Real-time root cause analysis and positioning method for Internet surfing fault of wide fixed network user

Abstract

The invention belongs to the technical field of network fault analysis, and particularly relates to a wide fixed network user online fault real-time root cause analysis and positioning method. The method comprises the following steps: S1) acquiring network performance data from network equipment; s2) preprocessing the acquired data; s3) performing statistical feature extraction on the sub-sequence data of each network device; the statistical features are fused into a multi-dimensional matrix data set according to a unified time step length; s4) combining an LSTM (Long Short Term Memory) model with an Attention mechanism to construct a fault analysis model of a multi-layer LSTM architecture; and S5) deploying a fault analysis model. The LSTM model is adopted to capture the long-term dependency relationship in the time sequence, and the attention weight is dynamically distributed in combination with the Attention mechanism, so that the attention capability of the model on the key time point is enhanced, and the accuracy of fault analysis is improved.

Description

Technical Field

[0001] The present invention belongs to the technical field of network fault analysis, and in particular, relates to a real-time root cause analysis and positioning method for Internet access faults of broadband fixed network users. Background Art

[0002] With the continuous expansion of broadband fixed-line networks and the increasing complexity of networks, real-time root cause analysis of user Internet access failures has become a major challenge in network operation and maintenance. Network operators usually use network equipment monitoring systems, fault management systems, and network performance analysis tools to locate and analyze Internet access failures. These systems collect the operating status and performance data of network equipment and conduct preliminary analysis of network failures based on information fed back by users. The network equipment monitoring system can provide data such as the online status and port performance of the equipment. The fault management system records and tracks the fault information reported by users. Network performance analysis tools evaluate the operating status of the network by measuring network performance indicators such as bandwidth utilization, latency, and packet loss rate. These methods are usually based on precise data recording or single-dimensional fault detection, and have the following shortcomings:

[0003] The inconsistent timestamps of multi-source data (such as optical attenuation, CRC bit error rate, etc.) make it difficult to fuse multi-source data and capture long-term dependencies and complex patterns in time series.

[0004] Existing methods mostly use simple statistical models or rule engines for fault analysis, which lack the ability to dynamically focus on key time points and cannot effectively identify the key time steps for fault occurrence, further reducing the accuracy of fault analysis. In addition, there is a lack of comprehensive analysis of device status changes and network topology relationships, resulting in low fault location efficiency and long troubleshooting time. Summary of the invention

[0005] In order to solve the technical problems in the prior art that multi-source data is difficult to merge and that simple statistical models or rule engines cannot effectively perform fault analysis, the present invention provides a real-time root cause analysis and location method for Internet access failures of broadband and fixed-line users.

[0006] The purpose of the present invention can be achieved through the following technical solutions:

[0007] A method for real-time root cause analysis of broadband fixed-line user Internet access failures comprises the following steps:

[0008] S1) Data collection: Collect network performance data from network devices, including traffic, CRC bit error rate, latency and optical attenuation.

[0009] Preferably, it also includes using a time synchronization protocol (NTP) to unify the timestamps of various network devices to ensure that the timing data of different network devices are aligned during the collection process; the specific implementation process includes:

[0010] Configure the NTP client on each network device, set the synchronization frequency, timeout, and retry mechanism of the NTP client to ensure that time synchronization can be maintained even when the network fluctuates;

[0011] Use the NTP command to check the synchronization status of each network device and the NTP client; ensure that the time deviation of all devices is within milliseconds;

[0012] During the data collection process, each data point (such as traffic, CRC bit error rate, etc.) is accompanied by a device local timestamp.

[0013] The collected data timestamps are uniformly converted into NTP timestamps.

[0014] Data from different network devices are aligned in chronological order based on a unified timestamp.

[0015] S2) Data preprocessing: preprocess the collected data, including data smoothing filtering, sliding window segmentation and data standardization.

[0016] Preferably, the specific process of the sliding window segmentation includes:

[0017] Determine the window length of each subsequence based on data characteristics;

[0018] The number of data points in each window is determined based on the acquisition frequency.

