Network element anomaly prediction methods, devices, network equipment, media, and software products

Abstract

This disclosure provides a method, apparatus, network device, medium, and program product for predicting network element anomalies, relating to the field of wireless communication technology. The method includes: dividing collected network element operational data in the core network into normal indicator data and raw anomaly indicator data based on different indicator types; performing time-series-based forward noise addition processing on the raw anomaly indicator data to construct a noisy indicator sequence; fusing the corresponding normal indicator data and the noisy indicator sequence based on the time sequence to obtain a fused sequence; performing the inverse operation of forward noise addition processing on the fused sequence to obtain diffused anomaly indicator data; and constructing network element time-series data based on the normal indicator data and the diffused anomaly indicator data to train an anomaly prediction model. This technical solution effectively alleviates the network element data imbalance problem and improves the prediction model's ability to learn anomaly indicators and predict network element anomalies.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the technical field of wireless communication, and particularly relates to a network element anomaly prediction method, a network element anomaly prediction device, a network device, a computer readable storage medium and a computer program product. BACKGROUND

[0002] In a modern communication network, the core network is a key hub of the communication network, and its stability and reliability are crucial. Although the frequency of network element failure is extremely low, once a key network element of the core network fails, it will cause millions of terminal devices to perceive network anomalies and trigger a large number of registration or session reconstruction requests in a very short time (usually within a few minutes), which seriously affects the quality of network services and user experience. Therefore, there is an urgent need for a solution that can perceive network element index anomalies in advance to prevent network element failures.

[0003] It should be noted that the information disclosed in the above background section is only used to strengthen the understanding of the background of the present disclosure, and therefore can include information that does not constitute prior art known to those of ordinary skill in the art. SUMMARY

[0004] The purpose of the present disclosure is to provide a network element anomaly prediction method, a network element anomaly prediction device, a network device, a storage medium and a computer program product, which at least partially overcome the poor performance of network element failure prediction in the related art.

[0005] Other characteristics and advantages of the present disclosure will become apparent from the following detailed description, or will be learned by practice of the present disclosure.

[0006] According to one aspect of the present disclosure, a network element anomaly prediction method is provided, comprising: dividing collected network element running data in a core network into normal index data and original abnormal index data based on different index types; performing forward noise adding processing based on time sequence on the original abnormal index data to construct a noise-added index sequence; fusing corresponding normal index data and the noise-added index sequence based on the time sequence to obtain a fusion sequence; performing an inverse operation of the forward noise adding processing on the fusion sequence to obtain diffusion abnormal index data; constructing network element time sequence data based on the normal index data and the diffusion abnormal index data, training an anomaly prediction model based on the network element time sequence data, and performing network element anomaly prediction operation based on the trained anomaly prediction model.

[0007] In an embodiment of the present disclosure, the time-based forward noise adding processing is performed on the original abnormal indicator data to construct a noise-added indicator sequence, including: constructing a plurality of time points based on the time sequence, and determining the original abnormal indicator data as abnormal data of an initial time point; starting from the initial time point, adding real noise values to the abnormal data based on the plurality of time points to obtain the noise-added indicator sequence.

[0008] In an embodiment of the present disclosure, the adding of the real noise values between adjacent two time points based on the plurality of time points includes: based on a decay coefficient and noise data obeying a normal distribution on the time sequence, performing the adding of the real noise values between adjacent two time points.

[0009] In an embodiment of the present disclosure, the corresponding normal indicator and the noise-added indicator sequence are fused based on the time sequence to obtain a fusion sequence, including: converting the normal indicator data into an indicator data vector; inputting the indicator data vector into a Transformer encoder to perform an encoding operation to obtain a normal encoding vector; and performing a fusion operation on the normal encoding vector and the noise-added indicator sequence to obtain the fusion sequence.

[0010] In an embodiment of the present disclosure, the fusion operation on the normal encoding vector and the noise-added indicator sequence to obtain the fusion sequence includes: inputting the normal encoding vector and the noise-added indicator sequence into a cross-attention layer based on the time sequence; in the cross-attention layer, taking the noise-added indicator sequence as a query and the normal encoding vector as a key value, calculating an attention weight between the noise-added indicator sequence and the normal encoding vector, so that the noise-added indicator sequence focuses on key information in the normal indicator data; and fusing the key information into the noise-added indicator sequence to obtain the fusion sequence.

[0011] In an embodiment of the present disclosure, the fusion operation on the normal encoding vector and the noise-added indicator sequence to obtain the fusion sequence includes: performing a layer normalization operation on the noise-added indicator sequence to obtain a normalized sequence; compressing the normal encoding vector into a fixed length representation based on global pooling; extracting a scaling factor and an offset from the fixed length representation based on a multi-layer perceptron; and adjusting a normalization parameter of the normalized sequence based on the scaling factor and the offset to fuse information in the normal indicator data into the noise-added indicator sequence to obtain the fusion sequence.

[0012] In an embodiment of the present disclosure, the inverse operation of the forward noise adding processing is performed on the fusion sequence to obtain diffusion anomaly index data, including: generating a reverse denoising model based on a neural network with an encoding layer and a decoding layer; inputting the fusion sequence into the reverse denoising model, performing a multi-step iterative denoising operation as the inverse operation of the forward noise adding processing; configuring an iteration termination condition based on the plurality of time points, and stopping the iteration operation when it is detected that the multi-step iterative denoising operation meets the iteration termination condition, and obtaining the diffusion anomaly index data.

[0013] In an embodiment of the present disclosure, inputting the fusion sequence into the reverse denoising model and performing a multi-step iterative denoising operation includes: in an initial iterative denoising period, inputting the fusion sequence into the encoding layer to extract features of the fusion sequence based on the encoding layer, and obtaining index feature information; inputting the index feature information into the decoding layer to predict noise based on the index feature information and noise distribution at the current time, and obtaining a predicted noise value; subtracting the predicted noise value from the fusion sequence to obtain denoising data of the iterative denoising period, and taking the denoising data as input information of the encoding layer in the next iterative denoising period.

