Network monitoring model training method, monitoring method, system, equipment and medium

Abstract

The invention relates to an emerging information technology, and discloses a network monitoring model training method, a network monitoring method, a network monitoring system, electronic equipment and a storage medium. According to the method, the special training data in the network monitoring field is generated by utilizing the general large language model, a large amount of data does not need to be additionally provided, and training obstacles caused by insufficient training data of the special field large language model can be avoided; the dimension reduction operation is performed on the training data generated by the general large language model, the general large language model is distilled, the model is fine-tuned by using the training data after dimension reduction, and then the fine-tuned model is distilled to obtain the final network monitoring model, so that the complexity of the monitoring model is reduced, the reasoning speed is increased, and the network monitoring efficiency is improved. And the requirement of the network monitoring field on reasoning delay can be met. In addition, model input data is generated through detection data, reasoning is carried out through a network monitoring model, a monitoring result of a network state is obtained, an action decision of further detection action is further carried out, and intelligent network monitoring can be achieved.

Description

Technical Field

[0001] The present application relates to the field of emerging information technology, and in particular to a network monitoring model training method, a network monitoring method, a network monitoring system, an electronic device and a storage medium. Background Art

[0002] Large language models are gradually being widely used in data center network operation and maintenance, covering all aspects from automated processing to intelligent optimization, significantly improving the efficiency of network operation and maintenance, reducing failure rates, and optimizing system performance. The excellent understanding and generation capabilities demonstrated by large language models, when combined with operation and maintenance data, will accelerate the implementation of intelligent operation and maintenance, and have application prospects in scenarios such as intelligent question and answer, automatic control, and auxiliary analysis. In the future, it is expected to enter the era of large language models + intelligent operation and maintenance.

[0003] However, the current application of large language models is mainly focused on intelligent question and answer, which allows users to input questions and operation and maintenance tools to output natural language answers. In actual network operation and maintenance work, it still plays a human auxiliary role, and is still far from complete automated control. This mainly manual and passive response method can no longer support the needs of flexible and fast operation and maintenance management. Taking network performance monitoring as an example, when some abnormal signals are detected, it is often necessary to make targeted further detection actions. This decision must be made manually, which will obviously reduce the response speed of the processing.

[0004] Therefore, establishing a closed loop of large language models, using their logical reasoning and summarizing capabilities, and quickly responding through correlation analysis of multi-source data has become an inevitable requirement for current intelligent network operation and maintenance. However, in the application of various sub-fields of network operation and maintenance, large language models still face challenges in achieving efficient application and tangible results. Summary of the invention

[0005] In order to realize intelligent network monitoring, the present application provides a network monitoring model training method, a network monitoring method, a network monitoring system, an electronic device and a storage medium.

[0006] According to one aspect of an embodiment of the present application, a network monitoring model training method is disclosed, the training method comprising:

[0007] Generate initial training data using a general large language model, and perform a dimensionality reduction operation on the initial training data to obtain a network monitoring training data set;

[0008] Distilling the universal large language model to obtain a network monitoring baseline model;

[0009] The network monitoring baseline model is fine-tuned using the network monitoring training data set, and the fine-tuned network monitoring baseline model is distilled to obtain a network monitoring model.

[0010] In an exemplary embodiment, the use of a general large language model to generate initial training data includes: creating a task description, the task description at least including a description of generating a network state and generating a next detection action; inputting any of the task descriptions and corresponding prompt examples into the general large language model, and using a sample-driven progressive guidance method to guide the general large language model to generate prompt data; the general large language model learns the original data again based on various prompt examples to obtain initial training data.

[0011] In an exemplary embodiment, the distilling of the general large language model to obtain a network monitoring baseline model includes: iteratively quantizing, structured pruning, and unstructured pruning the general large language model until the inference delay is reduced to millisecond level to obtain a network monitoring baseline model.

[0012] In an exemplary embodiment, performing a dimensionality reduction operation on the initial training data to obtain a network monitoring training data set includes: performing feature embedding on the initial training data to obtain a network monitoring training data set.

[0013] In an exemplary embodiment, performing a dimensionality reduction operation on the initial training data to obtain a network monitoring training data set includes: determining the data type contained in the initial training data; for the numerical data in the initial training data, using equal-width binning to perform numerical embedding, and for the textual data in the initial training data, using a relationship propagation clustering method to perform action template embedding to obtain a network monitoring training data set.

[0014] According to one aspect of an embodiment of the present application, a network monitoring method is disclosed, which is executed by a centralized controller, wherein the centralized controller is communicatively connected to a plurality of network nodes, and the network monitoring method includes:

[0015] Acquire detection data fed back by the network node based on the detection action, and obtain model input data based on the detection data;

[0016] Inputting the model input data into a network monitoring model, performing reasoning through the network monitoring model, obtaining a monitoring result of a network state and an action decision for further detection actions;

[0017] dispatching a probing action to the network node based on the action decision;

[0018] Wherein, the network monitoring model is obtained by adopting the aforementioned training method.