[0019] Use a fixed window length to segment the time series, generating overlapping subsequences with the same number of data points.

[0020] S3) Feature extraction and fusion of multi-source data:

[0021] Extract statistical features from the subsequence data of each network device; and fuse the statistical features into a multidimensional matrix data set according to a unified time step; the statistical features include mean, variance, peak, skewness or time series change rate;

[0022] Preferably, the specific process of step S3) includes:

[0023] S31) selecting a time series change rate as a statistical feature and calculating the time series change rate of subsequence data of each network device;

[0024] S32) using the calculated time series change rate as a feature vector, each subsequence corresponds to a feature vector, thereby forming a time series feature vector set of a network device;

[0025] S33) aligning the timing feature vector sets of each network device according to a unified time step;

[0026] S34) The time-aligned time series feature vector sets are merged into a multi-dimensional matrix, where each row of the multi-dimensional matrix corresponds to a time step, and each column corresponds to a feature vector of a network device.

[0027] S4) Fault analysis model construction and training: The LSTM model and Attention mechanism are combined to build a fault analysis model with a multi-layer LSTM architecture.

[0028] S5) Fault analysis model deployment: The newly collected and fused multidimensional matrix data set is input into the fault analysis model, and the probability of each fault category is output; the fault category with the highest probability is the fault analysis result.

[0029] Preferably, in step S4), the specific process of constructing and training the fault analysis model is as follows:

[0030] The architecture of the fault analysis model includes: an input layer, which is used to input a multidimensional matrix data set of statistical features; an LSTM layer, which is used to capture the long-term dependencies of the time series. Multiple LSTM layers are stacked to enhance the model's expressiveness.

[0031] The Attention layer enables the model to focus on the time steps that are more important for fault analysis. The attention mechanism is used to calculate the attention weight of each time step. The output of the LSTM is weighted and summed according to the attention weight to obtain the final context vector.

[0032] Fully connected layer, used to input the context vector into the fully connected layer for feature mapping and classification;

[0033] The output layer is used to output the probability of each fault category according to the softmax activation function;

[0034] Divide the multidimensional matrix data set into a training set and a test set, and use the training set data to train the fault analysis model; adjust the hyperparameters of the model for optimization through grid search or random search methods;

[0035] Preferably, the specific implementation process of using the attention mechanism to calculate the attention weight of each time step includes:

[0036] The output of LSTM, i.e., the hidden state at time step t, is linearly transformed using a learnable weight matrix to obtain a query vector and a key vector; the linear transformation formula is:

[0037] q t =W q ·h t ;k t =W k ·h t ;

[0038] In the formula, q t and k t are query vector and key vector respectively; W q and k t are different learnable weight matrices; h t represents the hidden state at time step t;

[0039] The attention score is calculated using the additive attention mechanism, and its calculation formula is:

[0040] e t =V T tanh(W q ·q t +W k ·k t );

[0041] In the formula, e t represents the attention score at time step t; V is the learnable parameter vector; T is the total number of time steps; tanh is the hyperbolic tangent activation function;

[0042] The attention score is normalized to the attention weight using the Softmax function; its calculation formula is:

[0043]

[0044] In the formula, a t represents the attention weight of time step t; T is the total number of time steps; Represents the exponential summation of the attention scores of all time steps for Softmax normalization.

[0045] The present invention also provides a positioning method based on the above-mentioned real-time root cause analysis of broadband fixed network user Internet access failure, which also includes the following steps:

[0046] S6) Fault root cause location:

[0047] Extract the attention weights generated by the Attention mechanism, which reflect the importance of different time steps for fault diagnosis;

[0048] Select key time steps where the attention weight is above a certain threshold;

[0049] The attention weights are combined with the real-time status information of the devices to identify the devices or cable segments whose status changes in the critical time steps;

[0050] Represent the network as a graph structure, with nodes representing devices and connecting lines representing fiber optic cable segments, and establish a network topology;

[0051] Use centrality analysis methods in graph theory (such as degree centrality, betweenness centrality, and closeness centrality) to analyze the importance of potential faulty equipment or optical cable segments in the network topology;

[0052] According to the centrality analysis results, select the device or optical cable segment with high connection centrality as the root cause of the fault.