[0014] In an embodiment of the present disclosure, the reverse denoising model is generated based on a neural network with an encoding layer and a decoding layer, and further includes: calculating an error value between the corresponding predicted noise value and the real noise value; calculating a mean square error based on the error value; and if it is detected that the mean square error is greater than an error threshold, optimizing the reverse denoising model.

[0015] In an embodiment of the present disclosure, the network element time sequence data is constructed based on the normal index data and the diffusion anomaly index data, and an anomaly prediction model is trained based on the network element time sequence data, including: aligning the normal index data and the diffusion anomaly index data based on the time sequence to obtain aligned index data; merging the aligned index data belonging to the same time period based on timestamp information to obtain corresponding data samples, and obtaining the network element time sequence data based on a plurality of the data samples on the time sequence; adding a sample label to each of the data samples, and training the anomaly prediction model based on the sample label.

[0016] According to another aspect of the present disclosure, a network element anomaly prediction apparatus is provided, comprising: a division module configured to divide collected network element operation data in a core network into normal index data and original abnormal index data based on different index types; a noise adding processing module configured to perform forward noise adding processing on the original abnormal index data based on time sequence to construct a noise-added index sequence; a fusion module configured to fuse the normal index data and the noise-added index sequence based on the time sequence to obtain a fusion sequence; an inverse operation module configured to perform inverse operation of the forward noise adding processing on the fusion sequence to obtain diffusion abnormal index data; a model training module configured to construct network element time sequence data based on the normal index data and the diffusion abnormal index data, train an anomaly prediction model based on the network element time sequence data, and perform network element anomaly prediction operation based on the trained anomaly prediction model.

[0017] According to still another aspect of the present disclosure, a network device is provided, comprising: a processor; and a memory configured to store executable instructions of the processor; the processor is configured to perform the network element anomaly prediction method of the first aspect described above via execution of the executable instructions.

[0018] According to yet another aspect of the present disclosure, a computer readable storage medium is provided, having stored thereon a computer program, the computer program being executed by a processor to implement the network element anomaly prediction method described above.

[0019] According to yet another aspect of the present disclosure, a computer program product is provided, having stored thereon a computer program, the computer program being executed by a processor to implement the network element anomaly prediction method described above.

[0020] The network element anomaly prediction scheme provided by the embodiments of the present disclosure can clearly distinguish between normal and original abnormal situations by classifying network element operation data by index type, enrich the forms and diversity of abnormal data by performing forward noise adding processing on original abnormal index data to construct a noise-added index sequence, further fuse normal index data and noise-added index sequence to enable features and rules of normal data to guide abnormal data processing, generate diffusion abnormal index data by performing inverse operation of the forward noise adding, which can further mine potential abnormal features, construct network element time sequence data based on normal index data and diffusion abnormal index data, and generate a large number of diversified, reasonable and time sequence characteristic diffusion abnormal index data from limited original abnormal data through randomness of the forward noise adding, probability sampling of the reverse noise removing and conditional constraints of normal data, effectively alleviate the network element data imbalance problem, and improve the learning of abnormal index by the prediction model and the prediction ability of network element anomaly.

[0021] It should be understood that the foregoing general description and the following detailed description are only exemplary and explanatory, and cannot limit the present disclosure. BRIEF DESCRIPTION OF DRAWINGS

[0022] The accompanying drawings, which are incorporated herein and form a part of the specification, illustrate embodiments consistent with the present disclosure and, together with the description, further serve to explain the principles of the disclosure. It is to be expressly understood, however, that the drawings are only for the purpose of illustration and as an aid to understanding the only embodiments of the application and are not intended as a definition of the limits of the disclosure. Other embodiments of the application will be readily apparent to those of ordinary skill in the art from the following description and accompanying drawings.

[0023] Figure 1 A flow chart illustrating a method for predicting network element abnormality in an embodiment of the present disclosure;

[0024] Figure 2 A flow chart illustrating another method for predicting network element abnormality in an embodiment of the present disclosure;

[0025] Figure 3 A flow chart illustrating still another method for predicting network element abnormality in an embodiment of the present disclosure;

[0026] Figure 4 A flow chart illustrating yet another method for predicting network element abnormality in an embodiment of the present disclosure;

[0027] Figure 5 A schematic diagram illustrating a scheme for predicting network element abnormality in an embodiment of the present disclosure;

[0028] Figure 6 A schematic diagram illustrating a device for predicting network element abnormality in an embodiment of the present disclosure;

[0029] Figure 7 A structural block diagram of a computer device in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0030] Example implementations will now be described with reference to the drawings; however, these implementations should not be construed as limiting the scope of the disclosure. The example implementations can be implemented in various forms and should not be construed as being limited to the examples set forth herein; rather, these implementations are provided so that the disclosure will be more thorough and complete, and will fully convey the concept of the example implementations to those skilled in the art. The described features, structures, or characteristics can be combined in any suitable manner in one or more implementations.

[0031] In addition, the drawings are merely schematic and are not necessarily drawn to scale. Like reference numerals designate like elements throughout the drawings and the description, and thus a repeated description of the same or similar elements can be omitted. Some of the block diagrams shown in the drawings are functional entities that do not necessarily have to correspond to physically or logically independent entities. These functional entities can be implemented in the form of software, or in one or more hardware modules or integrated circuits, or in different network and / or processor devices and / or microcontroller devices.

[0032] In modern communication networks, the stable operation of core network key network elements is crucial. Once a core network key network element fails, millions of terminal devices will perceive network anomalies within a few minutes, and these terminal devices will trigger a large number of registration or session reconstruction requests, which will greatly impact the normal operation of the network. Therefore, early perception of network element index anomalies and prevention of network element failures are of great significance to maintaining the stability of key network elements.

