Abnormity detection method and system for communication equipment

Abstract

The invention discloses an anomaly detection method and system for communication equipment, and relates to the technical field of communication networks. The method comprises the following steps: presetting a monitoring area, collecting related data, and establishing a rate baseline; an abnormal state value is quantized by calculating a rate deviation and a signal strength deviation weighted value of a monitoring point and an area normal state. A dynamic clustering algorithm is adopted, an elbow rule is combined to automatically determine the clustering number, a high-rate class and a low-rate class are recognized, when the proportion of low-rate nodes exceeds a threshold value and the rate difference is remarkable, region anomaly judgment is triggered, and normalization correction is conducted on abnormal region state values. And fusing the regional rate deviation and the network global reference by the equipment anomaly measurement factor, and adaptively adjusting through a trainable parameter. And for the abnormal region, introducing a weight reduction coefficient to dynamically correct the signal intensity, and finally inputting the multi-dimensional features into a pre-training model to output an abnormal probability. The method effectively adapts to network topology changes, the false alarm rate is reduced, and the anomaly detection precision in a complex scene is improved.

Description

Technical Field

[0001] The present invention belongs to the technical field of communication networks, and in particular relates to a method and system for detecting anomalies in communication equipment. Background Art

[0002] With the rapid development of communications technology, communication networks have become an indispensable infrastructure in modern society. However, due to various factors, such as equipment aging, environmental interference, and software defects, communication networks may experience various anomalies during operation, such as signal quality degradation, data rate fluctuations, and equipment failures. These anomalies not only affect the performance of the communication network but can also cause network outages, inconvenience users, and even financial losses. Therefore, anomaly detection of communication equipment and timely identification and resolution of potential issues are crucial to ensuring the stable operation of communication networks.

[0003] Currently, there are a variety of methods for detecting anomalies in communications equipment, but most rely on a single parameter or simple rules. For example, by monitoring device status parameters such as CPU temperature and memory usage, an anomaly is determined when these parameters exceed preset thresholds. However, this approach has significant limitations. First, a single parameter may not fully reflect the operating status of the device, leading to missed or false positives. Second, simple rules are often based on empirical assumptions and are difficult to adapt to complex network environments and changing anomalies.

[0004] In recent years, with the development of machine learning technology, several data-driven anomaly detection methods have gradually gained attention. These methods exploit underlying patterns in device operating data to build anomaly detection models, enabling more accurate identification of anomalies. However, existing machine learning-based anomaly detection methods also have some limitations. For example, they often overlook the spatial characteristics of communication networks, meaning that devices in different monitoring areas may have different operating modes and anomaly characteristics. Furthermore, these methods lack in-depth analysis and utilization of device status data, resulting in a need for improved detection accuracy and efficiency.

[0005] In response to the above problems, the present invention proposes a method and system for detecting anomalies in communication equipment. Summary of the Invention

[0006] In order to overcome the shortcomings and deficiencies of the above-mentioned prior art, the first object of the present invention is to provide a method for detecting anomalies in a communication device; the second object of the present invention is to provide a system for detecting anomalies in a communication device.

[0007] The first object of the present invention adopts the following technical solution:

[0008] A method for detecting anomalies in a communication device, the process is as follows:

[0009] For the preset monitoring area of the communication network to be monitored, the signal strength value, data transmission rate data and device status data of each monitoring point are obtained. The device status data includes CPU temperature, memory error count and radio frequency unit power, and a 24-hour rate baseline is calculated on a rolling basis.

[0010] Based on the numerical change distribution of the data transmission rate data between each monitoring point and other monitoring points in each monitoring area, the abnormal state value of each monitoring point is obtained;

[0011] Based on the data transmission rate data, the monitoring points in each monitoring area are classified, and the number of monitoring points in different categories is combined to determine whether to correct the abnormal status value of the monitoring points in each monitoring area;

[0012] Based on the distribution difference of data transmission rate data between each monitoring area and all monitoring areas, combined with the corrected abnormal state value of each monitoring point, the equipment abnormality measurement factor of each monitoring point in each monitoring area is obtained;

[0013] Based on the equipment anomaly measurement factor of each monitoring point in each monitoring area, the signal strength value of each monitoring point is corrected;

[0014] According to the corrected signal strength value, an abnormality detection result of the communication network to be monitored is obtained.

