Analysis method for high-flow user identification and service upgrade solution

Abstract

The invention relates to an analysis method for a high-traffic user identification and service upgrading solution. The method comprises the following steps: collecting user network activity data samples of a time sequence from a network log and network monitoring equipment; extracting main characteristics of user network activity data by adopting a statistical analysis method, and judging whether the monitored user is a high-flow user or not according to the main characteristics; when it is determined that the monitored user is the high-traffic user, inputting the main features of the user network activity data into a preset first deep learning model, and outputting a predicted user behavior pattern; inputting the predicted user behavior mode into a preset second deep learning model, and predicting a future bandwidth demand and a traffic peak; and determining a corresponding network resource configuration scheme according to a future bandwidth requirement and a traffic peak. According to the invention, the problem of inaccurate network resource configuration caused by difficulty in quickly and accurately predicting high-flow users and behavior models thereof at the same time in the prior art is solved.

Description

Technical Field

[0001] The invention belongs to the field of Internet technology and relates to an analysis method for high-traffic user identification and service upgrade solutions. Background Art

[0002] As Internet applications become increasingly popular, users' expectations for network service quality continue to rise, and the needs of high-traffic user groups are particularly prominent. Such users include enthusiastic viewers of video streaming, deep players of online games, and users who frequently upload and download large files. Their high-intensity network behavior causes a sharp increase in network resource consumption, which brings a heavy burden to the network environment, seriously interferes with the reasonable allocation of network resources, and has a negative impact on the overall service quality. In view of this, accurately identifying high-traffic users and building an adaptive service upgrade strategy are extremely critical to the optimal allocation of network resources and the improvement of user satisfaction.

[0003] However, the existing solutions have limitations in terms of accuracy, real-time performance and adaptability. For example, although statistical analysis methods are easy to implement, their accuracy is difficult to meet the needs; although traditional machine learning methods have made progress in accuracy, they still have significant shortcomings in real-time response and flexible adaptation; deep learning methods can achieve higher recognition accuracy and good adaptability, but they consume a lot of computing resources and the model training cycle is lengthy. Summary of the invention

[0004] The present invention provides an analysis method for high-traffic user identification and service upgrade solutions, aiming to combine statistical analysis methods and deep learning methods in a complementary form to quickly and accurately identify high-traffic users and their behavior patterns, wherein the statistical analysis method reduces the computing resources of subsequent deep learning and improves the training speed by processing and extracting features of user network activity data; the deep learning method improves the accuracy and adaptability of the analysis through nonlinear processing capabilities.

[0005] The purpose of the present invention can be achieved through the following technical solutions:

[0006] This application provides an analysis method for high-traffic user identification and service upgrade solution, including the following steps:

[0007] S1. Collecting a time series of user network activity data samples from network logs and network monitoring devices, wherein the network activity data includes network traffic, access frequency and network bandwidth;

[0008] S2, extracting the main features of the user's network activity data using a statistical analysis method, and judging whether the monitored user is a high-traffic user based on the main features;

[0009] S3. When it is determined that the monitored user is a high-traffic user, the main features of the user's network activity data are input into a preset first deep learning model, and a predicted user behavior pattern is output;

[0010] S4, inputting the predicted user behavior pattern into a preset second deep learning model to predict future bandwidth demand and traffic peak;

[0011] S5. Determine the corresponding network resource allocation plan based on future bandwidth requirements and traffic peaks.

[0012] Furthermore, in step S2, the statistical analysis method is configured as a principal component analysis method, comprising the following steps:

[0013] S21, standardizing the user's network activity data;

[0014] S22, calculating the covariance matrix of the standardized data, and determining the linear correlation between the variables of each user's network activity data;

[0015] S23, performing eigendecomposition on the covariance matrix to obtain eigenvalues ​​and eigenvectors;

[0016] S24, selecting the principal component: selecting the principal component according to the size of the eigenvalue and the cumulative contribution rate, and using the principal component as the main feature of the user network activity data;

[0017] S25, obtaining a principal component score of each sample in the principal component space by multiplying the original data with the eigenvector corresponding to the selected principal component;

[0018] S26. Set a total principal component score threshold. When the total principal component score of the monitored user exceeds the preset total principal component score threshold, the monitored user is determined to be a high-traffic user.

[0019] Furthermore, in step S21, the normalization is calculated by the following formula:

[0020]

[0021] Where D ij represents the standardized value of the jth data sample of the ith user network activity data variable; C ij I represents the original value of the jth data sample of the i-th user network activity data variable; mean represents the average value of the i-th user network activity data variable; I sd Represents the standard deviation of the i-th user network activity data variable.