[0033] However, in the existing network environment, the probability of network element failure is extremely low, which makes it difficult to collect network element abnormal index data, thereby leading to a serious imbalance in existing network element index data: up to 99.9% of the data is normal index data, and abnormal index data accounts for only 0.01%. Using such seriously imbalanced data to train network element anomaly models, the classes with small sample sizes are difficult to learn sufficiently in the training process, and their features cannot be effectively captured and remembered by the model, resulting in poor prediction performance of the model for sample-poor abnormal index data classes, and even complete loss of prediction ability, making it difficult to play an effective early warning role in actual application.

[0034] In the present disclosure, by classifying network element operation data by index type, normal and original abnormal situations can be clearly distinguished, and original abnormal index data is positively noise-added to construct a noise-added index sequence, which enriches the forms and diversity of abnormal data. Further, the fusion of normal index data and noise-added index sequence enables the features and rules of normal data to guide abnormal data processing, and the execution of the inverse operation of positive noise addition generates diffusion abnormal index data, which can further mine potential abnormal features. Based on normal index data and diffusion abnormal index data, network element time series data is constructed, a large number of diversified, reasonable and time series characteristic diffusion abnormal index data are generated from limited original abnormal data through the randomness of positive noise addition, the probability sampling of reverse noise reduction and the conditional constraints of normal data, effectively alleviating the imbalance of network element data and improving the learning of abnormal index by the prediction model and the prediction ability of network element anomalies.

[0035] In order to facilitate understanding, the following first explains several terms related to the present application.

[0036] Diffusion model: In machine learning, a diffusion model or diffusion probability model is a class of latent variable models that are Markov chains trained by variational estimation. The goal of a diffusion model is to learn the latent structure of a data set by modeling the diffusion pattern of data points in the latent space.

[0037] U-Net: is an encoder-decoder architecture based on convolutional neural network (CNN), the core design is to realize the feature extraction and accurate restoration of input data through the symmetric encoding-decoding structure and "skip connection".

[0038] In the following, the various steps of the network element anomaly prediction method in the present example embodiment will be described in more detail in conjunction with the accompanying drawings and examples.

[0039] Figure 1 A flowchart of a network element anomaly prediction method in an embodiment of the present disclosure is shown.

[0040] As Figure 1 shown, the network element anomaly prediction method according to one embodiment of the present disclosure comprises:

[0041] Step S102, the collected network element running data in the core network is divided into normal index data and original abnormal index data based on different index types.

[0042] In some embodiments, in the core network, the index types include resource usage indicators (such as CPU utilization, memory usage) of network elements, network performance indicators (such as network throughput, latency, packet loss rate), and signaling-related indicators (such as signaling success rate, signaling interaction times), etc. According to these different indicators, the network element running data can be classified into normal index data and original abnormal index data (i.e. index data deviating from the normal range, suggesting that there may be a fault or anomaly).

[0043] Step S104, performing forward noise adding processing based on time sequence on the original abnormal index data to construct a noise-added index sequence.

[0044] In some embodiments, in actual communication network scenarios, network element data will be disturbed by various noises. Starting from the initial original abnormal index data, noise is added based on time sequence according to certain rules. As the noise adding step progresses, the proportion of noise in the data gradually increases, forming a noise-added index sequence. The index data in the sequence gradually evolves from original abnormal data to data closer to pure noise. In this process, the model can learn the variation rule of this data distribution and establish a mapping relationship between the original data and the noise.

[0045] Step S106, based on time sequence, the corresponding normal index data and the noise-added index sequence are fused to obtain a fusion sequence.

[0046] In some embodiments, the normal index data reflects the state and regularity of the normal operation of the network element, and fusing the normal index data with the noise-added index sequence enriches the feature combination of the fusion sequence, which is a sequence obtained by splicing or mixing the normal index data and the noise-added abnormal data in time sequence. After different normal data samples (such as normal indexes in different time periods) are fused with abnormal data of different noise levels, diversified input conditions are generated, and the starting point of reverse denoising (fusion sequence) itself has rich feature combinations.

[0047] In step S108, the inverse operation of the forward noise-adding processing is performed on the fusion sequence to obtain the diffusion abnormal index data.

[0048] In some embodiments, the reverse denoising (inverse operation of the forward noise-adding) can be understood as a probability process of inversely sampling and restoring the original data from the noise distribution.

[0049] In some embodiments, the diffusion model refers to a process of gradually converting data into noise through forward diffusion (forward noise-adding) and then recovering the original data from the noise through reverse diffusion (reverse denoising). In the network element anomaly prediction, the forward noise-adding corresponds to the forward diffusion of the diffusion model, and a conversion path from data to noise is constructed. Fusing the normal index data and the noise-added index sequence is an extension of the diffusion model, which introduces additional condition information to constrain and guide data generation. The reverse denoising corresponds to the reverse diffusion process of the diffusion model, and the model is trained to remove noise and recover abnormal data, thereby finally realizing the prediction of the network element anomaly.

[0050] In step S110, the network element time sequence data is constructed based on the normal index data and the diffusion abnormal index data, the anomaly prediction model is trained based on the network element time sequence data, and the network element anomaly prediction operation is performed based on the trained anomaly prediction model.

[0051] In this embodiment, by classifying the network element operation data according to the index type, the normal and original abnormal conditions can be clearly distinguished. The original abnormal index data is subjected to the forward noise-adding processing to construct the noise-added index sequence, thereby enriching the forms and diversity of the abnormal data. Further, the normal index data is fused with the noise-added index sequence, so that the features and regularity of the normal data can guide the abnormal data processing. The diffusion abnormal index data is generated by performing the inverse operation of the forward noise-adding, which can further mine potential abnormal features. Based on the normal index data and the diffusion abnormal index data, the network element time sequence data is constructed. Through the randomness of the forward noise-adding, the probability sampling of the reverse denoising, and the condition constraint of the normal data, a large number of diversified, reasonable, and time sequence feature-compliant diffusion abnormal index data are generated from the limited original abnormal data, thereby effectively alleviating the network element data imbalance problem and improving the learning of the prediction model on the abnormal index and the prediction ability of the prediction model on the network element anomaly.

