Network anomaly diagnosis system, operation and maintenance management device and network diagnosis method thereof

Abstract

The application discloses a network anomaly diagnosis system, an operation and maintenance management device and a network diagnosis method thereof. The network diagnosis method uses a network diagnosis model to detect log data. The network diagnosis model is trained by using a log data set provided by a GAN neural network model trained by a method for training the GAN neural network model. The method for training the GAN neural network model comprises the following steps: acquiring data; performing data enhancement on the data by using the GAN neural network model, and outputting virtual data; selecting important data with important features from the virtual data, and performing data synthesis on the important data by using a loss function, so as to realize sample enhancement of the important data.

Description

Technical Field

[0001] This invention relates to the field of operation and maintenance management technology, and in particular to a network anomaly diagnosis system, operation and maintenance management equipment, and network diagnosis method thereof. Background Technology

[0002] In today's environment, which heavily relies on computer networks, network anomalies can have serious consequences. Therefore, it is necessary to employ a range of technical means and methods to detect, locate, analyze, and evaluate abnormal behaviors, performance degradation, and faults in computer networks. However, for network anomaly diagnosis scenarios, collecting the necessary anomaly log data is an extremely difficult and time-consuming process, making it challenging to obtain sufficient anomaly log data for machine learning and / or deep learning training.

[0003] In addition, current network anomaly detection methods only target existing anomaly cases and samples. They cannot effectively perceive and detect unknown, unsampled, or infrequent anomaly events. In other words, the anomaly log data samples are unbalanced, resulting in a lack of effective data support for accurate performance optimization and intelligent fault management.

[0004] Therefore, the technical problem to be solved by this invention is to address the issues of insufficient and incomplete abnormal log data samples, and to provide support for the accurate detection and prediction of network anomalies that have not occurred or have occurred infrequently. Summary of the Invention

[0005] The purpose of this invention is to provide a network anomaly diagnosis system, operation and maintenance management equipment, and a network diagnosis method thereof. This network diagnosis method detects abnormal events corresponding to log data using a network diagnosis model. This network diagnosis model is trained using the log dataset provided by the GAN neural network model trained in this invention, so that the final trained network diagnosis model can perfectly predict various abnormal events and attack types.

[0006] According to one aspect of the present invention, at least one embodiment provides a method for training a GAN neural network model, comprising: acquiring data; using a GAN network to perform data augmentation on the data, outputting virtual data; selecting important data with important features from the virtual data, and performing data synthesis on the important data through a loss function to achieve sample augmentation of the important data. It can be seen that this GAN neural network model provides a solution for data augmentation of various abnormal log data: by increasing the number of samples in the abnormal log data to balance the log dataset, it can not only generate abnormal log data with a large number of samples and complete types, but also effectively solve the problem of insufficient sample quantity and type in abnormal log data.

[0007] According to another aspect of the present invention, at least one embodiment also provides a network diagnostic method, comprising: acquiring log data; using a network diagnostic model to detect the log data and detect abnormal events corresponding to the log data, wherein the network diagnostic model is trained using a log dataset provided by a GAN neural network model trained by the method for training GAN neural network models developed in this invention, and the GAN neural network model balances the log dataset by increasing the number of samples of abnormal log data.

[0008] According to another aspect of the present invention, at least one embodiment also provides an operation and maintenance management device, comprising: a processor adapted to implement various instructions; and a memory adapted to store multiple instructions, the instructions being adapted to be loaded and executed by the processor: the method for training a GAN neural network model developed in this invention, and / or the network diagnosis method developed in this invention.

[0009] According to another aspect of the present invention, at least one embodiment also provides a network anomaly diagnosis system, including: the operation and maintenance management equipment developed by the present invention.

[0010] According to another aspect of the present invention, at least one embodiment also provides a computer-readable non-volatile storage medium storing computer program instructions, which, when the computer executes the program instructions, execute: the method for training a GAN neural network model developed in this invention, and / or the network diagnostic method developed in this invention.

