method for training a GAN neural network model as described in any one of claims 1 to 6, and the GAN neural network model balances the log data set by increasing the number of samples of abnormal log data.

8. An operation and maintenance management device, characterized in that: include: A processor, suitable for implementing each instruction; and a memory, suitable for storing multiple instructions, wherein the instructions are suitable for being loaded and executed by the processor: a method for training a GAN neural network model as described in any one of claims 1-6, and / or a network diagnosis method as described in claim 7.

9. A network anomaly diagnosis system, characterized in that: include: The operation and maintenance management device as claimed in claim 8.

10. A computer-readable non-volatile storage medium storing computer program instructions, wherein when a computer executes the program instructions, the computer executes: the method for training a GAN neural network model according to any one of claims 1 to 6, and / or the network diagnosis method according to claim 7.

Images