[0019] In an exemplary embodiment, the dispatching of the detection action to the network node based on the action decision includes: using a policy diffusion algorithm to perform action de-embedding on the action decision to obtain multiple detection action options; using a heuristic algorithm to select the detection action; and dispatching the selected detection action to the network node.

[0020] In an exemplary embodiment, the use of a policy diffusion algorithm to perform action de-embedding on the action decision to obtain multiple detection action options includes: restoring the state space and action space of the initial training data before feature embedding; generating multiple possible action paths by simulating the diffusion process of the action in the state space. The use of a heuristic algorithm to select the detection action includes: evaluating the effect of each action path in reaching the target state, the effect at least including the path length and time consumption; extracting the detection action from the action path with the best effect as the selected detection action.

[0021] According to one aspect of an embodiment of the present application, an electronic device is disclosed, which includes one or more processors and a memory, wherein the memory is used to store one or more programs, and when the one or more programs are executed by the one or more processors, the electronic device implements the training method or network monitoring method as described above.

[0022] According to one aspect of an embodiment of the present application, a computer-readable storage medium is disclosed, wherein the computer-readable storage medium stores computer-readable instructions. When the computer-readable instructions are executed by a processor of a computer, the computer executes the training method or network monitoring method as described above.

[0023] According to one aspect of an embodiment of the present application, a network monitoring system is disclosed, which includes a centralized controller and a number of network nodes. The centralized controller is communicatively connected to the number of network nodes and is configured to execute the network monitoring method as described above.

[0024] The technical solution provided by the embodiments of the present application includes at least the following beneficial effects:

[0025] The technical solution provided by the present application utilizes a general large language model to generate special training data in the field of network monitoring. It does not require a large amount of additional data, and can avoid training obstacles caused by insufficient training data for the large language model in the special field. Then, a dimensionality reduction operation is performed on the training data generated by the general large language model, and the general large language model is distilled and the model is fine-tuned using the dimensionality-reduced training data. The fine-tuned model is then distilled to obtain the final network monitoring model, which reduces the complexity of the monitoring model and improves the inference speed, and can meet the requirements for inference delay in the field of network monitoring.

[0026] In addition, by obtaining the detection data fed back by the network nodes based on the detection actions, the model input data is generated from the detection data, and reasoning is performed through the network monitoring model to obtain the monitoring results of the network status and the action decisions of further detection actions. Based on the action decisions, detection actions are dispatched to the network nodes to realize intelligent network monitoring.

[0027] It should be understood that the foregoing general description and the following detailed description are exemplary only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0029] Figure 1 It is a schematic diagram of a network monitoring system for executing the network monitoring method of the exemplary embodiment of the present application.

[0030] Figure 2 The figure is a flowchart of a network monitoring model training method according to some exemplary embodiments.

[0031] Figure 3 yes Figure 2 Detailed flowchart of step S201 is shown.

[0032] Figure 4 yes Figure 2 Detailed flowchart of step S203 is shown.

[0033] Figure 5 It is a block diagram of a network monitoring model training device according to some exemplary embodiments.

[0034] Figure 6 is a flow chart of a network monitoring method according to some exemplary embodiments.

[0035] Figure 7 yes Figure 6 A detailed flow chart of an embodiment of step S603 is shown.

[0036] Figure 8 yes Figure 6 A detailed flow chart of another embodiment of step S603 is shown.

[0037] Fig. 9 is a schematic diagram showing a network monitoring device according to some exemplary embodiments.

[0038] Fig.10 is a schematic diagram of a network monitoring model training process according to some exemplary embodiments.

[0039] Fig.11is a schematic diagram showing a network monitoring process according to some exemplary embodiments.

[0040] Fig.12 It is a block diagram of an electronic device according to an exemplary embodiment.

[0041] Fig.13 It is a block diagram of a computer system according to an exemplary embodiment.

[0042] The following are the descriptions of the reference numerals:

[0043] 500, network monitoring model training device; 501, data generation module; 502, first processing module; 503, data dimension reduction module; 504, second processing module; 505, third processing module; 900, network monitoring device; 901, data acquisition module; 902, processing module; 903, sending module; 1200, electronic device; 1201, processor; 1202, memory; 1300, computer system; 1301, CPU; 1302, ROM; 1303, storage part; 1304, RAM; 1305, bus; 1306, I / O interface; 1307, input part; 1308, output part; 1309, communication part; 1310, drive; 1311, removable medium. DETAILED DESCRIPTION

[0044] Although the present application can be easily embodied in different forms of embodiments, only some of the specific embodiments are shown in the drawings and described in detail in this specification. It should be understood that this description should be regarded as an exemplary illustration of the principles of the present application and is not intended to limit the present application to that described herein.