[0022] Furthermore, in step S3, the user behavior patterns include: content consumption pattern, social interaction pattern, work and study pattern, and entertainment and gaming pattern.

[0023] Furthermore, in step S3, the first deep learning model is configured as a convolutional neural network model, including the following construction steps:

[0024] S31, data preprocessing: converting the main features of the input user network activity data into data format and normalizing the data;

[0025] S32, model construction: including convolution layer definition, pooling layer setting and full connection layer construction; the convolution layer definition is specifically as follows: multiple convolution layers are set, and in each convolution layer, the size, number and step size of the convolution kernel are determined; the convolution kernel slides on the input data to perform convolution operations and extract local features in the data;

[0026] The pooling layer is configured as a maximum pooling layer or an average pooling layer, which is used to downsample the data output by the convolution layer to reduce the data dimension while retaining the main feature information;

[0027] The fully connected layer is constructed to perform a fully connected operation on the previously processed data, combining local features to output a prediction result about the user behavior pattern;

[0028] S33, model training: using the main features of user network activity data as input and user behavior patterns as output, learning is performed using the established convolutional neural network structure;

[0029] S34. Model evaluation: Use accuracy, precision, recall and F1 value to evaluate the model's predictive performance on user behavior patterns.

[0030] Furthermore, in step S33, the learning using the constructed convolutional neural network structure includes the following steps:

[0031] Loss function determination: Select cross entropy loss as the loss function to measure the deviation between the model prediction results and the actual user behavior pattern;

[0032] Optimizer selection: Stochastic gradient descent is selected as the optimizer to update the model parameters according to the value of the loss function, so that the model continues to develop in the direction of reducing the loss;

[0033] Training data division: Divide the user network activity data with known user behavior patterns into training set, validation set and test set;

[0034] Model training execution: Use the training set data to repeatedly train the convolutional neural network structure, and continuously update the model parameters according to the loss function through the optimizer until the preset training stop condition is reached.

[0035] Furthermore, in step S4, the second deep learning model is configured as a long short-term memory network, including the following construction steps:

[0036] S41, data preparation: for the predicted user behavior pattern, collect the complete time series of user network activity data under the user behavior pattern from the storage system;

[0037] S42, model construction: Determine the input dimension, output dimension and number of hidden units of the LSTM layer according to the dimension of the input data and the dimension of the expected output; add a fully connected layer to integrate and transform the features of the LSTM layer output;

[0038] S43, model training: select the first n data samples of the user network activity data of the complete time series as input, and the remaining data samples as expected output, and train the constructed LSTM model;

[0039] S44, model evaluation: Calculate the mean square error or mean absolute error between the predicted output and the expected output to evaluate the prediction accuracy of the model;

[0040] S45, model application: obtain the user network activity data of a time series that needs to be predicted, input it into the LSTM model of the corresponding user behavior pattern, and predict the user network activity data of a time series in the future to determine the bandwidth demand and traffic peak.

[0041] Furthermore, in step S5, the corresponding network resource allocation plan is determined according to the future bandwidth requirements and traffic peaks, specifically, the bandwidth allocation strategy is dynamically adjusted according to the priority of key businesses or high-traffic users; at the same time, a real-time monitoring mechanism is established to adjust the resource allocation plan according to different traffic loads.

[0042] Beneficial effects of the present invention:

[0043] By collecting a time series of user network activity data samples from network logs and network monitoring equipment; using statistical analysis methods to extract the main features of user network activity data, and judging whether the monitored user is a high-traffic user from the main features; when the monitored user is determined to be a high-traffic user, the main features of the user network activity data are input into a preset first deep learning model, and a predicted user behavior pattern is output; the predicted user behavior pattern is input into a preset second deep learning model to predict future bandwidth requirements and traffic peaks; according to future bandwidth requirements and traffic peaks, the corresponding network resource configuration plan is determined. The present invention solves the problem that the prior art is difficult to simultaneously meet the requirements of fast and accurate prediction of high-traffic users and their behavior models, resulting in inaccurate network resource configuration. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to facilitate understanding by those skilled in the art, the present invention is further described below with reference to the accompanying drawings.

[0045] Figure 1 The present invention is a flowchart of an analysis method for high-traffic user identification and service upgrade solution.

[0046] Figure 2 A flowchart of constructing a first deep learning model in one embodiment of the present invention.

