Network anomaly diagnosis method, device and system

Abstract

The invention discloses a network anomaly diagnosis method, device and system, and belongs to the technical field of network communication. The method comprises the following steps: acquiring first data, and determining a fault type causing a first network exception event according to the first data; wherein the first data is network performance data of the first user access equipment in a first time period, the first time period comprises time when a first network abnormal event is detected, and the first network abnormal event is a network abnormal event detected based on a message flow flowing through the first user access equipment; the first user access equipment is used for accessing the terminal equipment to the network. According to the method, the efficiency of diagnosing the network abnormality can be improved.

Description

Technical Field

[0001] The present application relates to the field of network communication technology, and in particular to a method, device and system for diagnosing network anomalies. Background Art

[0002] With the development of network communication technology, user services have diversified, and user services have put forward higher and higher requirements for network stability. Especially in some high-value scenarios, the stability of the network will affect the economic benefits of users. For example, in live broadcast or walking broadcast scenarios, problems such as freezing and black screen of live broadcast caused by network abnormalities will cause the live broadcast room to lose fans, thereby affecting the sales of the live broadcast room. Among them, walking broadcast refers to a mode of live broadcasting without a fixed live broadcast room, but walking and broadcasting in the offline market.

[0003] Therefore, when a network anomaly occurs, how to efficiently diagnose the network anomaly so as to quickly and efficiently repair the network has become a technical problem that needs to be solved urgently. Summary of the invention

[0004] The present application provides a method, device and system for diagnosing network anomalies. Through this method, the efficiency of diagnosing network anomalies can be improved.

[0005] The technical solutions provided by this application are as follows:

[0006] In a first aspect, the present application provides a method for diagnosing a network anomaly, the method comprising: obtaining first data, and determining the type of fault that causes a first network anomaly event based on the first data. The first data is network performance data of a first user access device within a first time period, the first time period includes the time when the first network anomaly event is detected, the first network anomaly event is a network anomaly event detected based on a message flow flowing through the first user access device, and the first user access device is used to connect a terminal device to a network.

[0007] Among them, the network performance data of the first user access device in the first time period includes the network performance data of the first user access device when the first network abnormal event occurs. That is, the network performance data of the first user access device in the first time period includes the network performance data of the first user access device at the time of the first network abnormal event. Therefore, through the method provided by the present application, it is possible to diagnose the network abnormal event based on the network performance data of the first user access device at the time of the network abnormal event, so as to efficiently and accurately determine the type of fault that caused the network abnormal event. That is, the network abnormality diagnosis method provided by the present application improves the efficiency of diagnosing network abnormal events.

[0008] In a possible design, the acquisition of the first data includes: receiving the first data sent by the data acquisition module, the first data including the identifier of the user access device. The determination of the fault type causing the first network abnormal event based on the first data includes: receiving an abnormal notification message, the abnormal notification message is used to determine the first network abnormal event, and in the case where the abnormal notification message includes the identifier of the user access device, responding to the first network abnormal event, determining the fault type causing the first network abnormal event based on the first data. Through this possible design, it is achieved that when a network abnormal event occurs, the network abnormality diagnosis method provided in the present application is triggered and executed again.

[0009] In another possible design method, the above-mentioned determining the fault type causing the first network abnormal event based on the first data includes: determining the location area where the fault causing the first network abnormal event is located, and the location area includes the user side of the first user access device or the network side of the first user access device; in the case that the fault causing the first network abnormal event is located on the user side of the first user access device, determining the fault type causing the first network abnormal event based on the first data.

[0010] In another possible design, the method further includes: when the fault causing the first network abnormal event is located on the network side of the first user access device, reporting alarm information of the network side fault.

[0011] Through the above two possible designs, it is achieved to first delimit the network abnormal event to determine the location area where the fault that caused the network abnormal event is located. Then, when the fault is located on the user side of the first user access device, the specific type of the fault is diagnosed based on the network performance data of the first user access device at the time when the network abnormal event occurred. And when it is determined that the fault is located on the network side of the first user access device, only the alarm information is reported. In this way, the computing resources of the analysis module used to execute the method provided in the present application can be saved.

[0012] In another possible design, the method further includes: obtaining second data, the second data being service data transmitted by the first user access device during the first time period. The above-mentioned determination of the location area where the fault causing the first network abnormal event is located includes: determining the location area where the fault causing the first network abnormal event is located based on the second data. Through this possible design, when it is determined that the current network has a network abnormal event, it is possible to determine that the fault causing the network abnormal event occurs on the network side or the user side of the user access device based on the service data flowing through the user access device.

[0013] In another possible design, the above-mentioned determining the location area where the fault causing the first network abnormal event is located based on the second data includes: determining the location area where the fault causing the first network abnormal event is located based on the second data and a second classifier.

[0014] In another possible design, the method further includes: obtaining a user-side network delay and a network-side network delay of the first user access device. The above-mentioned determination of the location area where the fault causing the first network abnormal event is located includes: determining the location area where the fault causing the first network abnormal event is located based on the user-side network delay and the network-side network delay of the first user access device.

[0015] The present application can determine, through any of the above two methods, based on business data that the fault that causes the network abnormal event occurs on the network side or the user side of the user access device.

[0016] In another possible design manner, the determining the fault type causing the first network abnormal event according to the first data includes: calling a first classifier to predict the fault type causing the first network abnormal event according to the first data.

[0017] In another possible design manner, the first classifier is trained using a decision tree model and / or a neural network model.

[0018] In another possible design, the above-mentioned determining the fault type causing the first network abnormal event according to the first data includes: searching for a correspondence between network performance data and the fault type according to the first data to determine the fault type causing the first network abnormal event.

[0019] In another possible design manner, the above-mentioned determining the fault type causing the first network abnormal event based on the first data includes: determining a first prediction result and a second prediction result based on the first data, the first prediction result is the fault type obtained by calling the first classifier according to the first data prediction, and the second prediction result is the fault type determined by searching the correspondence between network performance data and fault types based on the first data; determining a target prediction result from the first prediction result and the second prediction result, the target prediction result indicating the fault type causing the first network abnormal event.

[0020] Through any of the above-mentioned possible design methods, it is possible to determine the type of fault that causes the network abnormal event based on the network performance data of the user access device.

[0021] In another possible design, the above method is executed by an analysis module, which is configured in a cloud device.

[0022] In another possible design, the first data includes network performance data of the first user access device collected per second during the first period. Through this possible design, accurate collection of network performance data of the user access device, including the time and site of the network abnormality event, can be achieved.

[0023] In a second aspect, the present application provides a method for diagnosing network anomalies, the method comprising: detecting a network anomaly event; and sending a data acquisition instruction to a data acquisition module when a first network anomaly event is detected based on a message flow passing through a first user access device. The data acquisition instruction is used to indicate the acquisition of first data. The first user access device is used to connect a terminal device to a network, the first data is network performance data of the first user access device within a first time period, the first data is used to analyze the type of fault that caused the first network anomaly event, and the first time period includes the time when the first network anomaly event was detected.

[0024] Through the method provided in the present application, it is possible to detect network abnormal events in real time, and when a network abnormal event is detected, trigger the collection of network performance data of user access devices at the time when the network abnormal event is detected, so that the type of fault that caused the network abnormal event can be determined efficiently and accurately based on the network performance data.

[0025] In a possible design, the method further includes: sending an abnormality notification message to the analysis module, the abnormality notification message being used to determine the first network abnormality event. Through this possible design, the analysis module executing the method provided by the present application can be notified in a timely manner that a network abnormality event has occurred.

[0026] In another possible design, the data acquisition instruction is also used to indicate the acquisition of second data, the second data is the service data transmitted by the first user access device in the first time period, and the second data is used to determine the location area where the fault causing the first network abnormal event is located, and the location area includes the user side of the first user access device or the network side of the first user access device. Through this possible design, it is possible to first delimit the fault causing the network abnormal event according to the service data, and then specifically determine the type of the fault according to the network performance data of the user access device.

[0027] In another possible design, the above method also includes: determining the user-side network delay and network-side network delay of the first user access device; and sending the user-side network delay and network-side network delay of the first user access device to the analysis module.

[0028] In another possible design, the above method is executed by a detection module, and the detection module is applied to an optical line terminal OLT device, an optical network terminal ONT device or an optical network unit ONU device.

[0029] In a third aspect, the present application provides a method for diagnosing network anomalies, the method comprising: obtaining a data acquisition indication; in response to the data acquisition indication, obtaining first data; and sending the first data to an analysis module. The data acquisition indication is used to indicate the acquisition of the first data, the first data is the network performance data of the first user access device in the first time period, the first data is used to analyze the type of fault that causes the first network anomaly event, the first time period includes the time when the first network anomaly event is detected, the first network anomaly event is a network anomaly event determined based on a message flow flowing through the first user access device, and the first user access device is used to connect the terminal device to the network.

[0030] Through the method of the present application, network performance data of user access devices at the time when the network abnormal event was detected can be collected, so that the type of fault that caused the network abnormal event can be determined efficiently and accurately based on the network performance data.

[0031] In another possible design, the data acquisition instruction is also used to indicate the acquisition of second data, the second data is the service data transmitted by the first user access device in the first time period, and the second data is used to determine the location area where the fault causing the first network abnormal event is located, and the location area includes the user side of the first user access device or the network side of the first user access device. Through this possible design, it is possible to first delimit the fault causing the network abnormal event according to the service data, and then specifically determine the type of the fault according to the network performance data of the user access device.

[0032] In another possible design, the first user access device is configured with a cache pool, which is used to store the network performance data and service data of the first user access device. The above-mentioned acquisition of the first data includes: acquiring the third data and the fourth data of the first user access device stored in the cache pool. Among them, the third data includes the network performance data and service data of the first user access device in the second time period, and the second time period is the time period from the current time to the first preset time period before the current time to the current time. The fourth data includes the network performance data and service data of the first user access device in the third time period, and the third time period is the time period from the current time to the time after the current time and the first preset time period from the current time. The first time period includes the second time period and the third time period, the first data includes the network performance data in the third data and the network performance data in the fourth data, and the second data includes the service data in the third data and the service data in the fourth data.

[0033] Through this possible design, based on a pre-set cache pool, it is possible to collect network performance data of user access devices at the scene when the network abnormal event is detected.

[0034] In another possible design, the above method is executed by a data acquisition module, and the data acquisition module is applied to a first user access device, where the first user access device is an optical network terminal ONT device or an optical network unit ONU device.

[0035] In a fourth aspect, the present application provides a device for diagnosing network anomalies.

[0036] In a possible design mode, the diagnostic device is used to perform any of the methods provided in the first, second and third aspects above. The present application may divide the functional modules of the diagnostic device according to any of the methods provided in the first, second and third aspects above. For example, each functional module may be divided corresponding to each function, or two or more functions may be integrated into one processing module. Exemplarily, the present application may divide the diagnostic device into a transceiver unit and a processing unit according to the function. Among them, the transceiver unit is used to perform operations related to receiving and / or sending in any of the methods provided in the first, second and third aspects above, and the processing unit is used to perform other operations other than operations related to receiving and / or sending in any of the methods provided in the first, second and third aspects above. The description of the possible technical solutions and beneficial effects performed by each of the functional modules divided above can refer to the technical solutions provided by the first, second and third aspects or their corresponding possible designs, which will not be repeated here.

[0037] In another possible design, the diagnostic device includes: one or more processors, a memory and a network interface, the one or more processors receiving or sending data through the network interface, and the one or more processors being configured to read program instructions stored in the memory to execute any method provided by the first aspect, the second aspect, the third aspect and any possible design thereof.

[0038] In a fifth aspect, the present application provides a network anomaly diagnosis system, the system comprising: an analysis module, a detection module and a data acquisition module. The analysis module is used to execute any method provided in the first aspect and any possible design thereof, the detection module is used to execute any method provided in the second aspect and any possible design thereof, and the data acquisition module is used to execute any method provided in the third aspect and any possible design thereof.

[0039] In a sixth aspect, the present application provides a computer-readable storage medium, which is a non-volatile computer-readable storage medium, and the computer-readable storage medium includes program instructions. When the program instructions are executed on a computing device, the computing device executes the method provided in the first aspect, the second aspect, the third aspect of the present application and any possible implementation thereof.

[0040] In a seventh aspect, the present application provides a computer program product comprising instructions, which, when executed on a computer, enables the computer to execute the method provided in the first aspect, the second aspect, the third aspect and any possible implementation manner of the present application.

[0041] It can be understood that any of the above-mentioned devices, systems, computer storage media or computer program products can be applied to the corresponding methods provided above. Therefore, the beneficial effects that can be achieved can refer to the beneficial effects in the corresponding methods and will not be repeated here.

[0042] In this application, the names of the above-mentioned diagnostic devices and diagnostic systems do not limit the devices or functional modules themselves. In actual implementation, these devices or functional modules may appear with other names. As long as the functions of each device or functional module are similar to those of this application, they fall within the scope of the claims of this application and their equivalent technologies. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1 It is a flowchart for handling abnormal network events;

[0044] Figure 2 It is a schematic diagram of the architecture of a network anomaly diagnosis system provided in an embodiment of the present application;

[0045] Figure 3 It is a schematic diagram of the architecture of another network anomaly diagnosis system provided in an embodiment of the present application;

[0046] Figure 4 It is a flowchart of a method for diagnosing network anomalies provided in an embodiment of the present application;

[0047] Figure 5 It is a flowchart of another method for diagnosing network anomalies provided in an embodiment of the present application;

[0048] Figure 6 is a schematic diagram of a process of obtaining first data provided by an embodiment of the present application;

[0049] Figure 7 This is a schematic diagram of a process for locating a fault type provided by an embodiment of the present application;

[0050] Figure 8 It is a flowchart of another method for diagnosing network anomalies provided in an embodiment of the present application;

[0051] Fig. 9 It is a schematic diagram of a process for determining a location area where a fault causing a first network abnormal event is located according to second data provided by an embodiment of the present application;

[0052] Fig.10 It is a schematic diagram of message interaction in a second message flow provided in an embodiment of the present application;

[0053] Fig.11 is a schematic diagram of a window size trend provided in an embodiment of the present application;

[0054] Fig.12 is a schematic diagram of a second message flow provided in an embodiment of the present application;

[0055] Fig.13 This is a schematic diagram of a process for demarcating a fault provided by an embodiment of the present application;

[0056] Fig.14 It is a flowchart of another method for diagnosing network anomalies provided in an embodiment of the present application;

[0057] Fig.15 It is a schematic diagram of determining user-side delay and network-side delay provided by an embodiment of the present application;

[0058] Fig.16 This is another method for diagnosing network anomalies provided by an embodiment of the present application;

[0059] Fig.17 is a schematic diagram of another method for diagnosing network anomalies provided in an embodiment of the present application;

[0060] Fig.18 It is a structural schematic diagram of a network anomaly diagnosis device provided in an embodiment of the present application;

[0061] Fig.19 It is a structural schematic diagram of another network anomaly diagnosis device provided in an embodiment of the present application;

[0062] Fig. 20 It is a structural diagram of another network abnormality diagnosis device provided in an embodiment of the present application;

[0063] Fig.21 It is a structural diagram of a computing device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0064] In order to make the objectives, technical solutions and advantages of the present application clearer, the implementation methods of the present application will be further described in detail below with reference to the accompanying drawings.

[0065] To facilitate understanding, the technology and background involved in the embodiments of the present application are first explained below.

[0066] 1) Optical Access Network (OAN)

[0067] Optical access network, also known as "fiber user loop", refers to a collection of access connections that use or partially use optical fiber to transmit signals between service nodes (such as service servers) and terminal devices and share the same network-side interface.

[0068] The specific access forms of the optical access network can be fiber to the room (FTTR), fiber to the building (FTTB), fiber to the curb (FTTC), fiber to the home (FTTH), fiber to the zone (FTTZ), etc., but are not limited to these.

[0069] The optical access network includes the optical line terminal (OLT), optical distribution network (ODN), and optical network unit (ONU) (or optical network terminal (ONT)). In addition, when the ODN uses passive optical devices such as passive optical splitters, the OAN is also called a passive optical network (PON).

[0070] Among them, OLT is an endpoint of OAN, and OLT is connected to the operator's bearer network through Ethernet cable. OLT is used to perform photoelectric conversion between electrical signals transmitted in Ethernet cables through the operator's bearer network and optical signals transmitted in ODN. ODN is the transmission medium of optical signals, which is used to transmit optical signals between OLT and ONU (or ONT). ONU / ONT is another endpoint of OAN. ONU / ONT is essentially a device that converts optical signals transmitted through optical fibers in ODN into electrical signals. The difference is that ONT is a term used by the International Telecommunication Union-Telecommunication Standardization Sector (ITU-T), while ONU is a term used by the Institute of Electrical and Electronics Engineers (IEEE), and they belong to different standard bodies. Furthermore, user stations (STA) (such as mobile phones, computers, tablets, Internet TVs, printers, cameras and other user terminals) can access OAN through ONU / ONT, and then access the operator's bearer network, thereby connecting to the operator's network.

[0071] In the optical access network, OLT is the network-side endpoint connected to the operator's bearer network, and ONU / ONT is the user-side endpoint connected to the STA. Therefore, ONU / ONT is called the user-side access device in the optical access network (abbreviated as user access device), and OLT is called the network-side access device in the optical access network.

[0072] It should be understood that when the access form of the optical access network is FTTR, the ONU / ONT as the user access device in the optical access network can also be called FTTR equipment. When the access form of the optical access network is FTTH, the ONU / ONT as the user access device in the optical access network can also be called FTTH equipment. In this case, STA generally accesses ONU / ONT wirelessly. That is, the FTTR device or FTTH device acts as a wireless access point (AP) to connect STA to the optical access network.