[0015] Preferably, the abnormal state value of each monitoring point is obtained, specifically:

[0016] In each monitoring area, for the i-th monitoring point, first calculate the average of the absolute difference in data transmission rate between it and all other monitoring points in the same area, and multiply this average by the preset data transmission rate deviation weight α; at the same time, calculate the absolute deviation between the signal strength value of the i-th monitoring point and the regional average signal strength value, and multiply this deviation by the preset signal strength deviation weight β; finally, add the two parts of the result to obtain the abnormal state value of the i-th monitoring point, where α+β=1. The larger the abnormal state value, the greater the degree to which the monitoring point deviates from the regional norm and the greater the possibility of abnormality.

[0017] Preferably, the monitoring points in each monitoring area are classified based on the data transmission rate data, and combined with the number of monitoring points in different categories, it is determined whether to correct the abnormal state value of the monitoring point in each monitoring area, specifically including:

[0018] Dynamic clustering classification: The monitoring points in each monitoring area are classified based on data transmission rate, signal strength and CPU temperature using the K-means clustering algorithm, and the optimal number of cluster centers is automatically determined using the elbow rule.

[0019] Key category identification: Calculate the average rate of each cluster, mark the cluster with the highest average rate as the high-rate class, mark the cluster with the lowest average rate as the low-rate class, and exclude intermediate clusters from subsequent judgment;

[0020] Calculation of the same attribute resolution value: The difference between the average rate of the high-rate class and the average rate of the low-rate class is divided by the average rate of the low-rate class to obtain the same attribute resolution value reflecting the degree of difference between the two rates;

[0021] Correction condition judgment: Calculate the ratio of the number of low-rate nodes to the number of high-rate nodes. When the ratio is greater than the set value and the same attribute resolution value is greater than the preset threshold, the monitoring area is determined to be an abnormal area.

[0022] Abnormal state value correction: For abnormal areas, the original abnormal state value of each monitoring point is corrected by the formula: the sum of the maximum and minimum abnormal state values in the area is subtracted from the original value, and then divided by 2, so that the abnormal point value approaches 0 and the normal point value approaches 1.

[0023] Preferably, obtaining the equipment abnormality measurement factor of each monitoring point in each monitoring area specifically includes:

[0024] Regional average rate calculation: For each monitoring area, the data transmission rates of all monitoring points are summed and divided by the total number of monitoring points to obtain the average rate of the area;

[0025] Network rate average calculation: After excluding the monitoring areas with the highest and lowest average rates, the arithmetic mean of the average rates of the remaining areas is calculated as the global network rate average to eliminate the influence of extreme values.

[0026] Anomaly measurement factor calculation: The corrected anomaly status value is multiplied by an adjustment factor, which is 1 plus the absolute difference between the regional average rate and the network mean rate divided by the network mean rate, multiplied by a trainable parameter. The trainable parameter is determined using the least squares method based on historical fault data: the covariance between the regional rate deviation and the actual fault level is calculated and divided by the variance of the regional rate deviation to adapt the parameter to different network environments.

[0027] Preferably, the signal strength value of each monitoring point is corrected, specifically:

[0028] When the monitoring area is judged as an abnormal area, that is, when the same attribute resolution value is greater than the preset threshold and the proportion of low-rate nodes is greater than the set value, the regional abnormal weight factor is introduced to reduce the signal strength of the abnormal area;

[0029] The weight factor is calculated as: 1 divided by (1 plus the product of the weight reduction coefficient α and the same attribute resolution value). The larger the same attribute resolution value, the smaller the weight factor. The signal strength correction value of the abnormal area is the original value multiplied by the weight factor, and the normal area keeps the original value unchanged.

[0030] Preferably, the abnormality detection result of the communication network to be monitored is obtained according to the corrected signal strength value, specifically:

[0031] The input vector is composed of multi-dimensional features such as the corrected signal strength value, device anomaly measurement factor, CPU temperature, memory error count, and radio frequency unit power of each monitoring point in all monitoring areas. This vector is input into the pre-trained anomaly detection model, and the model outputs the anomaly probability of the monitoring point.

[0032] The probability value is compared according to the preset threshold, and the anomaly detection result and the corresponding anomaly level are output.

[0033] Preferably, the method further comprises: preprocessing the acquired signal strength value, data transmission rate data and device status data of each monitoring point, including data cleaning, missing value filling and normalization processing.

[0034] Preferably, the method further includes: generating an anomaly report based on the final anomaly detection result, the anomaly report including the time, location, type and severity of the anomaly; triggering a corresponding alarm mechanism based on the anomaly report, and providing anomaly handling suggestions.