[0011] Given that GAN neural network models are widely used in deep learning for data augmentation of unevenly distributed datasets, traditional GAN ​​models are only suitable for image and text data augmentation, and their effect on abnormal data augmentation is poor. This invention improves the GAN neural network model by using a feature recursive elimination algorithm to select important features, focusing on a few features, strengthening the processing of local features, and enhancing the fitting effect of the GAN neural network model on local features. This results in a network diagnostic model with sufficient log dataset for training, achieving the beneficial effect of perfectly predicting various abnormal events and attack types in operation and maintenance management equipment. Attached Figure Description

[0012] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0013] Figure 1 This is a schematic diagram of a network anomaly diagnosis system according to an embodiment of the present invention;

[0014] Figure 2 This is a schematic diagram of the operation and maintenance management equipment according to an embodiment of the present invention;

[0015] Figure 3 This is a flowchart of a network diagnostic method according to an embodiment of the present invention;

[0016] Figure 4 This is a flowchart of a method for training a GAN neural network model according to an embodiment of the present invention;

[0017] Figure 5 A schematic diagram of the generator operation according to an embodiment of the present invention;

[0018] Figure 6 A schematic diagram of the discriminator operation according to an embodiment of the present invention;

[0019] Figure 7 A schematic diagram of the classifier operation according to an embodiment of the present invention;

[0020] Figure 8 Comparison chart of DDoS anomaly data according to an embodiment of the present invention [Left: Original data (CICIDS2017 dataset), Right: Augmented data];

[0021] Figure 9 This is a comparison chart of DoS Hulk anomaly data in an embodiment of the present invention [left: original data (CICIDS2017 dataset), right: augmented data]. Detailed Implementation

[0022] The technical solution of the present invention will now be clearly and completely described with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0023] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0024] Currently, network anomaly detection methods suffer from imbalanced anomaly log data, leading to a lack of effective data support for precise performance optimization and intelligent fault management. When processing imbalanced anomaly log data, oversampling methods are generally used, which involve increasing the number of samples in the minority class dataset to balance the anomaly log dataset (referred to as the "dataset"), thereby improving the processing effect of the imbalanced dataset. Among these, the SMOTE (FINCH Synthetic Minority Oversampling Technique) algorithm is one such oversampling algorithm, which has achieved good results in data-level research on imbalanced datasets. The FSMOTE method, as an improvement on SMOTE, combines the efficient nearest-neighbor parameter-free clustering algorithm with a multilayer perceptron in conjunction with the SMOTE algorithm to rebalance the network traffic dataset, ultimately improving the effectiveness of network anomaly detection.

[0025] The above oversampling methods all have certain drawbacks: if the minority class sample is surrounded by minority class samples, the newly synthesized sample will not provide much useful information; if the minority class sample is surrounded by majority class samples, these samples may be noise, and the newly synthesized sample will have a large overlap with the surrounding majority class samples, making classification difficult.

[0026] Given the wide application of deep learning in image recognition, text processing, and anomaly detection, this invention provides a network anomaly diagnosis system in at least one embodiment to address the problem of insufficient anomaly log data (or anomaly alarm log data). Figure 1 As shown, the network anomaly diagnosis system includes an operation and maintenance management device 100 and a computer network 200. A communication link exists between the operation and maintenance management device 100 and the computer network 200. This link can be established based on Ethernet, Wi-Fi, or other network protocols. The operation and maintenance management device 100 operates the computer network 200 through corresponding instructions, thereby collecting network traffic and log data from devices in the computer network 200 and troubleshooting faults in the devices within the computer network 200.

[0027] The operation and maintenance management equipment is 100, such as Figure 2 As shown, it includes: a processor 202, adapted to implement various instructions; and a memory 204, adapted to store multiple instructions, the instructions being adapted to be loaded and executed by the processor 202: the method for training a GAN neural network model developed in this invention, and / or the network diagnostic method developed in this invention (which will be described in detail later in this paper, and will not be repeated here).

[0028] The processor 202 can be any applicable processor, such as a central processing unit, microprocessor, or embedded processor, and can adopt architectures such as x86 or ARM.