[0073] It should also be understood that when the access form of the optical access network is FTTB, the ONU / ONT as the user access device in the optical access network can also be called FTTB device. When the access form of the optical access network is FTTC, the ONU / ONT as the user access device in the optical access network can also be called FTTC device. When the access form of the optical access network is FTTZ, the ONU / ONT as the user access device in the optical access network can also be called FTTZ device. In this case, there may also be an AP (such as a wireless router, etc.) device between the STA and the ONU / ONT, so that the STA accesses the AP wirelessly, and the AP is connected to the ONU / ONT by wire to achieve the access of the STA to the OAN.

[0074] With the development of network technology, optical access network is more and more widely used. Compared with cables, optical access network has lower environmental interference and higher transmission rate.

[0075] Currently, it is usually the user who discovers a network anomaly while using the network and reports it to the network operator. The network operator's installation and maintenance personnel will perform on-site repairs some time after receiving the user's report. For some occasional network anomalies, such as freezes in live broadcasts and black screens caused by network anomalies, it is difficult for the installation and maintenance personnel to reproduce the network anomaly site due to the time difference between the time when the installation and maintenance personnel visit the site to repair the network and the time when the network anomaly occurs. It is therefore difficult to quickly diagnose the type of fault that causes the network anomaly, which in turn affects the efficiency of repairing the network. For example, Figure 1As shown in the figure, when the user discovered the network anomaly at 10:00 and reported it to the network operator, the network operator's installation and maintenance personnel came to the site at 14:00 to handle the network anomaly. Since the network anomaly scene could not be reproduced at this time, the installation and maintenance personnel reported it to the expert. The expert visited the site several times within 1-3 days, and when the network anomaly reappeared, he captured packets on site, collected logs and key performance indicators (KPI) and other data to diagnose the network anomaly, and repaired the network based on the diagnosis results. It can be seen that due to the difficulty in reproducing the network anomaly scene, the efficiency of diagnosing network anomalies is very low.

[0076] Based on this, an embodiment of the present application provides a method for diagnosing network anomalies. Through this method, the network performance data of the first user access device in the first time period can be obtained, and the fault type causing the network anomaly event can be determined based on the network performance data. Among them, the first time period includes the time when the network anomaly event is detected based on the message flow flowing through the first user access device (recorded as the first time). Here, the first time when the network anomaly event is detected can be approximately regarded as the time when the network anomaly event occurs. In this case, the network performance data of the first user access device in the first time period includes the network performance data of the first user access device when the network anomaly event occurs. Or it can be understood that the network performance data of the first user access device in the first time period includes the network performance data of the first user access device at the time when the network anomaly event occurs. Therefore, through the method provided by the embodiment of the present application, the network performance data of the first user access device at the time when the network anomaly event occurs is realized, and the network anomaly event is diagnosed based on the network performance data of the first user access device at the time when the network anomaly event occurs, so that the fault type causing the network anomaly event can be determined efficiently and accurately. That is, the method for diagnosing network anomalies provided by the embodiment of the present application improves the diagnostic efficiency of network anomalies.

[0077] Optionally, the above-mentioned network abnormal event is any network event that can reflect the existence of a network fault. For example, the network abnormal event may be a sudden change in the number of data packets transmitted by the message flow (suddenly increasing or decreasing), or a sudden change in the packet interval of the message flow (suddenly becoming longer or shorter), or a network event such as the number of retransmitted messages of the message flow exceeding a threshold, etc., without limitation.

[0078] The embodiment of the present application also provides a network anomaly diagnosis system, which includes a detection module, a data acquisition module and an analysis module. Among them, the detection module is used to detect network anomaly events based on the message flow flowing through the user access device. The data acquisition module is used to obtain the crime scene of incident (CSI) data (referred to as snapshot data) of the first user access device after determining that a network anomaly event is detected based on the message flow flowing through a certain user access device (such as a first user access device). The snapshot data refers to the snapshot data of the first user access device when the network anomaly event is detected. The snapshot data includes network performance data of the first user access device. Optionally, the snapshot data also includes service data transmitted by the first user access device. The analysis module is used to analyze and diagnose the fault type that causes the network anomaly event based on the snapshot data of the first user access device. Among them, the detailed description of the method described in the embodiment of the present application performed by the detection module, the data acquisition module and the analysis module can refer to the description of the method below, and will not be repeated here.

[0079] The above diagnostic system can be applied to access networks. Among them, the access network refers to a collection of access connections that transmit signals between service nodes (such as service servers) and terminal devices (such as mobile phones, computers, tablets, Internet TVs, etc.) and share the same network side interface. Optionally, the access network can use copper cables to transmit signals, optical fibers to transmit signals, and optical fiber hybrid coaxial cables to transmit data signals, without limitation. As an example, the access network is an optical access network.

[0080] Optionally, the above-mentioned detection module can be configured in any network device in the access network. As an example, the detection module can be configured in an OLT device in the optical access network, or in an OLT device provided with an access edge computing (AEC) module in the optical access network, or in an ONT device or ONU device (such as an FTTR device) in the optical access network, or in any device that can obtain the mirrored message flow flowing through the user access device, without limitation. Among them, the mirrored message flow refers to a copy of the message flow.

[0081] Optionally, the above data acquisition module can be configured in a user access device in the access network, or in any other device that can obtain network performance data of the user access device, without limitation. As an example, the data acquisition module can be configured in an ONT device or an ONU device (such as an FTTR device) in an optical access network, or in an OLT device in an optical access network, without limitation.

[0082] Optionally, the above analysis module can be configured in a local device in a user network that accesses the operator's bearer network through an access network, for example, the analysis module is configured in a network management device in the user network. Optionally, the analysis module can also be configured in a cloud device. For example, the analysis module is configured in a cloud computing platform (such as a Network Cloud Engine (NCE) platform) or a cloud server, but is not limited thereto.

[0083] Optionally, the above-mentioned detection module, data acquisition module and analysis module may be configured in one device, or may be configured in at least two devices, which is not limited.

[0084] As an example, the detection module, data acquisition module and analysis module are configured in different devices. For example, the detection module is configured in the OLT device of the optical access network, the data acquisition module is configured in the FTTR device of the optical access network, and the analysis module can be configured in the NCE. Figure 2 , Figure 2 FIG. 1 is a schematic diagram showing the architecture of a network anomaly diagnosis system provided by an embodiment of the present application. Figure 2 As shown, the diagnostic system 200 includes an OLT device, an FTTR device, and an NCE, and the OLT device and the FTTR device communicate via a PON, and the FTTR device and the STA communicate via a wireless connection. Among them, the OLT device is used to execute the method part executed by the detection module in the method described below in the embodiment of the present application, the FTTR device is used to execute the method part executed by the data acquisition module in the method described below in the embodiment of the present application, and the NCE is used to execute the method part executed by the analysis module in the method described below in the embodiment of the present application. For detailed description, please refer to the method description below, which will not be repeated.

[0085] It is understandable that multiple FTTR devices can be connected to one OLT device. Figure 2 Only one FTTR device is shown as an example. Similarly, one FTTR device can access multiple STAs. Figure 2 Only one STA is shown for exemplary purposes.

[0086] As another example, the detection module, data acquisition module and analysis module are configured in two devices. For example, the detection module and data acquisition module are configured in the FTTR device of the optical access network, and the analysis module is configured in the NCE. Figure 3 , Figure 3 FIG. 2 shows a schematic diagram of the architecture of another network abnormality diagnosis system provided by an embodiment of the present application. Figure 3As shown, the diagnostic system 300 includes an FTTR device and an NCE. The OLT device and the FTTR device communicate via PON, and the FTTR device and the STA use wireless communication. The FTTR device is used to execute the method part executed by the detection module and the data acquisition module in the method described below in the embodiment of the present application, and the NCE is used to execute the method part executed by the analysis module in the method described below in the embodiment of the present application. For detailed description, please refer to the method description below, which will not be repeated.

[0087] It should be understood that the above content is an exemplary description of the network abnormality diagnosis system provided in the embodiment of the present application, and does not constitute a limitation on the diagnosis system. It is known to those skilled in the art that the specific implementation of the diagnosis system can be adjusted according to the implementation form of the access network, and the embodiment of the present application does not list them one by one.

[0088] The embodiment of the present application also provides a diagnostic device for network anomalies, which is used to execute the diagnostic method for network anomalies provided by the embodiment of the present application. The detailed description of the method refers to the method description below and will not be repeated here. It is understandable that the above-mentioned detection module, data acquisition module and analysis module are applied to the diagnostic device provided by the embodiment of the present application. The diagnostic device provided by the embodiment of the present application can be any computing device with computing and processing capabilities, or a functional module in the computing device. Optionally, the computing device can be a terminal device such as a general-purpose computer, a laptop computer, a tablet, or a network device such as a server, without limitation.

[0089] The following describes the implementation process of the network anomaly diagnosis method provided in the embodiment of the present application.

[0090] refer to Figure 4 , Figure 4 The following is a flow chart of a method for diagnosing network anomalies provided by an embodiment of the present application. Optionally, the method is applied to Figure 2 The diagnostic system 200 shown, or applied to Figure 3 The diagnostic system 300 is shown. Figure 4 As shown, the method for diagnosing network anomalies includes the following steps.

[0091] Step 101: The diagnostic system obtains first data.

[0092] Here, the first data is network performance data of the first user access device in the first time period.

[0093] The first user access device is used to access the terminal device to the network. The first user access device is any user-side access device in the access network. As an example, the first user access device is any ONT device or ONU device in the optical access network, and the ONT device or ONU device can be, for example, an FTTR device, an FTTH device, etc., but is not limited thereto. It is understandable that multiple terminal devices can be connected to one user access device.

[0094] The first time period includes the time when the first network abnormal event is detected (hereinafter referred to as the first time), and the first network abnormal event is a network abnormal event detected based on the message flow flowing through the first user access device. Among them, the embodiment of the present application does not specifically limit the duration of the first time period. It should be understood that the network abnormal event can be any network event that can reflect the existence of a network failure. For example, the network abnormal event can be a sudden change in the number of data packets transmitted by the message flow (suddenly increasing or suddenly decreasing), etc., which will not be repeated.

[0095] It should be understood that since the time when the network abnormal event is detected can generally be regarded as the time when the network abnormal event occurs, the first time period includes the time when the first network abnormal event is detected, and it can be understood that the first time period is the time period including the time when the first network abnormal event occurs. In other words, the first data is the network performance data of the first user access device in a period of time including the time when the first network abnormal event occurs, or it can be understood that the first data is the network performance data of the first user access device in a period of time before and after the first network abnormal event occurs. That is, the first data includes the network performance data of the first user access device at the time when the first network abnormal event occurs. Among them, the detailed description of the network performance data can refer to the description of step 203 below, which will not be repeated here.

[0096] Step 102: The diagnostic system determines the fault type causing the first network abnormal event according to the first data.

[0097] Optionally, the diagnosis system calls a pre-trained classifier model (referred to as a first classifier) ​​to predict the fault type causing the first network abnormal event based on the first data.

[0098] Optionally, the diagnostic system searches for a correspondence between network performance data and fault types according to the first data to determine the fault type causing the first network abnormal event. For simple description, the correspondence between network performance data and fault types is recorded as an empirical rule below.

[0099] Optionally, the diagnostic system determines the fault type causing the first network abnormal event based on the first data, the first classifier and empirical rules.

[0100] The detailed description of the fault type that causes the first network abnormal event determined by the diagnostic system according to the first data may be referred to the description of step 206 below, which will not be repeated here.

[0101] Since the first data includes network performance data of the first user access device at the time when the first network abnormal event occurs, the type of fault causing the first network abnormal event can be determined efficiently and accurately based on the first data.

[0102] Therefore, through the network anomaly diagnosis method described in steps 101 to 102, it is possible to efficiently and accurately determine the fault type that caused the network anomaly event based on the network performance data of the user access device at the time when the network anomaly event occurred. Therefore, the network anomaly diagnosis method provided in the embodiment of the present application can improve the efficiency of network anomaly diagnosis.

[0103] In other embodiments, taking the configuration of the detection module, data acquisition module and analysis module in the diagnostic system provided in the embodiment of the present application in different devices as an example, reference Figure 5 , Figure 5 A schematic diagram of another method for diagnosing network anomalies provided in an embodiment of the present application is shown. Optionally, the method is applied to Figure 2 The diagnostic system 200 shown in FIG. 1 is used to perform the corresponding method steps by the detection module, data acquisition module and analysis module in the diagnostic system 200. Figure 5 As shown, the method for diagnosing network anomalies includes the following steps:

[0104] Step 201: The detection module detects network abnormal events.

[0105] The detection module communicates with at least one user access device including the first user access device, and can obtain the message flow transmitted by the at least one user access device. In this way, the detection module detects whether a network abnormal event occurs based on the message flow flowing through each user access device in the at least one user access device.

[0106] Optionally, the detection module can identify each acquired message flow, and maintain corresponding flow parameter information for each acquired message flow, and the flow parameter information includes but is not limited to one or more of the following flow parameters: flow identifier, the number of messages transmitted in the message flow, the size of the messages transmitted in the message flow, the number of retransmitted messages in the message flow, and the packet interval of adjacent messages in the message flow. Among them, the flow identifier can be represented by the quintuple / triplet / flow identification number (identity, ID) of the message flow, which is not limited. As an example, after obtaining any message (recorded as the first message), the detection module can determine the message flow to which the first message belongs (recorded as the first message flow), and update the flow parameter information corresponding to the first message flow based on the first message (recorded as the first flow parameter information), thereby achieving the purpose of maintaining the first flow parameter information. Optionally, when the detection module determines the message flow to which the first message belongs, the message flow to which the first message belongs can be determined according to the quintuple / triplet of the first message. Alternatively, if the first message carries a flow ID, the detection module can determine the message flow to which the first message belongs based on the flow ID carried by the first message. This is not limited. Among them, the five-tuple of the message generally includes the source address, source port, destination address, destination port and transmission protocol of the message. The triplet generally includes the source address, destination address and transmission protocol of the message, which is not limited.

[0107] In this way, the detection module can determine whether the message flow generates a network abnormality event based on the flow parameter information corresponding to each message flow. For example, when the detection module determines that the number of transmitted messages recorded in the first flow parameter information changes suddenly, it is determined that the first message flow generates a network abnormality event.

[0108] Furthermore, the detection module can also determine the user access device used to transmit the message flow based on the message flow that generated the network abnormal event. Optionally, the detection module can pre-store the correspondence between multiple user access devices managed by itself and the terminal devices connected to each user access device. In this way, the detection module can determine the user access device corresponding to the terminal device based on the pre-stored correspondence and the terminal device indicated by the destination address or source address of the message flow. Optionally, the detection module can determine that the source address or destination address of the message flow is used to indicate the terminal device based on the network segment to which the destination address and source address in the message flow belong. In this way, the detection module determines that the message flow flowing through the user access device has generated a network abnormal event. In other words, the detection module detects the network abnormal event based on the message flow flowing through the user access device.

[0109] As an example, combining Figure 2When the detection module is configured in the OLT device, the OLT device is generally connected to multiple FTTR devices, and the OLT device is used to forward message flows between the multiple FTTR devices and the upper-layer operator bearer network. In this case, the OLT device can maintain flow parameter information based on each message flowing through itself. In this way, the OLT device can determine whether the message flow generates a network abnormality event based on the flow parameter information of each message flow flowing through itself. For example, the OLT device determines that message flow 1 generates a network abnormality event based on the flow parameter information of message flow 1 flowing through itself.

[0110] In addition, the OLT device generally pre-stores the correspondence between the multiple FTTR devices connected to itself and the terminal devices connected to each FTTR device. For example, the OLT device is connected to FTTR device 1 and FTTR device 2, FTTR device 1 is connected to terminal devices 11, 12 and 13, and FTTR device 2 is connected to terminal devices 21 and 22. In this case, the pre-stored correspondence of the OLT device includes: the correspondence between FTTR device 1 and terminal devices 11, 12 and 13, and the correspondence between FTTR device 2 and terminal devices 21 and 22. In this way, the OLT device can determine the user access device 1 corresponding to the terminal device 1 indicated by the destination address or source address of the message flow 1 that generates the network abnormal event and the pre-recorded correspondence. In this way, the OLT determines that the message flow 1 flowing through the user access device 1 generates a network abnormal event. Or it can be understood that the OLT device detects the network abnormal event based on the message flow 1 flowing through the user access device 1.

[0111] Step 202: When the detection module detects a first network abnormal event according to a message flow passing through the first user access device, the detection module sends a data acquisition instruction to the data collection module, where the data acquisition instruction is used to instruct the acquisition of first data.

[0112] When the detection module detects the first network abnormal event according to the message flow flowing through the first user access device in the manner described in step 201, it generates a data acquisition instruction and sends the data acquisition instruction to the data acquisition module to instruct the data acquisition module that receives the data acquisition instruction to acquire the first data. For a detailed description of the first data, please refer to the description of the first data in step 203, which will not be repeated here.

[0113] Optionally, the above-mentioned data acquisition indication can be implemented by an abnormal notification message sent by the detection module to the data acquisition module. Specifically, when the detection module detects the first network abnormal event according to the message flow flowing through the first user access device, it generates an abnormal notification message and sends the abnormal notification message to the data acquisition module, and the abnormal notification message is used to indicate the first network abnormal event. In this way, the data acquisition module that receives the abnormal notification message can respond to the first network abnormal event indicated by the abnormal notification message, thereby triggering the process of acquiring the first data.

[0114] Optionally, the above-mentioned abnormal notification message may carry the event name or identifier of the first network abnormal event. In this way, the event name or identifier of the first network abnormal event carried in the abnormal notification message can indicate or characterize the first network abnormal event. Optionally, the abnormal notification message has a specific data structure, and the data structure is used to indicate the first network abnormal event.

[0115] As an example, combining Figure 2 When the detection module is configured in the OLT device, the data acquisition module is configured in the FTTR device, and the FTTR is the first user access device, when the OLT device detects a first network abnormal event based on the message flow passing through the FTTR device, it generates a data acquisition indication and sends the data acquisition indication to the FTTR device to instruct the FTTR device to acquire the first data.

