Network fault prediction method and device based on double-layer sliding window ARIMA algorithm

Abstract

The invention discloses a network fault prediction method and device based on a double-layer sliding window ARIMA algorithm, and belongs to the field of network fault prediction, and the method comprises the steps: collecting data from various heterogeneous hardware devices to a database through an SNMP protocol; preprocessing the data obtained from the database; calculating the Pearson correlation coefficient of the existing sample data to obtain an index with high correlation degree; using the screened indexes to construct double-layer sliding windows corresponding to different devices, and using the double-layer sliding windows as feature vectors for constructing local features; and inputting second-layer sliding window data as a feature vector into an ARIMA algorithm model, processing time series data in the feature vector by using the model, obtaining the best dependency relationship in historical time series data in combination with a cross combination rule of parameters, and predicting different input index values of different devices based on the learned relationship. Potential problems possibly existing in the network can be found in time, and the security control and risk prevention capabilities of the network are improved.

Description

Technical Field

[0001] The present invention relates to the field of network fault prediction, and in particular to a network fault prediction method and device based on a double-layer sliding window ARIMA algorithm. Background Art

[0002] With the rapid development of the Internet, the scale and complexity of networks are increasing. Network failures have become a key factor affecting network performance and user experience. In modern network systems, fault prediction is a key task, which aims to identify potential problems before they occur, thereby reducing the impact on network performance and user experience. Network fault prediction can help network administrators take preventive measures in advance to ensure the stable operation of the network. The existing types of network failures include at least:

[0003] (1) Network transmission load anomaly: The transmission load (i.e., the data traffic) of network devices (such as servers and routers) in a specific time period significantly exceeds the normal range. High transmission bandwidth utilization and packet transmission rate will cause network congestion, increase the probability of packet queuing and packet loss, and thus lead to decreased network performance and increased latency. Continuous transmission load anomalies may cause network device overload, resulting in service interruption or affecting the normal operation of other network devices.

[0004] (2) Abnormal network link quality: The quality of the network link has significantly decreased, affecting the normal transmission of data. High packet loss rate and bit error rate will cause data transmission failure or require retransmission, increase network transmission delay and bandwidth consumption, and affect the real-time and reliability of applications, especially real-time applications such as VoIP, video conferencing and online games.

[0005] (3) Abnormal network connection delay: The network connection delay time increases significantly. High RTT and jitter will cause the network response time to become longer, affecting the user experience. Delay and jitter in real-time applications will cause audio and video asynchrony and freezes, seriously affecting the use effect.

[0006] (4) Abnormal network receiving load: The receiving load (i.e., the received data flow) of the network device in a specific time period significantly exceeds the normal range. High receiving bandwidth utilization and receiving packet rate will lead to insufficient processing capacity of the network device, resulting in packet loss and increased latency. Abnormal receiving load may cause device overload, affect its stability and responsiveness, and even cause service unavailability.

[0007] (5) Abnormal device system performance: The system performance of network devices has significantly decreased, affecting their normal operation. High CPU and memory utilization will cause the device to run slower and its ability to process network requests will decrease. Degraded disk I / O performance will affect the speed of reading and writing data, resulting in increased system response time. Abnormal device system performance may cause network devices to crash, affecting the stability and service quality of the entire network.

[0008] In network management, traditional network fault prediction methods aim to identify potential network problems in advance by analyzing historical data and network behavior, thereby avoiding the occurrence of faults. The following are several traditional network fault prediction methods:

[0009] Rule-based prediction: Using expert knowledge and historical experience, a series of rules are defined to predict possible network failures. However, the flexibility is poor, the scope of application of the rules is limited, and they need to be constantly updated when facing new failure modes. In addition, they rely on expert experience, and the quality and effectiveness of the rules are highly dependent on the knowledge and experience of experts.

[0010] Threshold-based prediction: Set the threshold of network performance indicators. When the monitoring data exceeds the threshold, predict that a failure may occur. However, there is a high false alarm rate. Improper threshold setting will lead to a large number of false alarms or missed alarms. It is also difficult to capture complex patterns and cannot identify complex and nonlinear failure patterns.

[0011] Pattern recognition based on historical data: By analyzing historical network data, common fault precursor patterns are identified and these patterns are used for fault prediction. However, it is more dependent on data quality, and the prediction effect depends on the quality and completeness of historical data. It also has poor adaptability to new fault patterns and needs to continuously update the model.