[0035] The second purpose of the present invention adopts the following technical solution:

[0036] A communication device anomaly detection system is used to implement a communication device anomaly detection method, the system includes

[0037] Data acquisition and preprocessing module: responsible for real-time acquisition, time dimension processing and standardized preprocessing of monitoring data;

[0038] Abnormal state calculation module: calculates the single point abnormal state value based on neighborhood comparison;

[0039] Dynamic clustering and regional anomaly determination module: identifies abnormal areas through cluster analysis and determines correction conditions;

[0040] Global-local feature fusion module: used to fuse the global network status and local anomaly status and calculate the device anomaly measurement factor;

[0041] Signal strength intelligent correction module: downgrades signal strength based on regional abnormality;

[0042] Anomaly detection decision module: used for multi-dimensional feature fusion and anomaly probability calculation.

[0043] In summary, due to the adoption of the above technical solution, the beneficial effects of the present invention are:

[0044] 1. The present invention determines the optimal cluster center through the elbow rule, avoiding the limitations of fixed thresholds and adapting to network load fluctuations or hardware performance differences. It combines the same-attribute resolution value with the ratio of the number of nodes to determine the abnormal area, effectively distinguishing local faults from global anomalies and reducing the false alarm rate. It corrects the abnormal state value of the monitoring point in the abnormal area (approaching 0 / 1), enhancing the robustness to extreme values and ensuring that the detection results are closer to the actual state.

[0045] 2. This invention introduces a weighting factor (related to the resolution value of the same attribute) in the abnormal area to dynamically adjust the weight of the signal strength. The signal strength in the high-resolution area (where the rate difference is significant) is downgraded to prevent local anomalies from interfering with the global judgment. The adjustment coefficient is calculated by the difference between the regional average rate and the network rate mean, balancing the impact of local anomalies with the global network status, thereby improving the objectivity of the detection results.

[0046] 3. The present invention achieves adaptive anomaly detection through parameter optimization driven by historical data and trainable model design. The least squares method is used to calculate trainable parameters, so that the model can dynamically adjust the sensitivity according to historical fault data, automatically improve the detection sensitivity in high fault rate areas, and reduce the risk of missed reports; the pre-trained model outputs the anomaly probability, combined with multi-dimensional feature input, to improve the recognition ability of complex anomaly patterns; the real-time feedback mechanism generates anomaly reports and triggers alarms, while providing processing suggestions to form a closed-loop optimization. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0048] Figure 1 A flow chart showing a method for detecting abnormality in a communication device according to the present invention is shown;

[0049] Figure 2 A module diagram of an abnormality detection system for a communication device according to the present invention is shown;

[0050] Figure 3 The flowchart of step three of the present invention is shown. DETAILED DESCRIPTION

[0051] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0052] In addition, the described features, structures or characteristics can be combined in any suitable manner in one or more example embodiments. In the following description, many specific details are provided to provide a full understanding of the example embodiments of the present disclosure. However, those skilled in the art will appreciate that the technical solutions of the present disclosure can be practiced while omitting one or more of the specific details, or other methods, components, steps, etc. can be adopted. In other cases, well-known structures, methods, implementations or operations are not shown or described in detail to avoid obscuring various aspects of the present disclosure.

[0053] Example 1:

[0054] See Figure 1 As shown, a method for detecting abnormalities in a communication device according to this embodiment has the following process:

[0055] Step 1: For the preset monitoring area of the communication network to be monitored, obtain the signal strength value, data transmission rate data, and device status data of each monitoring point: CPU temperature, memory error count, and radio frequency unit power.

[0056] Take the time dimension into account: Calculate the 24-hour rate baseline on a rolling basis.

[0057] Step 2: Based on the numerical change distribution of the data transmission rate data between each monitoring point and other monitoring points in each monitoring area, the abnormal state value of each monitoring point is obtained.

[0058] The abnormal state value of each monitoring point is obtained by calculating the average level of the difference in data transmission rate data between any monitoring point and other monitoring points in each monitoring area, and marking it as the abnormal state value of any monitoring point. s ij represents the abnormal state value of the i-th monitoring point in the j-th monitoring area; v ij represents the data transmission rate of the i-th monitoring point in the j-th monitoring area; v ik represents the data transmission rate of other monitoring points k in the jth monitoring area (k≠i); RI ij Indicates the signal strength value (received signal strength) of the i-th monitoring point in the j-th monitoring area; represents the average signal strength value of all monitoring points in the jth monitoring area; N represents the total number of monitoring points in the jth monitoring area, and N ≥ 2; α and β are the weights of the data transmission rate deviation and signal strength deviation, respectively, and α + β = 1. Used to calculate the average of the absolute difference in rate between the i-th monitoring point and all other monitoring points in the same area. The effect is: the larger the value → the signal strength deviates from the regional norm → the higher the possibility of anomaly. Calculate the absolute deviation of the signal strength of the i-th monitoring point from the regional average. The effect is: the larger the value → the signal strength deviates from the regional norm → the higher the possibility of anomaly.