[0047] Figure 3 A flowchart of constructing a second deep learning model in one embodiment of the present invention. DETAILED DESCRIPTION

[0048] In order to further explain the technical means and effects adopted by the present invention to achieve the predetermined invention purpose, the specific implementation mode, structure, characteristics and effects of the present invention are described in detail below in combination with the accompanying drawings and preferred embodiments.

[0049] See also Figure 1-Figure 3 , the present application provides an analysis method for high-traffic user identification and service upgrade solution, comprising the following steps:

[0050] S1. Collecting a time series of user network activity data samples from network logs and network monitoring devices, wherein the network activity data includes network traffic, access frequency and network bandwidth;

[0051] In this embodiment, relevant data is obtained from two channels: network logs and network monitoring devices. Network logs record various detailed information during network operation, such as various operation records of users; network monitoring devices can monitor various indicators of the network in real time. The combination of the two can more comprehensively cover the activities of users in the network. Secondly, it is mentioned that the collected data is a sample of a time series. This means that it is not data at a single time point, but multiple groups of data arranged in a certain order within a continuous time period, which can more accurately reflect the dynamic trend of user network activities and help to analyze user behavior patterns more accurately in the future. Network traffic can reflect the amount of data transmitted by users in the network; access frequency can reflect the frequency of users accessing various network resources; network bandwidth is related to the ability of the network to transmit data. Through the collection of these key indicator data, it provides basic materials for the subsequent use of statistical analysis methods to extract the main features and further analyze and predict through deep learning models, which is an important prerequisite for the effective implementation of the entire high-traffic user identification and related service upgrade solutions.

[0052] S2, extracting the main features of the user's network activity data using a statistical analysis method, and judging whether the monitored user is a high-traffic user based on the main features;

[0053] In this embodiment, the collected user network activity sequence data is huge in scale, and it is difficult to extract key information representing user network characteristics from a large amount of data by statistical means such as calculating mean, extreme value, median, standard deviation, etc. Therefore, this embodiment uses the principal component analysis method to extract the main features of user network activity data, and then identify high-traffic users.

[0054] Principal component analysis (PCA) can transform these original multiple related variables into a few unrelated comprehensive variables, namely principal components. These principal components can retain most of the information of the original data, reduce the dimension of the data, and thus reduce the complexity of subsequent processing. In the scenario of high-traffic user identification, PCA can extract the most valuable information for judging whether a user is a high-traffic user. For example, it may be found that certain change patterns of network traffic or access frequency are most closely related to high-traffic users. These key features will be highlighted in the principal components, which will help to more accurately judge high-traffic users. In addition, there may be some noise in the network activity data, such as occasional abnormal access records or measurement errors. PCA can filter out this noise to a certain extent by projecting the data into a new principal component space. At the same time, it can also remove redundant information between variables, because it is transformed based on the correlation between variables, making each principal component as independent as possible, improving the accuracy of subsequent analysis.

[0055] Furthermore, in step S2, the statistical analysis method is configured as a principal component analysis method, comprising the following steps:

[0056] S21. Data standardization:

[0057] Since the collected network activity data (such as network traffic, access frequency, etc.) may have different dimensions and value ranges, the data needs to be standardized first. The commonly used method is to subtract the mean of each variable and then divide it by its standard deviation. This step ensures that each variable has the same weight in subsequent analysis and avoids analysis bias caused by dimensional differences.

[0058] Furthermore, the data is standardized and the calculation formula is:

[0059]

[0060] Where D ij represents the standardized value of the jth data sample of the ith user network activity data variable; C ij I represents the original value of the jth data sample of the i-th user network activity data variable; mean represents the average value of the i-th user network activity data variable; I sd Represents the standard deviation of the i-th user network activity data variable.

[0061] S22. Calculate the covariance matrix:

[0062] After standardization, the covariance matrix of the data is calculated. The covariance matrix can reflect the linear correlation between various variables. In user network activity data, it can reflect the degree of correlation between network traffic and access frequency, network bandwidth and access frequency, and other variables. For example, if the covariance between network traffic and access frequency is large and positive, it means that there is a positive correlation between them, that is, the higher the access frequency, the greater the network traffic.

[0063] S23. Calculate eigenvalues ​​and eigenvectors:

[0064] Perform eigendecomposition on the covariance matrix to obtain eigenvalues ​​and eigenvectors. The eigenvalue indicates the amount of information contained in each principal component, and the eigenvector determines the direction of the principal component. The principal components are usually sorted according to the size of the eigenvalue. The principal component with a larger eigenvalue contains more original data information. For example, if the eigenvalue of the first principal component is much larger than that of other principal components, it means that this principal component can well represent the main change trend of the original data.

