Network traffic early warning method and device, equipment, storage medium and program product

Abstract

The invention provides a network traffic early warning method, device and equipment, a storage medium and a program product, and relates to the technical field of big data, the network traffic early warning method comprises the following steps: obtaining real-time traffic data of a wide area network; inputting the real-time traffic data into a traffic prediction model to obtain predicted traffic data within a first duration after the current time output by the traffic prediction model; wherein the traffic prediction model is obtained by training historical traffic data of a wide area network; determining a broadband utilization rate alarm threshold within the first duration after the current time according to the historical traffic data and the predicted traffic data; and performing network flow early warning according to the real-time broadband utilization rate of the wide area network and the broadband utilization rate alarm threshold value. According to the invention, through the traffic prediction model, the predicted traffic data within the first duration after the current time can be predicted more accurately, and timely early warning of a data transmission link is realized.

Description

Technical Field

[0001] The present invention relates to the field of big data technology, and particularly to a network traffic warning method, device, equipment, storage medium and program product. Background Art

[0002] In the context of the information age, the wide area network, as the core architecture for data element transmission, undertakes the task of transmitting a huge amount of information flow. The diversification of Internet services and the rapid increase in the user base, combined with the booming development of the artificial intelligence field and the large model field, have increased the industry's demand for computing power and transportation capacity, and at the same time have further exacerbated the requirement for high-speed data transmission capabilities. An effective traffic management and risk warning mechanism plays a crucial role in ensuring the stability and security of network services.

[0003] With the increasing demand for high-speed transmission of massive data over wide area networks, and at the same time, scenarios such as multi-cloud data backup and off-site data cloudification have put forward higher requirements for the efficiency of online data high-speed migration. Achieving high-speed data transmission of massive data over wide area networks has become an urgent need. An effective traffic management and risk warning mechanism is crucial for ensuring the stability and security of network services. However, the data transmission of traditional wide area network architectures has the following defects:

[0004] The lack of universality of the prediction model for diverse network data: Most of the models of traditional methods are single, lack sensitivity to the real-time changes of network states, and cannot provide accurate prediction results;

[0005] The risk warning system responds slowly: Existing risk warning systems rely on static threshold judgments, making it difficult to issue early warnings at the initial stage of risks and missing the best intervention opportunity. Summary of the Invention

[0006] The present invention provides a network traffic warning method, device, equipment, storage medium and program product to solve the problems in the prior art that accurate prediction results cannot be provided for the prediction of network states and early warnings are difficult to issue.

[0007] To solve the above technical problems, the embodiments of the present invention provide the following technical solutions:

[0008] In a first aspect, an embodiment of the present invention provides a network traffic warning method, including:

[0009] Obtain the real-time traffic data of the wide area network;

[0010] Input the real-time traffic data into a traffic prediction model to obtain predicted traffic data within a first duration after the current time output by the traffic prediction model; wherein, the traffic prediction model is trained according to the historical traffic data of the wide area network;

[0011] Determine the broadband utilization warning threshold within the first time period after the current time based on the historical traffic data and the predicted traffic data;

[0012] Perform network traffic warning based on the real-time broadband utilization of the wide area network and the broadband utilization warning threshold.

[0013] Optionally, the method further includes:

[0014] Obtain the historical traffic data of the wide area network within the second time period before the current time;

[0015] Perform data cleaning, data smoothing processing, and data interpolation processing on the historical traffic data to obtain the processed first data;

[0016] Train the base model using the first data to obtain the traffic prediction model;

[0017] Wherein, the second time period is determined by the first time period;

[0018] The first time period is determined according to the data transmission service requirements of the wide area network and the link quality of the wide area network;

[0019] The data granularity of the historical traffic data is determined according to the second time period.

[0020] Optionally, the traffic data includes at least one of the following:

[0021] Circuit identifier;

[0022] Circuit bandwidth;

[0023] Average rate of circuit inflow;

[0024] Average rate of circuit outflow;

[0025] Data express service data;

[0026] Special time marking data of traffic data;

[0027] Round-trip delay;

[0028] Round-trip packet loss rate;

[0029] Round-trip delay jitter.

[0030] Optionally, training the base model using the first data to obtain the traffic prediction model includes:

[0031] Obtain channel input data of at least three channels in the first data, wherein the acquisition time intervals between the channel input data of any two adjacent channels are different;

[0032] Divide the channel input data of each said channel according to a preset sliding window to obtain channel segmentation data;

[0033] Use a convolutional neural network to perform feature extraction and statistical feature classification on the channel segmentation data to obtain model input data;

[0034] Use the model input data to train the base model to obtain the traffic prediction model.

[0035] Optionally, using a convolutional neural network to perform feature extraction and statistical feature classification on the channel segmentation data to obtain model input data includes:

[0036] Use the convolutional layer and pooling layer in the convolutional neural network to perform feature extraction on the channel segmentation data to obtain feature data;

[0037] Use the fully connected layer in the convolutional neural network to perform statistical feature classification on the feature data to obtain the model input data.

[0038] Optionally, the base model includes multiple time series prediction models;

[0039] Using the model input data to train the base model to obtain the traffic prediction model includes:

[0040] Use the model input data to train each of the time series prediction models to obtain multiple trained time series prediction models;

[0041] According to the model input data and the multiple trained time series prediction models, obtain the training prediction results output by each of the trained time series prediction models;

[0042] According to the training prediction results, determine at least two target time series prediction models among the multiple time series prediction models;

[0043] According to each trained time series prediction model corresponding to each target time series prediction model and the weight value corresponding to each target time series prediction model, obtain the traffic prediction model.

[0044] Optionally, the target time series prediction models include: a time series prediction additive model, a prediction model combining a recurrent neural network and an attention mechanism, and a machine learning model based on gradient boosting;

[0045] Input the real-time traffic data into the traffic prediction model to obtain the predicted traffic data within the first time period after the current time output by the traffic prediction model, including:

[0046] Input the real-time traffic data into the time series prediction additive model to obtain a first prediction result output by the time series prediction additive model;

[0047] Input the real-time traffic data into a prediction model combining a recurrent neural network and an attention mechanism to obtain a second prediction result output by the prediction model combining the recurrent neural network and the attention mechanism;

[0048] Input the real-time traffic data into a machine learning model based on gradient boosting to obtain a third prediction result output by the machine learning model based on gradient boosting;

[0049] According to the first prediction result, the first weight value corresponding to the time series prediction additive model, the second prediction result, the second weight value corresponding to the prediction model combining the recurrent neural network and the attention mechanism, the third prediction result, and the third weight value corresponding to the machine learning model based on gradient boosting, obtain the predicted traffic data within the first time period after the current time output by the traffic prediction model.

[0050] Optionally, the method further includes:

[0051] Use the real-time traffic data of the wide area network and the predicted traffic data output by the traffic prediction model to adjust the model parameters of at least one of the time series prediction additive model, the prediction model combining the recurrent neural network and the attention mechanism, and the machine learning model based on gradient boosting;

[0052] and / or,

[0053] Use the real-time traffic data of the wide area network and the predicted traffic data output by the traffic prediction model to adjust at least one of the first weight value, the second weight value, and the third weight value.

[0054] Optionally, determining the broadband utilization warning threshold within the first time period after the current time according to the historical traffic data and the predicted traffic data includes:

[0055] Obtain the historical broadband utilization upper limit threshold and the historical broadband utilization lower limit threshold according to the historical traffic data;

[0056] Obtain the broadband utilization within the first time period after the current time according to the predicted traffic data;

[0057] Obtain a dynamic adjustment factor according to the broadband utilization and the obtained real-time broadband utilization;

[0058] Obtain the broadband utilization warning threshold according to the historical broadband utilization upper limit threshold, the historical broadband utilization lower limit threshold, and the dynamic adjustment factor.

[0059] In a second aspect, an embodiment of the present invention further provides a network traffic early warning device, including:

[0060] A first acquisition module, configured to acquire real-time traffic data of a wide area network;

[0061] A first processing module, configured to input the real-time traffic data into a traffic prediction model to obtain predicted traffic data within a first time period after the current time output by the traffic prediction model; wherein, the traffic prediction model is trained according to historical traffic data of the wide area network;

[0062] A second processing module, configured to determine a broadband utilization warning threshold within the first time period after the current time according to the historical traffic data and the predicted traffic data;

[0063] A third processing module, configured to perform network traffic early warning according to the real-time broadband utilization rate of the wide area network and the broadband utilization warning threshold.