[0012] Prediction based on event correlation analysis: By analyzing the correlation of network events (such as logs and alarms), possible failures can be predicted. However, the computational complexity is high, and correlation analysis requires large computing resources and time. It also relies on event data, requiring complete and accurate event data for analysis.

[0013] At present, time series analysis methods are widely used in network fault prediction, among which the autoregressive integrated moving average (ARIMA) model has attracted much attention due to its effectiveness in processing time series data. The ARIMA model can capture the linear relationship in the time series and model the time series through three parts: autoregression, difference, and moving average. However, the prediction performance of a single ARIMA model may be limited when facing complex network environments and variable network traffic, and it is difficult to accurately predict sudden and nonlinear faults.

[0014] In view of this, in order to solve any of the problems in the above-mentioned prior art, the present application provides a network fault prediction method and device based on a double-layer sliding window ARIMA algorithm. Summary of the invention

[0015] The technical problem to be solved by the present invention is to provide a network fault prediction method and device based on a double-layer sliding window ARIMA algorithm, which introduces a double-layer sliding window into fault prediction. By segmenting time series data, the changing characteristics of the data in different time periods can be captured, and the prediction ability of the model can be enhanced. The limitations of a single ARIMA model are overcome, so that the network fault prediction model can capture both short-term and long-term trend changes at the same time, thereby improving the accuracy and robustness of network fault prediction.

[0016] In order to solve the above technical problems, the technical solution adopted by the present invention is:

[0017] A network fault prediction method based on a double-layer sliding window ARIMA algorithm comprises the following steps:

[0018] Step 1, collecting network communication log data of various heterogeneous devices in the target area network, and collecting different indicator data of various heterogeneous devices in the target area network;

[0019] Step 2, analyzing the obtained network communication log data and preprocessing different indicator data of various heterogeneous devices in the target area network to obtain preprocessed data;

[0020] Step 3: sort the data indicators obtained after preprocessing according to the Pearson correlation coefficient, and select several indicators with the highest correlation as the basis for classifying the network fault type;

[0021] Step 4: The filtered indicator data is sequentially passed into the double-layer sliding window according to the set historical range and the design rules of different layers, and the value that fills the sliding window of the second layer is used as the final feature vector;

[0022] Step 5: Input the feature vector into the ARIMA algorithm model, use the ARIMA algorithm model to process the time series data in the feature vector, and then cross-combine the parameter values ​​to obtain the parameter combination with the highest cross-validation accuracy as the result of the final algorithm parameter selection, thereby realizing the prediction of different network fault conditions in the target area.

[0023] A further improvement of the technical solution of the present invention is that in step 1, it specifically includes: real-time monitoring and collection of network equipment log data and indicator data in the target area through the SNMP protocol, storing them in the Renmin University of China Golden Warehouse database or the Elasticsearch database, and preserving historical network data.

[0024] A further improvement of the technical solution of the present invention is that before data preprocessing, the designed network fault prediction algorithm, Faust stream processing framework, kafka message queue, and python environment are first encapsulated into a docker container, and the screened indicator data is read into the kafka message queue of a specific topic by adopting a timing and frequency method. The data is circulated to the docker container through kafka, and then preprocessing operations are performed.

[0025] A further improvement of the technical solution of the present invention is that in step 2, it specifically includes:

[0026] S2.1, because there are many different devices in the target area, and there are multiple interfaces between different devices, the data obtained by the SNMP protocol is preliminarily processed for redundancy and formatted according to the predetermined field design rules;

[0027] S2.2, for some devices without interfaces and ports, they are directly distinguished by IP. For the same type of device with different ports, the interface name and device IP are combined, and the IP field is used as the unique identifier of each interface of each device. Further redundancy processing is performed according to the specific conditions of different devices, and the data is split into short JSON format to form structured data;

[0028] S2.3, data cleaning is performed on the data values ​​of different indicators in the short JSON string device monitoring field to remove interference factors such as outliers and missing values. Fields with collected indicators but values ​​that are 0 for a long time are not used as inputs for subsequent model predictions, and different unit data of the same type of indicators are unified.

