A method and device for diagnosing the status of core network elements based on dynamic AI algorithms

Abstract

This disclosure relates to the field of core network equipment operation and maintenance, and proposes a method and device for diagnosing the status of core network elements based on dynamic AI algorithms. The method includes: connecting with a third-party platform data source to obtain real-time status data of core network elements; outputting anomalies in the real-time performance indicators of network elements based on dynamic security thresholds; outputting anomaly information for detected abnormal log data and alarm information; and deriving a final health score for the network element based on anomalies, anomaly information in abnormal log data and alarm information, test results, and complaint information, triggering a hidden danger investigation task. This invention analyzes multi-dimensional data (performance, alarms, logs) using AI algorithms, and ultimately derives the network element status through a comprehensive health assessment algorithm. It can automatically adapt to network changes, possesses high intelligence and automation characteristics, and significantly improves the accuracy and efficiency of fault detection and location.

Description

Technical Field

[0001] This invention belongs to the field of core network equipment operation and maintenance. It proposes a method and device for diagnosing the status of core network elements based on a dynamic AI algorithm. Background Technology

[0002] In recent years, with the widespread adoption of 5G mobile communication networks and rapid technological advancements, the mobile communication field has witnessed unprecedented transformation. In this process, traditional 2G / 4G networks coexist with emerging virtualized 5G networks, jointly constructing a complex and ever-changing network environment. However, this increased complexity has also brought numerous challenges, the most significant of which are bottlenecks such as data fragmentation across different platforms, incomplete fault detection of network elements, and low efficiency in fault analysis and location.

[0003] Currently, mobile operators generally adopt dynamic and static threshold monitoring methods based on expert experience to address the poor quality of internet access services provided by communication devices. However, with the expansion of mobile communication networks and the evolution of technology, the network environment has become increasingly complex and volatile. Traditional threshold setting methods or single-indicator analysis methods are no longer effective in meeting production support requirements.

[0004] In practice, such fixed thresholds have revealed numerous limitations. On the one hand, the massive fault perception system of the core network makes manual analysis of this data a daunting task, time-consuming and prone to over-warning or overlooking critical faults. On the other hand, effectively identifying and locating problem nodes requires deep professional knowledge and practical experience, a high barrier to entry that poses a severe challenge to frontline operations and maintenance teams. Finally, the dynamic and complex nature of networks, with communication networks constantly evolving, necessitates sufficient flexibility to address unforeseen situations and long-term trends rather than relying on fixed thresholds. Establishing a comprehensive and accurate set of rules to cover all possible network states requires expert experience, extremely high human resource costs, and often lags behind the pace of network development. Therefore, constructing a core network element status analysis and diagnosis method and device with dynamic AI algorithms that can automatically adapt to network changes and possess high intelligence and automation has become a crucial issue that operators urgently need to address. Summary of the Invention

[0005] To address the above problems, this invention discloses a core network element status diagnosis method based on a dynamic AI algorithm, comprising:

[0006] The system interfaces with third-party platform data sources to obtain real-time status data of core network elements; the real-time status data of core network elements includes real-time performance index data of network elements, device log data, network element alarm information, network element dialing test results information and complaint information; the core network runs on the device.

[0007] An isolated forest model is built based on historical network element performance index data. The outlier score of each performance index for each network element is calculated. The dynamic security threshold of the network element performance index is output based on the outlier score. Based on the dynamic security threshold, the outliers of the real-time performance index data of the network element are output.

[0008] Feature extraction is performed on the processed device log data and alarm information to identify key information and patterns in the logs and alarms, determine whether there are any abnormalities in the input device log data and alarm information, and output abnormal information of abnormal log data and alarm information for detected abnormal log data and alarm information.

[0009] The final health score of a network element is derived from anomalies in real-time performance indicators, abnormal log data and alarm information, test results and complaints output by the performance index analysis model.

[0010] Based on the final health score of the network element, the fault event handling process is triggered.

[0011] The steps for triggering the fault event handling process based on the final health score of the network element specifically include:

[0012] The final health score of the network element has an initial score, and the score is deducted based on the anomalies in the real-time performance index data of the network element output by the isolated forest model, the anomalies in the log data of the abnormal device and the alarm information of the network element, the network element test results information and the complaint information.