[0064] In a third aspect, an embodiment of the present invention further provides a network traffic early warning device, including: a processor, a memory, and a program stored on the memory and executable on the processor, and when the program is executed by the processor, it implements the steps in the network traffic early warning method according to any one of the first aspects.

[0065] In a fourth aspect, an embodiment of the present invention further provides a readable storage medium, on which a program is stored, and when the program is executed by a processor, it implements the steps in the network traffic early warning method according to any one of the first aspects.

[0066] In a fifth aspect, an embodiment of the present invention further provides a computer program product, including computer instructions, and when the computer instructions are executed by a processor, they implement the steps in the network traffic early warning method according to any one of the first aspects.

[0067] The beneficial effects of the present invention are:

[0068] The network traffic early warning method provided by the solution of the present invention obtains real-time traffic data of a wide area network, inputs the real-time traffic data into a traffic prediction model to obtain predicted traffic data within a first time period after the current time output by the traffic prediction model, wherein the traffic prediction model is trained according to historical traffic data of the wide area network, and the traffic prediction model can more accurately predict the predicted traffic data within the first time period after the current time, and further, determines a broadband utilization warning threshold within the first time period after the current time according to the historical traffic data and the predicted traffic data, and performs network traffic early warning according to the real-time broadband utilization rate of the wide area network and the broadband utilization warning threshold, so as to realize timely early warning of the data transmission link. Brief Description of the Drawings

[0069] Figure 1 It is a flowchart showing the network traffic warning method provided by the embodiment of the present invention;

[0070] Figure 2 It is a flowchart showing the training process of the traffic prediction model provided by the embodiment of the present invention;

[0071] Figure 3 It is a flowchart showing the optimization process of the traffic prediction model provided by the embodiment of the present invention;

[0072] Figure 4 It is a flowchart showing the overall process of network traffic prediction and risk warning provided by the embodiment of the present invention;

[0073] Figure 5 It is a schematic structural diagram of the network traffic warning device provided by the embodiment of the present invention;

[0074] Figure 6 It is a schematic structural diagram of the network traffic warning device provided by the embodiment of the present invention. Detailed Embodiments

[0075] To make the technical problems, technical solutions and advantages to be solved by this application clearer, the following will be described in detail with reference to the accompanying drawings and specific embodiments. In the following description, specific details such as specific configurations and components are provided only to help a comprehensive understanding of the embodiments of this application. Therefore, those skilled in the art should clearly understand that various changes and modifications can be made to the embodiments described here without departing from the scope and spirit of this application. In addition, descriptions of known functions and structures are omitted for clarity and conciseness.

[0076] It should be understood that the "one embodiment" or "an embodiment" mentioned throughout the specification means that the specific features, structures or characteristics related to the embodiment are included in at least one embodiment of this application. Therefore, the "in one embodiment" or "in an embodiment" that appears throughout the specification does not necessarily refer to the same embodiment. In addition, these specific features, structures or characteristics can be combined in one or more embodiments in any suitable manner.

[0077] In various embodiments of this application, it should be understood that the size of the serial numbers of the following processes does not mean the order of execution, and the order of execution of each process should be determined by its function and internal logic, and should not constitute any limitation to the implementation process of the embodiments of this application.

[0078] The terms "first", "second", etc. in this application are used to distinguish similar objects, rather than to describe a specific order or sequence. It should be understood that such terms can be interchanged under appropriate circumstances, so that the embodiments of this application can be implemented in an order other than those illustrated or described here, and the objects distinguished by "first" and "second" are usually of the same category, and do not limit the number of objects. For example, the first object can be one or more. In addition, "or" in this application means at least one of the connected objects. For example, "A or B" covers three scenarios, namely, Scenario 1: including A and not including B; Scenario 2: including B and not including A; Scenario 3: including both A and B. The character " / " generally indicates that the related objects before and after are in an "or" relationship.

[0079] The term "indication" in this application can be either a direct indication (or an explicit indication) or an indirect indication (or an implicit indication). Among them, a direct indication can be understood as that the sender clearly informs the receiver of specific information, operations to be performed, or request results, etc. in the sent indication; an indirect indication can be understood as that the receiver determines the corresponding information according to the indication sent by the sender, or makes a judgment and determines the operations to be performed or request results, etc. according to the judgment result.

[0080] To solve the problems in the prior art that the prediction of the network state cannot provide accurate prediction results and it is difficult to give timely warnings, embodiments of the present invention provide a network traffic warning method, device, equipment, storage medium, and program product.

[0081] As Figure 1 shown, embodiments of the present invention provide a network traffic warning method, including:

[0082] Step 101: Obtain the real-time traffic data of the wide area network.

[0083] Among them, the traffic data includes at least one of the following:

[0084] Circuit identifier, where the circuit refers to the physical link of the communication network node;

[0085] Circuit bandwidth (kbps);

[0086] Average circuit inflow rate (kbps);

[0087] Average circuit outflow rate (kbps);

[0088] Data express service data;

[0089] Special time marking data of the traffic data;

[0090] Bidirectional delay (ms);

[0091] Bidirectional packet loss rate (%)

[0092] Bidirectional delay jitter (ms).

[0093] Among them, the data express service data includes relevant service record data such as the opening, closing, and monitoring of data transmission services, as well as path topology information.

[0094] The special time marking data of traffic data includes the peak dates of network transmission occurring regularly for each user, public holiday dates, and other periodic or predictable network transmission peak information, etc.

[0095] Among them, the circuit identifier, bidirectional delay (ms), bidirectional packet loss rate (%), and bidirectional delay jitter (ms) belong to network data information.

[0096] That is, the real-time traffic data includes at least one of the following:

[0097] Real-time circuit identifier

[0098] Real-time circuit bandwidth (kbps)

[0099] Real-time average incoming rate of the circuit (kbps)

[0100] Real-time average outgoing rate of the circuit (kbps)

[0101] Real-time data express service data

[0102] Special time marking data of real-time traffic data

[0103] Real-time bidirectional delay (ms)

[0104] Real-time bidirectional packet loss rate (%)

[0105] Real-time bidirectional delay jitter (ms).

[0106] Step 102: Input the real-time traffic data into a traffic prediction model to obtain predicted traffic data within the first duration after the current time output by the traffic prediction model; among them, the traffic prediction model is trained according to the historical traffic data of the wide area network.

[0107] Among them, the historical traffic data includes at least one of the following:

[0108] Historical circuit identifier

[0109] Historical circuit bandwidth (kbps)

[0110] Historical average incoming rate of the circuit (kbps)

[0111] Historical average outgoing rate of the circuit (kbps)

[0112] Historical data express service data;

[0113] Special time marking data of historical traffic data;

[0114] Historical round-trip delay (ms);

[0115] Historical round-trip packet loss rate (%);

[0116] Historical round-trip delay jitter (ms).

[0117] In this step, based on the historical traffic data of the wide area network, a traffic prediction model (or called link traffic prediction model) is constructed, which can be used to predict the traffic fluctuation situation within a future time window. Specifically, the real-time traffic data is input into the traffic prediction model to obtain the predicted traffic data within the first duration (i.e., the future time window) after the current time output by the traffic prediction model.

[0118] In the embodiment of the present invention, the traffic prediction model can more accurately predict the predicted traffic data within the first duration after the current time.

[0119] Step 103: Determine the broadband utilization warning threshold within the first duration after the current time according to the historical traffic data and the predicted traffic data.

[0120] After obtaining the above predicted traffic data, a dynamic threshold for broadband utilization warning (i.e., the broadband utilization warning threshold) is obtained according to the historical traffic data and the predicted traffic data, realizing the dynamic adjustment of the broadband utilization warning threshold.

[0121] Step 104: Perform network traffic warning according to the real-time broadband utilization of the wide area network and the broadband utilization warning threshold.

[0122] That is, in this step, during the data transmission process, when the real-time network bandwidth utilization reaches the broadband utilization warning threshold, an alarm notification is automatically initiated to ensure the efficiency and security of the massive data transmission and realize the timely warning of the data transmission link.

[0123] In an optional embodiment, the method further includes:

[0124] Obtain the historical traffic data of the wide area network within the second duration before the current time;

[0125] Perform data cleaning, data smoothing processing, and data interpolation processing on the historical traffic data to obtain the processed first data;

[0126] Use the first data to train the base model to obtain the traffic prediction model;

[0127] Among them, the second duration is determined by the first duration;

[0128] The first duration is determined according to the data transmission service of the wide area network and the link quality of the wide area network;

[0129] The data granularity of the historical traffic data is determined according to the second duration.