[0029] A further improvement of the technical solution of the present invention is that in step 3, it specifically includes: pairing the network operation monitoring data with the target variable to form time series data, assuming that each sample contains a multi-dimensional indicator value X = [x 1, x 2, …,x n ] and the corresponding fault state Y;

[0030] For each indicator X i The Pearson correlation coefficient between the target variable Y is calculated as follows:

[0031]

[0032] Where, X ij is the value of the jth sample on the i-th index; Y j is the target fault value corresponding to the jth sample; X i and Y are respectively Xi and the mean of Y; m is the total number of samples;

[0033] After calculating the correlation coefficient between each indicator and the target variable, sort them from large to small according to their absolute values ​​to identify the indicators with high correlation; select the first k indicators with the largest absolute correlation coefficient as the basis for classification.

[0034] A further improvement of the technical solution of the present invention is that in step 4, it specifically includes: according to the historical data interval and the predicted data interval, a double-layer sliding window including a first layer and a second layer is reasonably set, the first layer sliding window slides according to the entire window, and the second layer sliding window slides according to the data flow in the window; if the second layer sliding window is filled for the first time, the second layer sliding window data is passed into the ARIMA algorithm model as a feature vector, and then the second layer sliding window passes a vector into the ARIMA algorithm model every time it slides.

[0035] A further improvement of the technical solution of the present invention is that in step 5, it specifically includes: when the sliding window data of the second layer is filled, it is passed into a pre-designed ARIMA algorithm model as a feature vector, and the pre-designed ARIMA algorithm model includes an ARIMA algorithm model of a default parameter combination and a rule for cross-combination of different parameters; the final parameter combination is determined based on the result after the cross-combination, and the parameter combination with the highest cross-validation accuracy is selected to achieve prediction of the screened network fault indicators and timely prevent the occurrence of network faults.

[0036] A network fault prediction device based on a double-layer sliding window ARIMA algorithm, comprising:

[0037] The data acquisition module is used to obtain the log data and various indicator parameter data of the target area network at the current moment and store them in the database for visualization;

[0038] The feature extraction module is used to construct a double-layer sliding window according to the indicator data of the target network and the interval length of the historical and predicted data, so as to extract the feature dependency relationship of the historical time period;

[0039] The fault prediction module is used to input all the historical data characteristics of indicators into the pre-designed ARIMA algorithm model to obtain the network fault prediction results and store them in another database;

[0040] The graph construction module is used to construct the prediction accuracy curve graph of the ARIMA algorithm model based on the prediction results and real data.

[0041] A computer-readable storage medium stores a computer program, wherein the computer program, when executed by a processor, implements the steps of the network fault prediction method based on a double-layer sliding window ARIMA algorithm.

[0042] Due to the adoption of the above technical solution, the technical progress achieved by the present invention is:

[0043] 1. The present invention introduces a double-layer sliding window method with two sliding windows, the first layer and the second layer, into the network fault prediction model, thereby enhancing the data capture capability of the ARIMA algorithm model at different time scales, so that the network fault prediction model can simultaneously capture short-term and long-term trend changes, effectively capture the multi-scale change characteristics of network traffic, and improve the accuracy and robustness of network fault prediction, thereby improving the accuracy of fault prediction.

[0044] 2. The network fault prediction method provided by the present invention optimizes the feature extraction process by preprocessing and screening the network communication log data of various heterogeneous devices, and uses the Pearson correlation coefficient to screen out the most relevant indicators, thereby further improving the performance of the prediction model.

[0045] 3. The present invention selects the best parameter combination through cross-validation, ensuring the optimal configuration of the model, thereby greatly improving the prediction accuracy.

[0046] 4. The present invention can not only prevent and timely predict network failures, reduce the frequency of failures and maintenance costs, but also significantly improve network stability and user experience, and has broad application prospects and important practical value. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art are briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative labor.

[0048] Figure 1 It is a flow chart of a network fault prediction method based on a double-layer sliding window ARIMA algorithm provided in an embodiment of the present invention;

[0049] Figure 2 It is a schematic diagram of a long JSON data string formed in an embodiment of the present invention;

[0050] Figure 3 is a prediction model training flow chart provided in an embodiment of the present invention;

[0051] Figure 4 is a visualization diagram of the results of the data acquisition module in an embodiment of the present invention;

[0052] Figure 5 It is the visualization of the results of the fault prediction module in the embodiment of the present invention;

[0053] Figure 6 It is a visualization diagram of the results of the figure construction module in an embodiment of the present invention;

[0054] Figure 7 It is a structural schematic diagram of a network fault prediction device based on a double-layer sliding window ARIMA algorithm provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0055] It should be noted that the terms "including" and "having" and any variations thereof in the specification and claims of the present invention and the above-mentioned drawings are intended to cover non-exclusive inclusions. For example, a process, method, system, product or apparatus comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or apparatus.