[0053] Preferably, the threshold is determined by analyzing the distribution of attention weights, selecting the first 5-7 attention weights as the threshold, and then determining the critical time step.

[0054] Preferably, the method further comprises: assisting in identifying the root cause of the fault according to the collected network status data; the network status data comprises device status, port status, and optical cable status.

[0055] Beneficial effects of the present invention:

[0056] 1. Through the distributed data acquisition system, the data acquisition tasks are dispersed to multiple network device nodes, which significantly improves the efficiency and real-time performance of data acquisition. And through statistical feature extraction and time alignment, the feature vector sets of multiple sources are integrated into a unified multi-dimensional matrix, which enhances the data representation ability and analysis effect.

[0057] 2. The LSTM model is used to capture long-term dependencies in time series, and the Attention mechanism is used to dynamically allocate attention weights, which enhances the model's ability to focus on key time points and improves the accuracy of fault analysis. The Softmax output layer supports analysis of multiple fault categories, enhancing the overall performance of the system.

[0058] 3. By selecting key time points through attention weights, combining centrality analysis and state change information, the root cause of the fault can be dynamically located, thereby accurately locating the fault point and significantly shortening the troubleshooting time. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for describing the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0060] Figure 1 This is a flow chart of a method for real-time root cause analysis of broadband fixed-line user Internet access failures in Embodiment 1 of the present invention;

[0061] Figure 2 This is a flowchart of step S3) of a method for real-time root cause analysis of broadband fixed-line user Internet access failures in embodiment 1 of the present invention;

[0062] Figure 3 This is a flow chart of a method for locating the root cause of a broadband fixed-line user's Internet access failure in real time in Embodiment 2 of the present invention. DETAILED DESCRIPTION

[0063] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0064] Example 1

[0065] See also Figure 1-Figure 2 As shown, a method for real-time root cause analysis of broadband fixed network user Internet access failures includes the following steps:

[0066] S1) Data collection: Collect network performance data from network devices, including traffic, CRC bit error rate, latency and optical attenuation.

[0067] Specifically, the present invention adopts a distributed data acquisition system to distribute data acquisition tasks to multiple network device nodes; wherein the network devices include switches, optical cables, and terminal devices, etc. Including but not limited to:

[0068] 1. Collect network status data from network devices through network monitoring tools (such as SNMP, NetFlow), including device status, port status, and optical cable status. 2. Collect network performance data through sensors (such as optical power meters, OTDR, etc.), including flow, CRC bit error rate, delay, and optical attenuation data.

[0069] In addition, set a reasonable collection frequency based on network load and device performance. For example, regular synchronous collection: Before each data collection, force an NTP time synchronization to ensure the accuracy of the timestamp. Dynamically adjust the NTP synchronization frequency based on the collection frequency (such as collecting performance data every 15 minutes and collecting status data every 30 minutes).

[0070] Event-triggered synchronous acquisition: When a network anomaly is detected (such as a sudden increase in optical attenuation, increased CRC bit error rate, etc.), NTP synchronization is immediately triggered to ensure the accuracy of the timestamp of the abnormal event.

[0071] Furthermore, it also includes using the time synchronization protocol (NTP) to unify the timestamps of various network devices to ensure that the timing data of different network devices are aligned during the collection process; the specific implementation process includes:

[0072] Configure the NTP client on each network device, set the synchronization frequency, timeout, and retry mechanism of the NTP client to ensure that time synchronization can be maintained even when the network fluctuates;

[0073] Use NTP commands (such as ntpq -p) to check the synchronization status of each network device and the NTP client; ensure that the time deviation of all devices is within milliseconds;

[0074] During the data collection process, each data point (such as device status, port status, traffic, CRC error rate, etc.) is accompanied by a device local timestamp.