[0045] In addition, the terms "include", "comprising", "having" and any variations thereof mentioned in the description of this application are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device including a series of steps or modules is not limited to the listed steps or modules, but may optionally include other steps or modules not listed, or may optionally include other steps or modules inherent to these processes, methods, products or devices.

[0046] It should be noted that, in the embodiments of the present application, words such as "exemplary" or "by way of example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary" or "by way of example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "by way of example" is intended to present related concepts in a specific way.

[0047] The exemplary embodiments will be described in detail below. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present application. Instead, they are only examples of devices and methods consistent with some aspects of the present application as detailed in the Summary of the Invention.

[0048] In the application of various sub-fields of network operation and maintenance, large language models still face challenges in terms of model training and reasoning in order to be efficiently applied and achieve tangible results.

[0049] In terms of training, the current large language model is mainly based on text-based training, which is acceptable for question-answering, but still insufficient for anomaly analysis and processing. Taking network monitoring tasks as an example, the large language model needs to analyze the currently acquired network detection data to determine the network status, and further perform more detection actions based on the current status to obtain more accurate monitoring results. This data to analysis results and response actions, and even continuous iterative progressive data analysis and response difficulty obviously exceeds the question-answering task. However, in the field of network monitoring, the training data for this task is obviously insufficient compared to the question-answering training data, and is not enough to fine-tune a general large language model to this field.

[0050] In terms of reasoning, even though various inference acceleration technologies have been proposed in the field of large language models, there is still a large gap in the millisecond-level response speed requirements in the field of network monitoring. It may take much longer than milliseconds for a large language model to generate a token, especially when dealing with large models and complex calculations. Network monitoring systems, such as RDMA monitoring components, already need to achieve millisecond-level responses. Therefore, there is a certain gap between the two, especially in application scenarios with extremely high real-time requirements.

[0051] To this end, the present application proposes a network monitoring model training method, a network monitoring method, a network monitoring system, an electronic device and a storage medium to realize intelligent network monitoring. In terms of training, the present application adopts the existing large language model of network question and answer to generate (data, state + action) pairs as training data for the network monitoring model, overcoming the data bottleneck of fine-tuning and specialization of large language models; in terms of reasoning, the numerical embedding method and the action space template method are used to reduce the dimension of the input and output space of the model, providing an opportunity for further distillation of the model, thereby reducing the reasoning time; at the same time, in order to avoid the excessive distillation of the model affecting the performance, the action space is increased in dimension by using strategy diffusion to ensure the reasoning performance. The combined use of the two technologies overcomes the challenges of using large language models for intelligent monitoring of data center networks and can realize intelligent network monitoring.

[0052] First, some nouns or terms that appear in the process of explaining the embodiments of the present application are subject to the following explanations.

[0053] Network monitoring: refers to the process of real-time monitoring and management of the performance, security, availability, and traffic of network systems. Network monitoring is a key tool to ensure network reliability, security, and efficiency, and is vital to any organization that relies on the network. Its significance is very broad: it can be used for network performance optimization. By monitoring network performance, problems such as latency, packet loss, and insufficient bandwidth can be identified and resolved, thereby improving network efficiency and user experience; fault diagnosis: when a problem occurs in the network, the monitoring system can quickly locate the fault point and help technicians respond and fix the problem quickly; resource management: monitoring the use of network resources can help to reasonably allocate and optimize resources and avoid waste; and predictive analysis: using historical data and trend analysis, future network needs and potential problems can be predicted, so that planning can be made in advance.

[0054] Large Language Model: With the rise of generative artificial intelligence (AI) represented by large language models (LLM), the research on applying large language models to communication networks has attracted widespread attention. Large language models focus on the field of cloud network operations, and are guided by empowering the front line, improving operation and maintenance efficiency, and enhancing user perception, forming a scenario planning that runs through cloud network operation scenarios and AI empowerment evolves layer by layer. In the application practice of cloud network operations, this model activates knowledge value and empowers production through large language models. Fine-tuned large language models in the network field can be used to process network log data, model, and solve specific network problems.

[0055] Diffusion Policy: Diffusion policy is an agent action generation strategy based on the diffusion model. It provides new research ideas and methods for intelligent control. This strategy can not only generate complex and effective action sequences, but also has strong adaptability, which helps to promote the continuous development of intelligent control technology.

[0056] Figure 1 It is a schematic diagram of a network monitoring system for executing the network monitoring method of the exemplary embodiment of the present application.

[0057] like Figure 1 As shown, the network monitoring system 100 may include a centralized controller 101 and a plurality of network nodes 102 . The centralized controller 101 is communicatively connected with the plurality of network nodes 102 to implement information interaction between the centralized controller 101 and each network node 102 .