[0059] Step 3: Classify the monitoring points in each monitoring area based on the data transmission rate data, and determine whether to correct the abnormal state value of the monitoring point in each monitoring area in combination with the number of monitoring points in different categories.

[0060] See Figure 3 As shown, the specific process of step three is as follows:

[0061] S31. Dynamic clustering classification.

[0062] For each monitoring point in the monitoring area, the K-means clustering algorithm is used to dynamically classify the points based on the following characteristics:

[0063] Data transfer rate (core feature), signal strength (auxiliary feature), CPU temperature (new device status)

[0064] The number of cluster centers is automatically determined by the elbow rule (not fixed 2 categories)

[0065] S32. Identify key categories: Calculate the average rate of each cluster:

[0066] mark:

[0067] High rate class: The cluster with the highest average rate.

[0068] Low rate class: The cluster with the lowest average rate.

[0069] Other intermediate clusters do not participate in subsequent judgments.

[0070] S33. Calculate the same attribute resolution value: in, is the average rate of the high-rate class; It is the average rate of the low-rate class.

[0071] S34, Modify the condition judgment:

[0072] Calculate the proportion of low-rate nodes:

[0073]

[0074] Physical meaning: An abnormality is detected only when the proportion of low-speed nodes is greater than the set value θ and the rate difference is significant.

[0075] S35, abnormal status value correction:

[0076] Execute only for regions marked as abnormal:

[0077] Among them, s j max is the maximum abnormal state value of the area; s j min The minimum abnormal state value of the area. Correction effect: abnormal point value approaches 0, normal point value approaches 1.

[0078] Step 4: Based on the distribution difference of the data transmission rate data of each monitoring area and all monitoring areas, combined with the corrected abnormal state value of each monitoring point, the equipment abnormality measurement factor of each monitoring point in each monitoring area is obtained.

[0079] The device abnormality measurement factor of each monitoring point in each monitoring area is obtained, including: regional average rate calculation: for each monitoring area j, the arithmetic mean of the data transmission rate of all monitoring points is calculated. Among them, N j is the total number of monitoring points in region j; v ij is the data transmission rate at point i.

[0080] Calculation of average network rate: After excluding the monitoring areas with the largest and smallest average rates, calculate the average network rate for the remaining (M-2) areas (M is the total number of areas) Where M is the total number of monitoring areas; J ′ To exclude the maximum and minimum A collection of regions.

[0081] Calculation of equipment abnormality measurement factor: Calculate the equipment abnormality measurement factor of the i-th monitoring point in the j-th monitoring area Among them, s ij ′ is the corrected abnormal state value (from step 3); λ is a trainable parameter (determined by regression of historical fault data).

[0082] λ is determined by least squares regression: Where N is the number of historical fault samples; Δv (n) is the regional rate deviation of the nth sample; y (n) is the actual fault level of the nth sample; is the mean regional rate deviation; is the mean fault level.

[0083] Step 5: Based on the equipment abnormality measurement factor of each monitoring point in each monitoring area, the signal strength value of each monitoring point is corrected.

[0084] The signal strength value of each monitoring point is modified as follows: When the monitoring area is judged to be abnormal (the same attribute resolution value>preset resolution threshold and the number of high-rate classes>the number of low-rate classes), the regional abnormality weight factor ω is introduced j ,(0<ω j <1), the signal strength of all monitoring points in the area is downgraded:

[0085] in, D j is the regional attribute discrimination value; σ is the weight reduction coefficient.

[0086] Step 6: Obtain anomaly detection results of the communication network to be monitored based on the corrected signal strength value.

[0087] The anomaly detection results of the communication network to be monitored are obtained by inputting the signal values of all monitoring points in all monitoring areas (the anomaly areas have been downgraded), device anomaly measurement factors, CPU temperature, memory error count, radio frequency unit power and other multi-dimensional features into the pre-trained anomaly detection model to obtain the final anomaly probability:

[0088] Abnormal probability = Model(r ij ,f ij ,T ij ,M ij ,P ij ), and output the final anomaly detection result based on the comparison between the anomaly probability and the preset threshold.