[0075] The collected data timestamps are uniformly converted into NTP timestamps.

[0076] Data from different network devices are aligned in chronological order based on a unified timestamp.

[0077] As a further implementation method, interpolation or smoothing methods are used to correct data points with inconsistent timestamps. The timestamps are unified through the NTP protocol to ensure the consistency of multi-source data in the time dimension. The high-precision synchronization capability of NTP supports real-time data synchronization collection.

[0078] Specifically, unifying the timestamps of network devices through the NTP protocol is the basis of the real-time root cause analysis system for broadband and fixed-line users' Internet access failures. Its implementation process includes NTP server deployment, device time synchronization configuration, and data collection timestamp alignment. It not only improves data consistency and the accuracy of fault analysis, but also provides a reliable time benchmark for real-time root cause analysis of faults.

[0079] S2) Data preprocessing: preprocess the collected data, including data smoothing filtering, sliding window segmentation and data standardization.

[0080] Furthermore, the specific process of the sliding window segmentation includes:

[0081] Determine the window length of each subsequence based on data characteristics;

[0082] The number of data points in each window is determined based on the acquisition frequency.

[0083] Use a fixed window length to segment the time series, generating overlapping subsequences with the same number of data points.

[0084] In the specific implementation process, the window length can determine the time span of each subsequence according to business requirements and data characteristics. For example, 20s is selected as the window length to capture network status changes within 20s.

[0085] Sliding step is the step size of each window slide. The step size can be less than the window length to generate overlapping subsequences, or equal to the window length to generate non-overlapping subsequences. For example, if you select 5s as the step size, 50% overlapping subsequences are generated.

[0086] The data granularity can be determined by the number of data points in each window based on the frequency of collection (e.g., collecting performance data regularly every 15 minutes or triggering collection when a network anomaly is detected). For example, a window length of 20 seconds corresponds to 4 data points.

[0087] As an optional implementation, when there are insufficient data points in the window, a filling method (such as forward filling, backward filling or interpolation) is used to complete the data. When the data points in the window exceed the window length, the redundant data points are truncated. In addition, the window length can be dynamically adjusted according to the network load and the fault type. For example, when the network load is high, a shorter window length is used to capture rapid changes.

[0088] Specifically, the purpose of sliding window segmentation is to generate subsequences and input the feature vectors of the subsequences into the LSTM model to detect the fault mode in each window. The changing trend of performance indicators such as optical attenuation and flow is captured through the time series relationship of the sliding window. Sliding window segmentation is a key technology in data preprocessing. By dividing time series data into subsequences of fixed length, it can effectively capture time dependencies and provide high-quality input data for subsequent fault analysis models. This significantly improves the accuracy and real-time performance of fault detection and trend analysis.

[0089] S3) Feature extraction and fusion of multi-source data:

[0090] Extract statistical features from the subsequence data of each network device; and fuse the statistical features into a multidimensional matrix data set according to a unified time step; the statistical features include mean, variance, peak, skewness or time series change rate;

[0091] Further, the specific process of step S3) includes:

[0092] S31) selecting a time series change rate as a statistical feature and calculating the time series change rate of subsequence data of each network device;

[0093] S32) using the calculated time series change rate as a feature vector, each subsequence corresponds to a feature vector, thereby forming a time series feature vector set of a network device;

[0094] S33) aligning the timing feature vector sets of each network device according to a unified time step;

[0095] S34) The time-aligned time series feature vector sets are merged into a multi-dimensional matrix, where each row of the multi-dimensional matrix corresponds to a time step, and each column corresponds to a feature vector of a network device.

[0096] In the specific implementation process, select appropriate statistical features based on business needs and data characteristics. Common statistical features include:

[0097] Mean: reflects the average level of subsequence data.

[0098] Variance: reflects the degree of fluctuation of subsequence data.

[0099] Peak value: reflects the maximum or minimum value of the subsequence data.

[0100] Skewness: reflects the symmetry of the distribution of subsequence data.

[0101] Time series change rate: reflects the changing trend of subsequence data (such as first-order difference or slope).

