Network fault prediction method and device based on double-layer sliding window ARIMA algorithm

Abstract

The application discloses a network fault prediction method and device based on a double-layer sliding window ARIMA algorithm, belongs to the field of network fault prediction, and comprises the following steps: collecting data from a plurality of heterogeneous hardware devices to a database through an SNMP protocol; preprocessing the data obtained from the database; calculating the Pearson correlation coefficient of the existing sample data to obtain indexes with high correlation degrees; using the screened indexes to construct double-layer sliding windows corresponding to different devices as feature vectors for constructing local features; inputting the data of the second-layer sliding window into an ARIMA algorithm model as feature vectors, processing the time series data in the feature vectors by using the model, combining a cross combination rule of parameters, obtaining the best dependency relationship in the historical time series data, and predicting different index values of different devices based on the learned relationship. The application can discover potential problems existing in the network in a timely manner, and improve the safety management and control and risk prevention capabilities of the network.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of network failure prediction, and particularly to a network failure prediction method and device based on a double-layer sliding window ARIMA algorithm. BACKGROUND

[0002] With the rapid development of the Internet, the scale and complexity of the network are increasing, and network failures have become a key factor affecting network performance and user experience. In modern network systems, failure prediction is a key task, which aims to identify potential problems before failures occur, thereby reducing the impact on network performance and user experience. Network failure prediction can help network administrators take preventive measures in advance to ensure the stable operation of the network. Existing network failures include at least:

[0003] (1) Network sending load anomaly: the sending load (i.e., the data traffic sent) of network devices (such as servers, routers) significantly exceeds the normal range within a certain time period. High sending bandwidth utilization and sending packet rate can cause network congestion, increase data packet queuing and packet loss probability, and further cause network performance degradation and increased latency. Continuous sending load anomaly can cause network device overload, leading to service interruption or affecting the normal work of other network devices.

[0004] (2) Network link quality anomaly: the quality of network links significantly decreases, affecting the normal transmission of data. High packet loss rate and bit error rate can cause data transmission failure or the need for retransmission, increasing network transmission delay and bandwidth consumption, affecting the real-time performance and reliability of applications, especially real-time applications such as VoIP, video conferencing, and online gaming.

[0005] (3) Network connection delay anomaly: the delay time of network connections significantly increases. High RTT and jitter can cause network response time to become longer, affecting user experience. Delay and jitter under real-time applications can cause audio and video out of sync and stuttering, severely affecting the use effect.

[0006] (4) Network receiving load anomaly: the receiving load (i.e., the data traffic received) of network devices significantly exceeds the normal range within a certain time period. High receiving bandwidth utilization and receiving packet rate can cause network devices to lack processing capacity, resulting in data packet loss and increased latency. Receiving load anomaly can cause device overload, affecting its stability and response ability, and even leading to service unavailability.

[0007] (5) Device system performance anomaly: The system performance of network devices significantly decreases, affecting their normal operation. High CPU and memory utilization can cause devices to run slowly and reduce their ability to handle network requests. Disk I / O performance degradation can affect data read / write speed, leading to increased system response time. Device system performance anomalies can cause network devices to crash, affecting the stability and quality of service of the entire network.

[0008] In network management, traditional network failure prediction methods analyze historical data and network behavior to identify potential network problems in advance, thereby avoiding failures. Here are several traditional network failure prediction methods:

[0009] Rule-based prediction: Use expert knowledge and historical experience to define a series of rules to predict possible network failures. However, it has poor flexibility, limited scope of rules, and needs to be updated constantly when facing new failure patterns. It also relies on expert experience, and the quality and effectiveness of rules are highly dependent on the knowledge and experience of experts.

[0010] Threshold-based prediction: Set threshold values for network performance indicators, and when monitoring data exceeds the threshold, predict possible failures. However, it has a high false alarm rate, and unreasonable threshold settings can lead to a large number of false alarms or missed alarms. It is also difficult to capture complex patterns and cannot identify complex and nonlinear failure patterns.

[0011] Pattern recognition based on historical data: By analyzing historical network data, identify common pre-failure patterns and use these patterns for failure prediction. However, it is more dependent on data quality, and the prediction effect depends on the quality and integrity of historical data. It also has poor adaptability and poor adaptability to new failure patterns, requiring constant model updates.

[0012] Event correlation analysis-based prediction: By analyzing the correlation of network events (such as logs, alarms), predict possible failures. However, it has high computational complexity, and correlation analysis requires large computational resources and time. It also depends on event data, requiring complete and accurate event data for analysis.