[0065] S24. Select the main component:

[0066] The principal component is selected based on the size of the eigenvalue and the cumulative contribution rate. The cumulative contribution rate refers to the ratio of the sum of the eigenvalues ​​of the first few principal components to the sum of all eigenvalues. Generally, the principal component with a cumulative contribution rate reaching a certain threshold (such as 80% or 90%) is selected as the final principal component, and the principal component is used as the main feature of the user network activity data. In this way, effective data dimensionality reduction can be achieved while retaining enough original data information.

[0067] S25. Calculate the principal component score:

[0068] By multiplying the original data with the eigenvector corresponding to the selected principal component, the score of each sample in the principal component space is obtained. These scores can be used as new variables for subsequent analysis such as high-traffic user judgment.

[0069] S26. Set a total principal component score threshold. When the total principal component score of the monitored user exceeds the preset total principal component score threshold, the monitored user is determined to be a high-traffic user.

[0070] S3. When it is determined that the monitored user is a high-traffic user, the main features of the user's network activity data are input into a preset first deep learning model, and a predicted user behavior pattern is output;

[0071] In this embodiment, after determining that the monitored user is a high-traffic user through the previous principal component analysis, it enters the stage of further analysis with the help of a deep learning model. The main features (principal components) of the extracted user network activity data, that is, the key information that can represent the network traffic characteristics, access frequency patterns, etc. after processing, are input into the pre-set first deep learning model. The deep learning model can deeply mine and analyze these main input features with its powerful nonlinear processing capabilities and complex neural network structure. Through a large number of training and learning mechanisms, it can infer and output possible behavior patterns of the high-traffic user based on these features.

[0072] Furthermore, the user behavior pattern includes:

[0073] (1) Content consumption model:

[0074] Video enthusiasts: The network traffic of this type of users is mainly concentrated on video playback platforms. From the network activity data, downlink traffic (receiving data) accounts for a large proportion, and the traffic consumption is continuous and stable. For example, they may concentrate on watching long videos, such as TV series and movies, at night or on weekends. The higher the resolution of the video, the more network traffic is required. By observing the peak traffic hours and traffic size, we can determine their habitual time for watching videos.

[0075] Reading enthusiasts: They mainly browse text content, such as e-books, news and information websites, etc. The traffic generated by each visit is relatively small, but the frequency of visits may be high. In the network activity data, the HTTP / HTTPS protocol (for web browsing) is used frequently, and the traffic consumption may be concentrated on certain specific news or reading websites.

[0076] (2) Social interaction model:

[0077] Active social users: They frequently use social networking platforms, such as WeChat and Weibo. Their network activity data shows a high access frequency, and the traffic consumption is mainly used to load new messages, pictures, short videos and other content. By analyzing the data, it can be found that this type of user has small traffic peaks at multiple times a day, such as on the way to work in the morning, during lunch break and in the evening leisure time, for checking and posting updates.

[0078] Social group participants: These users often participate in group chats, forum discussions, and other activities. From the network activity data, their data transmission direction is both upstream (sending messages) and downstream (receiving group messages and files). Traffic consumption may peak when group activities are frequent (such as when discussing hot topics), and the ports and protocols involved are usually related to instant messaging software.

[0079] (3) Work-Study Model:

[0080] Remote workers: They frequently use work-related software and services during working hours, such as enterprise office software (DingTalk, WeChat for Enterprise, etc.), cloud storage services, etc. Network activity data shows that their traffic consumption has a certain regularity, with traffic peaks during working hours, both upstream and downstream, depending on the work content (such as uploading files or downloading meeting materials). At the same time, they may often use video conferencing functions to transmit data through protocols such as UDP.

[0081] Online learners: They frequently visit online learning platforms, such as NetEase Cloud Classroom and Coursera. Their traffic consumption pattern is related to the rhythm of course learning. They may consume traffic intensively during course updates or learning time, such as downloading course materials and watching teaching videos. Downlink traffic accounts for a large proportion, and traffic peaks may occur during learning times such as evenings or weekends.

[0082] (4) Entertainment Game Mode

[0083] Mobile game enthusiasts: They mainly play games on their mobile phones, and their network activity data shows frequent connections to game servers. Each time a game is started and run, a certain amount of data traffic is consumed, which is used to update game resources and synchronize game data. Data traffic peaks may occur during players' free time, such as during lunch breaks, after get off work, or on weekends.