[0116] Optionally, when the detection module detects a first network abnormal event based on the message flow flowing through the first user access device, it can also send an abnormal notification message indicating the first network abnormal event to the analysis module, so that the analysis module determines that the first network abnormal event has occurred in the current network. It can be understood that the abnormal notification message sent by the detection module to the analysis module also includes the identifier of the first user access device, so that it is convenient for the analysis module to determine that the first network abnormal event is detected based on the message flow flowing through the first user access device. Optionally, the abnormal notification message sent by the detection module to the analysis module also includes the first time. Among them, the identifier of the first user access device can be, for example, the Internet Protocol (IP) address, Media Access Control (MAC) address or ID of the first user access device, which is not limited to this.

[0117] Step 203: The data acquisition module obtains a data acquisition instruction, and obtains first data in response to the data acquisition instruction.

[0118] After receiving the data acquisition instruction sent by the detection module, the data acquisition module obtains the first data in response to the data acquisition instruction. The first data is the network performance data of the first user access device in the first time period. The detailed description of the first time period can refer to the description of the first time period in step 101 above, which will not be repeated here.

[0119] The network performance data of the user access device specifically includes but is not limited to the value of at least one of the following network performance indicators: uplink rate, downlink rate, number of incoming packets, number of outgoing packets, queue waiting time, queue size, air interface delay, number of packet retransmissions, transmission channel, bandwidth of transmission channel, signal strength, negotiation rate, noise floor, interference duty cycle, transmission opportunity (TXOP), broadcast / unicast / multicast traffic, 11K / V switching, seamless roaming coordinated network (SRCN) switching, number of online devices, number of offline devices, frequency band traffic, or number of online devices, etc. Among them, 11K refers to the 802.11K protocol, which is used for neighbor reporting and specifically defines how the AP transmits information about neighbor APs to STAs. 11V refers to the 802.11v protocol, which defines how the AP guides the STA to switch.

[0120] Among them, the uplink rate is the rate at which the user access device transmits data to the network-side access device. The downlink rate is the rate at which the user access device transmits data to the terminal device. The number of incoming messages is the number of messages received by the user access device. The number of outgoing messages is the number of messages sent by the user access device. The queue waiting time includes the time that the message in the user access device's sending queue waits to be sent, and the time that the message in the user access device's receiving queue waits to be received. The queue size includes the size of the sending queue in the user access device and the size of the receiving queue in the user access device. Among them, the sending queue of the user access device is used to store the messages to be sent by the user access device, and the receiving queue of the user access device is used to store the messages to be received by the user access device. The air interface delay refers to the air interface delay from the user access device to the STA. The number of message retransmissions refers to the number of retransmissions of the message retransmitted by the user access device. The transmission channel refers to the channel used when the user access device transmits data to the terminal device. The bandwidth of the transmission channel refers to the frequency width (i.e., bandwidth) of the channel used when the user access device transmits data to the terminal device. Signal strength refers to the signal strength of the terminal device that covers the access user device. Negotiated rate refers to the uplink and downlink rates pre-negotiated between the user device and the terminal device that accesses the user device. Noise floor refers to the wireless noise in the environment where the user device is located. Interference duty cycle refers to the ratio of the interference signal in the environment where the user device is located to the signal transmitted by the user device. TXOP refers to the probability that the user device occupies the channel to transmit data. Broadcast / thin / multicast traffic refers to the size of the broadcast / thin / multicast traffic forwarded / transmitted by the user device. 802.11K / V switching refers to the switching between the 802.11K protocol and the 802.11V protocol. SRCN switching refers to the senseless switching of the user device during roaming. The number of online devices refers to the number of STAs (i.e., terminal devices) connected to the user device. The number of offline devices refers to the number of STAs (i.e., terminal devices) that have disconnected from the user device. Band traffic refers to the size of the traffic transmitted by the user device on the transmission band, and online device data refers to the number of STAs that are connected to the user device.

[0121] In an embodiment of the present application, the data collection module can collect the network performance data of the user access device in real time, or collect the network performance data of the user access device at a certain interval (such as 1 second, 2 seconds, etc.), and store it in a cache pool. Alternatively, the user access device collects its own network performance data in real time or at a certain interval, and stores it in a cache pool. It should be understood that when the interval for collecting the network performance data of the first user access device is in seconds, such as 1 second, it means that the first data includes the network performance data of the first user access device collected by seconds during the first time period.

[0122] Among them, the cache pool can be a cache pool configured for the data acquisition module, or it can be a cache pool configured for the user access device, and the embodiment of the present application does not limit this. When the cache pool is a cache pool configured for the data acquisition module, the cache pool can be used to store network performance data of multiple user access devices managed by the data acquisition module. The embodiment of the present application does not specifically limit the specific implementation form of the cache pool. For example, it can be a storage device, storage device or storage system accessed by the data acquisition module or the user access device, but is not limited to this.

[0123] In an embodiment of the present application, the cache pool is specifically used to store snapshot data of the user access device within a second time period, and the snapshot data includes network performance data. The second time period is a time period from the time before the current time and the first preset time period from the current time to the current time. The embodiment of the present application does not specifically limit the specific value of the first preset time period. It can be seen that as time changes dynamically, the cache pool continuously and dynamically stores snapshot data of the user access device within a period of time from the first preset time period from the current time.

[0124] As an example, taking the first preset time length as 30 seconds and the time interval for collecting snapshot data of user access devices as 1s, the above-mentioned cache pool is used to store snapshot data of user access devices collected within 30s before the current time. For example, if the current time is t1, the cache pool is used to store snapshot data of user access devices collected within 30s before t1. When the current time is updated to (t1+1), the snapshot data of user access devices collected at time (T1+1) is stored in the cache pool, and the snapshot data of user access devices collected at time (t1-30) is deleted, so as to ensure that the snapshot data of user access devices collected within 30s before (t1+1) is stored in the cache pool.

[0125] For the sake of simple description, the embodiment of the present application will include data of "snapshot data of the user access device in the second period" as the third data of the user access device. That is, the above-mentioned cache pool is used to store the third data of the user access device, and the third data of the user access device is the snapshot data of the user access device in the second period.

[0126] In this case, when the data acquisition module obtains the first data in response to the data acquisition instruction, the data acquisition module can first obtain the third data of the first user access device from the cache pool. And after the first preset time, obtain the fourth data of the first user access device stored in the cache pool. Among them, the fourth data is the snapshot data of the user access device in the third time period, and the third time period is the time period from the current time to the time after the current time and the time of the first preset time period from the current time. It can be understood that when the data acquisition module determines that the above-mentioned data acquisition instruction is obtained at the current time, the first time period mentioned above includes the second time period and the third time period, so the first data includes the network performance data in the third data and the network performance data in the fourth data. In this way, after the data acquisition module obtains the third data and the fourth data of the first user access device, it obtains the first data. Among them, since the above-mentioned data acquisition instruction is sent to the data acquisition module in real time when the detection module detects the first network abnormal event, the time when the data acquisition module obtains the data acquisition instruction can be approximately regarded as the time when the detection module detects the first network abnormal event (that is, the first time), that is, the time when the data acquisition module obtains the data acquisition instruction can be approximately regarded as the first time mentioned above. In this case, when the data acquisition module determines that the above-mentioned data acquisition instruction is acquired at the current time, the first time is included in the first time period of the first preset time length before and after the current moment.

[0127] Optionally, the process of the data acquisition module acquiring the fourth data stored in the buffer pool may include: when the data acquisition module determines that the first data needs to be acquired in response to the data acquisition indication, setting a timer with a duration of a first preset duration. Since the data stored in the buffer pool is updated from the third data to the fourth data when the first preset duration indicated by the timer is reached, the data acquisition device acquires the fourth data in the buffer pool when the first preset duration indicated by the timer is reached.

[0128] As an example, the detection module is configured in the OLT device, the data acquisition module is configured in the FTTR device, the FTTR device is the first user access device, and the first preset time length is 30 seconds. Figure 6 , Figure 6 FIG. 1 shows a schematic diagram of a process for obtaining first data provided by an embodiment of the present application. Figure 6As shown, the OLT device continuously detects network abnormal events, and when a first network abnormal event is detected, it sends a data acquisition instruction to the FTTR device. After receiving the data acquisition instruction, the FTTR device responds to the data acquisition instruction and acquires the third data of the FTTR device in the cache pool in real time to obtain the network performance data in the third data. At the same time, the FTTR device starts a timer with a duration of 30 seconds, and acquires the fourth data of the FTTR device stored in the cache pool when the timing duration reaches 30 seconds to obtain the network performance data in the fourth data. Among them, assuming that the time when the FTTR device receives the data acquisition request is the current time, the third data includes the network performance data collected by the FTTR device in the first 30 seconds of the current time, and the fourth data includes the network performance data collected by the FTTR device in the last 30 seconds of the current time. In this way, the first data includes the network performance data collected by the FTTR device in the first time period of 60 seconds including the current time.

[0129] Step 204: The data acquisition module sends the first data to the analysis module.

[0130] Since the first data includes the network performance data in the third data of the first user access device and the network performance data in the fourth data, the data acquisition module may optionally send the network performance data in the third data to the analysis module when the third data of the first user access device is obtained, and send the network performance data in the fourth data to the analysis module when the fourth data of the first user access device is obtained. Optionally, the data acquisition module may also send the collection of the network performance data in the third data of the first user access device and the network performance data in the fourth data (i.e., the first data) to the analysis module after obtaining the third data and the fourth data of the first user access device.

[0131] Optionally, when the data acquisition module sends the first data to the analysis module, it can also send an abnormal notification message indicating the first network abnormal event to the analysis module, so that the analysis module determines that the first network abnormal event has occurred in the current network. It should be noted that the abnormal notification message sent by the data acquisition module to the analysis module also includes the identifier of the first user access device, so that it is convenient for the analysis module to determine that the first network abnormal event is detected based on the message flow flowing through the first user access device. Optionally, the abnormal notification message sent by the data acquisition module to the analysis module also includes the first time. Among them, the identifier of the first user access device can be, for example, the IP address, MAC address or ID of the first user access device, which is not limited to this.

[0132] It is understandable that the data acquisition module can combine the first data and the abnormal notification message into one message for sending, or send them separately, and the embodiment of the present application does not limit this. When the data acquisition module sends the first data and the abnormal notification message separately, the embodiment of the present application does not limit the sequence of the data acquisition module sending the first data and sending the abnormal notification message. For example, the data acquisition module can send the first data first and then send the abnormal notification message, or the data acquisition module can send the abnormal notification message first and then send the first data.

[0133] Step 205: The analysis module obtains first data.

[0134] In response to step 204 , the analysis module receives the first data sent by the data acquisition module.

[0135] Optionally, the analysis module may also obtain the first data collected by the data collection device through a storage device (such as a USB flash drive) or the like.

[0136] Step 206: The analysis module determines the fault type causing the first network abnormal event based on the first data.

[0137] Since the first data is network performance data of the first user access device in the first time period, the analysis module determines the fault type of the first network abnormal event according to the first data.

[0138] Step 206 can be implemented through the following steps 2061 and 2062.

[0139] Step 2061: The analysis module determines a first network abnormal event.

[0140] Optionally, the analysis module may determine the first network abnormal event by receiving the abnormal notification message sent by the detection module. For the description of the abnormal notification message sent by the detection module to the analysis module, reference may be made to the relevant description in step 202, which will not be repeated here. Optionally, the analysis module may determine the first network abnormal event by receiving the abnormal notification message sent by the data acquisition module. For the description of the abnormal notification message sent by the data acquisition module to the analysis module, reference may be made to the relevant description in step 204, which will not be repeated here.

[0141] In this way, when the analysis module determines that the abnormal notification message includes the identifier of the first user access device, the analysis module can determine that the first network abnormal event is detected based on the message flow flowing through the first user access device.

[0142] Optionally, the abnormal notification message received by the analysis module carries the occurrence time of the first network abnormal event, that is, the first time mentioned above.

[0143] Step 2062: In response to the first network abnormal event, the analysis module determines the fault type causing the first network abnormal event according to the first data.

[0144] When the analysis module determines the first network abnormal event and determines that the first network abnormal event is a network abnormal event detected based on the message flow flowing through the first user access device, the analysis module determines that it is necessary to analyze the network performance data of the first user access device to determine the fault type that caused the first network abnormal event. Therefore, after the analysis module obtains the first data representing the first user access device in the first time period, the fault type that caused the first network abnormal event is determined based on the first data (i.e., the network performance data of the first user access device in the first time period). In the embodiment of the present application, the process of determining the fault type that caused the first network abnormal event based on the first data is called the process of locating the fault type.

[0145] Among them, for the first network abnormal event detected based on the message flow flowing through the first user access device, the fault type causing the first network abnormal event includes but is not limited to one of the following faults: interference fault, coverage fault, radar interference fault, access abnormality fault, roaming ping-pong fault, roaming rejection fault, optical power too high / too low fault, optical path disconnection fault, excessive load, etc. Here, the interference fault refers to that the data transmission channel of the first user access device is interfered too much by the adjacent frequency channel or the same frequency channel, and the coverage fault refers to that the signal strength of the terminal device covering the access to the first user access device is too low. The radar interference fault refers to that the first user access device is seriously interfered by the radar of other devices. The access abnormality fault refers to that the terminal device cannot access the first user access device normally, or the terminal device cannot access the network after accessing the first user access device. The roaming ping-pong fault refers to that when there is a slave device in the first user access device, the terminal device frequently switches between the first user access device and the slave device when the physical position of the terminal device remains unchanged. The roaming rejection fault refers to that when there is a slave device in the first user access device, when the terminal device accessing the first user access device roams to the signal coverage area of ​​the slave device, the terminal device cannot access the slave device normally. The optical power is too high / too low fault means that the optical power of the first user access device is too high / too low. The optical path disconnection fault means that the optical path of the first user access device is disconnected. Overload means that the number of terminal devices connected to the first user access device is too large.

[0146] Optionally, since the first data is network performance data collected per second, that is, each network performance indicator includes multiple performance values ​​collected per second during the first period, the performance value of the network performance indicator may have a certain amount of random disturbance noise. Therefore, in order to reduce the impact of noise in the performance value of the network performance indicator, the analysis module can perform segmented processing on the performance value of each network performance indicator in the first data, thereby achieving discretization processing of the performance value of each network performance indicator.

[0147] As an example, taking the performance value of the first network performance indicator in the first data as an example, in this case, the first data includes multiple performance values ​​(recorded as the first performance value set) collected by seconds for the first network performance indicator in the first time period. The analysis module can extract the 5th quantile, 25th quantile, 50th quantile, 75th quantile and 95th quantile in the first performance value set. Among them, the X% quantile refers to the data located at the X% position in a set of data to be processed. Taking the first time period as 60 seconds and the interval for collecting network performance data as mentioned above as 1 second, the first performance value set includes 60 performance values ​​of the first network performance indicator. Among them, the 5th percentile in the first performance value set is the performance value collected at the 3rd second within the aforementioned 60 seconds, the 25th percentile in the first performance value set is the performance value collected at the 15th second within the aforementioned 60 seconds, the 50th percentile in the first performance value set is the performance value collected at the 30th second within the aforementioned 60 seconds, the 75th percentile in the first performance value set is the performance value collected at the 45th second within the aforementioned 60 seconds, and the 95th percentile in the first performance value set is the performance value collected at the 57th second within the aforementioned 60 seconds.

[0148] Further optionally, the analysis module uses the first performance value in the first performance value set to represent the performance values ​​in the first performance value set that are less than the 5th percentile, uses the 5th percentile in the first performance value set to represent the performance values ​​in the first performance value set that are between the 5th and 25th percentiles, uses the 25th percentile in the first performance value set to represent the performance values ​​in the first performance value set that are between the 25th and 50th percentiles, uses the 50th percentile in the first performance value set to represent the performance values ​​in the first performance value set that are between the 50th and 75th percentiles, uses the 75th percentile in the first performance value set to represent the performance values ​​in the first performance value set that are between the 75th and 95th percentiles, and uses the 95th percentile in the first performance value set to represent the performance values ​​in the first performance value set that are greater than the 95th percentile. In this way, the analysis module discretizes the 60 performance values ​​in the first performance value set into 6 performance values.

[0149] For ease of description, when the embodiment of the present application performs the discrete processing as described above on the performance value of each network performance indicator in the first data, the embodiment of the present application refers to the data after the discrete processing of the first data as "the first data after the discretization processing" hereinafter.

[0150] Next, in a first possible implementation, the analysis module determines the type of fault that causes the first network abnormal event based on the first data (or the first data after discretization) and the pre-trained first classifier. The first classifier is used to predict the type of fault that causes the network abnormal event based on the network performance data. Optionally, the first classifier can be trained using a decision tree model (such as an extreme gradient boosting (eXtreme Gradient Boosting, XGBoost) algorithm model) and / or a neural network model. Here, the XGBoost algorithm is a popular and efficient open source implementation of the gradient boosting tree algorithm. Gradient boosting is a guided learning algorithm that can combine the estimated values ​​of a set of simpler and weaker models to accurately predict the target variable. When gradient boosting is used for regression, the weak learner is a regression tree, and each regression tree maps the input data point to a leaf containing a continuous fraction.

[0151] In some examples, when a first classifier is obtained by training a neural network model, in the training samples (referred to as first training samples) used to train the first classifier, the sample labels are multiple fault types, and the samples to be trained are all network performance data of user access devices that can be obtained under known fault types. In this way, the first classifier can be obtained by training the preset initial neural network model through the first training sample. It should be understood that the first classifier obtained by training the neural network model can predict multiple fault types at the same time, and the prediction accuracy is high.

[0152] Furthermore, the analysis module can call the first classifier trained by the neural network model, and input the first data (or the first data after discretization) into the first classifier, and the first classifier can output the weight of each fault type. In this way, the analysis module can determine the fault type with the highest weight as the fault type that causes the first network abnormal event.