[0130] In this alternative embodiment, due to different service requirements and link qualities for data transmission, the required prediction window lengths are also different. That is, the first duration is determined according to the data transmission service requirements and the link quality.

[0131] According to the first duration, different historical data granularities are selected. That is, according to the first duration, the second duration is determined. For example, if it is necessary to predict the network traffic distribution in the next 5 hours, the input data of the system is required to provide historical traffic data for 7 days, with the effective data ratio not less than 80%, and the data granularity is 5 minutes. Among them, the division of the data granularity is determined according to the data granularity of the historical traffic data collection in the actual business, or it can be understood that the data granularity of the historical traffic data is determined according to the second duration.

[0132] A longer prediction length requires a longer historical training data. For an overly long historical training time, when the historical data time points are too long, it will significantly increase the model modeling duration and increase resource consumption. And too fine a time granularity will bring more noise to the long-term data. That is, the longer the first duration, the longer the second duration.

[0133] That is, according to the first duration, the determined second duration and data granularity are shown in Table 1 below.

[0134] Table 1

[0135]

[0136] In the embodiment of the present invention, when making a longer prediction length, a coarse-grained time granularity can be used as appropriate. For example, if it is necessary to predict the traffic fluctuations in the next 1 day - 7 days, at least the traffic data of the transmission link for more than 1 month in history is required, and the data collection granularity can be relaxed to 1 collection point per hour; if it is necessary to predict the traffic fluctuations in a larger range (such as 30 days), at least the traffic data of the transmission link for more than 90 days in history is required, and the data collection granularity can be relaxed to 1 collection point per day. Since the wide area network transmission data has periodic characteristics, when cleaning the data, it is cycled with a day as the period, and time points are marked for the obvious business peak periods and business trough periods.

[0137] In the embodiment of the present invention, taking the data granularity of the historical traffic data as 5 minutes as an example, the steps of cleaning the historical traffic data are described:

[0138] For data whose collection time point is not at the exact 5 - minute mark, round down the time to the nearest 5 - minute mark. Here, the 5 - minute mark refers to the minutes rounded to 5 minutes, such as 05 minutes, 10 minutes, 15 minutes of each hour.

[0139] Taking the data granularity of historical traffic data as 5 minutes as an example, the steps for data smoothing processing of historical traffic data are described as follows:

[0140] That is, for significantly abnormal historical traffic data, smoothing processing is required to remove the spike points. Specifically, for the historical traffic data arranged in time series that needs to be analyzed currently, its reasonable range is calculated using the improved box - plot method.

[0141] The basic box - plot calculates the 1 / 4 position point q1 and the 3 / 4 position point q3 of the data. The interpolation q3 - q1 between them is the interval value qr. Then the lower limit of the reasonable range is q1 - 1.5×qr, and the upper limit of the reasonable range is q3 + 1.5×qr. In the basic box - plot, the positions of q1 and q3 are calculated from all the data. However, the fluctuation range of wide - area network transmission data is large, and using all the data cannot well adapt to the data distribution characteristics. Therefore, in this optional embodiment, the method of obtaining q1 and q3 is modified as follows: remove the highest x% of the numerical values and the lowest y% of the numerical values from the historical traffic data. Then, use the 1 / 4 and 3 / 4 positions in the remaining data to calculate q1 and q3 respectively. After that, calculate the upper limit and lower limit of the reasonable range according to the algorithm in the basic box - plot. Optionally, the value of x% is set to 5% and the value of y% is set to 2%. For the data outside the reasonable range, mean filtering is adopted, that is, take the data within the reasonable range of the previous and next two data, and calculate their mean value for smoothing.

[0142] The following specifically describes the steps for data interpolation processing of historical traffic data:

[0143] Data sampling is an essential step in the wide - area network data transmission link traffic prediction and risk warning system. It helps to improve data processing efficiency, reduce model complexity, avoid over - fitting, and adapt to the requirements of different time granularities.

[0144] Based on the historical traffic data of the link used for data transmission, data sampling is performed at a 5 - minute granularity. For the missing values in the sampling, a data smoothing scheme is used for fitting interpolation to ensure the integrity of the data sample. At the same time, using the Multiple Instance Classification Evaluation (MICE) interpolation method for fitting interpolation can maintain the statistical characteristic law of the data sample.

[0145] In the embodiments of the present invention, when the proportion of missing values in the data set is 3%, the interpolation process is automatically triggered. Also, if the length of consecutive missing values in the data exceeds a certain set value, for example, the missing data of 3 or 5 consecutive time points, the interpolation is also automatically triggered. The missing value threshold is default set to 3%. The reason is that when the missing values exceed 3%, using the method of directly filling the missing data with forward interpolation will result in inaccurate filled data, thus affecting the result of the final time series model modeling prediction. The interpolation logic in this alternative embodiment is a data smoothing scheme, that is, for each data variable containing missing values, a simple univariate interpolation method (such as mean, median or regression interpolation) is used for initialization, and a regression model is established to predict the missing values. By comparing the mean squared error (MSE), root mean square error (RMSE), etc., the interpolation accuracy is quantitatively evaluated.

[0146] After performing data cleaning, data smoothing processing and data interpolation processing on the historical traffic data in the above specific manner, the obtained data is the first data, and the base model is trained using the first data to obtain the traffic prediction model.

[0147] Among them, the base model can be understood as the basic model or sub-model, and the traffic prediction model includes the trained base model and sub-model.

[0148] It should be noted that for the problem of differences in historical traffic data of different service types in data transmission in the network and various time granularities of network data collection, the embodiments of the present invention use the convolutional neural network (CNN) algorithm to extract features from the historical traffic data input to the system, judge the stationarity and periodicity of the traffic data, calculate the classification of data such as stationarity and periodicity, and output the classification probability result vector of the network data.

[0149] Optionally, training the base model using the first data to obtain the traffic prediction model includes:

[0150] Dividing the first data into channel input data of at least three channels, where the acquisition time intervals between the channel input data of any two adjacent channels are different.

[0151] It should be noted that the CNN algorithm is generally applied to image data processing. Usually, data with a multi-channel structure of two-dimensional vectors is input into the input layer. However, in the scenario of network data transmission, time series data is used, which is a single-channel structure of a one-dimensional vector. That is, the first data is a single-channel structure of a one-dimensional vector. It is necessary to perform preprocessing logic on the first data to convert the first data of time series data into a channel structure of two-dimensional vectors and then input it into the model input layer. The processing logic is as follows:

[0152] Taking the example of obtaining channel input data for three channels in the first data, data at three time points with different time intervals are obtained in the first data. For example, the data of the current day of a certain day, the data of the previous day of this day, and the data of the previous week of this day are respectively used as the channel input data for the three channels (i.e., the initial data for the three channels), and the expression is as follows:

[0153]

[0154] Among them, Channel represents the channel number, Data(T) represents the data of the current day, and Data(T - xd) represents the data with an interval of x days of data pushed forward from day T.

[0155] The channel input data for each channel is divided according to a preset sliding window to obtain channel segmentation data.

[0156] Among them, the length of the preset sliding window is L (L > 0), and the step size is S (S > 0). Taking the period granularity of the preset sliding window as 5 minutes as an example, the length of L means that for the first time, data for consecutive L time periods starting from 0:00 on the current day is taken. For the second time, starting from 0:00, after S time nodes of 5 minutes later, data for consecutive L time periods is taken again, and so on. Each piece of time series data segmented by the preset sliding window is a one-dimensional vector of the same length. In this embodiment, the length of L is 12 and S is 6, that is, data for 12 5-minute time periods (i.e., 1 hour) is taken as single-window data each time, and it slides to the next window at a distance of 6 5-minute (i.e., half an hour) intervals. For example, for the first time, data from 0:00 to 0:55 is taken, and for the second time, data from 0:30 to 1:25 is taken, and so on. The channel input data for each channel is divided according to the preset sliding window to obtain M pieces of data.

[0157] After the channel input data for each channel is divided into M pieces of data according to the preset sliding window, the one-dimensional vectors corresponding to the M pieces of data are combined into a two-dimensional vector of size L×M (i.e., the channel segmentation data corresponding to each channel). M = C / S, where C is the number of period granularities included in a day and S is the step size. Taking the period granularity of 5 minutes and the step size S of 6 as an example, the value of M is 48.