[0084] Console or PC game players (online games): These players consume a lot of data when playing online games, especially for some large-scale 3D online games. Data transmission is both upstream (sending player operation instructions) and downstream (receiving game scene updates and other data). Traffic peaks usually occur during game time and may last for a long time, depending on the length of the game.

[0085] Furthermore, the first deep learning model is configured as a convolutional neural network model. The convolutional neural network model (CNN) is a powerful deep learning model. It is mainly composed of convolutional layers, pooling layers and fully connected layers. The convolutional layer performs convolution operations on the input data (such as the main features of user network activity data) by sliding convolution kernels to automatically capture local features in the data. Different convolution kernels can extract multiple types of features. The pooling layer follows closely, and downsamples the output data of the convolutional layer by maximum pooling and other methods to reduce dimensions, retain significant features, reduce computational costs and enhance robustness to small changes and noise. Finally, the data processed by multiple convolution and pooling layers enters the fully connected layer, where each neuron is fully connected to all neurons in the previous layer, and the local features extracted previously are integrated to finally output prediction results for user behavior patterns, etc., which plays an important role in analyzing user network activity data to predict behavior patterns. The convolutional neural network model includes the following construction steps:

[0086] S31. Data preprocessing:

[0087] Data format adjustment: The main features of the input user network activity data are organized in the format required by the CNN model. For example, if the original data is a feature vector of different dimensions, it may be necessary to convert it into a tensor form so that it can be processed smoothly in the CNN model.

[0088] Data normalization: Normalize the input data, such as mapping the data value range to a specific interval (such as [0,1] or [-1,1]). This helps improve the efficiency and stability of model training and avoid problems in the training process caused by large differences in data magnitude.

[0089] S32. Model construction:

[0090] Convolutional layer definition: Set up multiple convolutional layers. In each convolutional layer, determine the size, number, and step size of the convolution kernel. The convolution kernel slides over the input data to perform convolution operations and extract local features from the data. For example, for the traffic time series features in user network activity data, the convolution kernel can capture the local patterns of traffic changes in different time periods.

[0091] Pooling layer settings: A pooling layer is usually added after the convolution layer, such as a maximum pooling layer or an average pooling layer. The role of the pooling layer is to downsample the data output by the convolution layer, reduce the data dimension, and retain the most important feature information. For example, through maximum pooling, the maximum value in the local area can be selected as a representative to further highlight the key features of the data.

[0092] Fully connected layer construction: After several convolutional layers and pooling layers, a fully connected layer is constructed. The fully connected layer performs fully connected operations on the previously processed data, combines local features to form a comprehensive understanding of the entire user network activity data, and finally outputs the prediction results about the user behavior pattern.

[0093] S33, model training:

[0094] Loss function determination: Select an appropriate loss function, such as cross entropy loss, to measure the deviation between the model prediction results and the actual user behavior pattern. Cross entropy loss is one of the most commonly used loss functions in classification problems. It is based on the concept of cross entropy in information theory and measures the difference between two probability distributions. In multi-classification problems, the output of the model is usually a probability distribution, which represents the probability that the input data belongs to each category. The cross entropy loss function calculates the difference between the predicted probability distribution and the probability distribution corresponding to the true category (the probability of the true category is 1, and the probability of other categories is 0).

[0095] Optimizer selection: Choose a suitable optimizer, such as stochastic gradient descent (SGD), Adagrad, Adadelta, etc. The role of the optimizer is to update the parameters of the model according to the value of the loss function, so that the model continues to develop in the direction of reducing the loss, thereby improving the prediction accuracy of the model.

[0096] Training data division: divide the existing annotated user network activity data (i.e. data with known user behavior patterns) into training set, validation set and test set. Generally, the division is based on a certain ratio, such as 70% for training set, 20% for validation set and 10% for test set. The training set is used to train the model, the validation set is used to adjust the model parameters during the training process, and the test set is used to finally evaluate the performance of the model.

[0097] Model training execution:

[0098] The constructed CNN model is repeatedly trained using the training set data, and the model parameters are continuously updated by the optimizer according to the loss function until the preset training stop conditions are reached, such as reaching a certain number of training rounds, the validation set loss no longer decreasing, etc. Various regularization techniques (such as L1 and L2 regularization) and dropout methods are applied during the training process to reduce model overfitting and improve the generalization ability of the model.