[0052] In one embodiment of the present disclosure, time-based forward noise adding processing is performed on original abnormal index data to construct a noise-added index sequence, including:

[0053] A plurality of time points are constructed, and the original abnormal index data is determined as abnormal data of an initial time point. Starting from the initial time point, real noise values are gradually added to the abnormal data based on the plurality of time points to obtain the noise-added index sequence.

[0054] In this embodiment, through multi-time point and multi-stage noise superposition, a single original abnormal data is expanded into a time sequence containing different noise intensities (such as from a slightly noisy abnormality to a severely noisy abnormality), which provides rich intermediate states for generating diverse abnormal data for subsequent reverse denoising. Even if the original abnormal data is scarce, the noise adding process can generate a large number of intermediate samples (x2, x3, … x T-1 ) through the randomness and time sequence combination of noise, which can be used as additional training data to alleviate the problem of insufficient abnormal samples. In addition, the noise adding process based on real noise values enables the model to adapt to the noise interference actually existing in the network element data, and the generated abnormal data is more consistent with the characteristics of the field environment, thereby enhancing the generalization ability and detection accuracy of the subsequent abnormal prediction model in the real scene.

[0055] In one embodiment of the present disclosure, gradually adding real noise values to the abnormal data based on a plurality of time points includes: based on a decay coefficient and noise data obeying a normal distribution in time sequence, adding real noise values between adjacent two time points.

[0056] In some embodiments, T time points are constructed, each corresponding to noise-added abnormal data. Time point 1 is denoted as x1, and time point 2 is denoted as x2. A noise is added at each time point. The noise adding formula is shown in formula (1):

[0057]

[0058] wherein x t-1 and x t represent abnormal data at time t-1 and time t respectively, α t is generally a hyperparameter greater than 0 and less than 1, i.e. a decay coefficient, which decreases with the increase of time, and ε t represents the noise added at the t-th step, which conforms to a normal distribution.

[0059] In this embodiment, the intensity of noise addition is controlled by the orderly decrease of the attenuation coefficient (e.g., decreasing as the time step increases), so that the abnormal data gradually and controllably degrades from the initial state to pure noise, constructing a time-series data degradation path that conforms to physical laws. Real noise data that follows a normal distribution is introduced to simulate the random interference (e.g., Gaussian white noise) that network element indicators are subjected to in actual operation, enhancing the realism and scene fit of the noise-added data. This noise addition method that combines regularity and randomness not only provides a clear inverse operation target for reverse denoising, but also generates diverse intermediate samples with different noise intensities by superimposing noise at multiple time points, effectively expanding the temporal feature space of abnormal data.

[0060] like Figure 2 As shown, in one embodiment of this disclosure, the corresponding normal index and noisy index sequences are fused based on time series to obtain a fused sequence, including:

[0061] Step S202: Convert normal indicator data into indicator data vector.

[0062] In some embodiments, the original indicators (such as CPU utilization and throughput) are normalized, the correlation between adjacent time steps is extracted by a sliding window, the time series information is embedded in the vector, and non-numerical indicators (such as network element type and alarm level) are converted into fixed-length vectors by one-hot encoding, so that the model can process mixed-type data. The processed numerical features and categorical features are concatenated by dimension to form a complete indicator data vector.

[0063] Step S204: Input the index data vector into the Transformer encoder to perform the encoding operation and obtain the normal encoded vector.

[0064] In some embodiments, inputting the metric data vector into the Transformer encoder for encoding can capture long-range dependencies and contextual information in the data.

[0065] Step S206: Perform a fusion operation on the normal encoding vector and the noisy index sequence to obtain a fused sequence.

[0066] In this embodiment, the temporal patterns of normal indicators (such as periodic fluctuations and the correlation between load and response time) are extracted by Transformer encoding and injected as constraints into the noisy sequence, so that the generated abnormal data is more in line with the physical logic of network element operation. The fusion process retains the core features of abnormal data (such as sudden fluctuations) and introduces the contextual information of normal patterns, so that the subsequent prediction model can learn the "abnormality in the normal", which is conducive to enhancing the model's ability to detect anomalies.

[0067] In one embodiment of the present disclosure, a fusion operation is performed on the normal encoding vector and the noise-added index sequence to obtain a fusion sequence, including:

[0068] The normal encoding vector and the noise-added index sequence are input into a cross-attention layer based on timing.

[0069] In the cross-attention layer, the noise-added index sequence is taken as a query, and the normal encoding vector is taken as a key value, so as to calculate the attention weight between the noise-added index sequence and the normal encoding vector, so that the noise-added index sequence focuses on the key information in the normal index data.

[0070] The key information is integrated into the noise-added index sequence to obtain the fusion sequence.

[0071] In some embodiments, assuming that the noise-added index sequence is X and the normal encoding vector is Z, X is projected into a query (Query) space, and Z is projected into a key (Key) and value (Value) space, the noise-added index sequence X is enabled to focus on the key information in the normal encoding vector Z through attention weight calculation, and the attention output, i.e., the key information, is spliced or added to the original noise-added sequence to obtain the fusion sequence.

[0072] In this embodiment, by inputting the normal encoding vector and the noise-added index sequence into the cross-attention layer, the attention weight is calculated with the noise-added index sequence as a query and the normal encoding vector as a key value, so as to realize adaptive learning of abnormal data on normal mode, and utilize the correlation modeling capability of the cross-attention mechanism to enable the noise-added index sequence to dynamically focus on the key features in the normal index data, so as to effectively fuse the prior knowledge of the normal mode in the noise-added index sequence.

[0073] In one embodiment of the present disclosure, a fusion operation is performed on the normal encoding vector and the noise-added index sequence to obtain a fusion sequence, including:

[0074] The noise-added index sequence is subjected to a layer normalization operation to obtain a normalized sequence.

[0075] The normal encoding vector is compressed into a fixed-length representation based on global pooling.

[0076] A scaling factor and an offset are extracted from the fixed-length representation based on a multi-layer perceptron.