[0013] Currently, time series analysis methods are widely used in network failure prediction, among which the autoregressive integrated moving average (ARIMA) model is of great concern due to its effectiveness in handling time series data. ARIMA model can capture linear relationships in time series and model time series through autoregression, differencing, and moving average. However, a single ARIMA model may be limited in its prediction performance when facing complex network environments and variable network traffic, making it difficult to accurately predict sudden and nonlinear changes in failures.

[0014] In view of this, in order to solve any of the above problems in the prior art, the application provides a network fault prediction method and device based on a double-layer sliding window ARIMA algorithm. SUMMARY

[0015] The technical problem to be solved by the application is to provide a network fault prediction method and device based on a double-layer sliding window ARIMA algorithm, which introduces a double-layer sliding window into fault prediction, can capture the change characteristics of data in different time periods through segmented processing of time series data, enhances the prediction ability of the model, overcomes the limitations of a single ARIMA model, enables the network fault prediction model to capture short-term and long-term trend changes at the same time, and improves the accuracy and robustness of network fault prediction.

[0016] To solve the above technical problems, the technical solution adopted by the application is as follows:

[0017] A network fault prediction method based on a double-layer sliding window ARIMA algorithm, comprising the following steps:

[0018] Step 1, collecting network communication log data of a plurality of heterogeneous devices of a target area network, and collecting different index data of the plurality of heterogeneous devices of the target area network;

[0019] Step 2, analyzing the obtained network communication log data and preprocessing the different index data of the plurality of heterogeneous devices of the target area network to obtain preprocessed data;

[0020] Step 3, sorting the data indexes obtained after preprocessing according to the Pearson correlation coefficient, and selecting several indexes with the highest correlation degree as the classification basis of network fault types;

[0021] Step 4, sequentially inputting the screened index data into a double-layer sliding window according to the design rules of different layers according to the set historical range, and taking the value of the sliding window filled in the second layer as the final feature vector;

[0022] Step 5, inputting the feature vector into an ARIMA algorithm model, processing the time series data in the feature vector by using the ARIMA algorithm model, then cross-combining the values of the parameters, taking the parameter combination with the highest cross-validation accuracy as the result of selecting the final algorithm parameters, so as to realize prediction of different network fault conditions of the target area.

[0023] The further improvement of the technical solution of the application is that in step 1, the network device log data and index data of the target area are monitored and collected in real time through an SNMP protocol, and are stored in a Rondap database or an Elasticsearch database, and historical network data is saved.

[0024] Further improvement of the technical scheme of the application is that before the data is preprocessed, the designed network fault prediction algorithm, the Faust flow processing framework, the kafka message queue and the python environment are encapsulated into a docker container, the screened index data is read into the kafka message queue of a specific topic by using a timing and frequency method, the data is circulated to the docker container through the kafka flow, and then the preprocessing operation is performed.

[0025] Further improvement of the technical scheme of the application is that in step 2, specifically comprising:

[0026] S2.1, because there are many different devices in the target area, and there are many interfaces between different devices, so the data obtained by the SNMP protocol is subjected to preliminary redundancy processing and format design according to the subscribed field design rules;

[0027] S2.2, for some devices without interfaces and ports, the IP is directly distinguished, for the same type of device with different ports, the interface name and the device IP are combined, the IP field is formed into the unique identifier of each interface of each device, and further redundancy processing is performed according to the specific conditions of different devices, the data is split into the form of short json, and the structured data is formed;

[0028] S2.3, the data values of different indicators in the short json string device monitoring field are subjected to data cleaning to remove abnormal values, missing values and other interference factors, the fields with collected indicators and values but long-term 0 are not used as input for subsequent model prediction, and different unit data of the same type of indicators are unified in unit.

[0029] Further improvement of the technical scheme of the application is that in step 3, specifically comprising: the network operation monitoring data and the target variable are paired and arranged into time series data, assuming that each sample contains multi-dimensional indicator values X=[x 1, x 2, …,x n ] and the corresponding fault state Y;

[0030] For each indicator X i and target variable Y, the Pearson correlation coefficient between them is calculated, and the formula is:

[0031]

[0032] In the formula, X ij is the value of the jth sample on the ith indicator; Y j is the target fault value corresponding to the jth sample; X i and Y are Xi The mean value of Y; m is the total number of samples;

[0033] After calculating the correlation coefficient of each index with the target variable, sort them by absolute value from large to small, identify the index with high correlation degree; select the first k indexes with the largest absolute correlation coefficient as the classification basis.