[0089] The beneficial effects of this embodiment are as follows: the communication equipment anomaly detection method significantly improves the anomaly detection accuracy, reduces the false alarm rate, adapts to complex network environments, achieves accurate fault location, and provides reliable protection for the stable operation of the communication network through multi-dimensional data fusion and dynamic analysis.

[0090] Example 2:

[0091] See Figure 2 As shown, a communication device abnormality detection system of this embodiment includes

[0092] Data acquisition and preprocessing module: responsible for real-time acquisition, time dimension processing and standardized preprocessing of monitoring data.

[0093] Abnormal state calculation module: calculates the single point abnormal state value based on neighborhood comparison.

[0094] Dynamic clustering and regional anomaly determination module: Identifies abnormal areas through cluster analysis and determines correction conditions.

[0095] Global-local feature fusion module: used to fuse the global network status and local anomaly status and calculate the device anomaly measurement factor.

[0096] Signal strength intelligent correction module: downgrades signal strength based on regional abnormalities.

[0097] Anomaly detection decision module: used for multi-dimensional feature fusion and anomaly probability calculation.

[0098] The beneficial effects of this embodiment are: the system realizes accurate anomaly detection and intelligent correction through multi-module collaboration, improves detection accuracy, reduces false alarms, adapts to complex network environments, and ensures stable operation of the communication network.

[0099] The weighting factors of the present invention are used to measure the degree of influence of different factors or variables on a particular outcome or decision. A weighting factor is defined as a numerical value assigned to each factor when comparing and evaluating multiple factors to reflect its importance or priority. These weighting factors can be determined based on specific circumstances and needs, and are typically developed and confirmed by professionals or relevant stakeholders. By properly setting weighting factors, programs or systems can be helped to make more accurate decisions or predictions.

[0100] The above embodiments can be implemented in whole or in part by software, hardware, firmware or any other combination. When implemented using software, the above embodiments can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer program are loaded or executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center via a wired (e.g., infrared, wireless, microwave, etc.) method. The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or data center that contains one or more available media sets. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium. The semiconductor medium can be a solid-state drive.

[0101] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0102] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0103] In the several embodiments provided in this application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of the units is merely a division of some logical functions. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0104] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0105] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

Claims

1. A method for detecting abnormality of a communication device, characterized in that: The method flow is as follows: For the preset monitoring area of the communication network to be monitored, the signal strength value, data transmission rate data and device status data of the monitoring points in each monitoring area are obtained. The device status data includes CPU temperature, memory error count and radio frequency unit power, and a rolling 24-hour rate baseline is calculated; Based on the numerical change distribution of the data transmission rate data between each monitoring point and other monitoring points in each monitoring area, the abnormal state value of each monitoring point is obtained; Based on the data transmission rate data, the monitoring points in each monitoring area are classified, and the number of monitoring points in different categories is combined to determine whether to correct the abnormal status value of the monitoring points in each monitoring area; Based on the distribution difference of data transmission rate data between each monitoring area and all monitoring areas, combined with the corrected abnormal state value of each monitoring point, the equipment abnormality measurement factor of each monitoring point in each monitoring area is obtained; Based on the equipment anomaly measurement factor of each monitoring point in each monitoring area, the signal strength value of each monitoring point is corrected; According to the corrected signal strength value, an abnormality detection result of the communication network to be monitored is obtained.

2. The method for detecting abnormality of a communication device according to claim 1, wherein: The abnormal state value of each monitoring point is obtained as follows: In each monitoring area, for the i-th monitoring point, first calculate the average value of the absolute difference in data transmission rate between it and all other monitoring points in the same area, and multiply the average value by the preset data transmission rate deviation weight α to obtain the rate difference mean term; at the same time, calculate the absolute deviation between the signal strength value of the i-th monitoring point and the regional average signal strength value, and multiply the deviation by the preset signal strength deviation weight β to obtain the signal strength deviation term; finally, add the rate difference mean term and the signal strength deviation term to obtain the abnormal state value of the i-th monitoring point, where α+β=1, and the larger the abnormal state value, the higher the degree to which the monitoring point deviates from the regional normal state and the greater the possibility of abnormality.