[0029] The memory 204 can be various suitable storage devices, such as non-volatile storage devices, including but not limited to magnetic storage devices, semiconductor storage devices, optical storage devices, etc., and can be arranged as a single storage device, a storage device array, or a distributed storage device. The embodiments of the present invention do not impose any limitations on these. Optionally, corresponding to the memory 204, at least one embodiment of the present invention also provides a computer-readable non-volatile storage medium for storing computer program instructions. When the computer executes the program instructions, it executes: the method for training a GAN neural network model developed in this invention, and / or the network diagnostic method developed in this invention (which will be described in detail later in this paper and will not be repeated here).

[0030] Those skilled in the art will understand that the above-described structure of the operation and maintenance management device 100 is merely illustrative and does not limit the structure of the operation and maintenance management device 100. For example, the operation and maintenance management device 100 may also include components that are more... Figure 2 The diagram shows more or fewer components (such as transmission devices). The aforementioned transmission devices are used to receive or send data via a network. In one example, the transmission device is a radio frequency (RF) module, which is used to communicate wirelessly with computer network 200.

[0031] The computer network 200 comprises multiple computer devices and communication links. These computer devices include servers, clients (such as personal computers and smartphones), routers, switches, etc., which are connected together via wired (e.g., Ethernet cables) or wireless means to achieve resource sharing and information exchange. The wireless means include, but are not limited to, wide area networks (WANs), metropolitan area networks (MANs), local area networks (LANs), or mobile data networks. Typically, the mobile data network includes, but is not limited to, Global System for Mobile Communications (GSM) networks, Code Division Multiple Access (CDMA) networks, Wideband Code Division Multiple Access (WCDMA) networks, Long Term Evolution (LTE) networks, Wi-Fi networks, ZigBee networks, and Bluetooth-based networks. Different types of communication networks may be operated by different operators. The type of communication network does not constitute a limitation on the embodiments of the present invention.

[0032] Logs are generated by servers, clients (such as personal computers and smartphones), routers, and switches to record device operations, events, and error information. Therefore, the operation and maintenance management device 100 of this invention can accurately detect and predict network anomalies by monitoring and analyzing the log data of the computer network 200.

[0033] Through the above embodiments of the present invention, the operation and maintenance management device is equipped with a trained GAN neural network model (which can perform data augmentation on abnormal log data). By using the operation and maintenance management device to monitor and analyze the log data of the computer network, it is possible to perfectly predict various abnormal events and attack types in the computer network.

[0034] In the aforementioned hardware and software environment, at least one embodiment of the present invention provides a network diagnostic method applicable to operation and maintenance management equipment 100, such as... Figure 3 As shown. It should be noted that the steps illustrated in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be performed in a different order than that shown here. This network diagnostic method may include the following steps:

[0035] Step S301: Obtain log data;

[0036] Step S303: Use a network diagnostic model to detect log data and identify abnormal events corresponding to the log data. The network diagnostic model is trained using the log dataset provided by the GAN neural network model trained by the method of training GAN neural network model of the present invention. The GAN neural network model balances the log dataset by increasing the number of abnormal log data samples.

[0037] Through the above-described embodiments of the present invention, the GAN neural network model balances the log dataset by increasing the number of samples of abnormal log data, thereby ensuring that the network diagnostic model has sufficient log dataset for training, achieving the beneficial effect of perfectly predicting various abnormal events and attack types for operation and maintenance management equipment.

[0038] In the aforementioned hardware and software environment, at least one embodiment of this invention provides a method for training a GAN neural network model, which can also be called a GAN-based method for generating unstructured abnormal data (or: a GAN-based method for generating multiple types of network abnormal data), or a novel GAN ​​network architecture and loss calculation method, and is a network traffic anomaly detection technology. This method for training a GAN neural network model generates abnormal log data (or: data types with a small proportion), increasing the proportion of this data type in the entire log dataset, i.e., performing data augmentation on the abnormal log data. This ensures that the network diagnostic model has sufficient log dataset for training, achieving the beneficial effect of perfectly predicting various abnormal events and attack types for operation and maintenance management equipment. Figure 4 As shown, the method for training the GAN neural network model includes:

[0039] Step S402, acquire data;

[0040] Step S404: Use a GAN neural network model to augment the data and output virtual data;

[0041] Step S406: Select important data with important features from the virtual data, and synthesize the important data using a loss function to enhance the sample of the important data.