[0158] Using a convolutional neural network, feature extraction and statistical feature classification are performed on the channel-split data to obtain model input data.

[0159] That is, the above-mentioned vector data of L×M×3 (i.e., the channel-split data corresponding to three channels) is passed into the input layer of the CNN (where 3 is the number of channels), and the CNN algorithm is used for feature extraction and statistical feature classification to obtain model input data.

[0160] Using the model input data to train the base model to obtain the traffic prediction model.

[0161] Furthermore, using a convolutional neural network, feature extraction and statistical feature classification are performed on the channel-split data to obtain model input data, including:

[0162] Using the convolutional layer and pooling layer in the convolutional neural network CNN to perform feature extraction on the channel-split data to obtain feature data.

[0163] That is, in the embodiment of the present invention, a convolutional neural network CNN is used to classify and capture network data features. Specifically, the convolutional neural network CNN automatically extracts features from the time series of network traffic data through the convolutional layer and pooling layer to obtain feature data. The expression is as follows:

[0164]

[0165] Among them, f represents the time series data slice of the input historical traffic data (i.e., a channel-split data), g represents the convolutional kernel, n represents the time point of the currently analyzed time series (i.e., the time point corresponding to the channel-split data), and m is the mth sample point in the time series sample, that is, the mth channel-split data in the channel-split data corresponding to one channel.

[0166] Using the fully connected layer in the convolutional neural network CNN to perform statistical feature classification on the feature data to obtain the model input data.

[0167] That is, in the embodiment of the present invention, the convolutional neural network CNN performs statistical feature classification through the fully connected layer. Specifically, in the embodiment of the present invention, multiple fully connected layers are set, the extracted feature data is mapped to the label space of the sample, the prediction probability of each category is output, and the output is converted into a probability distribution through the softmax function to realize the probability prediction of the stationarity feature and periodic feature of the historical traffic data. The expression is as follows:

[0168] Result=[P1,P2,P3,…]

[0169] These traffic time series classification feature prediction probability result vectors will serve as the input components of the fusion algorithm model (i.e., the traffic prediction model) proposed in the embodiments of the present invention, that is, the model input data.

[0170] It should be noted that the traffic prediction model in the embodiments of the present invention involves multiple base models. Each base model needs to go through a model training process. Multiple base models trained in parallel using the Bootstrap Aggregating (Bagging) method, after model fusion, form the final integrated model (i.e., the traffic prediction model). In actual traffic prediction, the link traffic is predicted by allocating weights according to the time series classification results (input components) performed by the CNN to improve the prediction ability and generalization ability.

[0171] In an alternative embodiment, the base model includes multiple time series prediction models;

[0172] Training the base model using the model input data to obtain the traffic prediction model includes:

[0173] Training each of the time series prediction models using the model input data to obtain multiple trained time series prediction models;

[0174] Evaluating the models of the multiple trained time series prediction models to obtain the model evaluation results output by each of the trained time series prediction models;

[0175] Determining at least two target time series prediction models among the multiple time series prediction models according to the model evaluation results;

[0176] Obtaining the traffic prediction model according to the trained time series prediction model corresponding to each target time series prediction model and the weight value corresponding to each target time series prediction model.

[0177] That is, in this alternative embodiment, using the model input data, the optimal model is selected among multiple time series prediction models, and the traffic prediction model is obtained according to the selected optimal model (i.e., the target time series prediction model) and the corresponding weight value. That is, in this alternative embodiment, the optimal algorithm model is selected, and the process of selecting the optimal algorithm model is as follows:

[0178] The full - scale model input data is segmented into N subsets (N is a positive integer) using the piece - wise random sampling method, and the time lengths of each subset may not be equal. For example, the full - scale model input data contains all historical traffic data of a certain link in a certain month. When sampling, the data from the 1st to the 8th of this month can be used as subset 1, the 9th to the 12th as subset 2, and the remaining dates as subset 3. For each subset, M selected algorithms (i.e., M time - series prediction models, M is a positive integer) are used for training respectively, and N×M trained algorithm models (i.e., N×M trained time - series prediction models) are obtained.

[0179] Each trained algorithm model is used for model evaluation. Specifically, the 3 - fold cross - validation method is used to evaluate the prediction performance of each algorithm model, and the mean squared error (MSE) of each algorithm model is calculated. When the training data is sufficient, 5 - fold or 10 - fold cross - validation methods can be used to improve the model training accuracy. Using the softmax function, the product of the MSE value of each algorithm model and the CNN classification result is converted into a weight value W that is distributed between 0 and 1 and has a sum of 1. According to the weight results calculated by the softmax function for each algorithm model, they are sorted in descending order, and the top N models are selected. These are the target time - series prediction models. In this embodiment, the value of N is set to 3.

[0180] After obtaining the three target time - series prediction models, corresponding weight values are set for each target time - series prediction model, and they are fused according to the weight values and the trained time - series prediction models to obtain the traffic prediction model.

[0181] It should also be noted that, optionally, multiple algorithm models can be trained in parallel based on different algorithms, and the evaluation metrics (such as MSE) of each model are compared. The P worst - performing algorithm models are removed from the model options. In this embodiment, the value of P is 2. The algorithm selection should cover as many mainstream time - series prediction - related algorithms in the industry as possible, at least more than 8 kinds, such as Prophet, LSTM, Arima, etc.

[0182] Through the model evaluation process in model self - verification, the best model fusion scheme is identified. The fused model is deployed to replace the original model.

[0183] Furthermore, the target time - series prediction model includes:

[0184] A time - series prediction additive model, taking NeuralProphet as an example;

[0185] A prediction model combining a recurrent neural network and an attention mechanism, taking TimesNet as an example;

[0186] A machine learning model based on gradient boosting, taking LightGBMProphet as an example.

[0187] It should be noted that in the embodiments of the present invention, NeuralProphet, TimesNet, and LightGBMProphet are used as the base models and other traffic prediction algorithms to be fused to obtain the base algorithm models of multiple traffic prediction algorithms. The above three base models are only selected from the perspective commonly used in time series prediction scenarios, and can also be replaced with other commonly used time series algorithms such as Long Short-Term Memory (LSTM), Prophet, and Autoregressive Integrated Moving Average Model (Arima). Generally, it is necessary to ensure that the number of base models is greater than or equal to 3 to facilitate subsequent screening and fusion according to the actual effects of the models.

[0188] In an optional embodiment, inputting the real-time traffic data into the traffic prediction model to obtain the predicted traffic data within the first time period after the current time output by the traffic prediction model includes:

[0189] Inputting the real-time traffic data into the time series prediction additive model to obtain a first prediction result output by the time series prediction additive model;

[0190] Inputting the real-time traffic data into the prediction model combining a recurrent neural network and an attention mechanism to obtain a second prediction result output by the prediction model combining a recurrent neural network and an attention mechanism;

[0191] Inputting the real-time traffic data into the machine learning model based on gradient boosting to obtain a third prediction result output by the machine learning model based on gradient boosting;

[0192] According to the first prediction result, the first weight value corresponding to the time series prediction additive model, the second prediction result, the second weight value corresponding to the prediction model combining a recurrent neural network and an attention mechanism, the third prediction result, and the third weight value corresponding to the machine learning model based on gradient boosting, obtain the predicted traffic data within the first time period after the current time output by the traffic prediction model.

[0193] It should be noted that NeuralProphet is an additive model that comprehensively considers time series trends, periodic trends, sporadic fluctuations, etc. Therefore, it can be used for the comprehensive prediction of the periodic and non-periodic fluctuation components of the traffic on the link. The formula of the model is as follows:

[0194] y(t) = Trend(t) + Seasonal(t) + Holiday(t) + ∈(t)

[0195] Among them, y(t) represents the value of the time series at time point t; Trend(t) represents the trend component of the time series; Seasonal(t) represents the seasonal component of the time series; Holiday(t) represents the holiday effect; ∈(t) represents the error term.

[0196] In the scenario of a high-speed data transmission network, the trend change of network traffic data is relatively obvious. Therefore, a relatively small value needs to be passed for the trend_reg parameter corresponding to Trend(t), and the default setting is 0.05. For transmission lines with insignificant seasonal changes, the parameter values related to Seasonal(t) can all be default set to False. Since holidays have a greater impact on data, the peak network transmission dates in each month, holiday dates such as National Day, and dates that are not holidays but are prone to network transmission peaks such as Double Eleven can all be used as parameters related to Holiday(t) and input into the model.