[0058] In detail, the centralized controller 101 and each network node 102 may be connected in a wired manner, for example, via an RS485 bus, a USB cable, an Ethernet, etc. The centralized controller 101 and each network node 102 may also be connected in a wireless manner, for example, via WI-FI, Bluetooth, ZigBee, LoRa (Long Range Radio), etc.

[0059] The centralized controller 101 is configured to run a large language model, that is, a network monitoring model, which dispatches network detection actions to each network node 102 according to the output of the large language model and generates a judgment on the network status according to the detection data.

[0060] It can be understood that the centralized controller 101 can be any electronic device with data interaction and data processing capabilities.

[0061] The network node 102 is configured to perform a specific detection action based on the detection action task issued by the centralized controller 101 , and feed back detection data to the centralized controller 101 .

[0062] It can be understood that the several network nodes 102 may be one or more network nodes 102, that is, the network monitoring system 100 may include one or more network nodes 102. Exemplarily, the network monitoring system 100 includes multiple network nodes 102, wherein one or some network nodes 102 are switches, and one or some network nodes 102 are network cards.

[0063] It can be understood that the network node 102 can be any electronic device with data interaction capability and data processing capability.

[0064] Next, the model training process and network monitoring process of this application are explained.

[0065] Figure 2 The figure is a flowchart of a network monitoring model training method according to some exemplary embodiments.

[0066] like Figure 2 As shown, the network monitoring model training method includes the following steps S201 to S205.

[0067] In step S201, initial training data is generated using a general large language model.

[0068] It can be understood that the general large language model refers to a large language model used in general fields.

[0069] In some embodiments, Figure 3 As shown, generating initial training data using a general large language model includes the following steps S301 to S303.

[0070] In step S301, a task description is created, which at least includes a description of generating a network state and generating a next detection action to meet network monitoring requirements.

[0071] For example, the created task description includes the following four categories: [

[0073] 1. "Retrieve data that was related with network state": Retrieve data related to network state

[0074] 2. "Find recipes for further detection actions": Find recipes to perform further monitoring actions

[0075] 3. "Search for decisions report related to network diagnosis": Search for decision reports related to network diagnosis

[0076] 4. "Find actions and network states pairs": Find actions and network states pairs ]

[0078] In step S302, any task description and corresponding prompt examples are input into the general large language model, and a sample-driven progressive guidance method is used to guide the general large language model to generate task-specific prompt data including positive and negative examples.

[0079] Here we first need to construct an initial sample as a prompt sample. For example, for Task 1, an example for INT packet feedback is:

[0080] [p.sw[s].[p].qlen=70%], which means that the information carried by the INT packet shows that the queue occupancy of port p of switch x has reached 70%.

[0081] In step S303, the general large language model learns the original data again based on various prompt examples to obtain initial training data.

[0082] The original data includes but is not limited to user manuals, device reports, network diagnostic reports, etc. used to train the general large language model. Step S303 is to extract various task prompt data from such documents.

[0083] In step S202, the general large language model is distilled to obtain a network monitoring baseline model.

[0084] In some embodiments, distilling the general large language model specifically includes: iteratively quantizing, structured pruning, and unstructured pruning the general large language model until the inference delay is reduced to millisecond level, thereby obtaining a network monitoring baseline model.

[0085] Of course, in other embodiments, other methods may be used to distill the general large language model to obtain a network monitoring baseline model.

[0086] In step S203, a dimensionality reduction operation is performed on the initial training data to obtain a network monitoring training data set.

[0087] In some embodiments, performing a dimensionality reduction operation on the initial training data specifically includes: performing feature embedding on the initial training data to obtain a network monitoring training data set.

[0088] In some embodiments, Figure 4 As shown, the feature embedding of the initial training data to obtain the network monitoring training data set includes the following steps S401-S402.

[0089] In step S401, the data type included in the initial training data is determined.

[0090] The data type included in the initial training data is, for example, a numerical type, or a text type, that is, a descriptive type.

[0091] In step S402, the numerical data in the initial training data is embedded by using equal width binning, and the action template is embedded by using the affinity propagation clustering method for the text data in the initial training data to obtain a network monitoring training data set.

[0092] Exemplarily, if task 1 listed in step S301 is numerical data, in step S402, numerical embedding is performed on task 1, specifically by using equal-width bin discretization, that is, the data is divided according to the specified interval width, and the data range in each interval is the same. This method of numerical discrete embedding conforms to the threshold characteristics of network device operation status data. If task 2 listed in step S301 is text data, in step S402, action template embedding is performed on task 2, specifically by using relationship propagation clustering. Clustering of actions through relationship transmission is more in line with the action correlation characteristics of network detection than direct text vectorization clustering. Similarly, numerical embedding is performed on the numerical data in tasks 3 and 4 listed in step S301, and action template embedding is performed on the text data therein. The embedded prompts of task 3 and task 4 will be merged as prompt data for the next stage of training.