[0013] If S1 ≥ final health score of network element > S2, start the first fault event handling task;

[0014] If S2 ≥ final health score of network element > S3, start the second fault event handling task;

[0015] If S3 ≥ final health score of network element > S4, the third fault event handling task is initiated.

[0016] If Sn≥Network element final health score>0, start the nth fault event handling task;

[0017] S1, S2, S3, ..., Sn are all located between the initial score of the final health rating of the network element and 0.

[0018] Also includes:

[0019] Define the mapping relationship between different types of data sources and Doris tables; the data source types include real-time performance index data of network elements, device log data, alarm information, test results information and complaint information;

[0020] Based on the Doris table model mapping configuration, the data hierarchy is divided into the raw data layer ODS, the detailed data layer DWD, the wide table data DWS, and the application layer ADS.

[0021] It interfaces with various data sources to obtain different types of data sources;

[0022] Collect data files provided by the data source and parse the data files into a structured data stream;

[0023] The data stream is pushed to the Kafka distributed message queue, and based on Flink's real-time stream processing capabilities, the data is processed separately. Different data streams are pushed to the raw data layer ODS, detailed data layer DWD, wide table data DWS, and application layer ADS to perform data standardization and data aggregation processing.

[0024] The processed data is stored and managed efficiently using Doris.

[0025] The step of outputting the dynamic security threshold based on outlier scores for network element performance indicators specifically includes:

[0026] For indicator data identified as normal, extract the normal indicator data set A and the indicator data set B that is close to abnormal;

[0027] The normal indicator data set A is averaged to obtain the normal value a;

[0028] Compare the indicator data set B with the normal value a, and output the dynamic security threshold of the network element performance indicator:

[0029] If all values ​​in the indicator data set B are greater than the normal value a, then the maximum value of the indicator data set X is taken as the safety boundary value, and the dynamic safety threshold is "≤ safety boundary value".

[0030] If the set of indicator data B contains both indicators that are greater than the normal value a and those that are less than the normal value a, then the maximum value of the indicators that are greater than the normal value a is taken as the safety boundary data, and the minimum value of the indicators that are less than the normal value a is taken as the safety boundary data. Thus, the dynamic safety threshold is "≤ the maximum safety indicator value and ≥ the minimum safety indicator value".

[0031] If all values ​​in the set of indicator data B are less than the normal value a, the minimum value in the set of indicator data X is taken as the safety boundary value, that is, the dynamic safety threshold is "≥ minimum safety indicator value".

[0032] The step of outputting anomaly points of real-time performance index data of network elements based on dynamic security thresholds specifically includes: marking anomaly points of indicators based on the performance index security thresholds provided by the isolated forest model. If the value of an indicator of a certain device is not within the range of the dynamic security threshold at a certain time point, then one anomaly point is marked.

[0033] The step of deducting points based on anomalies in the real-time performance indicators of network elements output by the performance indicator analysis model, anomaly log data, alarm information, test results, and complaints specifically includes:

[0034] If no indicators are marked as abnormal within a preset series of n time points, no points will be deducted;

[0035] If only one indicator is marked as an anomaly within a preset series of n time points, it is considered a "single point anomaly" and 2 points will be deducted.

[0036] If only one indicator is marked with more than one abnormal point within a preset consecutive n time points, it is considered "continuous abnormality" and 5m points are deducted, where m is the number of abnormal points;

[0037] If multiple indicators experience "single-point anomalies" within a preset series of n time points, 2p points will be deducted, where p is the number of indicators.

[0038] If multiple indicators show "continuous abnormalities" within a preset range of n consecutive time points, 40 points will be deducted, indicating an unhealthy condition.

[0039] The steps for establishing an isolated forest model based on historical network element performance data also include:

[0040] Standardize the date format of historical network element performance index data to ensure that the time intervals of all data remain consistent;

[0041] Determine if there are any missing timestamps. If so, use linear interpolation to fill in the missing timestamps and their corresponding indicator data.

[0042] Based on the start time and predetermined time intervals, the data is sorted in ascending order by date to construct a complete and continuous time series.

[0043] Historical network element performance data were integrated into the newly constructed time series, and the data index was reset.

[0044] We obtain a new quality index dataset X;

[0045] The total quality indicator data X is split into n subsets of quality indicator data according to the dimension of (network element, indicator);

[0046] An isolated forest model is built for each quality indicator based on a subset of the quality indicator data.