[0153] In other examples, due to the characteristics of the decision tree model, a decision tree model can only be used to predict one type of fault. Therefore, when the first classifier is obtained by training the decision tree model, it is necessary to train a first classifier for each type of fault. That is, when the first classifier is obtained by training the decision tree model, and the number of fault types that cause network abnormal events is a preset number, the first classifier includes a group of decision tree model classifiers of the aforementioned preset number, and one decision tree model classifier in the first classifier is used to predict one type of fault. It should be understood that the first classifier obtained by training the decision tree model has strong interpretability.

[0154] When a decision tree model is used for each fault type to train a corresponding decision tree model classifier, taking the case of using a decision tree model for a first fault type to train a first decision tree model classifier corresponding to the first fault type, optionally, in a training sample (referred to as a second training sample) used to train the first decision tree model classifier, the sample label is the first fault type, and the network performance data of all user access devices that can be obtained when the training sample is a known first fault type. In this way, the preset decision tree model is trained through the second training sample to obtain the first decision tree model classifier.

[0155] Then, the analysis module calls the decision tree model classifier corresponding to each fault type, and inputs the first data (or the first data after discretization) into the decision tree model classifier corresponding to each fault type, and each decision tree model classifier can output the weight of its own predicted fault type. In this way, the analysis module can determine the fault type with the highest weight as the fault type that causes the first network abnormal event.

[0156] However, different network performance indicators of user access devices have different degrees of influence on different fault types. For example, when the fault type is a coverage type fault, the value of the signal strength in the network performance indicators described above will usually become lower. For another example, when the fault type is an interference type fault, the value of the interference duty cycle in the network performance indicators described above will usually become higher. Therefore, not all network performance indicators can play an important role in determining the type of fault. In other words, there will be some invalid network performance indicators for different fault types. Therefore, in order to reduce the risk of overfitting when training the decision tree model classifier in the first classifier and to improve the training effect of the decision tree model classifier, for different fault types, the performance value of the network performance indicator that has a higher impact on the fault type can be used as the sample to be trained, so as to train the decision tree model classifier corresponding to the fault type.

[0157] Taking the first decision tree model classifier used to predict the first fault type in the above-mentioned first classifier as an example, for the second training sample used to train the first decision tree model classifier, the sample label in the second training sample is the first fault type. When the training sample is a known first fault type, the performance value of the network performance indicator (recorded as the key network performance indicator) that has a higher degree of influence on the first fault type in the network performance data of all user access devices that can be obtained.

[0158] Among them, the importance of each network performance indicator in the network performance data of all user access devices that can be obtained when the first fault type is known can be calculated in advance. For the first performance indicator in the network performance data, the importance of the first performance indicator represents the degree of influence of the first performance indicator on the fault with the first fault type. In a physical sense, the importance of the first performance indicator is the mean value of each classification gain of the first performance indicator in the decision tree model algorithm (such as the xgboost algorithm).

[0159] In this way, optionally, after determining the importance of each network performance indicator in the network performance data of all user access devices that can be obtained when the known first fault type is determined, the importance of each network performance indicator is sorted, and when the importance is sorted from high to low, the network performance indicators ranked in the first k (k is a positive integer) positions are used as key network performance indicators. Optionally, the value logic of the top k rankings is: the sum of the importance of the network performance indicators ranked in the first k positions is greater than or equal to the first threshold, and the sum of the importance of the network performance indicators ranked in the first (k-1) positions is less than or equal to the first threshold. The embodiment of the present application does not limit the value of the first threshold. For example, the first threshold can be 95%, but is not limited to this.

[0160] Optionally, after determining the importance of each network performance indicator in the network performance data of all user access devices that can be obtained when the first fault type is known, the network performance indicator whose importance is greater than or equal to the second threshold is determined as a key network performance indicator. The embodiment of the present application does not specifically limit the specific value of the second threshold. For example, the value can be 95%, but it is not limited to this.

[0161] In this way, by using the performance value of the key network performance indicator of the user access device as the sample to be trained in the second training sample, the preset initial classifier is trained to obtain a decision tree model classifier corresponding to the fault type indicated by the sample label. For example, assuming that the sample label in the second training sample is the first fault type, and the second training sample uses the performance value of the network performance indicator with a high degree of importance to the first fault type as the sample to be trained, then the preset initial classifier is trained with the second training sample to obtain a first decision tree model classifier corresponding to the first fault type.

[0162] Furthermore, the analysis module selects the performance values ​​of the key network performance indicators used in training each decision tree model classifier from the first data (or the first data after discretization), and inputs the selected performance values ​​of the key network performance indicators into the corresponding decision tree model classifier, and the decision tree model classifier can output the weight of the predicted fault type. As an example, assuming that the key network performance indicators used in training the first decision tree model classifier include indicator 1, indicator 2, and indicator 3, the analysis module selects the performance values ​​of indicator 1, indicator 2, and indicator 3 from the first data (or the first data after discretization), and inputs the selected performance values ​​into the first decision tree model classifier, and the first decision tree model classifier can output the weight of the predicted first fault type.

[0163] In this way, the analysis module can determine the fault type with the highest weight output by the multiple decision tree model classifiers in the first classifier as the fault type causing the first network abnormal event.

[0164] In a second possible implementation, the analysis module determines the fault type causing the first network abnormal event based on the first data (or the first data after discretization) and a preset empirical rule. The empirical rule includes a corresponding relationship between a performance value of a network performance indicator and a fault type. It should be understood that the empirical rule may be an empirical rule based on expert experience, and the embodiment of the present application does not specifically limit the empirical rule.

[0165] As an example, the preset empirical rules in the analysis module include but are not limited to:

[0166] Rule 1) When the signal strength is less than or equal to -73dbm, the fault type is a coverage fault;

[0167] Rule 2) When the interference duty cycle is greater than or equal to 35%, the fault type is an interference fault;

[0168] Rule 3) When the number of online devices is greater than or equal to 16, the fault type is excessive load;

[0169] Rule 4) When the CPU occupancy rate of the user access device is greater than 80%, the fault type is high CPU occupancy rate of the user access device;

[0170] Rule 5) When the optical power of the user access device is less than -27dbm, the fault type is low optical power.

[0171] Wherein, dBm means decibel milliX. X can be volt (volt, v), then dbmv means decibel millivolt. X can also be watt (watt, w), then dbmw means decibel milliwatt.

[0172] In a third possible implementation, the analysis module first determines a first prediction result and a second prediction result based on the first data (or the first data after discretization). The first prediction result is a fault type determined based on the first data (or the first data after discretization) and the first classifier, and the second prediction result is a fault type determined based on the first data (or the first data after discretization) and the preset empirical rule.

[0173] Then, the analysis module determines a target prediction result from the first prediction result and the second prediction result, and the target prediction result is used to indicate the type of fault that causes the first network abnormal event.

[0174] It should be understood that from the above description, the first prediction result may include the result predicted by the first classifier trained with the decision tree model (recorded as the decision tree prediction result), and the result predicted by the first classifier trained with the neural network model (recorded as the neural network prediction result). Optionally, the analysis module uses the following voting algorithm to determine the target prediction result.

[0175] Voting algorithm 1: When the decision tree prediction result, the neural network prediction result and the second prediction result are all different, the analysis module determines the prediction result with the largest weight among the decision tree prediction result, the neural network prediction result and the second prediction result as the target prediction result.

[0176] Voting algorithm 2: When the decision tree prediction result, the neural network prediction result and the second prediction result are all the same, the analysis module determines the same result as the target prediction result.

[0177] Voting algorithm 3: When there are two identical prediction results among the decision tree prediction result, the neural network prediction result and the second prediction result, the analysis module compares the sum of the weights of the two identical prediction results with the weight of the other prediction result, and determines the prediction result with the larger value as the target prediction result. For example, when the decision tree prediction result and the neural network prediction result are the same but different from the second prediction result, the analysis module compares the sum of the weights of the decision tree prediction result and the neural network prediction result with the weight of the second prediction result, and determines the prediction result with the larger value as the target prediction result.

[0178] Among them, the weight of the first prediction result is the weight of the fault type output by the first classifier described above. The weight of the second prediction result is the historical accuracy of predicting the fault type through the empirical rules described above. Or it can be understood that the weight of the second prediction result is the accuracy of predicting the fault type through the empirical rules described above in history. It should be understood that the analysis module records the information of whether the fault type was accurately predicted each time through the empirical rules described above in history. Therefore, when predicting the fault type through the empirical rules at present, the historical accuracy of predicting the fault type through the empirical rules can be used as the weight of the prediction result when predicting the fault type at the current time.

[0179] As an example, refer to Figure 7 , Figure 7 A schematic diagram of a process for locating a fault type provided by an embodiment of the present application is shown. Figure 7 As shown, after acquiring the first data, the analysis module firstly discretizes the first data to obtain the discretized first data, so as to reduce the noise in the first data.

[0180] Then, on the one hand, the analysis module extracts the same network performance indicators as the training samples to be trained for each decision tree model classifier described above from the first data after discretization (i.e., network performance indicators with higher importance for each decision tree model classifier) ​​to obtain the performance values ​​of key network performance indicators. The analysis module then inputs the performance values ​​of key network performance indicators into the decision tree model classifier to obtain the decision tree prediction results. For a detailed description, please refer to the above description and will not be repeated. On the other hand, the analysis module inputs the first data after discretization into the first classifier obtained by training the neural network model to obtain the neural network prediction results. For a detailed description, please refer to the above description and will not be repeated. On the other hand, the analysis module makes a prediction based on the first data after discretization and the preset empirical rules to obtain a second prediction result. For a detailed description, please refer to the above description and will not be repeated.

[0181] Furthermore, the analysis module determines the target prediction result among the decision tree prediction result, the neural network prediction result and the second prediction result according to the above-mentioned voting algorithm. In other words, the analysis module inputs the network performance data of the user access device to the fault location unit used for locating the fault type, and the fault location unit can output the fault type.

[0182] Optionally, after determining the target prediction result (i.e., the fault type causing the first network abnormal event), the analysis module reports alarm information, which carries relevant information of the first network abnormal event (such as the event name, the relevant user access device identifier, etc.), as well as the currently predicted fault type causing the first network abnormal event. For example, after determining the target prediction result, the analysis module reports the alarm information to the management platform of the network operator so that the network operator's installation and maintenance personnel can promptly repair the fault for the user.

[0183] Thus, through the network anomaly diagnosis method described in the above steps 201 to 206, it is possible to efficiently and accurately determine the fault type causing the network anomaly event based on the network performance data of the user access device at the time when the network anomaly event occurs. That is, the network anomaly diagnosis method provided in the embodiment of the present application can improve the efficiency of network anomaly diagnosis.

[0184] In some other embodiments, in order to save the computing resources of the above analysis module, reference Figure 8 , Figure 8 A schematic diagram of another method for diagnosing network anomalies provided in an embodiment of the present application is shown. Optionally, the method is applied to Figure 2 In the diagnostic system 200 shown in FIG. Figure 5 ,like Figure 7 As shown, after executing steps 201 to 2061, the network anomaly diagnosis method uses the following steps 3062 to 3063 to replace step 2062.

[0185] Step 3062: The analysis module determines, in response to the first network abnormal event, a location area where the fault causing the first network abnormal event is located, where the location area includes a user side of the first user access device or a network side of the first user access device.

[0186] Since the first data used to determine the fault type that caused the first network abnormal event obtained in the embodiment of the present application is the network performance data of the first user access device. Therefore, the embodiment of the present application takes the first user access device as the boundary, and divides the location area where the fault that caused the network abnormal event is located into the user side of the first user access device and the network side of the first user access device. Among them, the user side of the first user access device refers to the area range from the terminal device to the first user access device, and the network side of the first user access device is the area range from the first user access device to the network operator's bearer network.

[0187] It should be understood that since the user side of the user access device is usually only the user access device that is a network device, when the fault causing the first network abnormal event is located on the user side of the first user access device, the network performance data of the first user access device can be used to determine the fault type of the fault. However, the network side of the first user access device generally includes multiple network devices, so it is usually impossible to diagnose the fault type located on the network side of the first user access device based only on the network performance data of the first user access device. Therefore, the analysis module can first determine the location area where the fault causing the first network abnormal event is located, and then determine whether it is necessary to diagnose the fault type located on the network side of the first user access device based on the network performance data of the first user access device according to the location area where the fault causing the first network abnormal event is located.

[0188] In a possible implementation manner, the analysis module may determine the area where the fault causing the first network abnormal event is located based on the service data transmitted via the first user access device.

[0189] In this implementation, the data acquisition indication in step 103 is also used to indicate the acquisition of second data. The second data is the service data transmitted by the first user access device in the first time period. Here, the service data of the user access device refers to the message flow forwarded / transmitted by the first user access device. That is, the second data is the message flow forwarded / transmitted by the first user access device in the first time period.

[0190] Optionally, in the process where the data acquisition module (or user access device) collects the network performance data of the user access device in real time or at intervals based on the above, and caches the collected network performance data in the cache pool, the data acquisition module (or the user access device) also stores the mirrored message stream flowing through the user access device in the cache pool in real time. In this way, the snapshot data mentioned above also includes the business data of the user access device stored in the cache pool. Therefore, the third data mentioned above includes not only the network performance data of the first user access device in the second time period, but also the business data of the first user access device in the second time period, and the fourth data mentioned above includes not only the network performance data of the first user access device in the third time period, but also the business data of the first user access device in the third time period.

[0191] Therefore, the analysis module determines the area where the fault causing the first network abnormal event is located based on the service data transmitted by the first user access device, which means that after the analysis module obtains the second data, the analysis module determines the area where the fault causing the first network abnormal event is located based on the second data. Here, the method of collecting the second data and the method of the analysis module obtaining the second data can refer to the description of collecting and obtaining the first data above, and will not be repeated here.

[0192] In another possible implementation, the analysis module can determine the area where the fault causing the first network abnormal event is located based on the user-side network delay of the first user access device and the network-side network delay of the first user access device. The user-side network delay of the first user access device refers to the network delay between the first user-side network delay and the terminal device. The network-side network delay of the first user access device refers to the network delay between network devices on the communication link from the first user access device to the network operator's bearer network.

[0193] Among them, the analysis module determines the detailed description of the area where the fault causing the first network abnormal event is located based on the second data, and the analysis module determines the detailed description of the area where the fault causing the first network abnormal event is located based on the user-side network delay of the first user access device and the network-side network delay of the first user access device. Both of these can be referred to the description below and will not be repeated here.

[0194] Step 3063: When the analysis module determines that the fault causing the first network abnormal event is located on the user side of the first user access device, the analysis module determines the type of fault causing the first network abnormal event according to the first data.

[0195] Among them, the detailed description of "the analysis module determines the fault type causing the first network abnormal event according to the first data" in step 3063 can refer to the description of step 2062 above, and will not be repeated here.

[0196] Optionally, the analysis module may also execute step 3064.

[0197] Step 3064: When the analysis module determines that the fault causing the first network abnormal event is located on the network side of the first user access device, the analysis module reports alarm information.

[0198] When the analysis module determines that the fault causing the first network abnormal event is located on the network side of the first user access device, it means that it is invalid to determine the fault type causing the first network abnormal event only based on the network performance data of the first user access device. Therefore, the analysis module reports the alarm information so that the network operator can analyze and diagnose the first network abnormal event in a timely manner and perform network repair.

[0199] Based on the network anomaly diagnosis method described in steps 101 to 2061 to 3062 to 3064, the location area where the fault causing the network anomaly event is located is first determined, and when it is determined that the fault causing the network anomaly event is located on the user side of the user access device, the fault type is further determined. In the case where it is determined that the fault causing the network anomaly event is located on the network side of the user access device, since the performance data of the user access device is not sufficient to diagnose the fault on the network side of the user access device, the analysis module only needs to report an alarm. Compared with the computing power required for the analysis module to determine the fault type (requiring multiple classifiers for reasoning), the analysis module requires less computing power to determine the location area where the fault is located, for example, only one second classifier is required for reasoning (refer to step 403), and for example, a simple calculation process is performed on the network delay (refer to the relevant content in the method described in 13), so this method can save the computing power of the analysis module.

[0200] The process of "the analysis module determining the region where the fault causing the first network abnormal event is located according to the second data" is described below.

[0201] refer to Fig. 9 , the figure shows a flow chart of determining the location area of ​​the fault causing the first network abnormal event based on the second data provided by an embodiment of the present application.

[0202] Step 401: The analysis module parses the message in the second data to obtain the message features of the second data.

[0203] Optionally, the analysis module parses the messages in the second data one by one to obtain message features in each message in the second data.

[0204] Taking any message in the second data, such as the second message, as an example, refer to Table 1, which exemplarily shows the message features provided in the embodiment of the present application. As shown in Table 1, Table 1 lists the names of the message features in the second message, and the description content corresponding to each message feature, which will not be repeated.

[0205] Table 1

[0206]

[0207]

[0208] Among them, the message features "time", "source IP", "source port", "destination IP", "destination port", "flow ID", "type", "transmission direction", "IP message payload length (IP-length)", "window size (WINSIZE)", "identification code", "Seq-REL", and "SeqAck-REL" shown in Table 1 can all be extracted from the second message. The message feature "packet interval" can be calculated based on the sending time carried by the second message and the sending time carried in the message adjacent to the second message. The message feature "RTT observation delay" can be calculated based on the second message and the response message of the second message. The message features "TCP disorder", "TCP retransmission", "ACK: duplicate" and "ACK: normal" can be obtained by analyzing the messages before and after the second message in time. The message feature "ACK lost" can be obtained by capturing and analyzing the response message of the second message. The message feature "ACK: data not captured" can be obtained by capturing and analyzing the message ACKed by the second message. Furthermore, the characteristic values ​​of the message characteristics "TCP out of order", "TCP retransmission", "ACK loss", "ACK: data not captured", "ACK: duplicate", and "ACK: normal" are "yes" or "no". In some examples, 0 and 1 can be used to represent "yes" and "no". For example, "1" is used to represent "yes" and "0" is used to represent "no", which is not limited.