[0102] Then, the selected statistical features are calculated for each subsequence data, and the calculated statistical features are stored as feature vectors, each subsequence corresponds to a feature vector, and then a time series feature vector set of a network device is formed.

[0103] As an optional implementation, the fused multidimensional matrix may also be standardized, such as using Z-score standardization or Min-Max standardization, to eliminate dimensional differences between features.

[0104] Specifically, the original time series data is extracted as statistical features to reduce the data dimension and the model calculation complexity. Through statistical feature extraction, the distribution and change trend of subsequence data are captured to enhance the characterization ability of features. In this way, a multidimensional matrix data set is constructed through the collected data of each network device, which provides richer information for the model and significantly improves the accuracy and real-time performance of fault analysis.

[0105] S4) Fault analysis model construction and training: The LSTM model and Attention mechanism are combined to build a fault analysis model with a multi-layer LSTM architecture.

[0106] Further, in step S4), the specific process of constructing and training the fault analysis model is as follows:

[0107] The architecture of the fault analysis model includes: an input layer, which is used to input a multidimensional matrix data set of statistical features; an LSTM layer, which is used to capture the long-term dependencies of the time series. Multiple LSTM layers are stacked to enhance the model's expressiveness.

[0108] The Attention layer enables the model to focus on the time steps that are more important for fault analysis. The attention mechanism is used to calculate the attention weight of each time step. The output of the LSTM is weighted and summed according to the attention weight to obtain the final context vector.

[0109] Fully connected layer, used to input the context vector into the fully connected layer for feature mapping and classification;

[0110] The output layer is used to output the probability of each fault category according to the softmax activation function;

[0111] Divide the multidimensional matrix data set into a training set and a test set, and use the training set data to train the fault analysis model; adjust the hyperparameters of the model for optimization through grid search or random search methods;

[0112] In the specific implementation process, the training process of the fault analysis model is as follows:

[0113] Use the training set data to train the model, use the Adam optimizer to train the model, set an appropriate learning rate (such as 0.001), and update the model parameters through the back propagation algorithm.

[0114] After each training cycle (Epoch), the validation set is used to evaluate the model performance to prevent overfitting. Early stopping is used to terminate the training early when the validation set performance no longer improves.

[0115] Tune hyperparameters such as the number of LSTM layers, number of hidden units, learning rate, etc. through grid search or random search.

[0116] Specifically, for different types of faults (such as optical cable breakage, excessive optical attenuation, equipment failure, etc.), the LSTM+Attention mechanism is used to establish a fault analysis model; LSTM processes the long-term dependencies of time series through a gating mechanism, and can capture the complex time patterns of optical attenuation changes and network load changes; the Attention mechanism can enhance the model's ability to pay attention to key time points; through the Softmax output layer, the model can simultaneously support the analysis of multiple fault categories.

[0117] Furthermore, the specific implementation process of using the attention mechanism to calculate the attention weight of each time step includes:

[0118] The output of LSTM, i.e., the hidden state at time step t, is linearly transformed using a learnable weight matrix to obtain a query vector and a key vector; the linear transformation formula is:

[0119] q t =W q ·ht ;k t =W k ·h t ;

[0120] In the formula, q t and k t are query vector and key vector respectively; W q and k t are different learnable weight matrices; h t represents the hidden state at time step t;

[0121] The attention score is calculated using the additive attention mechanism, and its calculation formula is:

[0122] e t =V T tanh(W q ·q t +W k ·k t );

[0123] In the formula, e t represents the attention score at time step t; V is the learnable parameter vector; T is the total number of time steps; tanh is the hyperbolic tangent activation function;

[0124] The attention score is normalized to the attention weight using the Softmax function; its calculation formula is:

[0125]

[0126] In the formula, a t represents the attention weight of time step t; T is the total number of time steps; Represents the exponential summation of the attention scores of all time steps for Softmax normalization.