[0042] Through the above-described embodiments of the present invention, relying on the generative adversarial network model (GAN neural network model), more data is generated from the original small sample dataset (such as anomaly log dataset or anomaly alarm log data), which effectively enhances the samples of unstructured data (such as anomaly log data or anomaly alarm log data), thereby alleviating the problem of insufficient anomaly alarm log data in anomaly detection and correlation analysis.

[0043] In step S402, data is acquired. This data includes, but is not limited to, tagged log data and / or network data with clearly defined true results. All of this data is collectively referred to as "data," for example, acquiring a data table of log data.

[0044] In step S404, a GAN neural network model is used to augment the data and output virtual data. This GAN neural network model includes a generator G, a discriminator D, a classifier C, and a loss function. For example, the data table is segmented to form at least one data matrix; the generator G uses the at least one data matrix to generate at least one piece of generated data and sends it to the discriminator D and the classifier C. The discriminator D discriminates the at least one piece of generated data to form a prediction result and feeds back the discrimination error between the prediction result and the true result to the discriminator D through a first backpropagation mechanism; the classifier C distinguishes whether the at least one piece of generated data matches the label and feeds back the classification error between the at least one piece of generated data and the label to the classifier C through a second backpropagation mechanism; virtual data is generated based on the at least one piece of generated data, and the overall loss of the virtual data is fed back to the generator G through a third backpropagation mechanism, where the overall loss is obtained based on the discrimination error and the classification error.

[0045] Examples are as follows, such as Figure 5 , 6 As shown in Figure 7, the present invention divides the data table of the input log data and converts each row of data into a matrix as the input of the GAN neural network model.

[0046] (1) The generator G uses a set of random numbers (or raw data) to generate generated data. Simultaneously, the generator's own loss function (such as...) It will assess whether the currently generated data is realistic.

[0047] (2) Discriminator D detects both the original and generated data. The loss function in discriminator D evaluates the discriminative power of the current discriminator. After training, the discriminator predicts 1 for real data and 0 for synthetic data after the last sigmoid layer. The error between the discriminator's prediction and the real result is fed back to the generator G through the backpropagation mechanism, which prompts the generator G to make changes to generate more realistic data.

[0048] (3) The loss function in the classifier evaluates whether the currently generated data is suitable for the label.

[0049] (4) Finally, fake data is generated row by row to synthesize a virtual data table of virtual data. The discrimination error of discriminator D and the classification error of classifier C are fed back to generator G through the backpropagation mechanism.

[0050] In step S406, important data with significant features are selected from the virtual data, and data synthesis is performed on the important data using a loss function to enhance the sample of the important data. It can be seen that this important data is the anomaly alarm log data, or anomaly log data.

[0051] First, selecting important data with significant features from the virtual data can include: ranking the importance of feature information in the virtual data based on a feature recursive elimination algorithm; and selecting the important data corresponding to the N most important features from the virtual data, where N is a natural number. For example, ranking the importance of feature information in the virtual data in the synthesized virtual data table based on a feature recursive elimination algorithm, and selecting the N most important features.

[0052] Second, data synthesis of important data through loss functions may include: performing normalization on important data based on BatchNorm to adjust the data distribution of important data to form first data; cleaning the first data to form second data, wherein the second data is labeled and encoded based on One-Hot; synthesizing data based on the second data to form synthetic data, and correcting the synthetic data through the overall loss function corresponding to the overall loss, the original loss function, and the information loss function.

[0053] Wherein, the overall loss function is α, σ, and β are set parameters: they adjust the influence of various loss values ​​on the generator C. The loss value representing the generated data in discriminator D: used to avoid mismatch between generated features and generated labels. This represents the loss value of the generated data in classifier C. This represents the loss value of the generator G itself.