[0209] It should be understood that the message flow described in the embodiment of the present application refers to a bidirectional flow. Bidirectional flow specifically refers to a flow identified by two quintuples whose source and destination positions are interchanged. As an example, it is assumed that quintuple 1 is represented by (address 1, port 1, address 2, port 2, protocol 1). Wherein, address 1 is the source address of quintuple 1, port 1 is the source port of quintuple 1, address 2 is the destination address of quintuple 1, port 2 is the destination port of quintuple 1, and protocol 1 is the transmission protocol used when the flow identified by quintuple 1 is transmitted. When the source and destination in quintuple 1 are exchanged, quintuple 2 (address 2, port 2, address 1, port 1, protocol 1) is obtained, wherein address 2 is the source address of quintuple 2, port 2 is the source port of quintuple 2, address 1 is the destination address of quintuple 2, port 2 is the destination port of quintuple 2, and protocol 1 is the transmission protocol used when the flow identified by quintuple 2 is transmitted. In the embodiment of the present application, quintuple 1 and quintuple 2 represent the same quintuple and correspond to a bidirectional flow.

[0210] Step 402: The analysis module determines flow characteristics according to the message characteristics of the second data.

[0211] The analysis module divides the packets in the second data into a plurality of packet flows based on the packet feature “flow ID” determined for each packet of the second data.

[0212] Optionally, the analysis module can generate a corresponding flow file for each message flow. The flow file includes message features obtained after parsing the messages in the message flow. The storage format of the flow file includes but is not limited to text files (Text, txt), data tables (excel) files and other formats. It should be understood that for any message flow in the second data, such as the second message flow, when the second message flow includes m messages, the analysis module determines that the message features for a message in the second data in step 401 are n, then the flow file corresponding to the second message flow can be represented as m*n structured data.

[0213] Optionally, the analysis module determines flow characteristics for each message flow in the second data according to message characteristics of the second data.

[0214] Optionally, the analysis module first determines a core message flow in the message flows included in the second data, and then determines a flow feature for the core message flow according to a message feature of the core message flow in the second data.

[0215] Among them, when the first network abnormal event occurs, there are a large number of flow interactions in the message flow flowing through the first user access device, and the purpose of screening the core message flow in the second data is to screen out the more important message flow in the second data for analysis. Here, the importance of the message flow is reflected in: the degree of correlation between the message flow and the time when the first network abnormal event is detected, the message flow in which the first network abnormal event is detected, etc. Optionally, the analysis module can determine the core message flow in the multiple message flows included in the second data by any one of the following methods or a combination of multiple methods.

[0216] Mode 1: The analysis module determines the message flow in the second data whose transmission protocol type is the same as the transmission protocol type of the message flow in which the first network abnormal event is detected as the core message flow. In which, the abnormal notification message received by the analysis module from the detection module or the data acquisition module carries the transmission protocol type of the message flow in which the first network abnormal event is detected, or the abnormal notification message carries the application to which the message flow in which the first network abnormal event is detected belongs (for example, the application to which the message flow belongs can be analyzed by the flow ID), so that the analysis module can determine the transmission protocol type of the message flow according to the application to which the message flow in which the first network abnormal event is detected belongs. For example, the message flow of the live broadcast application is usually transmitted using the TCP protocol. Therefore, when the flow ID carried in the abnormal notification message received by the analysis module is a message flow indicating the live broadcast application, the analysis module determines the message flow in the second data whose transmission protocol type is TCP (that is, the message feature "type" obtained in step 401 is TCP) as the core message flow.

[0217] Mode 2: The analysis module determines the message flow containing the occurrence time of the first network abnormal event (i.e., the first time) from the time when the first message of the message flow is sent to the time when the last message in the message flow is sent in the second data as the core message flow. The sending time of the second data packet message is carried in the message and has been obtained in step 401 (i.e., the message feature "time").

[0218] Method 3, the analysis module determines the terminal device to which the message flow in the second data belongs, which is the same as the terminal device to which the message flow that detected the first network abnormal event belongs, as the core message flow. The terminal device to which the message flow belongs refers to the terminal device indicated by the destination address or source address of the message flow. In this case, the abnormal notification message received by the analysis module from the detection module or the data acquisition module carries the identifier of the terminal device to which the message flow that detected the first network abnormal event belongs (such as the IP address / MAC address / ID of the terminal device, etc.). In this case, the analysis module can determine that the terminal device to which the message flow in the second data belongs is the same as the terminal device to which the message flow that detected the first network abnormal event belongs, based on the features "destination address" / "source address" extracted in step 401 and the identifier of the terminal device carried in the abnormal notification message, and determine the message flow as the core message flow.

[0219] Method 4. When the analysis module determines multiple core message flows according to Method 1, Method 2 and / or Method 3, then in Method 4, the analysis module sorts the number of messages included in each of the multiple core message flows. Optionally, the analysis module determines the core message flow whose number of messages in the multiple core message flows exceeds the third threshold as the final core message flow. Optionally, the analysis module determines the message flow whose sorting position is in the first j when the number of messages in the multiple core message flows is sorted from large to small as the final core message flow. Wherein, j is a positive integer, and the embodiments of the present application do not specifically limit the specific values ​​of the third threshold and j.

[0220] The following describes the process of the analysis module determining the flow characteristics for any message flow (or any core message flow) in the second data. For ease of description, the following describes the process of the analysis module determining the flow characteristics for the second message flow in the second data.

[0221] Specifically, the analysis module determines flow characteristics for the second message flow according to the message characteristics of the second message flow determined in step 401. In the embodiment of the present application, the flow characteristics determined by the analysis module for the second message flow include empirical characteristics of the second message flow and / or statistical characteristics of the second message flow.

[0222] Among them, the empirical characteristics of the second message flow include but are not limited to at least one empirical characteristic in the four empirical fields shown in Table 2 below.

[0223] Table 2

[0224]

[0225] For the empirical feature 1 in the field of "direction of first detection after network anomaly recovery" shown in Table 2, due to the impact of the network anomaly event, there may be no message interaction in the second message flow for a period of time. In this case, the analysis module determines the interaction direction of the first message when the message interaction in the second message flow is restored after the message interaction is interrupted for a period of time. Specifically, the analysis module can determine the interaction direction of the first message based on the message feature "transmission direction" of the first message (the message feature determined in step 401). For example, the message feature "transmission direction" of the first message indicates that the message is a downlink message, indicating that the message is a message sent from the network side to the terminal device. For another example, the message feature "transmission direction" of the first message indicates that the message is an uplink message, indicating that the message is an uplink message sent from the terminal device to the network side.

[0226] As an example, refer to Fig.10 , Fig.10 FIG. 4 shows a schematic diagram of message interaction in a second message flow. Fig.10 As shown in the figure, the horizontal axis represents time and the vertical axis represents the number of interactive messages. Fig.10 It can be seen that the second message flow is from Fig.10 There is no message interaction between the 2nd second and the 9th second, that is, the second message flow is interrupted during this period. From the 9th second, the message interaction of the second message flow begins to recover. The analysis module needs to determine the interaction direction of the first message when the message interaction of the second message flow is restored at the 9th second.

[0227] For the empirical feature 2 in the field of "window length trend" shown in Table 2, since the second message flow includes an upstream flow and a downstream flow, the upstream flow in the second message flow is composed of the upstream messages in the second message flow, and the downstream flow in the second message flow is composed of the downstream messages in the second message flow. Therefore, the analysis module determines whether there is a trend in the window size in the upstream flow according to the message features "time" and "window size" (the message features determined in step 401) of the upstream flow messages in the second message flow, and when it is determined that there is a trend in the window size, determines whether the trend of the window size in the upstream flow is an upward trend or a downward trend.

[0228] Optionally, the analysis module can use a trend detection algorithm to obtain the trend result of the window size in the upstream flow according to the message features "time" and "window size" of the upstream flow message in the second message flow. Among them, the trend detection algorithm is used to check the trend of the time interval sequence and the duration sequence. The trend detection algorithm is, for example, the Mann-Kendall (MK) algorithm. Among them, the MK algorithm is a non-parametric detection algorithm, or called a distribution-free detection algorithm. The advantage is that it does not require the sample to follow a certain distribution and will not be disturbed by a small number of outliers. For the window size of the upstream flow message in the second message flow, the trend detection algorithm can generally output trend results including: no trend in the upstream window size, an upward trend in the upstream window size trend, and a downward trend in the upstream window size trend.

[0229] As an example, refer to Fig.11 , Fig.11 FIG. 1 is a schematic diagram showing a window size trend provided by an embodiment of the present application. Fig.11 As shown in the figure, the horizontal axis represents time and the vertical axis represents window size. Fig.11 The flow shown is the upstream flow in the second message flow as an example. Fig.11 It can be seen that the window length of the upstream flow gradually decreases from the 3rd second until the window size is 0. Therefore, the analysis module determines that the upstream flow has a downward trend.

[0230] For the empirical feature 3 in the field of "window length trend" shown in Table 2, the analysis module determines whether there is a trend in the window size in the downstream according to the message features "time" and "window size" of the downstream message in the second message flow (the message features determined in step 401), and when it is determined that the window size has a trend, it determines whether the trend of the window size in the downstream is an upward trend or a downward trend. For detailed description, please refer to the description of empirical feature 2, which will not be repeated here. It should be understood that for empirical feature 3, the analysis module can determine that the trend results of the window size of the downstream message of the second message flow include: no trend in the downstream window size, an upward trend in the downstream window size trend, and a downward trend in the downstream window size trend.

[0231] For the empirical features 4 and 5 in the field of “window length trend” shown in Table 2, the analysis module determines the empirical features 4 and 5 based on the trend results of the empirical features 2 and 3.

[0232] For example, when the analysis module determines that the trend result of empirical feature 2 is "the trend of the upstream window size is a downward trend", and determines that the trend result of empirical feature 3 is "the trend of the downstream window size is an upward trend or no trend", that is, the trend result of empirical feature 3 is: the trend of the downstream window size is not a downward trend, then the analysis module determines that the value of empirical feature 4 "whether only the upstream window is decreasing" is "yes", and in other cases, determines that the value of empirical feature 4 "whether only the upstream window is decreasing" is "no".

[0233] For another example, when the analysis module determines that the trend result of empirical feature 3 is "the trend of the downstream window size is a downward trend", and determines that the trend result of empirical feature 2 is "the trend of the upstream window size is an upward trend or has no trend", that is, the trend result of empirical feature 3 is: the trend of the upstream window size is not a downward trend, then the analysis module determines that the value of empirical feature 5 "whether only the downstream window is decreasing" is "yes", and in other cases, determines that the value of empirical feature 5 "whether only the downstream window is decreasing" is "no".

[0234] Among them, the upstream window refers to the window size of the upstream flow message, and the downstream window refers to the window size of the downstream flow message. It can be seen that the feature values ​​of empirical feature 4 and empirical feature 5 include "yes" and "no". In some examples, 0 and 1 can be used to represent "yes" and "no". For example, "1" is used to represent "yes" and "0" is used to represent "no", and this is not limited.

[0235] For the empirical feature 6 in the field of "retransmission trend" shown in Table 2, for the upstream in the second message flow, the analysis module can accumulate and sum the characteristic values ​​of the message feature "TCP retransmission" of the upstream, so as to obtain the total number of retransmitted messages in the upstream. Similarly, the analysis module can also accumulate and sum the characteristic values ​​of the message feature "TCP retransmission" of the downstream, so as to obtain the total number of retransmitted messages in the downstream. When the total number of retransmitted messages in the upstream is greater than the total number of retransmitted messages in the downstream, the analysis module determines the trend result of the empirical feature 6 as: upstream. When the total number of retransmitted messages in the downstream is greater than the total number of retransmitted messages in the upstream, the analysis module determines the trend result of the empirical feature 6 as: downstream. When the total number of retransmitted messages in the upstream is equal to the total number of retransmitted messages in the downstream, the analysis module determines the trend result of the empirical feature 6 as: no significant difference (or called no trend). Optionally, "0" can be used to represent the downstream, and "1" can be used to represent the upstream.

[0236] For the empirical feature 7 in the field of "retransmission trend" shown in Table 2, the analysis module determines the interaction mode of the uplink and downlink messages in the second message flow through the message features "Seq-REL" and "SeqAck-REL" in the second message flow. When the analysis module determines that the uplink message in the second message flow multiple times requires the retransmission of a message with a certain sequence number (i.e., the SeqAck-REL value in the uplink message), but the Seq-REL in the multiple retransmitted messages of the downlink message is less than the Seq-REL of the message required to be retransmitted (or understood as, the downlink message multiple times retransmits the earlier message). In this case, the trend result of the empirical feature 7 is: the retransmission interaction trend is uplink. When the analysis module determines that the uplink message and the downlink message in the second message flow do not meet any of the aforementioned descriptions, the trend result of the empirical feature 7 is determined to be: other.

[0237] As an example, Fig.12 FIG. 1 is a schematic diagram showing a second message flow. Fig.12 , analysis module traversal Fig.12 The SeqAck-REL value in the uplink message in the second message flow is shown. When the analysis module determines that the uplink message requires the downlink message to retransmit Seq-REL for 7 times, it is "2875238901" (i.e., the SeqAck-REL value in the uplink message, Fig.12 When the uplink message is detected and the number of times 7 required to be retransmitted is greater than the threshold, the analysis module further determines whether the Seq-REL value in the retransmitted downlink message is less than the Seq-REL "2875238901" of the message required to be retransmitted. Fig.12 As shown, the analysis module determines the Seq-REL value "2875238647" in the downlink message retransmission message (by Fig.12 The solid line box in the figure shows that the downlink message is smaller than the Seq-REL "2875238901" of the message required to be retransmitted. Therefore, the analysis module determines that the downlink message is a message that is located before the message with the Seq-REL value of "2875238901", and determines that the downlink message is retransmitted multiple times ( Fig.12 3 retransmissions are shown). Therefore, the analysis module determines the trend result of the empirical feature 7 as follows: the retransmission interaction trend is upward. The embodiment of the present application does not specifically limit the value of the aforementioned threshold, for example, the value may be 5.

[0238] For the empirical feature 8 in the field of "retransmission trend" shown in Table 2, when the analysis module determines that the downlink message in the second message flow requires retransmission of a message with a certain sequence number (i.e., the SeqAck value in the downlink message) for multiple times, but the Seq in the uplink message that is retransmitted multiple times is less than the aforementioned sequence number (or understood as, the uplink message retransmits the earlier message multiple times). In this case, the trend result of the empirical feature 8 is: the retransmission interaction trend is downlink. For detailed description, please refer to the description of empirical feature 7 (only uplink and downlink are exchanged), which will not be repeated here.

[0239] For the empirical feature 9 in the field of "packet-by-packet message disappearance" shown in Table 2, the analysis module segments the upstream flow in the second message flow in the time domain according to the second preset duration, and counts the number of upstream messages in each time period. Among them, the second preset duration is less than the duration of the second message flow. Taking the second preset duration as 1 second as an example, the analysis module segments the upstream flow in the second message flow by seconds, and counts the number of upstream messages per second. When the analysis module determines that the number of upstream messages in multiple consecutive time periods is 0 based on the statistical results, the analysis module determines that the result of empirical feature 9 is: the second message flow upstream disappears packet by packet, that is, the result of empirical feature 9 is "yes". When the analysis module determines that the number of upstream messages in any time period in multiple consecutive time periods is not 0 based on the statistical results, the analysis module determines that the result of empirical feature 9 is: the second message flow upstream does not disappear packet by packet, that is, the result of empirical feature 9 is "no". Among them, the embodiment of the present application does not limit the number of "multiple consecutive time periods". Optionally, "1" may be used to represent "yes" and "0" may be used to represent "no".

[0240] As an example, taking the value of the number of "continuous multiple time periods" as 5 and the second preset time length as 1 second, when the analysis module determines that the number of uplink messages within 5 consecutive seconds is 0, the analysis module determines that the result of empirical feature 9 is "yes". When the analysis module determines that the number of uplink messages within any second of the 5 consecutive seconds is not 0, the analysis module determines that the result of empirical feature 9 is "no".

[0241] For the empirical feature 10 in the field of "packet-by-packet message disappearance" shown in Table 2, the analysis module segments the downstream flow in the second message flow in the time domain according to the second preset time length, and counts the number of downstream messages in each time period. When the analysis module determines, based on the statistical results, that the number of downstream messages in multiple consecutive time periods is 0, the analysis module determines the result of empirical feature 10 as follows: the second message flow disappears packet by packet, that is, the result of empirical feature 9 is "yes". When the analysis module determines, based on the statistical results, that the number of downstream messages in any time period in multiple consecutive time periods is not 0, the analysis module determines the result of empirical feature 10 as follows: the second message flow does not disappear packet by packet, that is, the result of empirical feature 10 is "no".

[0242] The statistical features of the second message flow include the statistical features of the upstream flow in the second message flow and the statistical features of the downstream flow in the second message flow. Specifically include but are not limited to at least one of the following statistical values: the statistical results of the mean, standard deviation, minimum value, 25th percentile, 50th percentile, 75th percentile, 90th percentile, 95th percentile, 99th percentile, and maximum value of the message features of the upstream flow of the second message flow that are continuous variables, the statistical results of the cumulative sum and average value of the message features of the upstream flow of the second message flow that are discrete variables, and the statistical results of the mean, standard deviation, minimum value, 25th percentile, 50th percentile, 75th percentile, 90th percentile, 95th percentile, 99th percentile, and maximum value of the message features of the downstream flow of the second message flow that are continuous variables, and the statistical results of the cumulative sum and average value of the message features of the downstream flow of the second message flow that are discrete variables.

[0243] Optionally, the message features that are continuous variables in the message features may be message features with actual values, and the message features that are discrete variables in the message features may be message features with characteristic values ​​of "yes" and "no". Taking the message features of the second message flow as the message features shown in Table 1 as an example, the message features that are continuous variables in the message features of the second message flow include: "IP-length", "WINSIZE", "packet interval" and "RTT observation delay", etc. The message features that are discrete variables in the message features of the second message flow include: "TCP out of order", "TCP retransmission", "ACK loss", "ACK: data not captured", "ACK: duplicate", "ACK: normal", etc.