[0034] The further improvement of the technical scheme of the application is that in step 4, specifically comprising: according to the historical data interval and the prediction data interval, reasonably setting the double-layer sliding window including the first layer and the second layer, the first layer sliding window slides according to the whole window, and the second layer sliding window slides according to the data stream in the window; if the second layer sliding window is filled for the first time, the second layer sliding window data is transmitted into the ARIMA algorithm model as a feature vector, and then the second layer sliding window transmits a vector into the ARIMA algorithm model once every time it slides.

[0035] The further improvement of the technical scheme of the application is that in step 5, specifically comprising: when the second layer sliding window data is filled, it is transmitted into the pre-designed ARIMA algorithm model as a feature vector, the pre-designed ARIMA algorithm model includes the ARIMA algorithm model with default parameter combination and the rule of different parameter cross combination; the final parameter combination is selected according to the cross combination result, and the parameter combination with the highest cross validation accuracy is selected to realize the prediction of the screened network fault index and timely prevent the occurrence of network fault.

[0036] A network fault prediction device based on a double-layer sliding window ARIMA algorithm, comprising:

[0037] A data acquisition module is used to acquire log data and index parameter data of a target area network at a current time and store them in a database for visualization.

[0038] A feature extraction module is used to construct a double-layer sliding window according to the interval length of historical and prediction data based on the index data of the target network, so as to extract the feature dependency relationship of the historical time period.

[0039] A fault prediction module is used to transmit all index historical data features into a pre-designed ARIMA algorithm model to obtain a network fault prediction result and store it in another database.

[0040] A graph construction module is used to construct a prediction accuracy curve graph of the ARIMA algorithm model according to the prediction result and the real data.

[0041] A computer readable storage medium stores a computer program, wherein the computer program is executed by a processor to implement steps of the network fault prediction method based on the double-layer sliding window ARIMA algorithm.

[0042] Thanks to the above technical solutions, the present application has achieved the following technical progress:

[0043] 1. The double-layer sliding window method with the first layer and the second layer is introduced into the network fault prediction model, which enhances the data capturing ability of the ARIMA algorithm model at different time scales, so that the network fault prediction model can capture short-term and long-term trend changes at the same time, effectively capture the multi-scale change characteristics of network traffic, and improve the accuracy and robustness of network fault prediction, thereby improving the accuracy of fault prediction.

[0044] 2. The network fault prediction method provided by the present application optimizes the feature extraction process by preprocessing and screening the network communication log data of various heterogeneous devices, and uses the Pearson correlation coefficient to screen the most relevant indicators, further improving the performance of the prediction model.

[0045] 3. The present application selects the best parameter combination through cross-validation to ensure the optimal configuration of the model, thereby greatly improving the prediction accuracy.

[0046] 4. The present application not only can prevent and predict network faults in time, reduce the frequency of fault occurrence and maintenance cost, but also significantly improves the stability of the network and user experience, has wide application prospect and important practical value. BRIEF DESCRIPTION OF DRAWINGS

[0047] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the drawings needed to be used in the embodiments or prior art description will be briefly introduced. Obviously, the drawings in the following description are some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor;

[0048] Figure 1 is a flowchart of the network fault prediction method based on the double-layer sliding window ARIMA algorithm provided in the embodiments of the present application;

[0049] Figure 2 is a schematic diagram of a long json data string formed in the embodiments of the present application;

[0050] Figure 3 is a flowchart of the prediction model training process provided in the embodiments of the present application;

[0051] Figure 4 is a result visualization diagram of the data acquisition module in the embodiment of the application;

[0052] Figure 5 is a result visualization of the fault prediction module in the embodiment of the application;

[0053] Figure 6 is a result visualization diagram of the graph construction module in the embodiment of the application;

[0054] Figure 7 is a structural schematic diagram of the network fault prediction device based on the double-layer sliding window ARIMA algorithm provided in the embodiment of the application. DETAILED DESCRIPTION

[0055] It should be noted that the terms "comprising" and "having" and any variations thereof in the specification and claims of the application and the above-mentioned drawings are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device comprising a series of steps or units does not have to be limited to those steps or units clearly listed, but can include other steps or units not clearly listed or inherent to the process, method, product or device.