[0093] The numerical data in the initial training data are numerically embedded, and the action-related text data are templated and embedded, which reduces the dimensionality of the input data of the large language model. At the same time, the large language model is distilled to obtain a streamlined model. These two aspects work together to reduce the complexity of the model, improve the reasoning speed, and solve the reasoning delay barrier of the large language model in the dedicated field.

[0094] In step S204, the network monitoring baseline model is fine-tuned using the network monitoring training data set.

[0095] In step S205, the fine-tuned network monitoring baseline model is distilled to obtain a network monitoring model.

[0096] In some embodiments, distilling the fine-tuned network monitoring baseline model mainly involves performing weight pruning on the fine-tuned network monitoring baseline model.

[0097] Through this step S205, the inference delay of the model fine-tuned by step S204 will not increase, and the model can be further refined by utilizing the effect of data dimensionality reduction.

[0098] In the aforementioned embodiment, based on the representation and understanding ability of the general large language model, all corpora involved in network monitoring are learned, and various types of information related to network monitoring can be extracted, including understanding of the state, decision-making and linkage from state to action, and generation of prompt data required for the next step. At the same time, the dimension of the training data is reduced through embedded feature extraction to ensure that fine-tuning of the model will not increase reasoning delay and model complexity.

[0099] Understandably, Figure 2 The step sequence shown is only an exemplary embodiment of the present application, and the actual implementation of the present application is not limited to the following Figure 2 The steps shown are sequentially executed to perform the model training process. Exemplarily, in some embodiments, it is configured as follows: first, the general large language model is used to generate initial training data; then, a dimensionality reduction operation is performed on the initial training data generated by the general large language model to obtain a network monitoring training data set; the general large language model is then distilled to obtain a network monitoring baseline model; finally, the network monitoring baseline model is fine-tuned using the network monitoring training data set, and the fine-tuned network monitoring baseline model is distilled to obtain a network monitoring model.

[0100] See next Figure 5 As shown, this embodiment provides a network monitoring model training device 500, which is used for electronic equipment and includes a data generation module 501, a first processing module 502, a data dimension reduction module 503, a second processing module 504 and a third processing module 505.

[0101] The data generation module 501 is used to generate initial training data using a general large language model.

[0102] Specifically, the data generation module 501 first creates a task description, which at least includes a description of generating a network state and generating the next detection action to meet the network monitoring needs; then, any task description and the corresponding prompt sample are input into the general large language model, and a sample-driven progressive guidance method is used to guide the general large language model to generate task-specific prompt data containing positive and negative samples; then, the general large language model is made to learn the original data again based on various prompt samples to obtain initial training data.

[0103] The first processing module 502 is used to distill the general large language model to obtain a network monitoring baseline model.

[0104] Specifically, the first processing module 502 iteratively quantizes, performs structured pruning, and unstructured pruning on the general large language model until the inference delay is reduced to the millisecond level, thereby obtaining a network monitoring baseline model.

[0105] The data dimension reduction module 503 is used to perform a dimension reduction operation on the initial training data, thereby obtaining a network monitoring training data set.

[0106] Specifically, the data dimension reduction module 503 performs feature embedding on the initial training data generated by the data generation module 501 to obtain a network monitoring training data set. More specifically, the data dimension reduction module 503 first determines the data type contained in the initial training data, and uses equal-width binning to perform numerical embedding on the numerical data in the initial training data, and uses the relationship propagation clustering method to perform action template embedding on the text data in the initial training data, thereby obtaining a network monitoring training data set.

[0107] The second processing module 504 is used to fine-tune the network monitoring baseline model obtained by the first processing module 502 using the network monitoring training data set.

[0108] The third processing module 505 is used to distill the network monitoring baseline model fine-tuned by the second processing module 504 to obtain a network monitoring model.

[0109] The implementation process of the functions and effects of each module in the above-mentioned network monitoring model training device 500 is specifically described in the implementation process of the corresponding steps in the above-mentioned network monitoring model training method, which will not be repeated here.

[0110] Figure 6 is a flow chart of a network monitoring method according to some exemplary embodiments.

[0111] like Figure 6As shown, the network monitoring method is executed by a centralized controller, which may be a computer loaded with Figure 2 The network monitoring model obtained by training the network monitoring model training method shown includes the following steps S601 to S603.

[0112] In step S601, detection data fed back by the network node based on the detection action is acquired, and model input data is obtained based on the detection data.

[0113] In some embodiments, detection data previously fed back by network nodes based on detection actions are collected, the detection data are numerically embedded to obtain target data, and data prompting generation of a network status report and the next detection action are constructed based on the target data as model input data.