3. The method for detecting abnormality of a communication device according to claim 1, wherein: Based on the data transmission rate data, the monitoring points in each monitoring area are classified. Combined with the number of monitoring points in different categories, it is determined whether the abnormal status value of the monitoring point in each monitoring area should be corrected. Specifically, it includes: Dynamic clustering classification: The monitoring points in each monitoring area are classified based on data transmission rate, signal strength and CPU temperature using the K-means clustering algorithm, and the optimal number of cluster centers is automatically determined using the elbow rule. Key category identification: Calculate the average rate of each cluster, mark the cluster with the highest average rate as the high-rate class, mark the cluster with the lowest average rate as the low-rate class, and exclude intermediate clusters from subsequent judgment; Calculation of the same attribute resolution value: The difference between the average rate of the high-rate class and the average rate of the low-rate class is divided by the average rate of the low-rate class to obtain the same attribute resolution value reflecting the degree of difference between the two rates; Correction condition judgment: Calculate the ratio of the number of low-rate nodes to the number of high-rate nodes. When the ratio is greater than the set value and the same attribute resolution value is greater than the preset threshold, the monitoring area is determined to be an abnormal area. Abnormal state value correction: For abnormal areas, the original abnormal state value of each monitoring point is corrected by the formula: the sum of the maximum and minimum abnormal state values in the area is subtracted from the original value, and then divided by 2, so that the abnormal point value approaches 0 and the normal point value approaches 1.

4. The method for detecting abnormality of a communication device according to claim 1, wherein: The device abnormality measurement factor of each monitoring point in each monitoring area is obtained, specifically including: Regional average rate calculation: For each monitoring area, the data transmission rates of all monitoring points are summed and divided by the total number of monitoring points to obtain the average rate of the area; Network rate average calculation: After excluding the monitoring areas with the highest and lowest average rates, the arithmetic mean of the average rates of the remaining areas is calculated as the global network rate average to eliminate the influence of extreme values. Abnormality measurement factor calculation: The abnormality measurement factor is calculated by substituting the corrected abnormal status value, adjustment coefficient, and trainable parameters into the formula. The adjustment coefficient is calculated by substituting the absolute difference between the regional average rate and the network rate mean, and the network rate mean into the formula. The trainable parameters are determined using the least squares method using historical fault data.

5. The method for detecting abnormality of a communication device according to claim 1, wherein: The signal strength value of each monitoring point is corrected as follows: When the monitoring area is judged as an abnormal area, that is, when the same attribute resolution value is greater than the preset threshold and the proportion of low-rate nodes is greater than the set value, the regional abnormal weight factor is introduced to reduce the signal strength of the abnormal area; Weight factor calculation: Substitute the weight reduction coefficient α and the same-attribute resolution value into the formula to calculate the value. The larger the same-attribute resolution value, the smaller the weight factor. The signal strength correction value of the abnormal area is the original value multiplied by the weight factor, and the normal area keeps the original value unchanged.

6. The method for detecting abnormality of a communication device according to claim 1, wherein: The abnormality detection result of the communication network to be monitored is obtained according to the corrected signal strength value, specifically: The multi-dimensional features of each monitoring point in all monitoring areas, including the corrected signal strength value, device anomaly measurement factor, CPU temperature, memory error count, and radio frequency unit power, are combined into an input vector and fed into the pre-trained anomaly detection model. The model then outputs the anomaly probability of the monitoring point. The probability value is compared according to the preset threshold, and the anomaly detection result and the corresponding anomaly level are output.

7. The method for detecting abnormality of a communication device according to claim 1, wherein: The method further includes: preprocessing the acquired signal strength value, data transmission rate data and device status data of each monitoring point, including data cleaning, missing value filling and normalization processing.

8. The method for detecting abnormality of a communication device according to claim 1, wherein: The method further includes: generating an anomaly report based on the final anomaly detection result, wherein the anomaly report includes the time, location, type, and severity of the anomaly; triggering a corresponding alarm mechanism based on the anomaly report, and providing anomaly handling suggestions.

9. A communication device anomaly detection system, used to implement the communication device anomaly detection method according to claim 1, characterized in that: The system includes Data acquisition and preprocessing module: responsible for real-time acquisition, time dimension processing and standardized preprocessing of monitoring data; Abnormal state calculation module: calculates the single point abnormal state value based on neighborhood comparison; Dynamic clustering and regional anomaly determination module: identifies abnormal areas through cluster analysis and determines correction conditions; Global-local feature fusion module: used to fuse the global network status and local anomaly status and calculate the device anomaly measurement factor; Signal strength intelligent correction module: downgrades signal strength based on regional abnormality; Anomaly detection decision module: used for multi-dimensional feature fusion and anomaly probability calculation.

Images