[0099] S34. Model evaluation

[0100] Test set application: Input the test set data into the trained CNN model to obtain the model's prediction results for the user behavior patterns of the test set.

[0101] Performance indicator calculation: Calculate relevant performance indicators, such as accuracy, precision, recall, F1 value, etc., to evaluate the prediction accuracy of the model. For example, accuracy refers to the ratio of the number of correctly predicted samples to the total number of predicted samples. These indicators can intuitively understand the quality of the model in predicting user behavior patterns.

[0102] S4, inputting the predicted user behavior pattern into a preset second deep learning model to predict future bandwidth demand and traffic peak;

[0103] In this embodiment, after the current user behavior pattern is predicted by the user network activity data of the previous time series, deep learning can be performed by collecting the complete user network activity data under the user behavior pattern in the historical period, so as to use the data of the previous time series to predict the user network activity data of the future time series to determine the future bandwidth demand and traffic peak. To this end, the second deep learning model of this embodiment is configured as a long short-term memory network. Long short-term memory network (LSTM) is an advanced recurrent neural network. It is mainly composed of cell state, input gate, forget gate and output gate. The cell state is like an information conveyor belt, which can maintain long-term memory throughout the sequence processing. The input gate uses sigmoid and tanh functions to control the amount of new information entering the cell state, the forget gate determines the information to be forgotten in the cell state through the sigmoid function, and the output gate determines the output information in the cell state based on the sigmoid and tanh functions. LSTM has significant advantages in processing time series data. Compared with traditional recurrent neural networks, it can solve the problem of long-term dependence very well. Taking user network activity data as an example, the network traffic of a user at a certain moment may be affected by behavior a long time ago, and the gating mechanism of LSTM can capture this complex dependency. For example, if a user is used to watching high-definition videos on Friday nights, which generates a traffic peak, it can learn and remember this pattern, and even if there is interference in the middle, it can accurately predict the traffic peak on the following Friday. In this embodiment, LSTM is very suitable for predicting the future time series of user network activity data. It can use network activity data with the same historical behavior pattern to learn. For example, to predict the bandwidth and traffic peak in the user's "video download" mode, it can learn information such as the start time, duration, and traffic changes from the historical download data, so as to accurately predict the future situation and provide a reference for network resource configuration.

[0104] The following are the steps involved in this scenario based on the Long Short-Term Memory Network (LSTM) as the second deep learning model:

[0105] S41. Data preparation:

[0106] Data Collection:

[0107] For the predicted current user behavior pattern, the complete user network activity data of the user in the historical period under this behavior pattern is collected from the storage system. This data must include detailed records of key indicators such as network traffic, access frequency, network bandwidth, etc.

[0108] Data preprocessing:

[0109] Data cleaning: Carefully check the collected data and remove obvious outliers, erroneous records, and duplicate data. For example, if the network traffic value at a certain moment is abnormally high or low and does not conform to normal logic, it can be corrected or eliminated.

[0110] Data standardization: Standardize the data of various indicators so that they have similar magnitude and distribution. Usually, the data can be converted into a standard normal distribution with a mean of 0 and a standard deviation of 1, so that the LSTM network can process the data more effectively.

[0111] Data partitioning: Divide the preprocessed data into training set, validation set and test set according to a certain ratio. A common ratio is 70% as training set for model training, 20% as validation set for monitoring and adjusting the model during training, and 10% as test set for final evaluation of model performance.

[0112] S42. Model construction:

[0113] Determine the LSTM layer parameters: Determine the key parameters of the LSTM layer, such as the input dimension, output dimension, and number of hidden units, based on the dimensions of the input data (for example, considering various indicators of network activity data and factors such as the length of the time series) and the dimensions of the expected output (that is, the dimensions of user network activity data in a series over a period of time in the future, including aspects such as predicted bandwidth demand and traffic peaks).

[0114] Add a fully connected layer: After the LSTM layer, a fully connected layer can be added as needed. The fully connected layer can further integrate and transform the features output by the LSTM layer to better generate the final predicted user network activity data for a certain period of time in the future. The number of neurons in the fully connected layer can be adjusted according to specific needs and experiments.

[0115] S43, model training:

[0116] Defining the loss function: Since we need to predict user network activity data for a certain period of time in the future (including continuous values ​​such as bandwidth requirements, etc.), we usually use the mean square error (MSE) as the loss function. MSE can effectively measure the average value of the square difference between the predicted value and the actual value, prompting the model to continuously reduce the prediction error.