[0114] In step S602, the model input data is input into the network monitoring model, and reasoning is performed through the network monitoring model to obtain the monitoring results of the network status and the action decision of further detection actions.

[0115] Among them, the network monitoring model is a model trained by the aforementioned training method.

[0116] In step S603, a detection action is assigned to the network node based on the action decision.

[0117] In some embodiments, Figure 7 As shown, dispatching detection actions to network nodes based on action decisions includes the following steps S701-S703.

[0118] In step S701, a strategy diffusion algorithm is used to perform action de-embedding on the action decision to obtain multiple detection action options.

[0119] In step S702, a heuristic algorithm is used to select a detection action.

[0120] In step S703, the selected detection action is dispatched to the network node.

[0121] The strategy diffusion algorithm and heuristic algorithm are used to reverse embed the output of the network monitoring model and increase the dimension, avoiding the performance and accuracy loss that may be caused by the simplification steps in the model and data.

[0122] In some embodiments, Figure 8 As shown, dispatching detection actions to network nodes based on action decisions includes the following steps S801-S805.

[0123] In step S801, the state space and action space of the initial training data before feature embedding are restored.

[0124] In step S802, a plurality of possible action paths are generated by simulating the diffusion process of the action in the state space.

[0125] In step S803, the effect of each action path in reaching the target state is evaluated, and the effect at least includes the path length and time consumption.

[0126] In step S804, a detection action is extracted from the action path with the best effect as a selected detection action.

[0127] That is, the action path with the best effect is converted into actions that can be executed by network nodes, such as switches and network cards.

[0128] In step S805, the selected detection action is assigned to the network node, so that each network node executes the detection action to obtain detection data.

[0129] See next Fig. 9 As shown, this embodiment provides a network monitoring device 900 , which is used in an electronic device and includes a data acquisition module 901 , a processing module 902 and a sending module 903 .

[0130] The data acquisition module 901 is used to acquire detection data fed back by the network node based on the detection action, and obtain model input data based on the detection data.

[0131] In some embodiments, the data acquisition module 901 collects the detection data previously fed back by the network node based on the detection action, numerically embeds the detection data to obtain target data, and constructs data based on the target data to prompt the generation of a network status report and the next detection action as model input data.

[0132] The processing module 902 is used to input the model input data into the network monitoring model, perform reasoning through the network monitoring model, and obtain the monitoring results of the network status and the action decision of further detection actions.

[0133] In some embodiments, the processing module 902 first uses a policy diffusion algorithm to perform action de-embedding on the action decision to obtain multiple detection action options, then uses a heuristic algorithm to select the detection action, and finally dispatches the selected detection action to the network node.

[0134] In some embodiments, the processing module 902 first restores the state space and action space of the initial training data before feature embedding, generates multiple possible action paths by simulating the diffusion process of the action in the state space, and then evaluates the effect of each action path in achieving the target state, the effect at least includes the path length and time consumption, extracts the detection action from the action path with the best effect as the selected detection action, and finally dispatches the selected detection action to the network node.

[0135] The sending module 903 is used to dispatch detection actions to network nodes based on the action decision.

[0136] The implementation process of the functions and effects of each module in the above-mentioned network monitoring device 900 is specifically described in the implementation process of the corresponding steps in the above-mentioned network monitoring method, which will not be repeated here.

[0137] The solution of the present application is described below by taking a specific embodiment as an example.

[0138] This application includes two stages: offline and online. The offline stage is used to train a network monitoring model, and the online stage is used to perform reasoning based on the model and network information to generate network status monitoring results and further detection actions.

[0139] like Fig.10 As shown, the offline phase can be divided into the following five sub-phases:

[0140] a. Generate initial training data D0 for network monitoring using a general large language model G;

[0141] b. Distill the general large language model G into a streamlined small model M1;

[0142] c. Perform numerical embedding and action template (feature embedding) operations on the training data D0 generated in step a to achieve feature dimensionality reduction and obtain D1;

[0143] d. Use the data D1 generated in step c to fine-tune the small model M1 in step b to obtain model M2;

[0144] e. Perform post-distillation on the fine-tuned model M2 to obtain the final network monitoring model M3.

[0145] like Fig.11 As shown, the online phase centralized controller cyclically executes the following four sub-phases:

[0146] a. Collect feedback from detection actions and generate model input;

[0147] b. Perform reasoning based on the network monitoring model M3, output the monitoring results of the network status and the decision of further detection actions;

[0148] c. De-embed the decision in step b and generate specific detection actions;

[0149] d. Dispatching and executing new detection actions.