[0197] Input the above real-time traffic data into the trained NeuralProphet to obtain the first prediction result output by the trained NeuralProphet.

[0198] It should be noted that TimesNet refers to a prediction model that combines a recurrent neural network (RNN) and an attention mechanism. Its advantage is that it can keenly capture the long-term dependencies and important time points in time series data. Therefore, it is accurate in predicting periodic fluctuations in a long time range. Therefore, among the CNN classification results, the link traffic with a higher periodic weight has a higher weight for the TimesNet model. The formula of the recurrent layer of TimesNet is expressed as follows:

[0199] h t = tanh(W h ·h t -1 + W x ·x t + b h )

[0200] Among them, h t represents the hidden state at time step t; W h represents the weight matrix from the hidden state to the hidden state; W x represents the weight matrix from the input to the hidden state; b h represents the bias vector of the hidden state; x t represents the input of the network traffic time series data value at time step t.

[0201] The attention mechanism of TimesNet is expressed as follows:

[0202] αt = softmax(s t )

[0203] s t = score(h t , h s )

[0204]

[0205] where α t represents the attention weight at time step t; s t represents the attention score, which is calculated using the following formula:

[0206]

[0207] where W a , U a represent learnable parameter matrices; c t represents the context vector, which is a weighted sum of all hidden states h s .

[0208] The output layer of TimesNet is represented as follows:

[0209]

[0210] where represents the predicted value of the network traffic at time step t; W o represents the weight matrix of the output layer; b o represents the bias of the output layer.

[0211] Input the real-time traffic data into the trained TimesNet to obtain the second prediction result output by the trained TimesNet.

[0212] It should be noted that LightGBMProphet is a machine learning model based on gradient boosting, which is sensitive to short-term non-periodic fluctuations of link traffic. Therefore, in the CNN classification results, link traffic with a higher non-periodic weight has a higher weight for the LightGBMProphet model. Its loss function algorithm is represented as:

[0213]

[0214] where y represents the true value of the time series traffic data, represents the predicted value of the time series traffic data.

[0215] The process of gradient boosting of LightGBMProphet can be represented as:

[0216] F m F(x) = F m-1 (x) + α·f m (x)

[0217] Among them, F m (x) represents the model after the m-th iteration, F m-1 (x) represents the model after the (m - 1)-th iteration, ·f m (x) represents the decision tree trained in the m-th iteration, and α represents the learning rate.

[0218] The LightGBMProphet decision tree generates rules by splitting features. Each split point s can be expressed as:

[0219] s = {x | x j ≤ c}

[0220] Among them, x j represents the value of feature j, and c represents the split threshold.

[0221] To find the best split point, LightGBMProphet uses the information gain, which is defined as:

[0222]

[0223] Among them, D represents the data set, D s represents the data subset that satisfies the split condition s, and L(D) represents the loss of the data set D.

[0224] Input the above real-time traffic data into the trained LightGBMProphet to obtain the third prediction result output by the trained LightGBMProphet.

[0225] According to the first prediction result, the first weight value corresponding to the first prediction result, the second prediction result, the second weight value corresponding to the second prediction result, the third prediction result, and the third weight value corresponding to the third prediction result, obtain the predicted traffic data within the first time period after the current time output by the traffic prediction model. The formula for the final predicted traffic data is as follows:

[0226] g(z) = ∑ n W n × f n (z)

[0227] Among them, z represents the time point, W represents the weight value, n represents the base model serial number, and f(z) represents the predicted traffic data at the z time point using the base model.

[0228] It should also be noted that in the traffic prediction model, the self-verification of the model is a key link to ensure the matching degree between the prediction accuracy of the model and the business requirements. In this embodiment, it is proposed that the newly collected traffic data every day will be added as new samples to the model evaluation, and then the model will be retrained to ensure that the model accuracy meets the accuracy requirements of business prediction. The key process of model self-verification is as follows:

[0229] Data collection: Regularly collect real-time traffic data from the network every day;

[0230] Data cleaning: Clean the collected data, including removing outliers, filling in missing values, and adjusting it to the model training format.

[0231] Calculate the existing model on each evaluation index (except using the mean square error MSE, other indexes such as the mean absolute error (MAE) can also be used) with the new data samples, convert the evaluation indexes of each model into weight values distributed between 0 and 1 and summing to 1 using the Softmax function, and identify the models with weights lower than the threshold T through the threshold T. In this embodiment, the threshold T is set to 0.1.

[0232] Furthermore, the method further includes:

[0233] Adjust the model parameters of at least one of the time series prediction additive model, the prediction model combining the recurrent neural network and the attention mechanism, and the machine learning model based on gradient boosting by using the real-time traffic data of the wide area network and the predicted traffic data output by the traffic prediction model;

[0234] And / or,

[0235] Adjust at least one of the first weight value, the second weight value, and the third weight value by using the real-time traffic data of the wide area network and the predicted traffic data output by the traffic prediction model.

[0236] It should be noted that in this alternative embodiment, it is necessary to continuously monitor the system performance, including the prediction accuracy of the model, the system response time, etc. According to the monitoring results and user feedback, regularly adjust the model parameters or introduce new model algorithms to continuously improve the system performance.

[0237] Specifically, when optimizing the model, the real-time traffic data of the collection network is monitored in real time, and the model is continuously updated according to the new data set. At the same time, according to the changes in the network traffic characteristics, the fusion strategy and model weights are dynamically adjusted to maintain the prediction accuracy. That is, according to the real-time traffic data, adjust the model parameters of at least one of the above basic models, and / or adjust at least one of the weight values.

[0238] In the embodiments of the present invention, through dynamic adjustment and continuous optimization, the Bagging fusion algorithm can adapt to the changing characteristics of network traffic and provide reliable prediction support for wide area network data transmission.

[0239] The following will describe Figure 2 , the training process of the traffic prediction model:

[0240] Perform data cleaning on historical traffic data, data express business data, and special time marker data; then perform data augmentation processing (i.e., data interpolation processing); perform CNN time series classification, that is, use the CNN algorithm for feature extraction and statistical feature classification; perform algorithm selection, that is, determine the base model; perform model fusion on the prediction results of the base model; obtain the traffic allocation result, that is, obtain the predicted traffic data.

[0241] The traffic prediction model has a self-checking function and can retrain the model according to data changes to generate a new traffic prediction model to cope with the complex scenarios of diverse links.

[0242] The following will describe Figure 3 , the optimization process of the traffic prediction model in detail:

[0243] Obtain the real-time traffic data of the wide area network; perform data preprocessing on the real-time traffic data, and the data preprocessing includes data collection and data cleaning; use the processed real-time traffic data to optimize the traffic prediction model, and the process of this model optimization includes algorithm model selection (model selection), multi-model training, and fusion deployment; perform monitoring and optimization on the real-time traffic data, including real-time monitoring, feedback adjustment, and dynamic optimization.

[0244] In an optional embodiment, determining the broadband utilization warning threshold within the first duration after the current time according to the historical traffic data and the predicted traffic data includes:

[0245] Obtain the historical broadband utilization upper limit threshold and the historical broadband utilization lower limit threshold according to the historical traffic data;

[0246] Specifically, according to the fluctuation of the historical traffic data, the historical broadband utilization upper limit threshold T u and the historical broadband utilization lower limit threshold T l can be calculated.

[0247] Among them, the calculation formula of the historical broadband utilization upper limit threshold T u is as follows:

[0248] T u = Mean + k × SD

[0249] Among them, Mean represents the average value of the historical bandwidth utilization rate, which is determined according to the historical traffic data; SD represents the standard deviation of the historical bandwidth utilization rate, which is determined according to the historical traffic data; k represents an adjustable coefficient, for example, k = 3 is taken.

[0250] Lower threshold T of historical bandwidth utilization rate l The calculation formula is as follows:

[0251] T l = Mean – k × SD

[0252] Among them, Mean represents the average value of the historical bandwidth utilization rate, which is determined according to the historical traffic data; SD represents the standard deviation of the historical bandwidth utilization rate, which is determined according to the historical traffic data; k represents an adjustable coefficient, for example, k = 3 is taken.

[0253] According to the predicted traffic data, obtain the broadband utilization rate within the first duration after the current time, that is, use the predicted traffic data to predict and calculate the bandwidth utilization rate U for a period of time in the future p .