[0117] Select an optimizer: Select a suitable optimizer to update the model parameters to reduce the value of the loss function. Common optimizers such as stochastic gradient descent (SGD) and its variants (such as Adagrad, Adadelta, etc.) can be used. Different optimizers have their own advantages and disadvantages in terms of convergence speed and processing of complex data. You can choose according to the actual situation.

[0118] Start training: Use the training set data to train the constructed LSTM model. During the training process, the model will select the first n data samples of the user network activity data of the complete time series as input, and the remaining data samples as the expected output. The optimizer will continuously update the model parameters according to the loss function until the preset training stop conditions are reached. These stop conditions can be reaching a certain number of training rounds, the validation set loss no longer decreasing, etc.

[0119] S44. Model evaluation:

[0120] Test set application: Input the test set data into the trained LSTM model to obtain the model's prediction results for the test set data, that is, the predicted user network activity data for a certain period of time in the future (including future bandwidth requirements and traffic peaks).

[0121] Performance index calculation: Calculate relevant performance indicators, such as mean square error (MSE) and mean absolute error (MAE), to evaluate the prediction accuracy of the model. The mean square error reflects the average of the squared difference between the predicted value and the actual value, while the mean absolute error reflects the average of the absolute difference between the predicted value and the actual value. These indicators can intuitively understand the pros and cons of the LSTM model in predicting future user network activity data, so as to further optimize or apply the model.

[0122] S45. Model application:

[0123] When the new user network activity data of the previous period that needs to be predicted is obtained and the corresponding user behavior pattern is determined, the data is processed according to the data preprocessing method used in the previous model training (such as cleaning, standardization, etc.), and then input into the trained LSTM model. Based on the input data, the model will use the learned rules and features to predict the user network activity data of the future period to determine key information such as bandwidth demand and traffic peak.

[0124] S5. Determine the corresponding network resource allocation plan based on future bandwidth requirements and traffic peaks.

[0125] In this embodiment, after accurately predicting the future bandwidth demand and traffic peak, it is crucial to determine the network resource allocation plan. If it is predicted that there will be a high bandwidth demand and traffic peak in a certain period of time, in terms of network infrastructure, it can be considered to enable more servers or network nodes to share the data traffic to ensure smooth data transmission. For network bandwidth resources, the allocation strategy should be adjusted dynamically to give priority to the use of bandwidth for key businesses or high-priority users, such as reserving sufficient bandwidth for services that are sensitive to network delays, such as real-time video conferencing and online games, while appropriately limiting low-priority and non-essential services that occupy a large amount of bandwidth, such as background automatic updates. In terms of network caching strategy, cache devices can be added near the user end or network edge nodes to pre-store popular content to reduce the bandwidth occupied by repeated data transmission and reduce the pressure on the core network. In addition, it is necessary to establish a real-time monitoring mechanism to pay close attention to the deviation between the actual operation status of the network and the predicted results, so as to adjust the resource allocation plan in a timely and flexible manner to ensure that the entire network system can operate efficiently and stably when facing different traffic loads.

[0126] The above description is only a preferred embodiment of the present invention and does not limit the present invention in any form. Although the present invention has been disclosed as a preferred embodiment as above, it is not used to limit the present invention. Any technical personnel in this field can make some changes or modify the technical contents disclosed above into equivalent embodiments without departing from the scope of the technical solution of the present invention. However, any brief modifications, equivalent changes and modifications made to the above embodiments based on the technical essence of the present invention without departing from the content of the technical solution of the present invention are still within the scope of the technical solution of the present invention.

Claims

1. A method for analyzing high-traffic user identification and service upgrade solutions, characterized by: The following steps are involved: S1. Collecting a time series of user network activity data samples from network logs and network monitoring devices, wherein the network activity data includes network traffic, access frequency and network bandwidth; S2, extracting the main features of the user's network activity data using a statistical analysis method, and judging whether the monitored user is a high-traffic user based on the main features; S3. When it is determined that the monitored user is a high-traffic user, the main features of the user's network activity data are input into a preset first deep learning model, and a predicted user behavior pattern is output; S4, inputting the predicted user behavior pattern into a preset second deep learning model to predict future bandwidth demand and traffic peak; S5. Determine the corresponding network resource allocation plan based on future bandwidth requirements and traffic peaks.