[0047] Secondly, a core network element status diagnosis device based on a dynamic AI algorithm is disclosed, comprising:

[0048] The multi-source data integration module is based on the Doris table model mapping configuration to process data from different data sources. It is used to perform data collection, data parsing, cleaning and other processing tasks, as well as to store and manage the data.

[0049] The performance index analysis module is used to build an isolated forest model, calculate the outlier scores of each performance index of each network element, and output the dynamic security threshold of the network element performance index.

[0050] The log and alarm analysis module is used to perform feature learning on log and alarm data, identify key information and patterns in logs and alarms, determine whether there are any anomalies in the input logs, and output abnormal logs and alarm information.

[0051] The forward-looking early warning module is used to predict faults by using a deduction system to score the health of network elements. The network element health score is then provided to the emergency response module as the triggering basis for the fault response mechanism.

[0052] The emergency response module is used to respond to different processing procedures based on the network element health score.

[0053] The present invention has the following advantages:

[0054] 1. This invention collects data in real time and uses diversified data integration technology to integrate cross-type data sources, making data analysis more accurate and in-depth;

[0055] 2. This invention uses an isolated forest small model to calculate the outlier score of each indicator for each network element, and uses the qwen2.5 large model to analyze log and alarm anomaly information. The large model is used for macro trend prediction and pattern recognition, while the small model focuses on the refined analysis of specific problems. It is more capable of handling complex scenarios than a single small model analysis, provides multi-dimensional interpretation of results, and enhances the flexibility and accuracy of decision-making.

[0056] 3. The present invention, based on a predictive mechanism using historical data and a comprehensive health assessment algorithm, significantly improves the effectiveness and accuracy of fault prevention and reduces the need for emergency response.

[0057] 4. This invention uses a real-time monitoring and emergency response mechanism to provide immediate warnings based on health status, ensuring that problems are immediately visible and controllable. Attached Figure Description

[0058] Figure 1 This is a flowchart of a core network element status diagnosis method according to an embodiment of the present invention;

[0059] Figure 2This is a structural diagram of a core network element status diagnosis device according to an embodiment of the present invention;

[0060] Figure 3 This is a schematic diagram of the core network element status data integration process in one embodiment of the present invention;

[0061] Figure 4 This is a flowchart of the performance index data cleaning process in one embodiment of the present invention;

[0062] Figure 5 This is a schematic diagram of the isolated forest model training for the core network element state diagnosis method in one embodiment of the present invention;

[0063] Figure 6 This is a schematic diagram illustrating the abnormal indicator diagnosis of the core network element status diagnosis method in one embodiment of the present invention. Detailed Implementation

[0064] The preferred embodiments of the present invention are described below through examples. It should be understood that the specific embodiments described herein are for detailed explanation of the present invention and should not be construed as limiting the present invention. It should be noted that various changes and modifications can be made while adhering to the principles and core scope of the present invention, and these changes should all be considered to fall within the protection scope of the present invention. The specific implementation steps of the present invention will be described in detail with reference to the accompanying drawings.

[0065] like Figure 1 The diagram shown is a flowchart of a core network element status diagnosis method according to an embodiment of the present invention, which specifically includes the following steps:

[0066] Step 1: Connect with third-party platform data sources to obtain real-time status data of core network elements;

[0067] In a specific embodiment, the third-party platform data source can be the core network maintenance data center.

[0068] In a specific embodiment, S1 includes the following steps:

[0069] S101: Obtain the Doris table model mapping configuration and define the mapping relationship between different types of data sources and Doris tables;

[0070] In specific embodiments, the mapping relationship between different types of data sources and Doris tables includes information such as data source type, data source format, and the correspondence between data fields and Doris table columns.

[0071] The data source types include real-time performance index data of network elements, device log data, network element alarm information, network element test results information, and complaint information.

[0072] S102: Based on the Doris table model mapping configuration, the data layers are divided into raw data layer ODS, detailed data layer DWD, wide table data DWS, and application layer ADS according to the big data layered architecture.

[0073] In a specific embodiment, the raw data layer has the same data structure and granularity as the content provided by the original file; the detailed data layer is responsible for cleaning, transforming, and integrating the data to generate a detailed data table, mainly performing data standardization; the wide table data layer performs aggregation operations to generate wide table data to meet general business needs. The application layer is used to store data and provide query interfaces for other modules.