[0254] According to the broadband utilization rate and the obtained real-time broadband utilization rate, obtain the dynamic adjustment factor A f , and the specific formula is as follows:

[0255] A f = U p / U c

[0256] Among them, U p represents the bandwidth utilization rate for a period of time in the future predicted by the prediction model; U c represents the current bandwidth utilization rate.

[0257] According to the upper threshold of the historical bandwidth utilization rate, the lower threshold of the historical bandwidth utilization rate, and the dynamic adjustment factor, obtain the broadband utilization rate alarm threshold D t , and the specific formula is as follows:

[0258] D t = T l + A f × (T u – T l )

[0259] When the current broadband utilization rate exceeds the broadband utilization rate alarm threshold D t , trigger the early warning mechanism and notify the operation and maintenance system in real time that there is a network anomaly.

[0260] The embodiment of the present invention performs learning and training based on historical network traffic data, and dynamically adjusts the early warning threshold to more accurately reflect the current network state.

[0261] Specifically, the embodiments of the present invention predict network traffic, network load, network quality, and network bandwidth utilization within a future period of time. Combining with the fluctuation of data, according to the prediction analysis results of non-linear characteristics such as data seasonality and holiday effects, the bandwidth utilization threshold is dynamically adjusted, thereby effectively improving the stability of the system.

[0262] The following combines Figure 4 to specifically illustrate the overall process of network traffic prediction and risk warning provided by the embodiments of the present invention:

[0263] Perform data preprocessing on historical traffic data, historical network quality data, data express business data, and special time mark data, including data cleaning, data smoothing processing, and data interpolation processing; use the processed data to train a traffic prediction model to obtain a traffic prediction model, and then obtain the traffic distribution result (i.e., predicted traffic data) output by the traffic prediction model; and use the predicted traffic data to input a dynamic alarm monitoring model to obtain the broadband utilization alarm threshold (i.e., dynamic alarm threshold) output by the dynamic alarm monitoring model. This system can accurately predict the link traffic fluctuation within a future time window, and during the data transmission process, when the network bandwidth utilization reaches the threshold, an alarm notification is automatically initiated to ensure the efficiency and security of massive data transmission.

[0264] The traffic transmission and warning system of the embodiments of the present invention can serve the requirements of high-speed data transmission services, realize real-time perception of the network quality of the transmission link and monitoring and warning of the operating state, ensure the stable and efficient data transmission, and provide decision support for the service scheduling of high-data transmission. The input data of this system includes historical traffic data, historical network quality data (such as network delay, packet loss rate, etc.), data transmission service data, and special time point marks. After the original data is preprocessed and sorted into a data format that meets the model requirements, a fusion model that comprehensively uses statistical models, deep neural network time series classification algorithms, and various time series prediction algorithms is used to perceive the traffic distribution law and dynamic alarm threshold of each data transmission link respectively, and output the traffic prediction result and dynamic alarm threshold within a specified time window. The output of the embodiments of the present invention can support relevant business personnel and system platforms related to data transmission to formulate transmission strategies and implement traffic optimization control.

[0265] The model learning and training in the embodiments of the present invention include traffic prediction model training and dynamic threshold generation model learning and training. The traffic prediction model is a multi-algorithm fusion model based on statistical models, deep neural network time series classification algorithms, time series prediction algorithms, etc. It learns and trains through historical network traffic data and network quality data, combines network data to accurately predict the network traffic within a specified period, and outputs predicted traffic sequence data. The dynamic threshold generation model learns and trains based on historical network traffic data and network quality data. The trained model dynamically outputs warning thresholds according to the real-time network traffic and quality to accurately reflect the current network state and trigger precise real-time network warnings.

[0266] In addition to the ability to monitor the comprehensive traffic and comprehensive bandwidth utilization rate of the wide area network, the embodiments of the present invention can also monitor multi-dimensional network quality indicators such as the network transmission delay, packet loss rate, jitter, etc. of different service links in real time, and comprehensively evaluate the health status of the network and each service link. The implementation method is as follows:

[0267] The embodiments of the present invention support setting independent warning thresholds for each monitoring indicator such as transmission delay, packet loss rate, jitter, etc.;

[0268] The embodiments of the present invention support flexible configuration of single-index rules and comprehensive-index rules for transmission delay, packet loss rate, jitter, etc. (such as combinations of different index types of transmission delay, packet loss rate, jitter, etc., and the weight ratios of each index in the combination), and based on the warning model with configurable rules, a warning is triggered when any rule exceeds the threshold;

[0269] The embodiments of the present invention support customizing warning rules and weights to meet the requirements of different business scenarios.

[0270] Embodiments of the present invention aim to achieve real-time monitoring of network status and in-depth analysis of traffic data. The system is based on multi-model fusion prediction technology and has accurate traffic prediction capabilities, thereby optimizing network resource allocation in data transmission service scenarios and reducing data transmission interruptions or delays caused by traffic fluctuations. The system also has a risk warning function. Through innovative dynamic network traffic warning threshold adjustment capabilities, it can timely identify potential network risks and abnormal behaviors, and notify the system and operation and maintenance personnel in advance through the warning mechanism, so as to quickly respond and effectively control risks, enhancing the security and stability of the data transmission link. Based on the requirements of data transmission services, it can perceive the network status in real time and provide link traffic prediction and abnormal active warning for the data transmission network. It maximizes the use of network bandwidth resources for data transmission, avoids network congestion, and ensures the efficiency, stability, and reliability of massive data transmission. Through real-time network quality monitoring of the data transmission link, combined with link traffic prediction and risk warning, it assists in intelligent path adjustment, transmission strategy decision-making, and network resource allocation for data transmission services, realizes transmission load balancing, improves the transmission efficiency and throughput of high-speed data transmission networks, and reduces operating costs at the same time.

[0271] As Figure 5 shown, embodiments of the present invention further provide a network traffic warning device, including:

[0272] The first acquisition module 501 is used to acquire real-time traffic data of the wide area network;

[0273] The first processing module 502 is used to input the real-time traffic data into the traffic prediction model to obtain predicted traffic data within the first time period after the current time output by the traffic prediction model; wherein, the traffic prediction model is trained according to the historical traffic data of the wide area network;

[0274] The second processing module 503 is used to determine the broadband utilization warning threshold within the first time period after the current time according to the historical traffic data and the predicted traffic data;

[0275] The third processing module 504 is used to perform network traffic warning according to the real-time broadband utilization rate of the wide area network and the broadband utilization warning threshold.

[0276] Optionally, the device further includes:

[0277] The second acquisition module is used to acquire historical traffic data of the wide area network within the second time period before the current time;

[0278] The fourth processing module is used to perform data cleaning, data smoothing processing, and data interpolation processing on the historical traffic data to obtain the processed first data;

[0279] The fifth processing module is used to train the base model with the first data to obtain the traffic prediction model;

[0280] Wherein, the second duration is determined by the first duration;

[0281] The first duration is determined according to the data transmission service requirements of the wide area network and the link quality of the wide area network;

[0282] The data granularity of the historical traffic data is determined according to the second duration.

[0283] Optionally, the traffic data includes at least one of the following:

[0284] Circuit identifier;

[0285] Circuit bandwidth;

[0286] Average inflow rate of the circuit;

[0287] Average outflow rate of the circuit;

[0288] Data express service data;

[0289] Special time marking data of traffic data;

[0290] Round-trip delay;

[0291] Round-trip packet loss rate;

[0292] Round-trip delay jitter.

[0293] Optionally, the fifth processing module includes:

[0294] The first acquisition unit is used to acquire channel input data of at least three channels in the first data, wherein the acquisition time interval between the channel input data of any two adjacent channels is different;

[0295] The first processing unit is used to divide the channel input data of each channel according to a preset sliding window to obtain channel segmentation data;

[0296] The second processing unit is used to extract features and classify statistical features of the channel segmentation data by using a convolutional neural network to obtain model input data;

[0297] The third processing unit is used to train the base model with the model input data to obtain the traffic prediction model.

[0298] Optionally, the second processing unit is specifically used for:

[0299] Using the convolutional layer and pooling layer in the convolutional neural network, feature extraction is performed on the channel-split data to obtain feature data;

[0300] Using the fully connected layer in the convolutional neural network, statistical feature classification is performed on the feature data to obtain the model input data.