[0077] The normalized parameters of the normalized sequence are adjusted based on the scaling factor and the offset, so as to fuse the information in the normal index data into the noise-added index sequence to obtain the fusion sequence.

[0078] In some embodiments, a standard layer normalization is performed on the noise-added index sequence X, the normal encoding vector Z is mapped into a scaling factor γ and an offset β through a linear layer, and then the scaling factor γ and the offset β are used to adjust the normalized sequence, as shown in formula (2).

[0079] X T =γ⊙X+β (2)

[0080] where the symbol ⊙ denotes element-wise multiplication (Hadamard product)

[0081] Based on the result of the adjustment, a fusion sequence is obtained.

[0082] In this embodiment, by performing layer normalization on the noise-added index sequence and adjusting the normalization parameters based on the normal encoding vector to dynamically generate a scaling factor and an offset, the normal data flexibly constrain the distribution of abnormal data, and the scaling factor and the offset extracted from the normal encoding vector by the global pooling and the multi-layer perception can adaptively adjust the normalization process of the noise-added sequence according to the statistical characteristics of the normal index, so that the distribution of the abnormal data is close to the normal mode while the abnormal characteristics are retained, thereby effectively enhancing the authenticity and logical consistency of the generated data.

[0083] As shown in FIG. 1, in one embodiment of the present disclosure, an inverse operation of the forward noise addition processing is performed on the fusion sequence to obtain diffusion abnormal index data, including: Figure 3

[0084] In step S302, a reverse denoising model is generated based on a neural network with an encoding layer and a decoding layer.

[0085] In some embodiments, the encoding layer is used to capture global and local dependencies of the data, and the decoding layer is used to gradually reconstruct detailed information to realize the mapping from abstract features to original data distribution.

[0086] In some embodiments, U-Net is used as the neural network with the encoding layer and the decoding layer, and in the abnormal data generation scenario, its multi-scale feature fusion capability can effectively combine the time series law of normal data and the abnormal characteristics of noise-added data to generate diffusion abnormal indexes that are more consistent with business logic, thereby improving the training effect of the subsequent abnormal detection model.

[0087] In step S304, the fusion sequence is input into the reverse denoising model to perform a multi-step iterative denoising operation as an inverse operation of the forward noise addition processing.

[0088] In some embodiments, the iterative denoising starts from the fusion sequence (corresponding to the final noisy state of the forward noise addition), and the model predicts the noise component at the current time in each iteration, for example, in the t-th step, the model outputs the predicted value ε t of the noise ε t′ based on the features extracted by the encoding layer and the current noisy data.

[0089] The predicted noise ε t′ is subtracted from the noisy data to obtain the denoised data x​t-1 = x t - ε t′ , data x t-1 As the input of the next iteration, this process is repeatedly performed, gradually reducing the proportion of noise in the data, and approximating the original abnormal data.

[0090] In step S306, an iteration termination condition is configured based on multiple time points. When the multi-step iteration denoising operation meets the iteration termination condition, the iteration operation is stopped, and the diffusion anomaly index data is obtained.

[0091] In some embodiments, the iteration termination condition is configured based on multiple time points, which can balance the denoising effect and computational efficiency, and ensure the rationality of the generated data.

[0092] In this embodiment, by constructing a reverse denoising model with an encoding-decoding structure, multi-step iteration denoising is performed on the fusion sequence and terminated based on the condition. The encoder-decoder architecture effectively extracts complex features in the fusion sequence, and in combination with the inverse process of forward noise addition, it is conducive to restoring the details of the original abnormal data. In addition, the multi-step iteration denoising mechanism gradually reduces the noise, so that the diffusion model can learn the hierarchy of noise distribution, generate more diverse and realistic abnormal data, and thus facilitate the generated abnormal data to conform to the physical laws of network element operation, and improve the business value of the abnormal data.

[0093] As shown in FIG. 5, in one embodiment of the present disclosure, the fusion sequence is input into the reverse denoising model to perform multi-step iteration denoising operation, including: Figure 4

[0094] In step S402, in the initial iteration denoising period, the fusion sequence is input into the encoding layer to perform feature extraction on the fusion sequence based on the encoding layer, and obtain index feature information.

[0095] In step S404, the index feature information is input into the decoding layer to predict the noise based on the index feature information and the noise distribution at the current time, and obtain the predicted noise value.

[0096] In step S406, the predicted noise value is subtracted from the fusion sequence to obtain denoised data of the iteration denoising period, and the denoised data is used as the input information of the encoding layer of the next iteration denoising period.

[0097] ​In this embodiment, by constructing an iterative noise prediction and removal mechanism in the reverse denoising model, through multiple iterations, the model gradually separates the noise component from the fusion sequence while retaining the abnormal characteristics deviating from the normal mode. In each iteration, the time series features and noise distribution information extracted by the encoding layer are used by the decoding layer to predict the noise. The model learns the time series dependency of the data (such as the correlation between traffic changes and response time) during the iteration process, so that the generated abnormal data conforms to the physical laws of network element operation, reducing non-real abnormal fluctuations.

[0098] In one embodiment of the present disclosure, the reverse denoising model is generated based on a neural network with an encoding layer and a decoding layer, and further includes:

[0099] An error value between the corresponding predicted noise value and the real noise value is calculated, and a mean square error is calculated based on the error value. If the mean square error is detected to be greater than an error threshold, an optimization operation is performed on the reverse denoising model.

[0100] In some embodiments, the mean square error is a loss function, and the goal is to enable the reverse denoising model to accurately predict the noise added at each time step, thereby gradually recovering the original data during the denoising process. The smaller the error between the predicted noise value and the real noise value, the better the effect of the denoising model.