[0150] In step a, the feedback of previous detection actions is collected, the results are numerically embedded to obtain data d, and the prompts for the third and fourth category tasks t are constructed; in step b, t is handed over to M3 for reasoning to obtain the monitoring state S0 and the detection action set A0; in step c, if A0 is not empty, it means that further detection actions are to be performed, but due to the previous output embedding, the current model outputs a state template with reduced dimensionality after clustering. In actual execution, it needs to be upgraded to a specific action, but clustering and dimensionality reduction are irreversible. Therefore, the action de-embedding is realized through the policy diffusion algorithm, and the action selection is realized using the heuristic method. The specific process is as follows.

[0151] 1) Define state space and action space:

[0152] First, we need to restore the state space and action space before the feature embedding in step 1.c.

[0153] 2) Simulate action diffusion:

[0154] Given the current state and the target task, a series of possible action paths are generated by simulating the diffusion process of actions in the state space. This process can be regarded as a conditional denoising diffusion process, but the strategy does not directly output actions, but derives the action score gradient based on visual observations in multiple denoising iterations.

[0155] 3) Evaluate the action path:

[0156] For each generated action path, the optimal action path is selected by evaluating its effect of reaching the target state, such as path length, time consumption, etc. This process involves learning the gradient of the action distribution score function and iteratively optimizing the gradient field through a series of stochastic Langevin dynamics steps during inference to model the scoring process.

[0157] 4) Extract further detection action A1 path from the selected optimal path.

[0158] In summary, the resource requirements for training and reasoning of the new large language model in the field of network monitoring in this application are relatively low. In terms of data, a general large language model is used to generate special training data in the field of network monitoring to train a specialized streamlined network monitoring model. Its reasonably designed multiple task prompts allow the large language model to extract the status and action flow of network monitoring from the general network text data and the network monitoring field text data as new network monitoring task prompts, so as to train a new special network monitoring model. There is no need to provide a large amount of additional data, which overcomes the obstacle of insufficient training data for training special field models. In terms of computing power, the model is mainly fine-tuned based on the general large language model, requiring fewer iterations, and the model structure has also been greatly streamlined, so it does not require too much computing resources and time. The reasoning resource requirements during the actual operation of the monitoring scheme are not high. On the one hand, the complexity of the model is controlled. On the other hand, although additional diffusion processes and heuristic search processes are introduced, the computational complexity is also within a controllable range.

[0159] This application can be used in the intelligent computing center heterogeneous network scenario, suitable for the intelligent computing transformation of existing heterogeneous network data centers, and also suitable for future network upgrades. The monitoring information is understood through software and models, so the requirements for network hardware are relatively low. The basic detection functions of various network nodes can be used in the solution of this application, such as the commonly used INT function. This greatly broadens the usage scenarios.

[0160] This application can be used as a general sub-domain specialization transformation framework for large language models. It only needs to redesign the prompts to adapt to a scenario outside the network monitoring field, laying the foundation for the all-round and systematic performance improvement of large language models.

[0161] See also Fig.12 As shown, this embodiment provides an electronic device 1200, which includes one or more processors 1201 and a memory 1202, and the memory 1202 is used to store one or more programs. When the one or more programs are executed by one or more processors 1201, the electronic device 1200 implements the network monitoring model training method or network monitoring method of the present application.

[0162] Fig.13 The following schematically shows a computer system structure block diagram for implementing some embodiments of the present application. It should be noted that: Fig.13 The computer system shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0163] like Fig.13As shown, the computer system 1300 includes a central processing unit 1301 (CPU), which can perform various appropriate actions and processes according to the program stored in the read-only memory 1302 (ROM) or the program loaded from the storage part 1303 to the random access memory 1304 (RAM). Various programs and data required for the operation of the device are also stored in the random access memory 1304. The central processing unit 1301, the read-only memory 1302 and the random access memory 1304 are connected to each other through a bus 1305. The input / output interface 1306 (Input / Output interface, i.e., I / O interface) is also connected to the bus 1305.

[0164] The following components are connected to the input / output interface 1306: an input section 1307 including a keyboard, a mouse, etc.; an output section 1308 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 1303 including a hard disk, etc.; and a communication section 1309 including a network interface card such as a LAN card, a modem, etc. The communication section 1309 performs communication processing via a network such as the Internet. A drive 1310 is also connected to the input / output interface 1306 as needed. A removable medium 1311, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 1310 as needed so that a computer program read therefrom is installed into the storage section 1303 as needed.

[0165] In particular, according to an embodiment of the present application, the processes described in the various method flow charts may be implemented as computer software programs. For example, an embodiment of the present application includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flow chart. In such an embodiment, the computer program can be downloaded and installed from a network through the communication part 1309, and / or installed from a removable medium 1311. When the computer program is executed by the central processor 1301, various functions defined in the device of the present application are executed.