[0301] Optionally, the base model includes multiple time series prediction models;

[0302] The third processing unit is specifically configured to:

[0303] Using the model input data to train each of the time series prediction models to obtain multiple trained time series prediction models;

[0304] Performing model evaluation on the multiple trained time series prediction models to obtain the model evaluation results output by each of the trained time series prediction models;

[0305] According to the model evaluation results, determining at least two target time series prediction models among the multiple time series prediction models;

[0306] According to the trained time series prediction model corresponding to each target time series prediction model and the weight value corresponding to each target time series prediction model, the traffic prediction model is obtained.

[0307] Optionally, the target time series prediction models include: a time series prediction additive model, a prediction model combining a recurrent neural network and an attention mechanism, and a machine learning model based on gradient boosting;

[0308] The first processing module 502 includes:

[0309] The fourth processing unit is configured to input the real-time traffic data into the time series prediction additive model to obtain a first prediction result output by the time series prediction additive model;

[0310] The fifth processing unit is configured to input the real-time traffic data into the prediction model combining a recurrent neural network and an attention mechanism to obtain a second prediction result output by the prediction model combining a recurrent neural network and an attention mechanism;

[0311] The sixth processing unit is configured to input the real-time traffic data into the machine learning model based on gradient boosting to obtain a third prediction result output by the machine learning model based on gradient boosting;

[0312] A seventh processing unit, configured to obtain predicted traffic data within a first duration after the current time output by the traffic prediction model according to the first prediction result, the first weight value corresponding to the time series prediction additive model, the second prediction result, the second weight value corresponding to the prediction model combining a recurrent neural network and an attention mechanism, the third prediction result, and the third weight value corresponding to the machine learning model based on gradient boosting.

[0313] Optionally, the apparatus further includes: a sixth processing module;

[0314] The sixth processing module is configured to:

[0315] Adjust model parameters of at least one of the time series prediction additive model, the prediction model combining a recurrent neural network and an attention mechanism, and the machine learning model based on gradient boosting by using real-time traffic data of a wide area network and the predicted traffic data output by the traffic prediction model; [[ID=ll]]

[0316] And / or,

[0317] Adjust at least one of the first weight value, the second weight value, and the third weight value by using real-time traffic data of a wide area network and the predicted traffic data output by the traffic prediction model.

[0318] Optionally, the second processing module includes:

[0319] An eighth processing unit, configured to obtain a historical upper bandwidth utilization threshold and a historical lower bandwidth utilization threshold according to the historical traffic data;

[0320] A ninth processing unit, configured to obtain the bandwidth utilization within the first duration after the current time according to the predicted traffic data;

[0321] A tenth processing unit, configured to obtain a dynamic adjustment factor according to the bandwidth utilization and the obtained real-time bandwidth utilization;

[0322] An eleventh processing unit, configured to obtain the bandwidth utilization warning threshold according to the historical upper bandwidth utilization threshold, the historical lower bandwidth utilization threshold, and the dynamic adjustment factor.

[0323] It should be noted that the network traffic warning device provided in the embodiments of the present invention can execute the device for the above-mentioned network traffic warning method, and all embodiments of the above-mentioned network traffic warning method are applicable to this device and can achieve the same or similar technical effects.

[0324] Such as Figure 6As shown in the figure, an embodiment of the present invention further provides a network traffic warning device, including: a processor 601; and a memory 603 connected to the processor 601 through a bus interface 602. The memory 603 is used to store the programs and data used by the processor 601 when performing operations, and the processor 601 calls and executes the programs and data stored in the memory 603.

[0325] Wherein, the transceiver 604 is connected to the bus interface 602 and is used to receive and send data under the control of the processor 601. Specifically, the processor 601 is used to read the programs in the memory 603 and perform the following processes:

[0326] Obtain the real-time traffic data of the wide area network;

[0327] Input the real-time traffic data into a traffic prediction model to obtain the predicted traffic data within the first duration after the current time output by the traffic prediction model; wherein, the traffic prediction model is trained according to the historical traffic data of the wide area network;

[0328] Determine the broadband utilization warning threshold within the first duration after the current time according to the historical traffic data and the predicted traffic data;

[0329] Perform network traffic warning according to the real-time broadband utilization rate of the wide area network and the broadband utilization warning threshold.

[0330] Optionally, the processor 601 is further used to:

[0331] Obtain the historical traffic data of the wide area network within the second duration before the current time;

[0332] Perform data cleaning, data smoothing processing and data interpolation processing on the historical traffic data to obtain the processed first data;

[0333] Use the first data to train a base model to obtain the traffic prediction model;

[0334] Wherein, the second duration is determined by the first duration;

[0335] The first duration is determined according to the data transmission service requirements of the wide area network and the link quality of the wide area network;

[0336] The data granularity of the historical traffic data is determined according to the second duration.

[0337] Optionally, the traffic data includes at least one of the following:

[0338] Circuit identifier;

[0339] Circuit bandwidth;

[0340] Average circuit inflow rate;

[0341] Average circuit outflow rate;

[0342] Data of the data express service;

[0343] Special time marking data of traffic data;

[0344] Round-trip delay;

[0345] Round-trip packet loss rate;

[0346] Round-trip delay jitter.

[0347] Optionally, the processor 601 is configured to:

[0348] Obtain channel input data of at least three channels from the first data, where the acquisition time intervals between the channel input data of any two adjacent channels are different;

[0349] Divide the channel input data of each channel according to a preset sliding window to obtain channel segmentation data;

[0350] Use a convolutional neural network to perform feature extraction and statistical feature classification on the channel segmentation data to obtain model input data;

[0351] Use the model input data to train the base model to obtain the traffic prediction model.

[0352] Optionally, the processor 601 is specifically configured to:

[0353] Use the convolutional layer and pooling layer in the convolutional neural network to perform feature extraction on the channel segmentation data to obtain feature data;

[0354] Use the fully connected layer in the convolutional neural network to perform statistical feature classification on the feature data to obtain the model input data.

[0355] Optionally, the base model includes multiple time series prediction models;

[0356] The processor 601 is specifically configured to:

[0357] Use the model input data to train each of the time series prediction models to obtain multiple trained time series prediction models;

[0358] Perform model evaluation on the multiple trained time series prediction models to obtain the model evaluation results output by each of the trained time series prediction models;

[0359] Determine at least two target time series prediction models among the multiple time series prediction models according to the model evaluation results;

[0360] Obtain the traffic prediction model according to the trained time series prediction model corresponding to each target time series prediction model and the weight value corresponding to each target time series prediction model.

[0361] Optionally, the target time series prediction models include: a time series prediction additive model, a prediction model combining a recurrent neural network and an attention mechanism, and a machine learning model based on gradient boosting;

[0362] The processor 601 is specifically configured to:

[0363] Input the real-time traffic data into the time series prediction additive model to obtain a first prediction result output by the time series prediction additive model;

[0364] Input the real-time traffic data into the prediction model combining a recurrent neural network and an attention mechanism to obtain a second prediction result output by the prediction model combining a recurrent neural network and an attention mechanism;

[0365] Input the real-time traffic data into the machine learning model based on gradient boosting to obtain a third prediction result output by the machine learning model based on gradient boosting;

[0366] According to the first prediction result, the first weight value corresponding to the time series prediction additive model, the second prediction result, the second weight value corresponding to the prediction model combining a recurrent neural network and an attention mechanism, the third prediction result, and the third weight value corresponding to the machine learning model based on gradient boosting, obtain the predicted traffic data within the first time period after the current time output by the traffic prediction model.

[0367] Optionally, the processor 601 is further configured to:

[0368] Use the real-time traffic data of the wide area network and the predicted traffic data output by the traffic prediction model to adjust the model parameters of at least one of the time series prediction additive model, the prediction model combining a recurrent neural network and an attention mechanism, and the machine learning model based on gradient boosting;

[0369] and / or,

[0370] Use the real-time traffic data of the wide area network and the predicted traffic data output by the traffic prediction model to adjust at least one of the first weight value, the second weight value, and the third weight value.

[0371] Optionally, the processor 601 is configured to:

[0372] Obtain the upper threshold value and the lower threshold value of the historical bandwidth utilization rate according to the historical traffic data;

[0373] Obtain the broadband utilization rate within the first time period after the current time according to the predicted traffic data;

[0374] Obtain a dynamic adjustment factor according to the broadband utilization rate and the obtained real-time broadband utilization rate;

[0375] Obtain the broadband utilization rate alarm threshold according to the upper threshold value of the historical bandwidth utilization rate, the lower threshold value of the historical bandwidth utilization rate and the dynamic adjustment factor.