[0056] The application will be further described in detail below in combination with the drawings and embodiments:

[0057] As shown in Figure 1 , 2 A network fault prediction method based on a double-layer sliding window ARIMA algorithm, comprising the following steps:

[0058] Step 1, collecting network communication log data of a plurality of heterogeneous devices of a target area network, and collecting different index data of the plurality of heterogeneous devices of the target area network;

[0059] In this embodiment, the target area has a plurality of servers of Legend, Huawei and Dell, a plurality of storage devices of Huawei and Dell, a plurality of workstations of Sugon, Lenovo, Dell and HP. First, log data and index data are collected from a plurality of heterogeneous hardware devices to large databases such as Renmin University of China Golden Warehouse and Elasticsearch through the SNMP protocol.

[0060] Before the data is preprocessed, the designed network fault prediction algorithm, the Faust flow processing framework, the kafka message queue and the python environment are encapsulated into a docker container, the selected index data is read to the kafka message queue of a specific topic by using a timing and frequency method, the data is circulated to the docker container through the kafka flow, and then the preprocessing operation is performed.

[0061] Step 2, analyze the obtained network communication log data and preprocess different index data of various heterogeneous devices of the target area network to obtain preprocessed data;

[0062] Specifically, it includes:

[0063] S2.1, because there are many different devices in the target area, and there are many interfaces between different devices, the data obtained by the SNMP protocol is integrated according to the fields of deviceName (device name), type (device type), IP (device IP address), monitoringItems (monitoring field of this device), and key (index name) and value (index value) set in monitoringltems, to form a long json data string, as shown in Figure 2 .

[0064] S2.2, divide each device according to its IP value, and for different ports of the same device, because their IP addresses are the same, the key value in the monitoringItems field is trimmed according to the port number, and then it is spliced with the device IP to make the IP field of each port its unique identifier, and it is split into a short json string to form structured data.

[0065] S2.3, data cleaning is performed on the data values of different indicators in the short json string device monitoring field to remove abnormal values, missing values and other interference factors, and the fields with collected indicators with values but long-term 0 are not used as input for subsequent model prediction, and different unit data of the same type of indicators are unified, such as flow data exists in bps, Kbps, Mbps, Gbps, etc., which are uniformly divided into bps; for example, CPU utilization is in units of %, which should be removed in data processing.

[0066] Step 3, sort the data indicators obtained after preprocessing according to the Pearson correlation coefficient, and select several indicators with the highest correlation as the classification basis of network fault types;

[0067] Specifically, the network operation monitoring data (such as memory utilization, CPU utilization, etc.) and the target variable (such as the occurrence of a certain network fault type) are paired and arranged as time series data. Assume that each sample contains multi-dimensional index values X = [x 1, x 2, …,x n ] and corresponding fault state Y.

[0068] For each index X i and target variable Y, calculate the Pearson correlation coefficient between them, the formula is:

[0069]

[0070] wherein X ij is the value of the jth sample on the ith index; Y j is the target fault value corresponding to the jth sample; and are the mean values of X i and Y, respectively; and m is the total number of samples.

[0071] After calculating the correlation coefficient of each index and the target variable, the correlation coefficients are sorted in descending order of absolute value, and the indexes with high correlation are identified. The first k indexes with the largest absolute correlation coefficients are selected as the classification basis.

[0072] Step 4: The screened index data is sequentially input into the sliding window according to the set historical range and different layers of design rules, and the values of the sliding window filled with the second layer are taken as the final feature vector.

[0073] Specifically, according to the historical data interval and the prediction data interval, a double-layer sliding window including the first layer and the second layer is reasonably set. The first layer sliding window slides according to the entire window, and the second layer sliding window slides according to the data stream in the window. If the second layer sliding window is filled for the first time, the second layer sliding window data is taken as the feature vector and input into the ARIMA algorithm model. Subsequently, the second layer sliding window is input into the ARIMA algorithm model once for each sliding.

[0074] Suppose the training data is 4 hours of historical data, and the future 2 hours of data is predicted. After the data is collected and processed, the frequency of extraction is once every 20 seconds, so the size of the first layer sliding window can be set to 36, i.e., the time span represented by the first layer is 12 minutes.

[0075] When the first layer data sliding window is filled, the mean value of the data in this layer is calculated and put into the second layer sliding window. When the mean value of the first layer window data is calculated, the first layer window is reset to empty, and the first layer window captures the short-term trend change of the data.

[0076] The above work is repeated until the second layer sliding window is fully filled. The value of the second layer sliding window is set to 20, and the data stored in the second layer sliding window is exactly the historical 4 hours of data, which is taken as the final feature vector. The second layer sliding window captures the long-term trend change of the data.