[0244] As shown in Table 3, the message features that are continuous variables in the message features of the second message flow include four message features: "IP-length", "WINSIZE", "packet interval" and "RTT observation delay", and the message features that are discrete variables in the message features of the second message flow include six message features: "TCP disorder", "TCP retransmission", "ACK loss", "ACK: data not captured", "ACK: duplicate", and "ACK: normal". Table 3 exemplifies the different statistical operation methods for different message features provided in the embodiments of the present application.

[0245] Table 3

[0246]

[0247]

[0248] In this way, for the message characteristics of each message in the second message flow in the second data in step 401, the statistical operation method corresponding to the message characteristics shown in Table 3 is executed to perform statistical calculations, so as to obtain the statistical characteristics of the upstream flow of the second message flow and the statistical characteristics of the downstream flow of the second message flow.

[0249] For the upstream flow in the second message flow, the analysis module can calculate 4×10=40 statistical features according to the 10 statistical operation methods for the 4 message features belonging to continuous variables shown in Table 3, and can calculate 6×2=12 statistical features according to the 2 statistical operation methods for the 6 message features belonging to discrete variables shown in Table 3. In this way, for the upstream flow of the second message flow, the analysis module calculates 40+12=52 statistical features. Similarly, for the downstream flow in the second message flow, the analysis module can also calculate 52 statistical features. That is, the analysis module can calculate 52+52=104 statistical features for the second message flow according to the message features and statistical operation methods shown in Table 3.

[0250] Step 403: The analysis module determines the location area where the fault causing the first network abnormal event is located according to the determined flow characteristics.

[0251] Optionally, the analysis module can determine the location area where the fault causing the first network abnormal event is located based on the determined flow characteristics and the second classifier. Here, the second classifier is used to predict the location area where the fault causing the network abnormal event is located based on the business data, and is specifically used to predict the location area where the fault causing the network abnormal event is located based on the flow characteristics of the business data. In the embodiment of the present application, the process of "determining the location area where the fault causing the first network abnormal event is located" is referred to as the process of delimiting the fault.

[0252] Among them, the second classifier is a classifier pre-trained based on the third training sample. In the third training sample used to train the second classifier, the sample label is the known fault location area, and the sample to be trained is the flow characteristics of the service data flowing through the user access device when the location area where the fault is determined is the location area. For example, for sample 1 in the third training sample, the sample label of sample 1 is the user side of the user access device when the location area where the fault is located is the user side of the user access device, and the sample to be trained of sample 1 is the flow characteristics of the service data flowing through the user access device when the location area where the fault is located is the user side of the user access device. For another example, for sample 2 in the third training sample, the sample label of sample 2 is the network side of the user access device when the location area where the fault is located is the network side of the user access device, and the sample to be trained of sample 2 is the flow characteristics of the service data flowing through the user access device when the location area where the fault is located is the network side of the user access device. Among them, the method for obtaining the flow characteristics of the service data can refer to the description of steps 401 to 402, which will not be repeated. In this way, the preset initial classifier model is trained by the third training sample to obtain the second classifier. Optionally, the algorithm adopted by the initial classification model includes but is not limited to an XGBoost algorithm, a classification method based on a Bayesian network, a classification method based on a random forest, a classification method based on a support vector machine (SVM), and the like.

[0253] Specifically, the analysis module may input the flow features determined in step 403 into the second classifier to obtain a classification result output by the second classifier, and the classification result may indicate the location area where the fault of the first network abnormal event is located.

[0254] As an example, the empirical features determined by the analysis module for a message flow in step 402 include the 10 empirical features shown in Table 2, and the statistical features determined for the message flow include 104 statistical features calculated based on the message features and statistical operation methods shown in Table 3, that is, the analysis module determines 10+104=114 flow features for the message flow. Furthermore, the analysis module can input the 114 features into the second classifier, and the second classifier outputs the classification result of the fault location area indicating the network abnormal event.

[0255] Optionally, when the analysis module determines flow features for multiple message flows in step 403, the analysis module first merges the flow features of the multiple message flows, and then inputs the merged flow features into the second classifier to obtain a classification result indicating the location area of ​​the fault that caused the first network abnormal event. Wherein, the analysis module merges the flow features of multiple message flows, which means that the analysis module performs a sum operation on the same flow features of different message flows. As an example, when the analysis module merges the flow features of message flow 1 and the flow features of message flow 2, taking the empirical feature 4 in the flow features as an example, when the empirical feature 4 of message flow 1 is "yes" and is represented by the feature value "1", and when the empirical feature 4 of message flow 2 is "no" and is represented by the feature value "0", the empirical feature 4 of message flow 1 and the empirical feature 4 of message flow 2 are merged, that is, the feature value "1" and the feature value "0" are summed to obtain a result "1". Therefore, the merged result "1" is obtained after merging the empirical feature 4 of message flow 1 and the empirical feature 4 of message flow 2. In this case, in the flow features obtained after the analysis module merges the flow features of message flow 1 and the flow features of message flow 2, the merging result "1" is used as the feature value of the empirical feature 4 in the merged flow features.

[0256] As an example, refer to Fig.13 , Fig.13 FIG. 1 is a schematic diagram showing a process of demarcating a fault provided by an embodiment of the present application. Fig.13 As shown, after the analysis module obtains the second data, it parses the message in the second data to obtain the message features of the second data (refer to the description of step 401). The analysis module determines the message features of the core message flow in the second data according to the message features of the second data, and determines the flow features of the core message flow according to the message features of the core message flow (refer to the relevant description of step 402). Then, the analysis module obtains the classification result indicating the area where the fault is located according to the flow features of the core message flow and the second classifier, that is, the fault delimitation result is obtained. That is to say, the analysis module inputs the second data to the fault delimitation unit used for fault delimitation, and the fault delimitation unit can output the area where the fault is located.

[0257] In this way, through steps 401 to 403, the location area where the fault that caused the network abnormal event is located can be determined. Furthermore, based on the location area where the fault that caused the network abnormal event is located, the analysis module determines whether it is necessary to further determine the type of fault that caused the network abnormal event based on the network performance data of the user access device. For example, when the fault that caused the network abnormal event is located on the network side of the user access device, the analysis module only needs to issue a network abnormality alarm to the network operator. This is because the performance data of the user access device is not sufficient to diagnose the fault on the network side of the user access device. In this way, the computing resources of the analysis module can be saved.

[0258] The following describes the process of "the analysis module determining the area where the fault causing the first network abnormal event is located based on the user-side network delay of the first user access device and the network-side network delay of the first user access device."

[0259] Combination Figure 5 ,refer to Fig.14 , Fig.14 A schematic diagram of a process flow of another method for diagnosing network anomalies provided in an embodiment of the present application is shown. Optionally, the method is applied to Figure 2 The diagnostic system 200 shown in FIG. 1 is a schematic diagram of a diagnostic system 200. Specifically, in the method, after the detection module executes step 201, in addition to executing step 202, it also executes step 503 and step 504.

[0260] Step 503: The detection module determines the user-side network delay and the network-side network delay of the first user access device.

[0261] For the sake of simplicity, the following will refer to the “user-side network delay of the first user access device” as “user-side delay”, and the “network-side network delay of the first user access device” as “network-side delay”.

[0262] Among them, the user-side network delay is the network delay from the terminal device accessing the first user access device to the first user access device. The network-side delay includes the network delay from the first user access device to the network-side device of the access network where the first user access device is located, and the network delay from the network-side device to the bearer network. Among them, the network delay from the network-side device of the access network to the bearer network includes but is not limited to at least one of the following delays: the network delay from the network-side device of the access network to the bearer network access gateway (such as the broadband access server (Broadband Remote Access Server, BRAS)), the network delay from the network-side device of the access network to the core router (Core Router, CR), the network delay from the bearer network access gateway to the CR, etc. Optionally, the network delay described in the embodiment of the present application is characterized by RTT delay.

[0263] Take the access network as an optical access network, the first user access device as an access network ONT device, and the network side access device of the optical access network as an OLT device as an example. Fig.15 , Fig.15 FIG. 1 shows a schematic diagram of determining a user side delay and a network side delay provided by an embodiment of the present application. Fig.15As shown in the figure, the terminal device accesses the ONT device through the AP, and the terminal device and the AP communicate wirelessly. The AP and the ONT device can communicate with each other by wire or wireless. In the access network, the ONT and the OLT communicate through the PON. The OLT device accesses the operator's bearer network through the BRAS and CR. In this way, the terminal device communicates with the application server through the optical access network and the bearer network in turn, thereby realizing the corresponding services.

[0264] In this case, the user-side delay of the ONT device is recorded as Fig.15 The T1 shown is the RTT delay between the ONT device and the terminal device. The network delay of the ONT device includes Fig.15 T2, T3 and T4 are shown. T2 is the RTT delay between the ONT device and the OLT device, T3 is the RTT delay between the OLT device and the BRAS, and T4 is the RTT delay between the BRAS and the speed test server. The speed test server is connected to the CR and is used to provide network rate measurement services to the terminal device.

[0265] In practice, the first user access device and the network equipment on the network side of the first user access device (such as the network side equipment of the access network, BRAS, CR, etc.) can calculate the RTT delay between themselves and the adjacent network devices through the regularly transmitted Point-to-Point Protocol over Ethernet (PPPOE) session heartbeat packets.

[0266] For example, Fig.15 The OLT device shown can calculate the RTT delay between itself and the ONT device, that is, T2, through the PPPOE session heartbeat packet transmitted between itself and the ONT device. Of course, T2 can also be calculated by Fig.15 The ONT device shown is calculated through the PPPOE session heartbeat packet transmitted between itself and the OLT device, and this is not limited to this. Fig.15 The OLT device shown can calculate the RTT delay between itself and the BRAS, that is, T3, through the PPPOE session heartbeat packet transmitted between the OLT device and the BRAS.

[0267] In a specific implementation, the detection module can instruct the first user access device to trigger the terminal device to initiate a speed test service when a first network abnormal event is detected, so that the first user access device or the network test access device of the access network calculates the network delay between itself and the terminal device, as well as the network delay between itself and the speed test server by eavesdropping on the speed test messages exchanged between the terminal device and the speed test server.

[0268] Optionally, when the detection module detects the first network abnormal event, it can send an indication message carrying a terminal device identifier to the first user access device to instruct the first user access device to send a speed measurement indication to the terminal device represented by the identifier according to the terminal device identifier in the indication message. In response, the terminal device receives the speed measurement indication and initiates a speed measurement process to the speed measurement server. Here, the embodiment of the present application does not limit the specific manner in which the terminal device initiates the speed measurement process. For example, the terminal device can use but is not limited to using network testing tools such as IPERF or packet generator (PKTGEN) to initiate the speed measurement process. Among them, the embodiment of the present application does not provide a detailed introduction to IPERF and PKTGEN. It can be understood that the terminal device represented by the terminal device identifier carried in the indication message sent by the detection module to the first user access device is the terminal device to which the message flow to which the detection module detects the first network abnormal event belongs.

[0269] Furthermore, based on the network delay calculated based on the speed test message and the network delay calculated based on the PPPOE session heartbeat packet, the first user access device or the network test access device of the access network can determine the user side delay and network side delay of the first user access device.

[0270] As an example, combining Fig.15 , take the case where the detection device instructs the ONT device to trigger the terminal device to initiate the speed test service, and the ONT device listens to the speed test message exchanged between the terminal device and the speed test server as an example. In this case, when the ONT device forwards the speed test message from the terminal device to the speed test server, it records the time t1 when the speed test message is forwarded, and when receiving the response message from the speed test server and serving as the speed test message, it records the time t2 when the response message is received, and reads the processing time d1 of the speed test message on the speed test server from the response message. In this way, the ONT can obtain the RTT delay between itself and the speed test server by calculating (t2-t1-d1), that is, Fig.15 In addition, when the ONT device forwards the speed test message from the speed test server to the terminal device, it records the time t3 when the speed test message is forwarded, and when receiving the response message from the terminal device as the speed test message, it records the time t4 when the response message is received, and reads the processing time d2 of the speed test message in the terminal device from the response message. In this way, the ONT can calculate (t4-t3-d2) to obtain the RTT delay between itself and the terminal device, that is, Fig.15 T1 shown.

[0271] In this way, based on the RTT delay T7 between the ONT device and the speed test server, and the RTT delay T2 between the ONT device and the OLT device, the RTT delay T8 between the OLT and the speed test server can be calculated, T8 = T7-T2. It should be understood that T8 is also one of the network-side delays of the ONT device. In this way, the ONT device determines its own user-side network delay T1, and determines its own network-side network delay: T2 and T8.

[0272] As another example, combining Fig.15 , take the case where the detection device instructs the ONT device to trigger the terminal device to initiate the speed test service, and the OLT device listens to the speed test message exchanged between the terminal device and the speed test server as an example. In this case, when the OLT device forwards the speed test message from the terminal device to the speed test server, it records the time t5 when the speed test message is forwarded, and when receiving the response message from the speed test server and serving as the speed test message, it records the time t6 when the response message is received, and reads the processing time d3 of the speed test message in the speed test server from the response message. In this way, the OLT can obtain the RTT delay between itself and the speed test server by calculating (t6-t5-d3), that is, Fig.15 In addition, when the OLT device forwards the speed test message from the speed test server to the terminal device, it records the time t7 when the speed test message is forwarded, and when receiving the response message from the terminal device as the speed test message, it records the time t8 when the response message is received, and reads the processing time d4 of the speed test message in the terminal device from the response message. In this way, the OLT can calculate (t8-t7-d4) to obtain the RTT delay between itself and the terminal device, that is, Fig.15 T5 shown.

[0273] In this way, the OLT device can calculate the RTT delay T1 between the ONT device and the terminal device based on the RTT delay T5 between the OLT device and the terminal device, and the RTT delay T2 between the OLT device and the ONT device, where T1=T5-T2. Also, the OLT device can calculate the RTT delay T4 between the BRAS and the speed test server based on the RTT delay T6 between the OLT device and the speed test server, and the RTT delay T3 between the OLT device and the BRAS, where T4=T6-T3. It should be understood that T4 is also one of the network-side delays of the ONT device. In this way, the OLT device determines the user-side delay T1 of the ONT device, and determines the network-side delays of the ONT device: T2, T3, and T4. It can be seen that T1, T2, T3, and T4 are the segment-by-segment network delays from the terminal device to the ONT device, from the ONT device to the OLT device, from the OLT device to the BRAS, and from the BRAS to the test server, respectively.

[0274] Furthermore, the detection module can obtain the above-mentioned user side delay and network side delay determined by the first user access device, or the detection device can obtain the above-mentioned user side delay and network side delay determined by the network side access device of the access network to which the first user access device belongs.

[0275] Step 504: The detection module sends the determined network delay to the analysis module.

[0276] In response, the analysis module obtains the user-side delay and network-side delay of the first user access device sent by the detection module.

[0277] In this way, the method provided in the embodiment of the present application is executed Figure 5 After step 203, step 204, step 205 and step 2061 are shown, when executing step 3062, the analysis module determines the location area of ​​the fault causing the first network abnormal event based on the acquired network delay. It should be understood that the embodiment of the present application does not limit the execution sequence of steps 202 to 2061 and steps 503 to 504.

[0278] Specifically, in step 3062, the analysis module determines the location area where the fault causing the first network abnormal event is located based on the acquired user-side network delay of the first user access device and the network-side network delay of the first user access device.

[0279] In one possible implementation, the analysis module determines, based on the user-side delay, the user-side reference delay, the network-side delay, and the network-side reference delay, the area corresponding to the delay values ​​of the user-side delay and the network-side delay that are greater than the respective reference delays as the location area of ​​the fault that caused the first network abnormal event. For example, when the analysis module determines that the user-side delay is greater than the user-side reference delay, and determines that the network-side delay is not greater than the network-side reference delay, the analysis module determines that the fault that caused the first network abnormal event is located on the user side of the first user access device. For another example, when the analysis module determines that the user-side delay is not greater than the user-side reference delay, and determines that the network-side delay is greater than the network-side reference delay, the analysis module determines that the fault that caused the first network abnormal event is located on the network side of the first user access device.

[0280] The user-side reference delay refers to the reference delay between the terminal device and the user access device. The network-side reference delay includes the reference delay of multiple location intervals on the network side on the communication link where the first user access device is located. Fig.15 , when the network side delay includes Fig.15As shown in T2, T3 and T4, the network side reference delay includes: the reference delay between the ONT device and the OLT device, the reference delay between the OLT device and the BRAS, and the reference delay between the BRAS and the CR.

[0281] Optionally, the user-side reference delay and the network-side reference delay can be the same preset value, or the average of the network delay in the same position interval on different communication links, and there is no limitation on this. Among them, the same position interval on the communication link refers to the area between two devices located at the same position on different communication links. Here, the location of the device refers to the location of the devices with the same network function on the communication link. For example, the interval formed by the terminal to the user access device on communication link 1, and the area formed by the terminal device to the user access device on communication link 2, are the same position intervals on communication link 1 and communication link 2. For another example, the area formed by the ONT device to the OLT device on communication link 1, and the area formed by the ONT device to the OLT device on communication link 2, are the same position intervals on communication link 1 and communication link 2.

[0282] In an example, taking TI representing the network delay between the terminal device and the user access device, T2 representing the network delay between the user access device and the OLT device, T3 representing the network delay between the OLT device and the BRAS, and T4 representing the network delay between the BRAS and the CR as an example, refer to Table 4, which shows a reference delay provided in an embodiment of the present application.

[0283] As shown in Table 4, ONT_1, ONT_2, ONT_3, and ONT_4 are four user access devices deployed under the same OLT device. On the four communication links including ONT_1, ONT_2, ONT_3, and ONT_4, each communication link includes the network delay of four location intervals. For example, on the communication link including ONT_1, the delay T1 between the terminal device and ONT_1, the network delay T2 between ONT_1 and the OLT device, T3 between the OLT device and the BRAS, and T4 between the BRAS and the CR are included. For another example, on the communication link including ONT_3, the delay T1 between the terminal device and ONT_3, the network delay T2 between ONT_3 and the OLT device, T3 between the OLT device and the BRAS, and T4 between the BRAS and the CR are included.