[0074] S103: Interact with various data sources to obtain different types of data sources;

[0075] In specific embodiments, the docking method can be active or passive, depending on the characteristics of the data platform and the frequency of data updates.

[0076] S104: After collecting data files from various data sources, the data files are parsed into a structured data stream. The parsing process includes data file format recognition, field extraction, data type conversion, and other operations.

[0077] S105: Push the parsed data stream to the Kafka distributed message queue, and process the data separately based on Flink's real-time stream processing capabilities, pushing different data streams to various data layers to perform data standardization, data aggregation and other processing tasks.

[0078] S106: After the data processing task is completed, efficient data storage and management are achieved based on Doris.

[0079] like Figure 3 The diagram shown is a schematic of the core network element status data integration process in one embodiment of the present invention. The collected indicators are from OMC devices and third-party data platforms. The indicator data sources can be HTTP Adapter, SNMP Trap Adapter and Syslog Adapter. The HTTP adapter is used to receive real-time performance indicators, the SNMP Trap Adapter processes alarm information and the Syslog Adapter processes device logs. These adapters can automatically push indicator data.

[0080] In specific embodiments, data sources can also include SFTP adapters, SNMP adapters, SSH adapters, RESTful adapters, and WebService adapters. SFTP adapters are used to retrieve files from remote servers or devices via secure file transfer protocols. SNMP adapters are used to obtain performance metrics from network devices in real time. SSH adapters connect to network devices via secure SSH protocols to execute commands and retrieve data collected from command outputs. RESTful adapters are used to obtain metric data via HTTP requests. WebService adapters are used to initiate requests to the target system via WebService interfaces to obtain the required monitoring data. In specific embodiments, metric data can be obtained through proactive collection methods such as initiating connections, requesting commands, or sending query operations.

[0081] In specific embodiments, indicator data can also be collected by issuing instructions.

[0082] In specific embodiments, different types of data sources obtain data with different formats and types, so the data needs to be processed separately, performing data standardization, data aggregation and other processing tasks.

[0083] Step 2: Build an isolated forest model based on historical network element performance index data, calculate the outlier score for each performance index of each network element, and output the dynamic security threshold for network element performance index based on the outlier score; based on the dynamic security threshold, output the outliers in the real-time performance index data of the network element.

[0084] In a specific embodiment, the specific implementation steps of S2 are as follows:

[0085] S201. Construct a subset Xn of historical performance index data based on historical performance index data of core network elements:

[0086] Collect and analyze historical indicator data of core network elements to extract key raw performance indicator dataset Z; dataset Z should include core information such as network element name, indicator name, corresponding indicator value, and collection time.

[0087] The extracted raw performance index dataset Z is cleaned and processed through a series of standardization steps to obtain the total performance index dataset X.

[0088] Furthermore, due to various factors such as equipment hardware, software version and configuration, operating environment, application scenarios and requirements, as well as maintenance and management, the values ​​of the same performance indicators vary among different network elements. Therefore, it is necessary to analyze each indicator of each device individually. Thus, the total performance indicator data set X needs to be split into n performance indicator data subsets according to the dimension of (network element, indicator), forming Xn (n = 1, 2, 3...n).

[0089] In specific embodiments, such as Figure 4 As shown, S201 includes the following steps:

[0090] S2011. Standardize the date format of historical network element performance index data to ensure that the time intervals of all data remain consistent.

[0091] S2012. Determine whether there are definite timestamps. If so, use linear interpolation to fill in the missing timestamps and their corresponding indicator data.

[0092] S2013. Based on the start time and predetermined time interval of the data, sort the data in ascending order by date to construct a complete and continuous time series;

[0093] S2014. Integrate the original data into the newly constructed time series and reset the data index;

[0094] S2015. Obtain the new quality indicator dataset X;

[0095] S2016. Split the total quality indicator data set X into n quality indicator data subsets Xn according to the dimension of (network element, indicator);

[0096] S202. Construct an isolated forest model based on the isolated forest algorithm and using a data subset Xn;

[0097] In a specific implementation, the Isolation Forest algorithm can be roughly divided into two stages. The first stage requires training t isolated trees (iTrees) to form an isolated forest (iForest). Then, each sample point is fed into each isolated tree in the forest, the average height is calculated, and finally, the outlier score for each sample point is calculated. The training process includes the following steps:

[0098] S2021. Split each performance metric dataset Xn into j sample points, i.e., Xn = {x n1 ,...,x nj}, randomly assign dimension d (features), each sample point has d dimensions (features), that is Randomly select φ sample points from Xn as a sample subset Xn' and place them into the root node of the tree.