[0077] When the second layer sliding window data is filled, if the next 12 minutes of new data is obtained, the replacement rule of the second layer sliding window data is different from the overall sliding of the previous layer, but adopts the idea of queue, and the value entering the window first is replaced, and then is sent to the ARIMA algorithm model designed in advance.

[0078] Step 5, input the feature vector into the ARIMA algorithm model, process the time series data in the feature vector by using the ARIMA algorithm model, then cross-combine the values of the parameters, and take the parameter combination with the highest cross-validation accuracy as the result of selecting the final algorithm parameters, so as to realize the prediction of different network fault conditions of the target area.

[0079] Specifically, when the second layer sliding window data is filled, it is transmitted as a feature vector into the pre-designed ARIMA algorithm model. The pre-designed ARIMA algorithm model includes: an ARIMA algorithm model with default parameter combination and rules for cross-combination of different parameters. The final parameter combination is determined according to the cross-combination result. The parameter combination with the highest cross-validation accuracy is selected to realize the prediction of the screened network fault indicators and timely prevent the occurrence of network faults.

[0080] As shown in Figure 7 , a network fault prediction device based on a double-layer sliding window ARIMA algorithm includes: a data acquisition module, a feature extraction module, a fault prediction module, and a graph construction module.

[0081] The data acquisition module is used to acquire log data and index parameter data of a target area network at a current time and store them in a database for visualization. The specific result is shown in Figure 4 .

[0082] The feature extraction module is used to construct a double-layer sliding window according to the interval length of historical and predicted data according to the index data of the target network, so as to extract the feature dependency relationship of the historical time period.

[0083] The fault prediction module is used to transmit all historical data features of the indicators into a pre-designed ARIMA algorithm model to obtain a network fault prediction result and store it in another database. The specific result is shown in Figure 5 .

[0084] The graph construction module is used to construct a prediction accuracy curve of the ARIMA algorithm model according to the prediction result and the real data. The specific result is shown in Figure 6 .

[0085] The application provides a computer readable storage medium, which stores a computer program, and the computer program realizes steps of a network fault prediction method based on a double-layer sliding window ARIMA algorithm when executed by a processor.

[0086] The application provides a computer device, which comprises a memory and a processor, the memory stores a computer program, and the processor realizes steps of a network fault prediction method based on a double-layer sliding window ARIMA algorithm when executing the computer program.

[0087] The application provides a computer program product, which comprises a computer program, and the computer program realizes steps of a network fault prediction method based on a double-layer sliding window ARIMA algorithm when executed by a processor.

[0088] It should be understood by those skilled in the art in this technical field that the embodiments of the application can be provided as a method, a system or a computer program product. Therefore, the application can adopt an entirely hardware-based embodiment, an entirely software-based embodiment, or an embodiment combining hardware and software. In addition, the application can also adopt the form of a computer program product stored on one or more computer readable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) and containing computer executable program code.

[0089] These computer program instructions can also be stored in a computer readable storage medium capable of instructing a computer or other programmable data processing device to operate in a specific manner. By executing the instructions stored in the computer readable storage medium, a device containing instruction devices can be generated, which realizes the jump of various instructions and thus realizes the final function flow.

[0090] Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the application, and not to limit them; although the application has been described in detail with reference to the above embodiments, those skilled in the art should understand that: it can still modify the technical solutions recorded in the above embodiments, or make equivalent replacement for part or all of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the scope of the technical solutions of the embodiments of the application.

Claims

1. A network fault prediction method based on a double-layer sliding window ARIMA algorithm, characterized in that: include: Step 1: collecting network communication log data of various heterogeneous devices in the target area network, and collecting different indicator data of various heterogeneous devices in the target area network; Step 2: Analyze the obtained network communication log data and pre-process different indicator data of various heterogeneous devices in the target area network to obtain pre-processed data; Step 3: Sort the data indicators obtained after preprocessing according to the Pearson correlation coefficient, and select the indicators with the highest correlation as the basis for classifying the network fault type; Step 4: The filtered indicator data is sequentially passed into the double-layer sliding window according to the set historical range and the design rules of different layers, and the value that fills the sliding window of the second layer is used as the final feature vector; Specifically, it includes: according to the historical data interval and the forecast data interval, reasonably setting a double-layer sliding window including the first layer and the second layer, the first layer sliding window slides according to the entire window, and the second layer sliding window slides according to the data flow in the window; when the first layer data sliding window is filled, the mean of the current layer data is calculated and then placed in the second layer sliding window, and when the mean of the first layer window data is calculated, the first layer window is reset to empty, and the above work is repeated until the second layer sliding window is fully filled; if the second layer sliding window is filled for the first time, the second layer sliding window data is passed into the ARIMA algorithm model as a feature vector, and then a vector is passed into the ARIMA algorithm model every time the second layer sliding window slides; In step 5, the feature vector is input into the ARIMA algorithm model. The time series data in the feature vector is processed using the ARIMA algorithm model. The parameter values ​​are then cross-combined to obtain the parameter combination with the highest cross-validation accuracy as the final algorithm parameter selection result, thereby achieving prediction of different network fault conditions in the target area.