[0284] Then, when T1 (denoted as T1) is calculated on the communication link including ONT_1, ONT_1 ) is 5 milliseconds, and the T1 calculated on the communication link including ONT_2 (denoted as T1 ONT_2 ) is 5 milliseconds, and the T1 calculated on the communication link including ONT_3 (denoted as T1ONT_3 ) is 5 milliseconds, and T1 (denoted as T1) calculated on the communication link including ONT_4 ONT_4 ) is 10 milliseconds, then the reference delay between the terminal device and the user access device (i.e., the user-side reference delay) can be T1 ONT_1 、T1 ONT_2 、T1 ONT_3 and T1 ONT_4 The average of the user-side reference delay is (5+5+5+10) / 4=6.25 milliseconds.

[0285] It should be understood that since the network delay generally includes multiple intervals of network delay, such as T2, T3, T4, etc. mentioned above, for a network delay of an interval, such as the network delay T2 between the user access device and the OLT device, when T2 (denoted as T2) calculated on the communication link including ONT_1 ONT_1 ) is 5 milliseconds, and T2 (denoted as T2) calculated on the communication link including ONT_2 ONT_2 ) is 10 milliseconds, and T2 (denoted as T2) calculated on the communication link including ONT_3 ONT_3 ) is 5 milliseconds, and T2 (denoted as T2) calculated on the communication link including ONT_4 ONT_4 ) is 5 milliseconds, then the reference delay between the user access device and the OLT device (recorded as the network side reference delay 1) is T2 ONT_1 、T2 ONT_2 、T2 ONT_3 and T2 ONT_4 The average of the network side reference delay is 1 = (5 + 10 + 5 + 5) / 4 = 6.25 milliseconds.

[0286] Similarly, for the network-side delay T3 between the OLT device and the BRAS, when T3 (denoted as T3) is calculated on the communication link including ONT_1, ONT_1 ) is 5 milliseconds, and T3 (denoted as T3) calculated on the communication link including ONT_2 ONT_2 ) is 5 milliseconds, and T3 (denoted as T3) calculated on the communication link including ONT_3 ONT_3 ) is 10 milliseconds, and T3 (denoted as T3) calculated on the communication link including ONT_4 ONT_4 ) is 5 milliseconds, then the reference delay between the OLT device and the BRAS (referred to as the network-side reference delay 2) is T3 ONT_1 、T3 ONT_2 、T3 ONT_3 and T3 ONT_4 The average of the network side reference delay is 2 = (5 + 5 + 10 + 5) / 4 = 6.25 milliseconds.

[0287] Similarly, for the network-side delay T4 between the BRAS and the CR, when T4 (denoted as T4) is calculated on the communication link including ONT_1, ONT_1 ) is 5 milliseconds, and T4 (denoted as T4) calculated on the communication link including ONT_2 ONT_2 ) is 5 milliseconds, and T4 (denoted as T4) calculated on the communication link including ONT_3 ONT_3 ) is 5 milliseconds, and T4 (denoted as T4) calculated on the communication link including ONT_4 ONT_4 ) is 5 milliseconds, then the reference delay between BRAS and CR (recorded as network-side reference delay 3) is T4 ONT_1 、T4 ONT_2 、T4 ONT_3 and T4 ONT_4 The average of the network side reference delay is 3 = (5+5+5+5) / 4 = 5 milliseconds.

[0288] Table 4

[0289]

[0290]

[0291] In this case, when the first user access device is ONT_1, the analysis module determines that T1, T2, T3, and T4 calculated on the communication link including ONT_1 and the reference delay shown in Table 4 do not exceed the reference delay of their respective corresponding intervals. Therefore, the analysis module determines that there is no abnormal delay on the communication link of the first user access device.

[0292] When the first user access device is ONT_2, the analysis module determines that T1, T3 and T4 do not exceed the reference delay 5 of the corresponding position interval, and T2 is greater than the reference delay 6.25 of the corresponding position interval based on T1, T2, T3, T4 calculated on the communication link including ONT_2, and the reference delay shown in Table 4, so the analysis module determines T2 as an abnormal delay. Since the position interval of T2 is the network side of ONT_2, the analysis module determines that the fault causing the first network abnormal event is located on the network side of the first user access device (ie, ONT_2). Similarly, when the first user access device is ONT_3, the analysis module determines that the network side delay T3 is an abnormal delay, and determines that the fault causing the first network abnormal event is located on the network side of the first user access device (ie, ONT_3).

[0293] When the first user access device is ONT_4, the analysis module determines that T2, T3, and T4 do not exceed the reference delay 5 of their respective corresponding position intervals based on T1, T2, T3, T4 calculated on the communication link including ONT_4 and the reference delay shown in Table 4, and T1 is greater than the reference delay 6.25 of the corresponding position interval, so the analysis module determines T1 as an abnormal delay. Since the position interval of T1 is the user side of ONT_4, the analysis module determines that the fault causing the first network abnormal event is located on the user side of the first user access device (ie, ONT_4).

[0294] In another possible implementation, the analysis module determines the abnormal delay in the acquired user-side delay and network-side delay according to the acquired user-side delay, network-side delay, and a preset abnormal delay detection algorithm, and determines the location area corresponding to the abnormal delay as the location area where the fault causing the first network abnormal event is located. The abnormal delay detection algorithm includes but is not limited to algorithms such as variance calculation and outlier check.

[0295] Then, the analysis module continues to execute steps 3063 to 3064.

[0296] pass Fig.14 The network anomaly diagnosis method shown achieves the purpose of determining the location area of ​​the fault that caused the network anomaly event through the user-side delay of the user access device and the network-side delay of the user access device. In this way, the analysis module can determine whether it is necessary to further determine the type of fault that caused the network anomaly event based on the network performance data of the user access device according to the location area of ​​the fault that caused the network anomaly event. For example, when the fault that caused the network anomaly event is located on the network side of the user access device, the analysis module only needs to issue a network anomaly alarm to the network operator. This is because the performance data of the user access device is not sufficient to diagnose the network fault on the network side of the user access device. Through this method, the computing resources of the analysis module can be saved.

[0297] In the embodiment of the present application, the detection module and the data acquisition module described above can be integrated in different devices respectively, so the method steps performed by the detection module and the data acquisition module can be performed by different devices. For example, the method steps performed by the detection module can be performed by a network-side access device (such as an OLT device) in the access network, and the method steps performed by the data acquisition module can be performed by a user access device (such as an ONT device or an ONU device).

[0298] Of course, the detection module and data acquisition module described above can also be integrated into the same device. Fig.16 , Fig.16 Another method for diagnosing network anomalies provided by an embodiment of the present application is shown. Optionally, the method can be applied to Figure 3 The diagnostic system 300 is shown. The method comprises the following steps.

[0299] Step 601: A first user access device detects a network abnormality event based on a message flow passing through the first user access device.

[0300] For detailed description of step 601, please refer to the description of the detection module detecting network abnormal events in step 201 above, which will not be repeated here.

[0301] Step 602: When the first user access device detects a first network abnormal event according to a first message flow passing through the first user access device, the first data is obtained.

[0302] When the first user access device detects a first network abnormality event according to the first message flow passing through itself, the process of obtaining the first data is triggered. Here, the detailed description of the first user access device obtaining the first data can refer to the description of step 203 above, which will not be repeated here.

[0303] Step 603: The first user access device sends first data and an abnormality notification message to the analysis device.

[0304] The detailed description of step 603 can refer to the description of step 204 above, which will not be repeated here.

[0305] Step 604: The analysis device obtains first data.

[0306] The detailed description of step 604 can refer to the description of step 205 above, which will not be repeated here.

[0307] Step 605 (optional): the analysis device determines a location area where a fault causing the first network abnormal event is located in response to the first network abnormal event indicated by the abnormal notification message.

[0308] Specifically, after the analysis device receives the abnormal notification message, when the analysis device determines, based on the identifier of the user access device carried in the abnormal notification message, that the first network abnormal event is detected based on the message flow flowing through the first user access device, the analysis device determines, in response to the first network abnormal event indicated by the abnormal notification message, the location area where the fault causing the first network abnormal event is located. For a detailed description of the location area where the fault causing the first network abnormal event is located, reference can be made to the description of step 3062 above, which will not be repeated here.

[0309] Step 606: When the analysis device determines that the fault causing the first network abnormal event is located at the user side of the first user access device, the analysis device determines the type of fault causing the first network abnormal event according to the first data.

[0310] The detailed description of the fault type that causes the first network abnormal event is determined by the analysis device according to the first data. Please refer to the description of step 2062 above and will not be repeated here.

[0311] Step 607 (optional): when the analysis device determines that the fault causing the first network abnormal event is located on the network side of the first user access device, the analysis device reports alarm information.

[0312] For detailed description of step 607, please refer to the description of step 3064 above, which will not be repeated here.

[0313] Through the network anomaly diagnosis method described in steps 601 to 607, when the analysis device determines that the fault causing the abnormal network event is located on the user side of the user access device, it can not only efficiently and accurately determine the type of fault causing the network anomaly event based on the network performance data of the user access device at the time when the network anomaly event occurs, but also save the computing resources of the analysis device.

[0314] In order to deepen the understanding of the method described in the embodiment of the present application, the method is further described below with reference to examples.

[0315] Take STA accessing the optical access network through FTTR equipment and communicating with the application server through the optical access network, and the detection module described above is configured in the OLT equipment of the optical access network, the data acquisition module is configured in the FTTR equipment, and the analysis module is configured in the NCE as an example. Fig.17 , Fig.17 A schematic diagram of another method for diagnosing network anomalies provided in an embodiment of the present application is shown.

[0316] like Fig.17 As shown, during the process of STA using the network, after the OLT device detects the first network abnormal event based on the message flow flowing through the FTTR device (refer to step 201), it sends an abnormal notification message to the FTTR device and NCE respectively to notify that the first network abnormal event has occurred (refer to step 202).

[0317] In response to the first network abnormal event indicated by the abnormal notification message, the FTTR obtains first data and sends the first data to the NCE (refer to steps 203 to 204).

[0318] The NCE receives an abnormality notification message from the OLT device and first data from the FTTR device through the southbound interface. When the NCE determines that the first network abnormality event is detected based on the message flow flowing through the FTTR device according to the identifier of the user access device carried in the abnormality notification message, the NCE determines the fault type causing the first network abnormality event according to the first data received from the FTTR device in response to the first network abnormality event indicated by the abnormality notification message. Specifically, the NCE first delimits the fault causing the first network abnormality event (refer to step 3062). Then, when the NCE determines that the fault causing the first network abnormality event is located on the user side of the FTTR device, the NCE determines the fault type of the fault according to the first data (refer to step 3063), and outputs the determined fault type to the operation support system (OSS) or the fixed network digital integration and operation (ADO) system of the network operator through the northbound interface. When the NCE determines that the fault causing the first network abnormality event is located on the network side of the FTTR device, the NCE outputs alarm information to the network operator OSS or ADO through the northbound interface (refer to step 3064).

[0319] The northbound interface is generally an interface for manufacturers or operators to access and manage the network, that is, an interface provided upward. The southbound interface is generally an interface for end users and is used to collect data.

[0320] It should be noted that the sequence of steps in the method for diagnosing network anomalies provided in the embodiment of the present application can be appropriately adjusted, and the steps can be increased or decreased accordingly according to the situation. Any technician familiar with the technical field can easily think of a change within the technical scope disclosed in this application, and it should be included in the protection scope of this application, so it will not be repeated.

[0321] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of each node described above can refer to the corresponding content in the aforementioned method embodiment, and will not be repeated here.

[0322] The above mainly introduces the solution provided in the embodiment of the present application from the perspective of method.

[0323] In order to achieve the above functions, Fig.18 As shown, Fig.18 FIG. 1 is a schematic diagram showing the structure of a network anomaly diagnosis device 1800 provided in an embodiment of the present application. The diagnosis device 1800 is used to execute the above-mentioned network anomaly diagnosis method, for example, to execute Figure 5 , Figure 8 , Fig. 9 , Fig.14 , Fig.16 or Fig.17 The part of the method shown in the figure that is executed by the analysis module. The diagnostic device 1800 may include an acquisition unit 1801 and a processing unit 1802 .

[0324] The acquisition unit 1801 is used to acquire first data. The processing unit 1802 is used to determine the fault type causing the first network abnormal event according to the first data. The first data is the network performance data of the first user access device in the first time period, the first time period includes the time when the first network abnormal event is detected, the first network abnormal event is a network abnormal event detected based on the message flow flowing through the first user access device, and the first user access device is used to connect the terminal device to the network.

[0325] As an example, combining Figure 5 , the acquisition unit 1801 can be used to execute step 205, and the processing unit 1802 can be used to execute step 206.

[0326] Optionally, the acquisition unit 1801 is used to receive first data sent by the data acquisition module, the first data including an identifier of a user access device. And, it is used to receive an abnormality notification message, the abnormality notification message is used to determine a first network abnormality event. The processing unit 1802 is used to respond to the first network abnormality event and determine the fault type causing the first network abnormality event according to the first data when the abnormality notification message includes the identifier of the user access device.

[0327] As an example, combining Figure 5 , the acquisition unit 1801 can be used to execute step 205, and the processing unit 1802 can be used to execute step 206.

[0328] Optionally, processing unit 1802 is also used to determine a location area where the fault causing the first network abnormal event is located, and the location area includes the user side of the first user access device or the network side of the first user access device; and to determine the type of fault causing the first network abnormal event based on the first data when the fault causing the first network abnormal event is located on the user side of the first user access device.

[0329] As an example, combining Figure 8 , processing unit 1802 can be used to execute steps 3062 to 3063.

[0330] Optionally, the diagnostic device 1800 further includes: a sending unit 1803, configured to report alarm information of a network side fault when the fault causing the first network abnormal event is located on the network side of the first user access device.

[0331] As an example, combining Figure 8, the sending unit 1803 can be used to execute step 3064.

[0332] Optionally, the acquisition unit 1801 is further configured to acquire second data, where the second data is service data transmitted by the first user access device in the first time period. The processing unit 1802 is specifically configured to determine the location area where the fault causing the first network abnormal event is located according to the second data.

[0333] Optionally, the processing unit 1802 is specifically configured to determine a location area where the fault causing the first network abnormal event is located according to the second data and the second classifier.

[0334] As an example, combining Fig. 9 , the processing unit 1802 can be used to execute steps 401 to 403.

[0335] Optionally, the acquisition unit 1801 is further configured to acquire the user-side network delay and the network-side network delay of the first user access device. The processing unit 1802 is specifically configured to determine the location area where the fault causing the first network abnormal event is located according to the user-side network delay and the network-side network delay of the first user access device.

[0336] As an example, combining Fig.14 , the acquisition unit 1801 can be used to respond to step 504.

[0337] Optionally, the processing unit 1802 is further configured to call the first classifier to predict, based on the first data, a fault type causing the first network abnormal event.

[0338] As an example, combining Figure 5 , processing unit 1802 can be used to execute step 206.

[0339] Optionally, the first classifier is trained using a decision tree model and / or a neural network model.

[0340] Optionally, the processing unit 1802 is further configured to search for a correspondence between network performance data and a fault type according to the first data to determine the fault type causing the first network abnormal event.

[0341] As an example, combining Figure 5 , processing unit 1802 can be used to execute step 206.

[0342] Optionally, the processing unit 1802 is further configured to determine a first prediction result and a second prediction result based on the first data, and to determine a target prediction result from the first prediction result and the second prediction result, wherein the target prediction result indicates a fault type that causes the first network abnormal event. The first prediction result is a fault type predicted by calling the first classifier based on the first data, and the second prediction result is a fault type determined by searching for a correspondence between network performance data and fault types based on the first data.

[0343] As an example, combining Figure 5 , processing unit 1802 can be used to execute step 206.

[0344] Optionally, the diagnostic device 1800 is applied to an analysis module, which is configured in a cloud device.

[0345] Optionally, the first data includes network performance data of the first user access device collected on a second basis during a first time period.

[0346] For the detailed description of the above optional methods, please refer to the above method embodiments, which will not be repeated here. In addition, the explanation of any of the above diagnostic devices 1800 and the description of the beneficial effects can refer to the above corresponding method embodiments, which will not be repeated here.

[0347] It should be understood that the unit in the diagnostic device 1800 that performs reception and transmission related operations may also be referred to as a transceiver unit, which is not limited to this.

[0348] As an example, combining Fig.21 The functions implemented by the acquisition unit 1801 and the sending unit 1803 in the diagnostic device 1800 can be realized by Fig.21 The functions implemented by the processing unit 1802 can be realized by Fig.21 Processor 2101 in the Fig.21 The program code in the memory 2102 is implemented.

[0349] like Fig.19 As shown, Fig.19 FIG. 1 is a schematic diagram showing the structure of a network anomaly diagnosis device 1900 provided in an embodiment of the present application. The diagnosis device 1900 is used to execute the above-mentioned network anomaly diagnosis method, for example, to execute Figure 5 , Figure 8 , Fig. 9 , Fig.14 , Fig.16 or Fig.17 The part of the method shown in the figure that is executed by the detection module. The diagnostic device 1900 may include a processing unit 1901 and a sending unit 1902.

[0350] The processing unit 1901 is used to detect a network abnormal event. The sending unit 1902 is used to send a data acquisition instruction to the data acquisition module when a first network abnormal event is detected according to a message flow flowing through a first user access device. The data acquisition instruction is used to indicate the acquisition of first data. The first user access device is used to connect a terminal device to a network, the first data is network performance data of the first user access device in a first time period, the first data is used to analyze the type of fault that causes the first network abnormal event, and the first time period includes the time when the first network abnormal event is detected.