[0376] Wherein, in Figure 6 The bus architecture may include any number of interconnected buses and bridges, specifically various circuits of one or more processors represented by the processor 601 and the memory represented by the memory 603 are linked together. The bus architecture can also link together various other circuits such as peripheral devices, voltage regulators, and power management circuits, etc., which are well known in the art, so they will not be further described herein. The bus interface provides the user interface 605. The transceiver 604 can be multiple components, that is, including a transmitter and a receiver, and provides a unit for communicating with various other devices on the transmission medium. The processor 601 is responsible for managing the bus architecture and general processing, and the memory 603 can store the data used by the processor 601 when executing operations.

[0377] In addition, a specific embodiment of the present invention further provides a readable storage medium, on which a computer program is stored, wherein when the program is executed by a processor, the steps in the network traffic warning method described in any one of the above are implemented.

[0378] In several embodiments provided by the present application, it should be understood that the disclosed methods and devices can be implemented in other ways. For example, the device embodiments described above are only illustrative. For example, the division of the units is only a logical function division, and there may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point, the displayed or discussed couplings or direct couplings or communication connections to each other can be through some interfaces, and the indirect couplings or communication connections of the devices or units can be in electrical, mechanical or other forms.

[0379] In addition, in each embodiment of the present invention, the functional units can be integrated in a processing unit, or each unit can be physically included separately, or two or more units can be integrated in one unit. The above integrated unit can be implemented in the form of hardware, or in the form of a hardware plus software functional unit.

[0380] The integrated units implemented in the form of software functional units can be stored in a computer-readable storage medium. The above-mentioned software functional units are stored in a storage medium, including several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to execute some steps of the resource selection method described in various embodiments of the present invention, or to execute some steps of the information sending method described in various embodiments of the present invention. The aforementioned storage medium includes: various media such as USB flash drives, mobile hard disks, read-only memories (ROM), random access memories (RAM), magnetic disks, or optical discs that can store program codes.

[0381] Specific embodiments of the present invention further provide a computer program product, including computer instructions, which when executed by a processor, implement each process of the method embodiments as described above Figure 1 and can achieve the same technical effects. To avoid repetition, it will not be elaborated here.

[0382] The above are the preferred embodiments of the present invention. It should be noted that for those of ordinary skill in the art, several improvements and refinements can be made without departing from the principle described in the present invention, and these improvements and refinements are also within the protection scope of the present invention.

Claims

1. A network traffic warning method, characterized in that, It includes: Obtain the real-time traffic data of the wide area network; Input the real-time traffic data into a traffic prediction model to obtain the predicted traffic data within the first time period after the current time output by the traffic prediction model; wherein, the traffic prediction model is trained according to the historical traffic data of the wide area network; Determine the broadband utilization warning threshold within the first time period after the current time according to the historical traffic data and the predicted traffic data; Perform network traffic warning according to the real-time broadband utilization of the wide area network and the broadband utilization warning threshold.

2. The method according to claim 1, wherein The method further includes: Obtain the historical traffic data of the wide area network within the second time period before the current time; Perform data cleaning, data smoothing processing and data interpolation processing on the historical traffic data to obtain the processed first data; Use the first data to train a base model to obtain the traffic prediction model; Wherein, the second time period is determined by the first time period; The first time period is determined according to the data transmission service requirements of the wide area network and the link quality of the wide area network; The data granularity of the historical traffic data is determined according to the second time period.

3. The method according to claim 1 or 2, characterized in that, The traffic data includes at least one of the following: Circuit identifier; Circuit bandwidth; Average circuit inflow rate; Average circuit outflow rate; Data express service data; Special time marking data of traffic data; Round-trip delay; Round-trip packet loss rate; Round-trip delay jitter.

4. The method according to claim 2, wherein Using the first data to train a base model to obtain the traffic prediction model includes: Obtain channel input data of at least three channels in the first data, wherein the acquisition time intervals between the channel input data of any two adjacent channels are different; Divide the channel input data of each channel according to a preset sliding window to obtain channel segmentation data; Use a convolutional neural network to perform feature extraction and statistical feature classification on the channel segmentation data to obtain model input data; Use the model input data to train the base model to obtain the traffic prediction model.

5. The method according to claim 4, characterized in that, Using a convolutional neural network to perform feature extraction and statistical feature classification on the channel segmentation data to obtain model input data includes: Use the convolutional layer and pooling layer in the convolutional neural network to perform feature extraction on the channel segmentation data to obtain feature data; Use the fully connected layer in the convolutional neural network to perform statistical feature classification on the feature data to obtain the model input data.

6. The method according to claim 4, characterized in that The base model includes multiple time series prediction models; Using the model input data to train the base model to obtain the traffic prediction model includes: Use the model input data to train each time series prediction model to obtain multiple trained time series prediction models; Perform model evaluation on the multiple trained time series prediction models to obtain the model evaluation results output by each trained time series prediction model; According to the model evaluation results, determine at least two target time series prediction models among the multiple time series prediction models; Based on the trained time series prediction models corresponding to each of the target time series prediction models and the weight values corresponding to each of the target time series prediction models, the traffic prediction model is obtained.

7. The method according to claim 6, wherein The target time series prediction models include: a time series prediction additive model, a prediction model combining a recurrent neural network and an attention mechanism, and a machine learning model based on gradient boosting. Inputting the real-time traffic data into the traffic prediction model to obtain the predicted traffic data within the first duration after the current time output by the traffic prediction model, including: Inputting the real-time traffic data into the time series prediction additive model to obtain a first prediction result output by the time series prediction additive model; Inputting the real-time traffic data into the prediction model combining a recurrent neural network and an attention mechanism to obtain a second prediction result output by the prediction model combining a recurrent neural network and an attention mechanism; Inputting the real-time traffic data into the machine learning model based on gradient boosting to obtain a third prediction result output by the machine learning model based on gradient boosting; Based on the first prediction result, the first weight value corresponding to the time series prediction additive model, the second prediction result, the second weight value corresponding to the prediction model combining a recurrent neural network and an attention mechanism, the third prediction result, and the third weight value corresponding to the machine learning model based on gradient boosting, the predicted traffic data within the first duration after the current time output by the traffic prediction model is obtained.

8. The method according to claim 7, wherein The method further includes: Using the real-time traffic data of the wide area network and the predicted traffic data output by the traffic prediction model to adjust the model parameters of at least one of the time series prediction additive model, the prediction model combining a recurrent neural network and an attention mechanism, and the machine learning model based on gradient boosting; and / or Using the real-time traffic data of the wide area network and the predicted traffic data output by the traffic prediction model to adjust at least one of the first weight value, the second weight value, and the third weight value.

9. The method according to claim 1, wherein Determining the broadband utilization warning threshold within the first duration after the current time according to the historical traffic data and the predicted traffic data, including: Obtaining the historical broadband utilization upper threshold and the historical broadband utilization lower threshold according to the historical traffic data; Obtaining the broadband utilization within the first duration after the current time according to the predicted traffic data; Obtaining a dynamic adjustment factor according to the broadband utilization and the obtained real-time broadband utilization; Obtaining the broadband utilization warning threshold according to the historical broadband utilization upper threshold, the historical broadband utilization lower threshold, and the dynamic adjustment factor.

10. A network traffic early warning device, characterized in that, Including: A first acquisition module, configured to acquire the real-time traffic data of the wide area network; A first processing module, configured to input the real-time traffic data into the traffic prediction model to obtain the predicted traffic data within the first duration after the current time output by the traffic prediction model; wherein, the traffic prediction model is trained according to the historical traffic data of the wide area network. A second processing module, configured to determine a broadband utilization warning threshold within the first duration after the current time according to the historical traffic data and the predicted traffic data; A third processing module, configured to perform network traffic warning according to the real-time broadband utilization rate of the wide area network and the broadband utilization warning threshold.

11. A network traffic warning device, characterized in that, Comprising: A processor, a memory, and a program stored on the memory and executable on the processor, where when the program is executed by the processor, the steps in the network traffic warning method according to any one of claims 1 to 9 are implemented.

12. A readable storage medium, characterized in that, A program is stored on the readable storage medium, and when the program is executed by the processor, the steps in the network traffic warning method according to any one of claims 1 to 9 are implemented.

13. A computer program product, characterized in that, Comprising computer instructions, where when the computer instructions are executed by the processor, the steps in the network traffic warning method according to any one of claims 1 to 9 are implemented.

Images