[0127] S5) Fault analysis model deployment: The newly collected and fused multidimensional matrix data set is input into the fault analysis model, and the probability of each fault category is output; the fault category with the highest probability is the fault analysis result.

[0128] Specifically, the present invention provides a real-time root cause analysis method for Internet access failures of broadband and fixed-line users. By combining the LSTM model and the Attention mechanism, a fault analysis model with a multi-layer LSTM architecture is constructed, which can effectively capture the long-term dependencies in time series data and enhance the model's ability to focus on key time points.

[0129] Example 2

[0130] See also Figure 3As shown, based on Example 1, the present invention also provides a method for locating a broadband fixed network user's Internet access failure in real time for root cause analysis, which also includes the following steps:

[0131] S6) Fault root cause location:

[0132] Extract the attention weights generated by the Attention mechanism, which reflect the importance of different time steps for fault diagnosis;

[0133] Select key time steps where the attention weight is above a certain threshold;

[0134] The attention weights are combined with the real-time status information of the devices to identify the devices or cable segments whose status changes in the critical time steps;

[0135] Represent the network as a graph structure, with nodes representing devices and connecting lines representing fiber optic cable segments, and establish a network topology;

[0136] Use centrality analysis methods in graph theory (such as degree centrality, betweenness centrality, and closeness centrality) to analyze the importance of potential faulty equipment or optical cable segments in the network topology;

[0137] According to the centrality analysis results, select the device or optical cable segment with high connection centrality as the root cause of the fault.

[0138] Furthermore, the threshold analyzes the distribution of attention weights and selects the first 5-7 attention weights as the threshold to determine the critical time step.

[0139] Furthermore, it also includes: assisting in identifying the root cause of the fault based on the collected network status data; the network status data includes device status, port status, and optical cable status.

[0140] Specifically, by extracting attention weights, selecting key time points, identifying devices or cable segments with status changes, building a network topology model, and combining centrality analysis with the collected device status data, the root cause of broadband and fixed-line user Internet access failures can be accurately located. In this way, based on the fault analysis model, key time points are selected based on attention weights, and the network topology structure is analyzed in combination with centrality, so that the location of the fault point can be accurately located.

[0141] The above contents are merely examples and explanations of the structure of the present invention. The technicians in this technical field may make various modifications or additions to the specific embodiments described or replace them in a similar manner. As long as they do not deviate from the structure of the invention or exceed the scope defined by the claims, they should all fall within the protection scope of the present invention.

Claims

1. A method for real-time root cause analysis of broadband fixed-line user Internet access failures, characterized in that: The following steps are involved: S1) collecting network performance data from network devices, the network performance data including flow, CRC bit error rate, delay and optical attenuation; S2) preprocessing the collected data, including data smoothing filtering, sliding window segmentation and data standardization; S3) extracting statistical features from the subsequence data of each network device; and fusing each statistical feature into a multidimensional matrix data set according to a unified time step; the statistical features include mean, variance, peak, skewness or time series change rate; S4) Combining the LSTM model with the Attention mechanism to build a fault analysis model with a multi-layer LSTM architecture; S5) Input the newly collected and fused multidimensional matrix data set into the fault analysis model, and output the probability of each fault category; the fault category with the largest probability is the fault analysis result.

2. According to claim 1, a method for real-time root cause analysis of broadband fixed-line user Internet access failures is characterized by: It also includes using a time synchronization protocol to unify the timestamps of various network devices to ensure that the timing data of different network devices are aligned during the collection process; The specific implementation process includes: Configure the NTP client on each network device, set the synchronization frequency, timeout, and retry mechanism of the NTP client to ensure that time synchronization can be maintained even when the network fluctuates; Use the NTP command to check the synchronization status of each network device and the NTP client; ensure that the time deviation of all devices is within milliseconds; During data collection, each data point is accompanied by a device-local timestamp; Convert the collected data timestamps into NTP timestamps; Data from different network devices are aligned in chronological order based on a unified timestamp.