[0099] S2022. In the sample subset Xn', randomly select a dimension q (i.e., feature) from d dimensions. Randomly generate a cutoff point p in the current node data. The cutoff point is generated between the maximum and minimum values ​​of the specified dimension in the current node data.

[0100] S2023. A hyperplane is generated using this cutting point, which divides the current node's data space into two subspaces: data less than p in the specified dimension is placed in the left child node of the current node, and data greater than or equal to p is placed in the right child node of the current node.

[0101] S2024. Recursively repeat steps S2022 and S2023 in the child nodes, continuously constructing new child nodes until there is only one data in the child node (it cannot be further cut) or the number of isolated data has reached the limit height.

[0102] S2025. Repeat the above steps for each subset Xn until each Xn generates t isolated trees (iTree), forming n isolated forests (iForest).

[0103] like Figure 5 The image shown is a training graph of an isolated forest in one embodiment of the present invention. The points marked in black have the shortest paths, are isolated points, and are closest to anomalies.

[0104] S203. Based on the generated n iForest models, output the outlier score of the performance metrics:

[0105] In a specific embodiment, for each data point x ni Let it iterate through each iTree corresponding to iForest and calculate point x. ni The average height h in the corresponding forest n (x ni The average height of all points is normalized, and the outlier score of the performance index is calculated.

[0106] The formula for calculating outlier scores is as follows:

[0107]

[0108] in,

[0109]

[0110] E(h n (x ni )) is the data point x ni The average path length across all isolated forests, c(φ) is a normalization factor for the expected path length.

[0111] Abnormal scores The value range is (0,1). The closer the score is to 1, the more likely the data point is to be an outlier; the closer the score is to 0, the more likely the data point is to be a normal point.

[0112] S204. Finally, based on the outlier score, output the dynamic security threshold of the network element performance index and output the outlier points of the real-time performance index data of the network element.

[0113] In a specific embodiment, the steps of S204 are as follows:

[0114] S2041. The indicator data identified as normal (i.e., indicator data with abnormal scores close to 0) are saved separately, and a set of normal indicator data A and a set of near-abnormal indicator data B are extracted from them.

[0115] S2042. Average the normal indicator data set A to obtain the normal value a;

[0116] S2043. Compare the indicator data set B with the normal value a, and output the dynamic security threshold of the network element performance indicator:

[0117] If all values ​​in the indicator data set B are greater than the normal value a, then the maximum value of the indicator data set B is taken as the safety boundary value, and the dynamic safety threshold is "≤ safety boundary value".

[0118] If the set of indicator data B contains both indicators that are greater than the normal value a and those that are less than the normal value a, then the maximum value of the indicators that are greater than the normal value a is taken as the safety boundary data, and the minimum value of the indicators that are less than the normal value a is taken as the safety boundary data. Thus, the dynamic safety threshold is "≤ the maximum safety indicator value and ≥ the minimum safety indicator value".

[0119] If all values ​​in the set of indicator data B are less than the normal value a, the minimum value in the set of indicator data X is taken as the safety boundary value, thus obtaining the dynamic safety threshold as "≥ minimum safety indicator value".

[0120] S2044. Based on the safety threshold of the performance indicators provided by the isolated forest model, anomaly points are marked. If the value of a certain indicator of a certain device is not within the safety threshold range at a certain time point, one anomaly point is marked.

[0121] Step 3: Extract features from the device log data and alarm information, identify key information and patterns in the logs and alarms, determine whether there are any abnormalities in the input device log data and alarm information, and output the abnormal information of the abnormal log data and alarm information for the detected abnormal log data and alarm information.

[0122] In a specific embodiment, S3 includes the following steps:

[0123] S301. Collect real-time syslog log data and alarm information, and perform cleaning processing on the log and alarm data, such as removing noise and invalid data; extract key information such as timestamps, event types, and event descriptions from the logs and perform structured processing.