[0101] In this embodiment, by constructing a mean square error (MSE) based reverse denoising model optimization mechanism, during the training of the reverse denoising model, the error between the predicted noise value and the real noise value is calculated, and the mean square error is used as a quantitative indicator to accurately measure the prediction deviation of the model for the noise distribution. If the mean square error is greater than a preset error threshold, it indicates that the current prediction effect of the model is not as expected, and at this time, the optimization operation is performed on the model to effectively correct the prediction deviation of the model, so that it can more accurately learn the addition rule of the noise in the forward noise addition process.

[0102] In one embodiment of the present disclosure, network element time series data is constructed based on normal index data and diffusion abnormal index data, and an abnormal prediction model is trained based on the network element time series data, including:

[0103] The normal index data and the diffusion abnormal index data are aligned based on time series to obtain aligned index data. The aligned index data belonging to the same time period are merged based on timestamp information to obtain corresponding data samples. The network element time series data is obtained based on multiple data samples in time series. A sample label is added to each data sample, and the abnormal prediction model is trained based on the sample label.

[0104] In some embodiments, the anomaly prediction model can be selected from various machine learning or deep learning models, such as decision tree, random forest, support vector machine, etc. in machine learning, recurrent neural network (RNN) and its variants long short-term memory network (LSTM), gated recurrent unit (GRU), or convolutional neural network (CNN), etc. in deep learning.

[0105] As shown in FIG. 5, according to the network element timing data construction scheme of one embodiment of the present disclosure, it includes a data preprocessing module 502, an index generation module 504 and an index evaluation module 506. Figure 5

[0106] The input data of the data preprocessing module 502 includes network element index historical data, which contains various index information of the network element in the past running process.

[0107] The processing process of the data preprocessing module 502 includes inputting the network element index historical data into the Transformer encoder for encoding operation. The Transformer encoder obtains the feature vector, i.e. the index data vector, through the self-attention mechanism and other technologies, which can effectively capture the long-distance dependence relationship and context information in the data.

[0108] After encoding, the network element index historical data is converted into a feature vector and output by the data preprocessing module 502, which is prepared for subsequent fusion with the abnormal index data, i.e. the original abnormal index data.

[0109] The input of the index generation module 504 includes the original abnormal index data and the index data vector.

[0110] The original abnormal index data, i.e. the network element abnormal index, is the network element index data that has been identified as abnormal.

[0111] The index data vector, i.e. the feature vector, represents normal index data information.

[0112] The processing process of the index generation module 504 includes:

[0113] The network element abnormal index is gradually added with noise, and the added noise is Gaussian noise. According to certain timing and rules, noise is gradually added to the abnormal index data at different time, so that it gradually evolves into a noisy index sequence.

[0114] The noisy index sequence is fused with the feature vector (representing normal index data) obtained by the data preprocessing module.

[0115] ​In some embodiments, the transformer encoding is utilized to effectively model the conditional data information by embedding the normal index data collected on the network element into the input sequence and fusing with the noisy index sequence through the cross-attention layer or the adaptive layer normalization layer.

[0116] The step-by-step denoising is performed using the U-Net network, which is a neural network with an encoding-decoding structure with skip connections, capable of extracting features of the fused sequence using the encoding layer, predicting noise based on these features and the current noise distribution through the decoding layer, and gradually removing noise.

[0117] In some embodiments, by training a neural network (such as U-Net), the conditional data after transformer encoding is fused, and the step-by-step denoising is started from pure noise to generate a real data model from pure noise x T Starting from, through multi-step iterative prediction and removal of noise, the original data x0 is gradually recovered, each step t of the reverse process corresponds to the inverse operation of the forward process, and the distribution characteristics of the noise need to be learned to realize the mapping from noise to data.

[0118] The index generation module 504 outputs diffusion anomaly index data.

[0119] The index evaluation module 506 inputs the actual noise value and the predicted noise value.

[0120] The actual noise value is the noise data actually added in the forward noise adding process.

[0121] The predicted noise value is the noise data predicted by the U-Net network in the reverse denoising process.

[0122] The processing process of the index evaluation module 506 includes: using a loss function such as mean square error to calculate the loss value (LOSS) between the predicted noise and the actual noise, to measure the difference between the actual noise value and the predicted noise value. The mean square error quantifies the accuracy of the model prediction by calculating the average of the square of the difference between the predicted noise and the actual noise.

[0123] According to the calculated loss value, the performance of the model is evaluated. If the loss value is large, it means that the accuracy of the model in predicting noise is poor, and the model (such as the U-Net network in the reverse denoising model) needs to be optimized and adjusted, such as adjusting network parameters, retraining, etc., to improve the model's ability to predict noise and the quality of the generated anomaly index data.

[0124] Further, by generating diverse anomaly data through the diffusion model, fusing the normal network element data collected in the network, forming network element time series data including normal and abnormal indexes, and finally generating high-quality network element operation data.

[0125] In this embodiment, the network element anomaly index generation scheme based on a diffusion model, which is a generation model based on a probability process, generates data by gradually introducing noise and removing noise in the reverse process, converts the original network element anomaly index data into Gaussian noise by gradually adding noise, completes the forward diffusion, in the denoising process, the conditional input feature index and the generated Gaussian noise are fused, input into the U-NET network architecture to gradually complete the denoising, and finally generate high-quality network element anomaly index data under the guidance of the conditional input.

[0126] It should be noted that the above-described figures are only schematic illustrations of the processes included in the method according to the exemplary embodiments of the present disclosure, and are not for limiting purposes. It is easy to understand that the processes shown in the above-described figures do not indicate or limit the time sequence of these processes. In addition, it is also easy to understand that these processes can be executed synchronously or asynchronously, for example, in multiple modules.

[0127] The network element anomaly prediction device 600 according to the embodiments of the present disclosure will be described below with reference to Figure 6 The network element anomaly prediction device 600 according to the embodiments of the present disclosure will be described below with reference to Figure 6 The network element anomaly prediction device 600 shown is only an example, and should not bring any limitation to the functions and use range of the embodiments of the present disclosure.