2. The method for analyzing a high-traffic user identification and service upgrade solution according to claim 1, characterized in that: In step S2, the statistical analysis method is configured as a principal component analysis method, comprising the following steps: S21, standardizing the user's network activity data; S22, calculating the covariance matrix of the standardized data, and determining the linear correlation between the variables of each user's network activity data; S23, performing eigendecomposition on the covariance matrix to obtain eigenvalues ​​and eigenvectors; S24, selecting the principal component: selecting the principal component according to the size of the eigenvalue and the cumulative contribution rate, and using the principal component as the main feature of the user network activity data; S25, obtaining a principal component score of each sample in the principal component space by multiplying the original data with the eigenvector corresponding to the selected principal component; S26. Set a total principal component score threshold. When the total principal component score of the monitored user exceeds the preset total principal component score threshold, the monitored user is determined to be a high-traffic user.

3. The method for analyzing a high-traffic user identification and service upgrade solution according to claim 2, characterized in that: In step S21, the normalization calculation formula is: Where D ij represents the standardized value of the jth data sample of the ith user network activity data variable; C ij I represents the original value of the jth data sample of the i-th user network activity data variable; mean represents the average value of the i-th user network activity data variable; I sd Represents the standard deviation of the i-th user network activity data variable.

4. The method for analyzing a high-traffic user identification and service upgrade solution according to claim 1, characterized in that: In step S3, the user behavior patterns include content consumption patterns, social interaction patterns, work and study patterns, and entertainment and gaming patterns.

5. The method for analyzing a high-traffic user identification and service upgrade solution according to claim 1, characterized in that: In step S3, the first deep learning model is configured as a convolutional neural network model, including the following construction steps: S31, data preprocessing: converting the main features of the input user network activity data into data format and normalizing the data; S32, model construction: including convolution layer definition, pooling layer setting and full connection layer construction; the convolution layer definition is specifically as follows: multiple convolution layers are set, and in each convolution layer, the size, number and step size of the convolution kernel are determined; the convolution kernel slides on the input data to perform convolution operations and extract local features in the data; The pooling layer is configured as a maximum pooling layer or an average pooling layer, which is used to downsample the data output by the convolution layer to reduce the data dimension while retaining the main feature information; The fully connected layer is constructed to perform a fully connected operation on the previously processed data, combining local features to output a prediction result about the user behavior pattern; S33, model training: using the main features of user network activity data as input and user behavior patterns as output, learning is performed using the established convolutional neural network structure; S34. Model evaluation: Use accuracy, precision, recall and F1 value to evaluate the model's predictive performance on user behavior patterns.

6. The method for analyzing a high-traffic user identification and service upgrade solution according to claim 5, characterized in that: In step S33, the learning using the constructed convolutional neural network structure includes the following steps: Loss function determination: Select cross entropy loss as the loss function to measure the deviation between the model prediction results and the actual user behavior pattern; Optimizer selection: Stochastic gradient descent is selected as the optimizer to update the model parameters according to the value of the loss function, so that the model continues to develop in the direction of reducing the loss; Training data division: Divide the user network activity data with known user behavior patterns into training set, validation set and test set; Model training execution: Use the training set data to repeatedly train the convolutional neural network structure, and continuously update the model parameters according to the loss function through the optimizer until the preset training stop condition is reached.

7. The method for analyzing high-traffic user identification and service upgrade solution according to claim 1, characterized in that: In step S4, the second deep learning model is configured as a long short-term memory network, including the following construction steps: S41, data preparation: for the predicted user behavior pattern, collect the complete time series of user network activity data under the user behavior pattern from the storage system; S42, model construction: Determine the input dimension, output dimension and number of hidden units of the LSTM layer according to the dimension of the input data and the dimension of the expected output; add a fully connected layer to integrate and transform the features of the LSTM layer output; S43, model training: select the first n data samples of the user network activity data of the complete time series as input, and the remaining data samples as the expected output, and train the constructed long short-term memory network; S44, model evaluation: Calculate the mean square error or mean absolute error between the predicted output and the expected output to evaluate the prediction accuracy of the model; S45, model application: obtain the user network activity data of a time series to be predicted, input it into the long short-term memory network model corresponding to the user behavior pattern, and predict the user network activity data of a time series in the future to determine the bandwidth demand and traffic peak.

8. The method for analyzing high-traffic user identification and service upgrade solution according to claim 1, characterized in that: In step S5, the corresponding network resource allocation plan is determined according to future bandwidth requirements and traffic peaks, specifically, the bandwidth allocation strategy is dynamically adjusted according to the priority of key businesses or high-traffic users; at the same time, a real-time monitoring mechanism is established to adjust the resource allocation plan according to different traffic loads.

Images