[0124] S302. Label the training log data and use the labeled log and alarm data to train the Qwen2.5 model. During training, the model will learn the characteristics and patterns of normal logs and alarms, and the accuracy and generalization ability of the model will be improved by adjusting the model parameters and optimizing the algorithm.

[0125] S303. Input the real-time syslog logs and alarms to be identified into the trained Qwen2.5 model. The model will extract features from the input log and alarm data, identify key information and patterns in the logs and alarms, and determine whether the input logs are abnormal based on the learned normal log and alarm features and patterns. If the logs and alarms differ significantly from the normal pattern, they will be marked as abnormal logs and alarms.

[0126] S304. For detected abnormal logs and alarms, the model will output detailed abnormal information in the form of alarm triggering, including network element abnormality (such as equipment failure, performance degradation, etc.), abnormality level (such as severe, general, etc.), scope of impact (such as which services or systems are affected), and services affected (such as causing service interruption, service degradation, etc.).

[0127] Step 4: Based on the anomalies in the real-time performance indicators of the network element output by the performance indicator analysis model, the anomaly information in the abnormal log data and alarm information, the test results information and complaint information, the final health score of the network element is obtained.

[0128] In a specific embodiment, a deduction system is used for fault prediction. The final health score of a network element is out of 100 points, and the score is deducted until it is exhausted. Negative scores are not allowed.

[0129] The final health score of a network element is mainly related to five dimensions: performance indicators, key indicators, alarms, logs, and complaints. Weights are set for each dimension, and the final health score of the network element is obtained by combining the weights.

[0130] In a specific embodiment, the following deduction system can be used to calculate the final health score of the network element.

[0131] For performance metrics data, such as Figure 6 The diagram shown is a schematic diagram for diagnosing abnormal indicators. If a device has no abnormal indicators marked within a preset n consecutive time points, it is considered "no abnormality" and no points are deducted for that indicator.

[0132] If a device has only one indicator marked as an anomaly within a preset series of n time points, it is considered a "single point anomaly" and is scored as -2 points.

[0133] If a device has only one indicator marked with more than one abnormal point within a preset n consecutive time points, it is considered as "continuous abnormality" and will receive -5m points (m is the number of abnormal points).

[0134] If a device experiences "single-point anomalies" in multiple indicators within a preset series of n time points, then -2p points are awarded (p is the number of indicators).

[0135] If a device experiences "continuous abnormalities" in multiple indicators within a preset series of n time points, it will be deducted 40 points and considered unhealthy.

[0136] For abnormal logs and alarm information, alarm information extracted based on the qwen2.5 model training results in a -5 point deduction for first-level alarm business nodes and a -3 point deduction for second-level alarm business nodes. Different deduction values ​​are given based on the filtered abnormal log data and the analysis of the large model.

[0137] For test information, if the test fails more than 5 times within 15 minutes, the business node will be deducted 30 points directly, and each failure within 15 minutes will deduct 6 points.

[0138] Regarding the complaint information, the number of complaints in the coverage area of ​​this network element has increased to over 100, and the trend is upward. The issue is easily reproduced through dial-up testing and is concentrated in the coverage area of ​​the faulty network element. Therefore, a score of -40 points is deducted, indicating that the network is unhealthy.

[0139] In summary, the scores and weights of the five aspects are combined and provided to the emergency response module as the triggering basis for the fault response mechanism.

[0140] It should be noted that the above algorithm and deduction rules are only an example and do not limit the flexibility and scalability of the present invention.

[0141] S5. Based on the final health score of the network element, trigger the fault event handling task.

[0142] The final health score of the network element has an initial score, and the score is deducted based on the anomalies in the real-time performance index data of the network element output by the isolated forest model, the anomalies in the log data of the abnormal device and the alarm information of the network element, the network element test results information and the complaint information.

[0143] If S1 ≥ final health score of network element > S2, start the first fault event handling task;

[0144] If S2 ≥ final health score of network element > S3, start the second fault event handling task;

[0145] If S3 ≥ final health score of network element > S4, the third fault event handling task is initiated.

[0146] If Sn≥Network element final health score>0, start the nth fault event handling task;

[0147] S1, S2, S3, ..., Sn are all located between the initial score of the final health rating of the network element and 0.