[0128] The network element anomaly prediction device 600 is in the form of a hardware module. The components of the network element anomaly prediction device 600 can include but are not limited to: a division module 602 for dividing the collected network element running data in the core network into normal index data and original anomaly index data based on different index types; a noise adding processing module 604 for performing time series-based forward noise adding processing on the original anomaly index data to construct a noise-added index sequence; a fusion module 606 for fusing the corresponding normal index data and the noise-added index sequence based on time series to obtain a fusion sequence; an inverse operation module 608 for performing inverse operation of the forward noise adding processing on the fusion sequence to obtain diffusion anomaly index data; a model training module 610 for constructing network element time series data based on the normal index data and the diffusion anomaly index data, training an anomaly prediction model based on the network element time series data, and performing network element anomaly prediction operation based on the trained anomaly prediction model.

[0129] Those skilled in the art can understand that each aspect of the present disclosure can be implemented as a system, a method or a program product. Therefore, each aspect of the present disclosure can be embodied as a complete hardware embodiment, a complete software embodiment (including firmware, microcode, etc.), or an embodiment combining hardware and software aspects, which can be collectively referred to as "circuitry", "module" or "system" here.

[0130] The network element anomaly prediction device 600 according to the embodiments of the present disclosure will be described below with reference to Figure 7An electronic device 700 according to such an embodiment of the present disclosure will be described. The electronic device 700 can be a network device or a terminal. Figure 7 The electronic device 700 shown is merely an example and should not limit the function and usage range of the embodiments of the present disclosure.

[0131] As Figure 7 shown, the electronic device 700 is in the form of a general computing device. The components of the electronic device 700 can include, but are not limited to, the at least one processing unit 710 described above, the at least one storage unit 720 described above, and a bus 730 connecting different system components, including the storage unit 720 and the processing unit 710.

[0132] The storage unit stores program codes that can be executed by the processing unit 710, so that the processing unit 710 performs the steps according to various exemplary embodiments of the present disclosure described in the "Exemplary Method" section of the present specification. For example, the processing unit 710 can perform the schemes as Figure 1 described.

[0133] The storage unit 720 can include a readable medium in the form of a volatile storage unit, such as a random access memory (RAM) 7201 and / or a cache 7202, and can further include a read-only memory (ROM) 7203.

[0134] The storage unit 720 can also include a program / utility 7204 having a set of program modules 7205, including but not limited to, an operating system, one or more application programs, other program modules, and program data, each of which or a combination thereof can include implementation of a network environment.

[0135] The bus 730 can represent one or more of several types of bus structures, including a storage unit bus or storage unit controller, a peripheral bus, a graphics acceleration port, a processing unit, or a local bus using any of a variety of bus structures.

[0136] The electronic device 700 can also communicate with one or more external devices 770 such as a keyboard or pointing device, a Bluetooth device, or a device for reading media. Communication with one or more devices can enable a user to interact with the electronic device 700 in order to use it or perform methods described herein. In some embodiments, the communication can be facilitated by an I / O interface 750. The electronic device 700 can also communicate with one or more networks, such as a local area network (LAN), a wide area network (WAN), or the Internet, through a network adapter 760. As depicted, the network adapter 760 communicates with the other components of the electronic device 700 through the bus 730. It should be understood that although not shown, other hardware and / or software components could be used in conjunction with the electronic device 700. These components, as well as the electronic device 700 itself, are examples of means for performing the functions described herein.

[0137] Those skilled in the art will readily understand that the example embodiments described herein can be implemented by software and / or by hardware coupled with software, as described above. Thus, the technical solutions according to the embodiments of the present disclosure can be embodied in the form of a software product. The software product can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash disk, a mobile hard disk, or the like) or a network, and includes a number of instructions for causing a computing device (which can be a personal computer, a server, a terminal device, or a network device, etc.) to perform the methods according to the embodiments of the present disclosure.

[0138] In the example embodiments of the present disclosure, a computer-readable storage medium is also provided, which stores a program product capable of implementing the above-mentioned methods of the present disclosure. In some possible embodiments, various aspects of the present disclosure can also be implemented in the form of a program product, which includes program codes for causing an electronic device to perform the steps according to various example embodiments of the present disclosure described in the above-mentioned “example methods” section of the present disclosure when the program product is run on the electronic device.

[0139] The program product for implementing the above-mentioned methods according to the embodiments of the present disclosure can take the form of a portable compact disc read-only memory (CD-ROM) and include program codes, and can be run on an electronic device, such as a personal computer. However, the program product of the present disclosure is not limited to this, and in this document, a readable storage medium can be any tangible medium including or storing a program, which can be used by or in conjunction with an instruction execution system, device, or apparatus.

[0140] The program product can take any combination of one or more computer-readable media. The computer-readable media can be a computer-readable storage medium or a computer-readable signal medium. The computer-readable storage medium can be, for example but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples (a non-exhaustive list) of the computer-readable storage medium include an electrical connection having one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0141] The computer-readable signal medium can include a computer-readable storage medium that is configured to store and deliver a computer-readable program code. The computer-readable program code can be propagated as a computer-readable signal medium.

[0142] The program code included on the computer-readable medium can be transmitted using any suitable medium, including but not limited to wireless, wired, optical fiber, RF, etc., or any suitable combination of the foregoing.

[0143] The program code for carrying out operations of the present disclosure can be written in any combination of one or more programming languages, including an object-oriented programming language such as Java, C++, etc., and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code can execute entirely on the user's computing device, partly on the user's device, as a stand-alone software package, partly on the user's device and partly on a remote computing device or entirely on the remote computing device or server. In the latter scenario, the remote computing device can be connected to the user's device through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computing device, such as through the Internet using an Internet Service Provider.

[0144] It should be noted that, although several modules or units of the device for action execution are mentioned in the foregoing detailed description, such a division is not mandatory. Indeed, according to an embodiment of the present disclosure, features and functionalities of two or more modules or units described above can be embodied in one module or unit. Conversely, features and functionalities of one module or unit described above can be further divided into a plurality of modules or units.