[0351] As an example, combining Figure 5 , the processing unit 1901 can be used to execute step 201, and the sending unit 1902 can be used to execute step 202.

[0352] Optionally, the sending unit 1902 is further configured to send an abnormality notification message to the analysis module, where the abnormality notification message is used to determine the first network abnormal event.

[0353] Optionally, the above-mentioned data acquisition indication is also used to indicate the acquisition of second data, where the second data is service data transmitted by the first user access device within the first time period, and the second data is used to determine the location area where the fault causing the first network abnormal event is located, and the location area includes the user side of the first user access device or the network side of the first user access device.

[0354] Optionally, the processing unit 1901 is further configured to determine the user-side network delay and the network-side network delay of the first user access device. The sending unit 1902 is further configured to send the user-side network delay and the network-side network delay of the first user access device to the analysis module.

[0355] As an example, combining Fig.14 , the processing unit 1901 can be used to execute step 503, and the sending unit 1902 can be used to execute step 504.

[0356] Optionally, the diagnostic device 1900 is applied to a detection module, and the detection module is applied to an OLT device, an ONT device or an ONU device.

[0357] For the detailed description of the above optional methods, please refer to the above method embodiments, which will not be repeated here. In addition, the explanation of any of the above diagnostic devices 1900 and the description of the beneficial effects can refer to the above corresponding method embodiments, which will not be repeated here.

[0358] It should be understood that the unit in the diagnostic device 1900 that performs reception and transmission related operations may also be referred to as a transceiver unit, which is not limited to this.

[0359] As an example, combining Fig.21The function implemented by the processing unit 1901 in the diagnostic device 1900 can be realized by Fig.21 Processor 2101 in the Fig.21 The functions implemented by the sending unit 1902 can be realized by Fig.21 The communication interface 2103 is implemented in.

[0360] like Fig. 20 As shown, Fig. 20 FIG. 2 is a schematic diagram showing the structure of a network anomaly diagnosis device 2000 provided in an embodiment of the present application. The diagnosis device 2000 is used to execute the above-mentioned network anomaly diagnosis method, for example, to execute Figure 5 , Figure 8 , Fig. 9 , Fig.14 , Fig.16 or Fig.17 The part of the method shown in the figure that is executed by the data acquisition module. The diagnostic device 2000 may include an acquisition unit 2001 and a sending unit 2002 .

[0361] The acquisition unit 2001 is used to acquire a data acquisition indication, and acquire first data in response to the data acquisition indication. The sending unit 2002 is used to send the first data to the analysis module. The data acquisition indication is used to indicate the acquisition of the first data, the first data is the network performance data of the first user access device in the first time period, the first data is used to analyze the fault type causing the first network abnormal event, the first time period includes the time when the first network abnormal event is detected, the first network abnormal event is a network abnormal event determined based on the message flow flowing through the first user access device, and the first user access device is used to connect the terminal device to the network.

[0362] As an example, combining Figure 5 , the acquiring unit 2001 can be used to execute step 203, and the sending unit 2002 can be used to execute step 204.

[0363] Optionally, the above-mentioned data acquisition indication is also used to indicate the acquisition of second data, where the second data is service data transmitted by the first user access device within the first time period, and the second data is used to determine the location area where the fault causing the first network abnormal event is located, and the location area includes the user side of the first user access device or the network side of the first user access device.

[0364] Optionally, the first user access device is configured with a cache pool, which is used to store network performance data and service data of the first user access device. The acquisition unit 2001 is specifically used to obtain the third data and fourth data of the first user access device stored in the cache pool. Among them, the third data includes the network performance data and service data of the first user access device in the second time period, and the second time period is the time period from the current time to the current time, which is a first preset time period before the current time. The fourth data includes the network performance data and service data of the first user access device in the third time period, and the third time period is the time period from the current time to the current time, which is a first preset time period from the current time to the current time. The first time period includes the second time period and the third time period, the first data includes the network performance data in the third data and the network performance data in the fourth data, and the second data includes the service data in the third data and the service data in the fourth data.

[0365] Optionally, the diagnostic apparatus 2000 is applied to a data acquisition module, and the data acquisition module is applied to a first user access device, and the first user access device is an ONT device or an ONU device.

[0366] For the detailed description of the above optional methods, please refer to the above method embodiments, which will not be repeated here. In addition, the explanation of any of the above diagnostic devices 2000 and the description of the beneficial effects can refer to the above corresponding method embodiments, which will not be repeated here.

[0367] It should be understood that the unit in the diagnostic device 2000 that performs operations related to receiving and sending can also be called a transceiver unit, and the unit in the diagnostic device 2000 that performs operations unrelated to receiving and sending can also be called a processing unit, without limitation.

[0368] As an example, combining Fig.21 , some functions of the acquisition unit 2001 and the sending unit 2002 in the diagnostic device 2000 can be achieved by Fig.21 Another part of the functions of the acquisition unit 2001 can be realized by Fig.21 Processor 2101 in the Fig.21 The program code in the memory 2102 is implemented, and there is no limitation on this.

[0369] Those skilled in the art should easily realize that, in combination with the units and algorithm steps of each example described in the embodiments disclosed herein, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0370] It should be noted that Fig.18 , Fig.19 and Fig. 20 The division of modules / units in the above is schematic and is only a logical function division. There may be other division methods in actual implementation. For example, two or more functions may be integrated into one processing module. The above integrated modules may be implemented in the form of hardware or software function modules.

[0371] The present application also provides a computing device for implementing the functions implemented by the diagnostic device described above, thereby implementing some or all of the functions in the network anomaly diagnosis method provided by the present application. For example, the functions of the detection module, data acquisition module or analysis module in the network anomaly diagnosis method are executed. Fig.21 Schematic diagram of a computing device provided in an embodiment of the present application. Fig.21 As shown, the computing device 2100 includes a processor 2101, a memory 2102, a communication interface 2103 and a bus 2104. The processor 2101, the memory 2102 and the communication interface 2103 are connected to each other through the bus 2104.

[0372] Processor 2101 may include a general processor and / or a dedicated hardware chip. A general processor may include: a central processing unit (CPU), a microprocessor or a graphics processing unit (GPU). The CPU is, for example, a single-core processor (single-CPU), or a multi-core processor (multi-CPU). A dedicated hardware chip is a hardware module for high-performance processing. A dedicated hardware chip includes at least one of a digital signal processor, an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or a network processor (NP). Processor 2101 may also be an integrated circuit chip with signal processing capabilities. In the implementation process, some or all of the functions of the network abnormality diagnosis method of the present application can be completed by the hardware integrated logic circuit in the processor 2101 or the instructions in the form of software.

[0373] The memory 2102 is used to store computer programs, which include an operating system 2102a and executable code (i.e., program instructions) 2102b. The memory 2102 is, for example, a read-only memory or other types of static storage devices that can store static information and instructions, or a random access memory or other types of dynamic storage devices that can store information and instructions, or an electrically erasable programmable read-only memory, a read-only optical disc or other optical disc storage, an optical disc storage (including a compressed optical disc, a laser disc, an optical disc, a digital versatile disc, a Blu-ray disc, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired executable code in the form of an instruction or data structure and can be accessed by a computer, but is not limited thereto. For example, the memory 2102 is used to store the first data, the second data, the network delay data, etc. The memory 2102 is, for example, independent and connected to the processor 2101 via the bus 2104. Or the memory 2102 and the processor 2101 are integrated together. The memory 2102 can store executable code. When the executable code stored in the memory 2102 is executed by the processor 2101, the processor 2101 is used to perform some or all functions of the network abnormality diagnosis method provided in the embodiment of the present application. For the implementation of the processor 2101 to execute the process, please refer to the relevant description in the aforementioned embodiment. The memory 2102 may also include software modules and data required for other running processes such as the operating system.

[0374] The communication interface 2103 uses a transceiver module such as, but not limited to, a transceiver to achieve communication with other devices or communication networks. For example, the communication interface 2103 can be any one or any combination of the following devices: a network interface (such as an Ethernet interface), a wireless network card, and other devices with network access functions.

[0375] The bus 2104 is any type of communication bus for interconnecting the internal devices of the computing device (e.g., the memory 2102, the processor 2101, and the communication interface 2103). For example, a system bus. The embodiment of the present application takes the interconnection of the above-mentioned devices inside the computing device through the bus 2104 as an example. Optionally, the above-mentioned devices inside the computing device 2100 can also be connected to each other in communication with each other using other connection methods other than the bus 2104. For example, the above-mentioned devices inside the computing device 2100 are interconnected through an internal logical interface.

[0376] It should be noted that the above-mentioned multiple devices can be respectively arranged on independent chips, or at least partially or completely arranged on the same chip. Whether to independently arrange each device on different chips or to integrate and arrange it on one or more chips often depends on the needs of product design. The embodiments of the present application do not limit the specific implementation form of the above-mentioned devices. The descriptions of the processes corresponding to the above-mentioned figures have different focuses. For the parts not described in detail in a certain process, please refer to the relevant descriptions of other processes.

[0377] In the above embodiments, all or part of the embodiments may be implemented by software, hardware, firmware, or any combination thereof. When implemented by software, all or part of the embodiments may be implemented in the form of a computer program product. The computer program product providing a program development platform includes one or more computer instructions, and when these computer program instructions are loaded and executed on a computing device, all or part of the functions of the memory method provided in the embodiments of the present application are implemented in whole or in part.

[0378] Furthermore, computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, computer instructions may be transmitted from one website, computer, server or data center to another website, computer, server or data center via wired (e.g., coaxial cable, optical fiber, digital subscriber line) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium stores computer program instructions that provide a program development platform.

[0379] An embodiment of the present application also provides a computer-readable storage medium, which is a non-volatile computer-readable storage medium. The computer-readable storage medium includes program instructions. When the program instructions are executed on a computing device, the computing device implements a method for diagnosing network anomalies as provided in an embodiment of the present application.

[0380] The embodiment of the present application also provides a computer program product including instructions. When the computer program product is executed on a computer, the computer implements the network anomaly diagnosis method provided by the embodiment of the present application.

[0381] A person skilled in the art will understand that all or part of the steps to implement the above embodiments may be accomplished by hardware or by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, and the above-mentioned storage medium may be a read-only memory, a disk or an optical disk, etc.

[0382] It should be noted that the information (including but not limited to user device information, user personal information, etc.), data (including but not limited to data used for analysis, stored data, displayed data, etc.) and signals involved in this application are all authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards of relevant countries and regions. For example, the image information and executable code involved in this application are all obtained with full authorization.

[0383] In the embodiments of the present application, the terms "first", "second" and "third" are used for descriptive purposes only and should not be understood as indicating or implying relative importance. The term "at least one" means one or more, and the term "plurality" means a plurality, unless otherwise expressly defined.

[0384] The term "and / or" in this application is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship.

[0385] It should be understood that the terms used in the description of the various examples herein are only for describing specific examples and are not intended to be limiting. As used in the description of the various examples and the appended claims, the singular forms "a", "an", and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise.

[0386] It should also be understood that in the various embodiments of the present application, the size of the serial number of each process does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0387] The above description is only an optional embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the concept and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A method for diagnosing network anomalies, characterized in that: include: Acquire first data, where the first data is network performance data of a first user access device within a first time period, where the first time period includes a time when a first network abnormality event is detected, where the first network abnormality event is a network abnormality event detected based on a message flow flowing through the first user access device, and the first user access device is used to access a terminal device to a network; The fault type causing the first network abnormal event is determined according to the first data.

2. The method according to claim 1, characterized in that The obtaining of the first data comprises: receiving the first data sent by a data acquisition module, where the first data includes an identifier of the user access device; Determining the fault type causing the first network abnormal event according to the first data includes: receiving an abnormality notification message, wherein the abnormality notification message is used to determine the first network abnormal event; In a case where the abnormal notification message includes the identifier of the user access device, in response to the first network abnormal event, a fault type causing the first network abnormal event is determined according to the first data.

3. The method according to claim 2, characterized in that Determining the fault type causing the first network abnormal event according to the first data includes: Determine a location area where a fault causing the first network abnormal event is located, where the location area includes a user side of the first user access device or a network side of the first user access device; In a case where the fault causing the first network abnormal event is located on the user side of the first user access device, the type of fault causing the first network abnormal event is determined according to the first data.

4. The method according to claim 3, characterized in that The method further comprises: Acquire second data, where the second data is service data transmitted by the first user access device within the first time period; Determining the location area where the fault causing the first network abnormal event is located includes: The location area where the fault causing the first network abnormal event is located is determined according to the second data.

5. The method according to claim 3, characterized in that The method further comprises: Obtaining a user-side network delay and a network-side network delay of the first user access device; Determining the location area where the fault causing the first network abnormal event is located includes: A location area where a fault causing the first network abnormal event is located is determined based on a user-side network delay and a network-side network delay of the first user access device.

6. The method according to any one of claims 1 to 5, characterized in that Determining the fault type causing the first network abnormal event according to the first data includes: A first classifier is called to predict, based on the first data, a fault type causing the first network abnormal event.

7. The method according to any one of claims 1 to 5, characterized in that Determining the fault type causing the first network abnormal event according to the first data includes: The correspondence between network performance data and fault types is searched according to the first data to determine the fault type causing the first network abnormal event.

8. The method according to any one of claims 1 to 5, characterized in that Determining the fault type causing the first network abnormal event according to the first data includes: Determine a first prediction result and a second prediction result according to the first data, wherein the first prediction result is a fault type predicted by calling a first classifier according to the first data, and the second prediction result is a fault type determined by searching a correspondence between network performance data and fault types based on the first data; A target prediction result is determined between the first prediction result and the second prediction result, where the target prediction result indicates a fault type causing the first network abnormal event.

9. The method according to any one of claims 1 to 8, characterized in that The method is executed by an analysis module, and the analysis module is configured in a cloud device.

10. A method for diagnosing network anomalies, characterized in that: include: Detect abnormal network events; When a first network abnormal event is detected based on a message flow passing through a first user access device, a data acquisition indication is sent to a data acquisition module, and the data acquisition indication is used to indicate the acquisition of first data; wherein, the first user access device is used to connect a terminal device to a network, and the first data is network performance data of the first user access device within a first time period, and the first data is used to analyze the type of fault that caused the first network abnormal event, and the first time period includes the time when the first network abnormal event was detected.

11. The method according to claim 10, characterized in that The method further comprises: An abnormality notification message is sent to the analysis module, where the abnormality notification message is used to determine the first network abnormal event.

12. The method according to claim 10 or 11, characterized in that The data acquisition indication is also used to indicate the acquisition of second data, where the second data is service data transmitted by the first user access device during the first time period, and the second data is used to determine the location area where the fault causing the first network abnormal event is located, and the location area includes the user side of the first user access device or the network side of the first user access device.

13. The method according to claim 10 or 11, characterized in that: The method further comprises: Determine a user-side network delay and a network-side network delay of the first user access device; Send the user-side network delay and the network-side network delay of the first user access device to the analysis module.

14. The method according to any one of claims 10 to 13, characterized in that The method is executed by a detection module, and the detection module is applied to an optical line terminal OLT device, an optical network terminal ONT device or an optical network unit ONU device.

15. A method for diagnosing network anomalies, characterized in that: include: Obtain a data acquisition instruction, where the data acquisition instruction is used to instruct to obtain first data, where the first data is network performance data of a first user access device within a first time period, where the first data is used to analyze a fault type causing a first network abnormal event, and where the first time period includes a time when the first network abnormal event is detected; The first network abnormal event is a network abnormal event determined based on a message flow flowing through a first user access device, and the first user access device is used to access a terminal device to a network; In response to the data acquisition instruction, acquiring the first data; The first data is sent to an analysis module.

16. The method according to claim 15, characterized in that The data acquisition indication is also used to indicate the acquisition of second data, where the second data is service data transmitted by the first user access device during the first time period, and the second data is used to determine the location area where the fault causing the first network abnormal event is located, and the location area includes the user side of the first user access device or the network side of the first user access device.

17. The method according to claim 16, characterized in that The first user access device is configured with a cache pool, and the cache pool is used to store network performance data and service data of the first user access device; and obtaining the first data includes: Acquire third data and fourth data of the first user access device stored in the cache pool; Among them, the third data includes network performance data and service data of the first user access device in a second time period, and the second time period is a time period from the current time to the current time and a first preset time period away from the current time; the fourth data includes network performance data and service data of the first user access device in a third time period, and the third time period is a time period from the current time to the current time and a first preset time period away from the current time, the first time period includes the second time period and the third time period, the first data includes the network performance data in the third data and the network performance data in the fourth data, and the second data includes the service data in the third data and the service data in the fourth data.

18. The method according to any one of claims 15 to 17, characterized in that The method is executed by a data acquisition module, and the data acquisition module is applied to the first user access device, and the first user access device is an optical network terminal ONT device or an optical network unit ONU device.

19. A network anomaly diagnosis device, characterized in that: include: A transceiver unit, configured to perform operations related to receiving and / or sending in any one of the methods of claims 1 to 18; A processing unit, configured to perform other operations other than operations related to receiving and / or sending in the method according to any one of claims 1 to 18.

20. A network anomaly diagnosis device, characterized in that: include: One or more processors, a memory and a network interface, the one or more processors receiving or sending data through the network interface, the one or more processors being configured to read program instructions stored in the memory to execute the method according to any one of claims 1 to 18.

21. A network anomaly diagnosis system, characterized in that: include: An analysis module, a detection module and a data acquisition module, wherein the analysis module is used to execute any one of the methods 1 to 9, the detection module is used to execute any one of the methods 10 to 14, and the data acquisition module is used to execute any one of the methods 15 to 18.

22. A computer-readable storage medium, characterized in that: The method comprises computer program instructions, and when the computer program instructions are executed by a computing device, the computing device performs the method according to any one of claims 1 to 18.

23. A computer program product comprising instructions, characterized in that When the instructions are executed by a computing device, the computing device is caused to perform the method according to any one of claims 1 to 18.

Images