[0056] The present invention is further described in detail below with reference to the accompanying drawings and embodiments:

[0057] like Figure 1 , 2 As shown, a network fault prediction method based on a double-layer sliding window ARIMA algorithm includes the following steps:

[0058] Step 1, collecting network communication log data of various heterogeneous devices in the target area network, and collecting different indicator data of various heterogeneous devices in the target area network;

[0059] In this embodiment, the target area has several servers from Inspur, Huawei, and Dell, several storage devices from Huawei and Dell, and several workstations from Sugon, Lenovo, Dell, and HP. First, log data and indicator data are collected from a variety of heterogeneous hardware devices through the SNMP protocol to large databases such as Renmin University of China Golden Warehouse and Elasticsearch.

[0060] Before data preprocessing, the designed network fault prediction algorithm, Faust stream processing framework, Kafka message queue, and Python environment are encapsulated into a Docker container. The screened indicator data is read into the Kafka message queue of a specific topic by adopting a timing and frequency method. The data is then transferred to the Docker container through Kafka and then preprocessed.

[0061] Step 2, analyzing the obtained network communication log data and preprocessing different indicator data of various heterogeneous devices in the target area network to obtain preprocessed data;

[0062] Specifically include:

[0063] S2.1, because there are many different devices in the target area, and there will be multiple interfaces between different devices, the data obtained by the SNMP protocol is integrated according to the deviceName (device name), type (device type), IP (device IP address), monitoringItems (monitoring fields of this device), and key (indicator name) and value (indicator value) fields set in monitoringItems to form a long JSON data string, such as Figure 2 shown.

[0064] S2.2, divide each device according to its IP value. For different ports of the same device, since their IP addresses are the same, the key value in the monitoringItems field is trimmed according to the port number, and then it is spliced ​​with the device IP to make the IP field of each port its unique identifier, and split it into short JSON strings to form structured data.

[0065] S2.3. Data cleaning is performed on the data values ​​of different indicators in the short json string device monitoring field to remove interference factors such as outliers and missing values. Fields with collected indicators but values ​​that are 0 for a long time are not used as inputs for subsequent model predictions. Different unit data of the same type of indicators are unified. For example, traffic data in bps, Kbps, Mbps, Gbps, etc. are uniformly divided into bps. For example, CPU utilization is in %, and % should be removed during data processing.

[0066] Step 3: sort the data indicators obtained after preprocessing according to the Pearson correlation coefficient, and select several indicators with the highest correlation as the basis for classifying the network fault type;

[0067] Specifically: Pair network operation monitoring data (such as memory utilization, CPU utilization, etc.) with target variables (such as whether a certain type of network failure occurs) to form time series data. Assume that each sample contains multi-dimensional indicator values ​​X = [x 1, x 2, …,x n ] and the corresponding fault state Y.

[0068] For each indicator X i The Pearson correlation coefficient between the target variable Y is calculated as follows:

[0069]

[0070] Where, X ij is the value of the jth sample on the i-th index; Y j is the target fault value corresponding to the jth sample; and They are X i and the mean of Y; m is the total number of samples.

[0071] After calculating the correlation coefficient between each indicator and the target variable, sort them from large to small according to their absolute values, and identify the indicators with high correlation. Select the first k indicators with the largest absolute correlation coefficient as the classification basis.

[0072] Step 4: The filtered indicator data is passed into the sliding window in sequence according to the set historical range and the design rules of different layers, and the value that fills the sliding window of the second layer is used as the final feature vector;

[0073] Specifically, according to the historical data interval and the predicted data interval, a double-layer sliding window including the first layer and the second layer is reasonably set. The first layer sliding window slides according to the entire window, and the second layer sliding window slides according to the data flow in the window; if the second layer sliding window is filled for the first time, the second layer sliding window data is passed into the ARIMA algorithm model as a feature vector, and then a vector is passed into the ARIMA algorithm model every time the second layer sliding window slides.

[0074] Assume that the training data is historical data of 4 hours, and the data of the next 2 hours is predicted. After data collection and processing, the frequency of extraction is once every 20 seconds, so the size of the first layer sliding window can be set to 36, that is, the time span represented by the first layer is 12 minutes.

[0075] When the first layer of data sliding window is filled, the mean of the data in this layer is calculated and then put into the second layer of sliding window. When the mean of the first layer of window data is calculated, the first layer of window is reset to empty. The first layer of window captures the short-term trend changes of the data.