[0148] In one possible embodiment, the initial score of the final health rating of the network element is 100 points. When the final health rating of the network element is in [70, 85), it is determined to be a potential event, and the corresponding potential event investigation task is triggered.

[0149] If the final health score of a network element is in the range [60, 70), it is considered a critical fault event, and the fault event handling process is initiated immediately.

[0150] If the final health score of a network element is in the range [0, 60), it is determined to be a major fault event, triggering the highest priority fault event handling task.

[0151] This invention also discloses a core network element status analysis and diagnosis device based on a dynamic AI algorithm, such as... Figure 2 As shown, it specifically includes:

[0152] The multi-source data integration module is based on the Doris table model mapping configuration to process data from different data sources. It is used to perform data collection, data parsing, cleaning and other processing tasks, as well as to store and manage the data.

[0153] The performance index analysis module is used to build an isolated forest model, calculate the outlier scores of each performance index of each network element, and output the dynamic security threshold of the network element performance index.

[0154] The log and alarm analysis module is used to perform feature learning on log and alarm data, identify key information and patterns in logs and alarms, determine whether there are any anomalies in the input logs, and output abnormal logs and alarm information.

[0155] The forward-looking early warning module is used to predict faults by using a deduction system to score the health of network elements. The network element health score is then provided to the emergency response module as the triggering basis for the fault response mechanism.

[0156] The emergency response module is used to respond to different processing procedures based on the network element health score.

[0157] This invention proposes a core network element status analysis and diagnosis method and device based on dynamic AI algorithm. Through real-time integration of massive data and diversified data, dual-model collaborative strategy, forward-looking early warning algorithm and comprehensive health assessment algorithm, it calculates the health status of network elements, as well as real-time monitoring and emergency response mechanism, to achieve refined monitoring of the status of core network elements and automatic and accurate capture of fault events.

[0158] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A core network element status diagnosis method based on dynamic AI algorithm, characterized in that, include: It connects with third-party platform data sources to obtain real-time status data of core network elements; The real-time status data of the core network elements includes real-time performance index data of the network elements, equipment log data, network element alarm information, network element dialing test results information, and complaint information; The core network elements operate on the equipment; Based on historical network element performance index data, an isolated forest model is built for each index of each network element. The outlier score of each performance index of the core network element is calculated, and the dynamic security threshold of the network element performance index is output based on the outlier score. Based on dynamic security thresholds, output anomalies in the real-time performance metrics data of network elements. The Qwen2.5 model is used to extract features from the device log data and network element alarm information, identify key information and patterns in the device log data and network element alarm information, determine whether there are any abnormalities in the input device log data and network element alarm information, and output the abnormal information of the abnormal device log data and network element alarm information for the detected abnormal device log data and network element alarm information. The final health score of the network element is derived from the anomalies in the real-time performance index data of the network element output by the isolated forest model, the anomalies in the log data of the abnormal device and the alarm information of the network element, the network element test results and the complaint information. Based on the final health score of the network element, trigger the fault event handling task; The step of outputting the dynamic security threshold based on outlier scores for network element performance indicators specifically includes: For indicator data identified as normal, extract the normal indicator data set A and the indicator data set B that is close to abnormal; The normal indicator data set A is averaged to obtain the normal value a; Compare the indicator data set B with the normal value a, and output the dynamic security threshold of the network element performance indicator; If all values ​​in the indicator data set B are greater than the normal value a, then the maximum value of the indicator data set B is taken as the safety boundary value, and the dynamic safety threshold is ≤ the safety boundary value. If the set of indicator data B contains both indicators that are greater than the normal value a and those that are less than the normal value a, then the maximum value of the indicators that are greater than the normal value a is taken as the safety boundary data, and the minimum value of the indicators that are less than the normal value a is taken as the safety boundary data. That is, the dynamic safety threshold is ≤ the maximum safety indicator value and ≥ the minimum safety indicator value. If all values ​​in the set of indicator data B are less than the normal value a, the minimum value in the set of indicator data B is taken as the safety boundary value, that is, the dynamic safety threshold is greater than or equal to the minimum safety indicator value.