[0166] It should be noted that the computer-readable medium shown in the embodiment of the present application may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, - but not limited to - an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor device, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM), a flash memory, an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by an instruction execution device, a device or a device or used in combination with it. In the present application, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, wherein a computer-readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer readable signal media may also be any computer readable medium other than computer readable storage media, which may send, propagate, or transmit programs for use by or in conjunction with instruction execution devices, devices, or devices. The program code contained on the computer readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0167] Those skilled in the art should be aware that in one or more of the above examples, the functions described in this application can be implemented by hardware, software, firmware, or any combination thereof. When implemented by software, these functions can be stored in a computer-readable storage medium or transmitted as one or more instructions or codes on a computer-readable storage medium.

[0168] Through the description of the above implementation methods, technical personnel in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional modules is used as an example. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above.

[0169] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic, for example, the module division is only a logical function division, and there may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another device, or some features can be ignored or not executed.

[0170] It should be understood that the present application is not limited to the precise structures that have been described above and shown in the drawings, and that various modifications and changes may be performed without departing from the scope thereof. The scope of the present application is limited only by the appended claims.

Claims

1. A network monitoring model training method, characterized in that: The training method comprises: Generate initial training data using a general large language model, and perform a dimensionality reduction operation on the initial training data to obtain a network monitoring training data set; Distilling the universal large language model to obtain a network monitoring baseline model; The network monitoring baseline model is fine-tuned using the network monitoring training data set, and the fine-tuned network monitoring baseline model is distilled to obtain a network monitoring model.

2. The training method according to claim 1, characterized in that: The method of generating initial training data using a general large language model includes: Creating a task description, wherein the task description at least includes a description of generating a network state and generating a next detection action; Inputting any of the task descriptions and corresponding prompt examples into a general large language model, and using a sample-driven progressive guidance method to guide the general large language model to generate prompt data; The general large language model learns the original data again based on various prompt samples to obtain initial training data.

3. The training method according to claim 1, characterized in that: The distilling of the general large language model to obtain a network monitoring baseline model includes: The general large language model is iteratively quantized, structured pruned, and unstructured pruned until the inference delay is reduced to the millisecond level, thereby obtaining a network monitoring baseline model.

4. The training method according to claim 2 or 3, characterized in that: The performing a dimensionality reduction operation on the initial training data to obtain a network monitoring training data set includes: Performing feature embedding on the initial training data to obtain a network monitoring training data set; or The performing a dimensionality reduction operation on the initial training data to obtain a network monitoring training data set includes: Determining the data type included in the initial training data; For the numerical data in the initial training data, equal-width binning is used to perform numerical embedding, and for the textual data in the initial training data, a relation propagation clustering method is used to perform action template embedding to obtain a network monitoring training data set.

5. A network monitoring method, executed by a centralized controller, wherein the centralized controller is communicatively connected to a plurality of network nodes, characterized in that: The network monitoring method comprises: Acquire detection data fed back by the network node based on the detection action, and obtain model input data based on the detection data; Inputting the model input data into a network monitoring model, performing reasoning through the network monitoring model, obtaining a monitoring result of a network state and an action decision for further detection actions; dispatching a probing action to the network node based on the action decision; Wherein, the network monitoring model is obtained by adopting the training method described in any one of claims 1 to 4.

6. The network monitoring method according to claim 5, characterized in that: The dispatching of a detection action to the network node based on the action decision comprises: A strategy diffusion algorithm is used to perform action de-embedding on the action decision to obtain multiple detection action options; Heuristic algorithm is used to select detection actions; The selected probing action is dispatched to the network node.

7. The network monitoring method according to claim 6, characterized in that: The strategy diffusion algorithm is used to perform action de-embedding on the action decision to obtain multiple detection action options, including: Restoring the state space and action space of the initial training data before feature embedding; Generate multiple possible action paths by simulating the diffusion process of the action in the state space; The use of a heuristic algorithm to select a detection action includes: Evaluate the effect of each action path in reaching the target state, wherein the effect at least includes the path length and time consumption; A detection action is extracted from the action path with the best effect as a selected detection action.

8. An electronic device, characterized in that: The electronic device comprises: one or more processors; A memory for storing one or more programs, which, when executed by the one or more processors, enables the electronic device to implement the training method as described in any one of claims 1 to 4 or the network monitoring method as described in any one of claims 5 to 7.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-readable instructions, and when the computer-readable instructions are executed by a processor of a computer, the computer is caused to execute the training method as described in any one of claims 1 to 4 or implement the network monitoring method as described in any one of claims 5 to 7.

10. A network monitoring system, comprising a centralized controller and a plurality of network nodes, wherein the centralized controller is communicatively connected with the plurality of network nodes, characterized in that: The centralized controller is configured to execute the network monitoring method according to any one of claims 5 to 7.

Images