2. A network fault prediction method based on a double-layer sliding window ARIMA algorithm according to claim 1, characterized in that: In step 1, it specifically includes: real-time monitoring and collection of network device log data and indicator data in the target area through the SNMP protocol, storing them in the Renmin University of China Golden Warehouse database or the Elasticsearch database, and preserving historical network data.

3. A network fault prediction method based on a double sliding window ARIMA algorithm according to claim 2, characterized in that: Before data preprocessing, the designed network fault prediction algorithm, Faust stream processing framework, Kafka message queue, and Python environment are encapsulated into a Docker container. The screened indicator data is read into the Kafka message queue of a specific topic using a timed and frequency method. The data is then transferred to the Docker container through Kafka and then preprocessed.

4. A network fault prediction method based on a double sliding window ARIMA algorithm according to claim 1, characterized in that: In step 2, specifically include: S2.1, because there are many different devices in the target area and there are multiple interfaces between different devices, the data obtained by the SNMP protocol is preliminarily processed for redundancy and formatted according to the predetermined field design rules; S2.2: For devices without interfaces and ports, we distinguish them directly by IP address. For devices with different ports, we combine the interface name with the device IP address, and use the IP address as a unique identifier for each device and each interface. Further redundancy processing is performed based on the specific conditions of different devices, and the data is split into short JSON format to form structured data. S2.

3. Data cleaning is performed on the data values ​​of different indicators in the short JSON string device monitoring field to remove interference factors such as outliers and missing values. Fields with collected indicators but values ​​that are 0 for a long time are not used as input for subsequent model predictions. Different unit data of the same indicator are unified.

5. The network fault prediction method based on the double sliding window ARIMA algorithm according to claim 1 is characterized in that: In step 3, the network operation monitoring data is paired with the target variable to form time series data. Assuming that each sample contains multi-dimensional indicator values ​​X = [x 1, x 2, …,x n ] and the corresponding fault state Y; For each indicator X i The Pearson correlation coefficient between the target variable Y is calculated as follows: Where, X ij is the value of the jth sample on the i-th index; Y j is the target fault value corresponding to the jth sample; and They are X i and the mean of Y; m is the total number of samples; After calculating the correlation coefficient between each indicator and the target variable, sort them from large to small according to their absolute values ​​to identify the indicators with high correlation; select the top k indicators with the largest absolute correlation coefficient as the basis for classification.

6. A network fault prediction method based on a double sliding window ARIMA algorithm according to claim 1, characterized in that: In step 5, specifically, after the sliding window data of the second layer is filled, it is passed as a feature vector into a pre-designed ARIMA algorithm model, wherein the pre-designed ARIMA algorithm model includes an ARIMA algorithm model of a default parameter combination and rules for cross-combining different parameters; the final parameter combination is determined based on the result of the cross-combination, and the parameter combination with the highest cross-validation accuracy is selected to predict the screened network fault indicators and prevent the occurrence of network faults in a timely manner.

7. A network fault prediction device based on a double-layer sliding window ARIMA algorithm, used to implement the network fault prediction method based on a double-layer sliding window ARIMA algorithm according to any one of claims 1 to 6, characterized in that: include: The data acquisition module is used to obtain the log data and various indicator parameter data of the target area network at the current moment and store them in the database for visualization; The feature extraction module is used to construct a double-layer sliding window based on the target network's indicator data and the interval length of historical and predicted data, thereby extracting the feature dependency relationship of the historical time period; The fault prediction module is used to input all historical indicator data features into a pre-designed ARIMA algorithm model to obtain network fault prediction results and store them in another database; The graph construction module is used to construct the prediction accuracy curve of the ARIMA algorithm model based on the prediction results and real data.

8. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the steps of the network fault prediction method based on the double-layer sliding window ARIMA algorithm according to any one of claims 1 to 6 are implemented.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, it implements the steps of the network fault prediction method based on the double-layer sliding window ARIMA algorithm according to any one of claims 1 to 6.

Images