[0054] Where l(·) represents a function that returns the label attribute values ​​of the input data. This represents a function based on the generated data for label attribute values. `remove(·)` represents removing the input features of the label. C represents the generated data after removing the labels, and C(·) represents the label predicted by classifier C. This loss measures the difference between the label of the generated record and the label predicted by the classifier for that record. If there are multiple labels, the classifier neural network can be extended to perform multi-class learning to generate data of various different kinds. in, The standard deviation of the representative characteristic The feature standard deviation of the vector generated after the true result passes through discriminator D. The standard deviation of the features representing the vector generated after the generated data passes through the discriminator D. A second-order statistic used to compare the characteristics of real results and synthetic data. A first-order statistic used to compare features of real results and synthetic data. and This means that real results and synthetic data have statistically similar characteristics.

[0055] Wherein, the original loss function is p data (z) is the generated data A prior distribution, This indicates that the generated data z is derived from its prior distribution. x ~ p were obtained from random sampling. data (x) represents the true data x derived from its prior distribution p. data The data is randomly sampled from x, where G(·) is a function of the generator G and D(·) is a function of the discriminator D. The output span is [0,1]. D(x) = 0 indicates that the discriminator D classifies the real data x as generated data, where x represents the real data. This represents the mean of all features in the dataset. This indicates that the discriminator D is expected to correctly identify the real data x as the real result. This indicates that the discriminator D is expected to correctly identify the generated data z as the generated result.

[0056] Wherein, the information loss function is f represents the features extracted from the last layer of the discriminator D: i.e., a high-dimensional vector. f represents the mean of all features in the dataset: that is, the centroid of the vector. x The features representing the real data x extracted by the last layer of the discriminator D. This represents the features extracted by the last layer of the discriminator D after the generated data z is output by the generator G. This represents the mean of the vector generated after the real data x passes through the discriminator D. The vector generated by generator G and discriminator D represents the mean or centroid of the vector generated from the generated data z. ||.||2 represents the Euclidean norm, which measures the difference between two mean features. It generates data A prior distribution, A first-order statistic used to compare features of real results and synthetic data.

[0057] Furthermore, the normalization operation follows this algorithm: forward propagation. Backpropagation Multi-level gradient backpropagation It can be seen that using BatchNorm adds a matrix based on standard deviation during the backpropagation process of each layer. For weight W i Scaling is applied. If the weight W... i Smaller, then The smaller the standard deviation σ, the better. i Smaller, relatively Larger, therefore Compared to the original W i This amplifies the gradient and avoids gradient decay; similarly, if the weight W... i Larger, can be easily obtained Compared to the original W i The gradient size is reduced, avoiding gradient inflation. By incorporating BatchNorm into the backpropagation process, gradient vanishing or exploding is less likely to occur, ensuring the gradient remains within a reasonable range. The performance improvement is reflected in a more efficient gradient-based training process, i.e., faster convergence and reduced training failures caused by gradient vanishing or exploding.

[0058] Through the above-described embodiments of the present invention, the generator G, discriminator D, classifier C, original loss function, information loss function, and overall loss function work together to enhance unstructured data (such as abnormal log data) in terms of both data samples and data types. Simultaneously, based on the feature recursive elimination algorithm, important features are selected, focusing on a few features and strengthening the processing of local features, thereby enhancing the fitting effect of the GAN neural network model on local features.

[0059] Examples are as follows, such as Figure 8 , 9As shown, the original CICIDS2017 dataset exhibits a significant distribution of attack types, with BENIGN, DoS Hulk, PortScan, and DdoS accounting for 99% of the total data. It is foreseeable that directly using this dataset for machine learning model training will result in excellent predictions only for these four high-proportion data types, while the accuracy will be very low for other data types, which constitute only 1% of the dataset. However, this invention utilizes a generative adversarial network (GAN) model to learn the sequence relationships and features of anomalous log data, enabling the GAN to generate reasonable data and expand the anomalous dataset. By relying on the GAN model, more anomalous alarm log data can be generated even in scenarios with small network anomalies. Based on this data processing, a large-scale, highly reliable dataset suitable for deep model training is formed. This not only generates a large number of anomalous log data samples with diverse types but also effectively solves the problem of insufficient sample quantity and types in anomalous log data.