[0076] The above work is repeated until the second sliding window is fully filled. The value of the second sliding window is set to 20. At this time, the data stored in the second sliding window is exactly the historical 4-hour data. As the final feature vector, the second sliding window captures the long-term trend changes of the data.

[0077] When the second-layer sliding window data is filled, if new data for the next 12 minutes is obtained, the replacement rule of the second-layer sliding window data is different from the overall sliding of the previous layer. Instead, it adopts the idea of ​​queuing and replaces the value that first enters the window, and then sends it to the pre-designed ARIMA algorithm model.

[0078] Step 5: Input the feature vector into the ARIMA algorithm model, use the ARIMA algorithm model to process the time series data in the feature vector, and then cross-combine the parameter values ​​to obtain the parameter combination with the highest cross-validation accuracy as the result of the final algorithm parameter selection, thereby realizing the prediction of different network fault conditions in the target area.

[0079] Specifically, when the sliding window data of the second layer is filled, it is passed as a feature vector into a pre-designed ARIMA algorithm model. The pre-designed ARIMA algorithm model includes: an ARIMA algorithm model of a default parameter combination and rules for cross-combining different parameters. The final parameter combination is determined based on the result of the cross-combination, and the parameter combination with the highest cross-validation accuracy is selected to predict the screened network fault indicators and prevent the occurrence of network faults in a timely manner.

[0080] like Figure 7 As shown, a network fault prediction device based on a double-layer sliding window ARIMA algorithm includes: a data acquisition module, a feature extraction module, a fault prediction module and a graph construction module.

[0081] The data acquisition module is used to obtain the log data and various indicator parameter data of the target area network at the current moment and store them in the database for visualization. The specific results are as follows Figure 4 As shown;

[0082] The feature extraction module is used to construct a double-layer sliding window according to the indicator data of the target network and the interval length of the historical and predicted data, so as to extract the feature dependency relationship of the historical time period;

[0083] The fault prediction module is used to pass all historical data characteristics of indicators into the pre-designed ARIMA algorithm model to obtain network fault prediction results and store them in another database. The specific results are as follows Figure 5 shown.

[0084] The graph construction module is used to construct the prediction accuracy curve of the ARIMA algorithm model based on the prediction results and real data. The specific results are as follows Figure 6 shown.

[0085] The present invention provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps of a network fault prediction method based on a double-layer sliding window ARIMA algorithm are implemented.

[0086] The present invention provides a computer device, comprising a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the steps of a network fault prediction method based on a double-layer sliding window ARIMA algorithm are implemented.

[0087] The present invention provides a computer program product, comprising a computer program, which implements the steps of a network fault prediction method based on a double-layer sliding window ARIMA algorithm when executed by a processor.

[0088] It should be understood by professionals in the art that the embodiments of the present application can be provided as methods, systems or computer program products. Therefore, the present application can take an embodiment based entirely on hardware, an embodiment based entirely on software, or an embodiment combining hardware and software. In addition, the present application can also take the form of a computer program product, which is stored on one or more computer-readable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) and contains computer executable program code.

[0089] These computer program instructions may also be stored in a computer-readable storage medium that can instruct a computer or other programmable data processing device to operate in a specific manner. By executing the instructions stored in the computer-readable storage medium, a device including an instruction device may be generated that implements the jump of multiple instructions to achieve the final functional flow.

[0090] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A network fault prediction method based on a double sliding window ARIMA algorithm, characterized in that: include: Step 1, collecting network communication log data of various heterogeneous devices in the target area network, and collecting different indicator data of various heterogeneous devices in the target area network; Step 2, analyzing the obtained network communication log data and preprocessing different indicator data of various heterogeneous devices in the target area network to obtain preprocessed data; Step 3: sort the data indicators obtained after preprocessing according to the Pearson correlation coefficient, and select several indicators with the highest correlation as the basis for classifying the network fault type; Step 4: The filtered indicator data is sequentially passed into the double-layer sliding window according to the set historical range and the design rules of different layers, and the value that fills the sliding window of the second layer is used as the final feature vector; Step 5: Input the feature vector into the ARIMA algorithm model, use the ARIMA algorithm model to process the time series data in the feature vector, and then cross-combine the parameter values ​​to obtain the parameter combination with the highest cross-validation accuracy as the result of the final algorithm parameter selection, thereby realizing the prediction of different network fault conditions in the target area.