2. The method according to claim 1, characterized in that, The steps for triggering fault event handling tasks based on the final health score of network elements specifically include: The final health score of the network element has an initial score, and the score is deducted based on the anomalies in the real-time performance index data of the network element output by the isolated forest model, the anomalies in the log data of the abnormal device and the alarm information of the network element, the network element test results information and the complaint information. If S1 ≥ final health score of network element > S2, start the first fault event handling task; If S2 ≥ final health score of network element > S3, start the second fault event handling task; If S3 ≥ final health score of network element > S4, the third fault event handling task is initiated. If Sn≥Network element final health score>0, start the nth fault event handling task; S1, S2, S3, ..., Sn are all located between the initial score of the final health rating of the network element and 0.

3. The method according to claim 1, characterized in that, Also includes: Define the mapping relationship between different types of data sources and Doris tables; The data source types include real-time performance index data of network elements, device log data, network element alarm information, network element test results information, and complaint information; Based on the Doris table model mapping configuration, the data hierarchy is divided into the raw data layer ODS, the detailed data layer DWD, the wide table data DWS, and the application layer ADS. It interfaces with various data sources to obtain different types of data sources; Collect data files provided by the data source and parse the data files into a structured data stream; The data stream is pushed to the Kafka distributed message queue, and based on Flink's real-time stream processing capabilities, the data is processed separately. Different data streams are pushed to the raw data layer ODS, detailed data layer DWD, wide table data DWS, and application layer ADS to perform data standardization and data aggregation processing. The processed data is stored and managed using Doris.

4. The method according to claim 1, characterized in that, The step of identifying outliers in the real-time performance metrics data of network elements based on dynamic security thresholds specifically includes: Anomalies are marked based on the performance index safety threshold provided by the isolated forest model. If the value of an indicator of a certain device is not within the dynamic safety threshold range at a certain time point, one anomaly is marked.

5. The method according to claim 2, characterized in that, The steps for deducting points based on anomalies in the real-time performance metrics data of network elements output by the isolated forest model, anomalies in the log data of abnormal devices and network element alarm information, network element testing results, and complaint information specifically include: If no indicators are marked as abnormal within a preset series of n time points, no points will be deducted; If only one indicator is marked as an anomaly within a preset series of n time points, it is considered a single point of failure and 2 points will be deducted. If only one indicator is marked with more than one abnormal point within a preset consecutive n time points, it is considered as a continuous abnormality and 5m points will be deducted, where m is the number of abnormal points; If multiple indicators experience single-point anomalies within a preset series of n time points, 2p points will be deducted, where p is the number of indicators. If multiple indicators show consecutive abnormalities within a preset range of n consecutive time points, 40 points will be deducted, indicating an unhealthy condition.

6. The method according to claim 1, characterized in that, The steps for establishing an isolated forest model based on historical network element performance data also include: Standardize the date format of historical network element performance index data to ensure that the time intervals of all data remain consistent; Determine if there are any missing timestamps. If so, use linear interpolation to fill in the missing timestamps and their corresponding indicator data. Based on the start time and predetermined time intervals, the data is sorted in ascending order by date to construct a complete and continuous time series. The historical network element performance data is integrated into the newly constructed time series, and the data index is reset to obtain a new set of quality indicator data X. The overall quality indicator data set X is split into n quality indicator data subsets according to the dimensions of network elements and indicators; An isolated forest model is built for each quality indicator based on a subset of the quality indicator data.

7. A core network element status analysis and diagnosis device based on dynamic AI algorithm, characterized in that, To implement any one of the methods of claims 1-6 above, the method comprises: The multi-source data integration module, based on the Doris table model mapping configuration, processes data from different data sources, performs data acquisition, data parsing, cleaning and processing tasks, and stores and manages the data. The performance index analysis module is used to construct an isolated forest model for each index of each network element based on historical network element performance index data, calculate the outlier score of each performance index of each network element, and output the dynamic security threshold of network element performance index. The log and alarm analysis module is used to perform feature learning on log and alarm data through the Qwen2.5 model, identify key information and patterns in logs and alarms, determine whether there are anomalies in the input logs, and output abnormal logs and alarm information. The forward-looking early warning module is used to predict faults by using a deduction system to score the health of network elements. The network element health score is then provided to the emergency response module as the triggering basis for the fault response mechanism. The emergency response module is used to respond to different processing procedures based on the network element health score.

Images