[0060] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for training a GAN neural network model, characterized in that, include: Acquire data; wherein the data is tagged log data with clear real results, and the acquisition of data includes: acquiring a data table of the log data; Data augmentation is performed on the data using a GAN neural network model to output virtual data; wherein, the GAN neural network model includes a generator G, a discriminator D, a classifier C, and a loss function; data augmentation using the GAN neural network model includes: The data table is divided to form at least one data matrix; The generator G uses the at least one data matrix to generate at least one generated data, and sends the at least one generated data to the discriminator D and the classifier C. The discriminator D discriminates the at least one generated data to form a prediction result, and feeds back the discrimination error between the prediction result and the true result to the discriminator D through a first backpropagation mechanism. The classifier C distinguishes whether the at least one generated data is suitable for the label, and feeds back the classification error between the at least one generated data and the label to the classifier C through a second backpropagation mechanism. Virtual data is generated based on the at least one generated data, and the overall loss of the virtual data is fed back to the generator G through a third backpropagation mechanism, wherein the overall loss is obtained based on the discrimination error and the classification error; Important data with key features are selected from the virtual data, and the important data are synthesized using the loss function to achieve sample enhancement of the important data. Among them, the important data with important characteristics selected from the virtual data include: The importance of feature information in virtual data is ranked based on the feature recursive elimination algorithm; Select the most important data corresponding to the N most important features from the virtual data, where N is a natural number; The data synthesis of the important data through a loss function includes: The important data is normalized using BatchNorm to adjust its distribution and form the first data. The normalization operation includes adding a standard deviation-based matrix to scale the weights during backpropagation at each layer of the network using BatchNorm. The first data is cleaned to form the second data, wherein the second data is tagged and encoded based on One-Hot; Based on the second data, data is synthesized to form composite data. The composite data is then corrected using the overall loss function, the original loss function, and the information loss function corresponding to the overall loss. The overall loss function is... , , , To set parameters, This represents the loss value of the generated data in discriminator D. This represents the loss value of the generated data in classifier C. The loss value representing the generator G itself, the original loss function is: , This indicates that the generated data z is derived from its prior distribution. Obtained by random sampling This indicates that the real data x is derived from its prior distribution. The generator G(·) is obtained by random sampling, and D(·) is a function of the discriminator D. Let represent the mean of all features in the dataset, and let be the information loss function. , The features representing the real data x extracted by the last layer of the discriminator D. This represents the features extracted by the discriminator D in the last layer after the generated data z is output by the generator G. ||.||2 represents the L-2 norm, used to measure the difference between two mean features. A first-order statistic used to compare features of real results and synthetic data.

2. The method according to claim 1, characterized in that: ,in, A function that returns the label attribute values ​​of the input data. This represents a function based on the generated data for label attribute values. `remove(·)` represents removing the input features of the label. C represents the generated data after removing the labels, and C(·) represents the label predicted by classifier C. , ,in, The standard deviation of the representative characteristic A second-order statistic used to compare the characteristics of real results and synthetic data. = 0 and = 0 means that the real results and the synthetic data have the same statistical characteristics.

3. A network diagnostic method, characterized in that, include: Retrieve log data; The log data is detected using a network diagnostic model to identify abnormal events corresponding to the log data. The network diagnostic model is trained using a log dataset provided by a GAN neural network model trained by the method described in any one of claims 1-2. The GAN neural network model balances the log dataset by increasing the number of abnormal log data samples.

4. An operation and maintenance management device, characterized in that, include: A processor adapted to implement various instructions; and a memory adapted to store multiple instructions, said instructions being adapted to be loaded and executed by the processor: the method for training a GAN neural network model as claimed in any one of claims 1-2, and / or, the network diagnostic method as claimed in claim 3.

5. A network anomaly diagnosis system, characterized in that, include: The operation and maintenance management equipment as described in claim 4.

6. A computer-readable non-volatile storage medium storing computer program instructions, which, when executed by a computer, perform: the method for training a GAN neural network model as described in any one of claims 1-2, and / or the network diagnostic method as described in claim 3.

Images