3. The method for real-time root cause analysis of broadband fixed-line user Internet access failures according to claim 1, characterized in that: The specific process of the sliding window segmentation includes: Determine the window length of each subsequence based on data characteristics; According to the acquisition frequency, determine the number of data points in each window; Use a fixed window length to segment the time series, generating overlapping subsequences with the same number of data points.

4. The method for real-time root cause analysis of broadband fixed-line user Internet access failures according to claim 1, characterized in that: The specific process of step S3) includes: S31) selecting a time series change rate as a statistical feature and calculating the time series change rate of subsequence data of each network device; S32) using the calculated time series change rate as a feature vector, each subsequence corresponds to a feature vector, thereby forming a time series feature vector set of a network device; S33) aligning the timing feature vector sets of each network device according to a unified time step; S34) The time-aligned time series feature vector sets are merged into a multi-dimensional matrix, where each row of the multi-dimensional matrix corresponds to a time step, and each column corresponds to a feature vector of a network device.

5. The method for real-time root cause analysis of broadband fixed-line user Internet access failures according to claim 1, characterized in that: In step S4), the specific process of constructing and training the fault analysis model includes: The architecture of the fault analysis model includes: an input layer, which is used to input a multidimensional matrix data set of statistical features; an LSTM layer, which is used to capture the long-term dependencies of the time series. Multiple LSTM layers are stacked to enhance the model's expressiveness. The Attention layer enables the model to focus on the time steps that are more important for fault analysis. The attention mechanism is used to calculate the attention weight of each time step. The output of the LSTM is weighted and summed according to the attention weight to obtain the final context vector. Fully connected layer, used to input the context vector into the fully connected layer for feature mapping and classification; The output layer is used to output the probability of each fault category according to the softmax activation function; The multidimensional matrix data set is divided into a training set and a test set, and the fault analysis model is trained using the training set data; the hyperparameters of the model are adjusted and optimized through grid search or random search methods.

6. A method for real-time root cause analysis of broadband fixed-line user Internet access failures according to claim 5, characterized in that: The specific implementation process of using the attention mechanism to calculate the attention weight of each time step includes: The output of LSTM, i.e., the hidden state at time step t, is linearly transformed using a learnable weight matrix to obtain a query vector and a key vector; the linear transformation formula is: q t =W q ·h t ;k t =W k ·h t ; In the formula, q t and k t are query vector and key vector respectively; W q and k t are different learnable weight matrices; h t represents the hidden state at time step t; The attention score is calculated using the additive attention mechanism, and its calculation formula is: e t =V T ·tanh(W q ·q t +W k ·k t ); In the formula, e t represents the attention score at time step t; V is the learnable parameter vector; T is the total number of time steps; tanh is the hyperbolic tangent activation function; The attention score is normalized to the attention weight using the Softmax function; its calculation formula is: In the formula, a t represents the attention weight of time step t; T is the total number of time steps; Represents the exponential summation of the attention scores of all time steps for Softmax normalization.

7. A method for locating a broadband fixed network user's Internet access failure in real time for root cause analysis according to any one of claims 1 to 6, characterized in that: The following steps are also included: Extract the attention weights generated by the Attention mechanism; Select key time steps where the attention weight is above a certain threshold; The attention weights are combined with the real-time status information of the devices to identify the devices or cable segments whose status changes in the critical time steps; Represent the network as a graph structure, with nodes representing devices and connecting lines representing fiber optic cable segments, and establish a network topology; Use centrality analysis methods in graph theory to analyze the importance of potential faulty equipment or optical cable segments in the network topology; According to the centrality analysis results, select the device or optical cable segment with high connection centrality as the root cause of the fault.

8. The method for locating a broadband fixed network user's Internet access failure in real time for root cause analysis according to claim 7, characterized in that: The threshold analyzes the distribution of attention weights and selects the first 5-7 attention weights as the threshold to determine the key time step.

9. The method for locating a broadband fixed network user's Internet access failure in real time for root cause analysis according to claim 7, characterized in that: Also includes: Assist in identifying the root cause of the fault based on the collected network status data; Network status data includes device status, port status, and optical cable status.

Images