2. According to claim 1, a network fault prediction method based on a double sliding window ARIMA algorithm is characterized in that: In step 1, it specifically includes: real-time monitoring and collection of network device log data and indicator data in the target area through the SNMP protocol, storing them in the Renmin University of China Golden Warehouse database or the Elasticsearch database, and preserving historical network data.

3. A network fault prediction method based on a double sliding window ARIMA algorithm according to claim 2, characterized in that: Before data preprocessing, the designed network fault prediction algorithm, Faust stream processing framework, Kafka message queue, and Python environment are encapsulated into a Docker container. The screened indicator data is read into the Kafka message queue of a specific topic by adopting a timing and frequency method. The data is then transferred to the Docker container through Kafka and then preprocessed.

4. A network fault prediction method based on a double sliding window ARIMA algorithm according to claim 1, characterized in that: In step 2, specifically including: S2.1, because there are many different devices in the target area, and there are multiple interfaces between different devices, the data obtained by the SNMP protocol is preliminarily processed for redundancy and formatted according to the predetermined field design rules; S2.2, for some devices without interfaces and ports, they are directly distinguished by IP. For the same type of device with different ports, the interface name and device IP are combined, and the IP field is used as the unique identifier of each interface of each device. Further redundancy processing is performed according to the specific conditions of different devices, and the data is split into short JSON format to form structured data; S2.3, data cleaning is performed on the data values ​​of different indicators in the short JSON string device monitoring field to remove interference factors such as outliers and missing values. Fields with collected indicators but values ​​that are 0 for a long time are not used as inputs for subsequent model predictions, and different unit data of the same type of indicators are unified.

5. A network fault prediction method based on a double sliding window ARIMA algorithm according to claim 1, characterized in that: In step 3, the network operation monitoring data is paired with the target variable to form time series data. Assuming that each sample contains multi-dimensional indicator values ​​X = [x 1, x 2, …,x n ] and the corresponding fault state Y; For each indicator X i The Pearson correlation coefficient between the target variable Y is calculated as follows: Where, X ij is the value of the jth sample on the i-th index; Y j is the target fault value corresponding to the jth sample; and They are X i and the mean of Y; m is the total number of samples; After calculating the correlation coefficient between each indicator and the target variable, sort them from large to small according to their absolute values ​​to identify the indicators with high correlation; select the first k indicators with the largest absolute correlation coefficient as the basis for classification.

6. A network fault prediction method based on a double sliding window ARIMA algorithm according to claim 1, characterized in that: In step 4, specifically including: according to the historical data interval and the predicted data interval, reasonably setting a double-layer sliding window including a first layer and a second layer, the first layer sliding window slides according to the entire window, and the second layer sliding window slides according to the data flow in the window; if the second layer sliding window is filled for the first time, the second layer sliding window data is passed into the ARIMA algorithm model as a feature vector, and then the second layer sliding window passes a vector into the ARIMA algorithm model every time it slides.

7. A network fault prediction method based on a double sliding window ARIMA algorithm according to claim 1, characterized in that: In step 5, specifically including: when the sliding window data of the second layer is filled, it is passed into the pre-designed ARIMA algorithm model as a feature vector, and the pre-designed ARIMA algorithm model includes the ARIMA algorithm model of the default parameter combination and the rules of cross-combination of different parameters; the final parameter combination is determined based on the result of the cross-combination, and the parameter combination with the highest cross-validation accuracy is selected to achieve the prediction of the screened network fault indicators and timely prevent the occurrence of network faults.

8. A network fault prediction device based on a double sliding window ARIMA algorithm, characterized in that: include: The data acquisition module is used to obtain the log data and various indicator parameter data of the target area network at the current moment and store them in the database for visualization; The feature extraction module is used to construct a double-layer sliding window according to the indicator data of the target network and the interval length of the historical and predicted data, so as to extract the feature dependency relationship of the historical time period; The fault prediction module is used to input all the historical data characteristics of indicators into the pre-designed ARIMA algorithm model to obtain the network fault prediction results and store them in another database; The graph construction module is used to construct the prediction accuracy curve graph of the ARIMA algorithm model based on the prediction results and real data.

9. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the steps of the network fault prediction method based on the double-layer sliding window ARIMA algorithm described in any one of claims 1 to 7 are implemented.

10. A computer device comprising a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the steps of the network fault prediction method based on the double sliding window ARIMA algorithm according to any one of claims 1 to 7 are implemented.

Images