[0145] Furthermore, although individual steps of the methods in the present disclosure are described in a particular order in the drawings, this is not required or implied as to the order in which the steps must be performed, or that all of the steps shown must be performed to achieve the desired result. Additionally or alternatively, certain steps can be omitted, combined into a single step, broken into multiple steps, and / or the like.

[0146] From the above description of the embodiments, those skilled in the art will readily perceive that the example embodiments described herein can be implemented by software and / or by software in combination with the necessary hardware. Thus, the technical solutions according to the embodiments of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash disk, a mobile hard disk, or the like) or a network, and includes a number of instructions to enable a computing device (which can be a personal computer, a server, a mobile terminal, or a network device, etc.) to perform the methods according to the embodiments of the present disclosure.

[0147] Other embodiments of the present disclosure will be apparent to those skilled in the art from consideration of the specification and practice of the present disclosure. This application is intended to cover any variations, uses, or adaptations of the present disclosure following the general principles thereof and including such departures from the present disclosure that come within known use or custom in the art to which the present disclosure pertains. The specification and examples are to be regarded as illustrative only, and the true scope and spirit of the present disclosure are indicated by the appended claims.

Claims

1. A network element anomaly prediction method, characterized by, The method comprises the steps of: dividing the collected network element operation data in the core network into normal index data and original abnormal index data based on different index types; performing time-based forward noise adding processing on the original abnormal index data to construct a noise-added index sequence; fusing the corresponding normal index data and the noise-added index sequence based on the time sequence to obtain a fusion sequence, including: converting the normal index data into an index data vector; inputting the index data vector into a Transformer encoder to perform encoding operation to obtain a normal encoding vector; and inputting the normal encoding vector and the noise-added index sequence into a cross-attention layer based on the time sequence; in the cross-attention layer, taking the noise-added index sequence as a query and the normal encoding vector as a key value, calculating the attention weight between the noise-added index sequence and the normal encoding vector, so that the noise-added index sequence pays attention to the key information in the normal index data; and fusing the key information into the noise-added index sequence to obtain the fusion sequence; or performing layer normalization operation on the noise-added index sequence to obtain a normalized sequence; compressing the normal encoding vector into a fixed length representation based on global pooling; extracting a scaling factor and an offset from the fixed length representation based on a multi-layer perceptron; adjusting the normalization parameter of the normalized sequence based on the scaling factor and the offset to fuse the information in the normal index data into the noise-added index sequence to obtain the fusion sequence; performing inverse operation of the forward noise adding processing on the fusion sequence to obtain diffusion abnormal index data; constructing network element time sequence data based on the normal index data and the diffusion abnormal index data to train an abnormal prediction model based on the network element time sequence data, and performing network element abnormal prediction operation based on the trained abnormal prediction model.

2. The network element anomaly prediction method of claim 1, wherein, performing time-based forward noise adding processing on the original abnormal index data to construct a noise-added index sequence, comprising: constructing a plurality of time points based on the time sequence, and determining the original abnormal index data as abnormal data at an initial time point; starting from the initial time point, gradually adding real noise values to the abnormal data based on the plurality of time points to obtain the noise-added index sequence.

3. The network element anomaly prediction method of claim 2, wherein, gradually adding real noise values to the abnormal data based on the plurality of time points, comprising: based on a decay coefficient and noise data obeying a normal distribution on the time sequence, performing addition of the real noise values between adjacent two time points.

4. The network element anomaly prediction method of claim 1, wherein, performing inverse operation of the forward noise adding processing on the fusion sequence to obtain diffusion abnormal index data, comprising: generating a reverse denoising model based on a neural network with an encoding layer and a decoding layer; inputting the fusion sequence into the reverse denoising model to perform multi-step iterative denoising operation as inverse operation of the forward noise adding processing; configuring an iteration termination condition based on a plurality of time points, and stopping iteration operation when it is detected that the multi-step iterative denoising operation meets the iteration termination condition, and obtaining the diffusion abnormal index data.

5. The network element anomaly prediction method of claim 4, wherein, inputting the fusion sequence into the reverse denoising model to perform multi-step iterative denoising operation, comprising: In the initial iteration denoising period, the fusion sequence is input into the encoding layer to perform feature extraction on the fusion sequence based on the encoding layer, to obtain index feature information; The index feature information is input into the decoding layer to predict noise based on the index feature information and the noise distribution at the current time, to obtain a predicted noise value; The predicted noise value is subtracted from the fusion sequence to obtain denoised data of the iteration denoising period, so as to take the denoised data as input information of the encoding layer of the next iteration denoising period.

6. The network element anomaly prediction method of claim 5, wherein, The reverse denoising model based on the neural network with the encoding layer and the decoding layer further includes: Calculate the error value between the corresponding predicted noise value and the real noise value; Calculate the mean square error based on the error value; If it is detected that the mean square error is greater than an error threshold, an optimization operation is performed on the reverse denoising model.

7. The network element anomaly prediction method of claim 1, wherein, Based on the normal index data and the diffusion abnormal index data, network element time sequence data is constructed, and an abnormal prediction model is trained based on the network element time sequence data, including: Align the normal index data and the diffusion abnormal index data based on the time sequence to obtain aligned index data; Based on the timestamp information, the aligned index data belonging to the same period are merged to obtain corresponding data samples, and the network element time sequence data is obtained based on a plurality of data samples on the time sequence; A sample label is added to each data sample, and the abnormal prediction model is trained based on the sample label.

8. A network element anomaly prediction apparatus, characterized by comprising: It includes: The division module is used for dividing the collected network element running data in the core network into normal index data and original abnormal index data based on different index types; The noise adding processing module is used for performing time sequence-based forward noise adding processing on the original abnormal index data to construct a noise-added index sequence; The fusion module is used for fusing the corresponding normal index data and noise-added index sequence based on the time sequence to obtain a fusion sequence, including: converting the normal index data into an index data vector; inputting the index data vector into a Transformer encoder to perform encoding operation to obtain a normal encoding vector; and Based on the time sequence, the normal encoding vector and the noise-added index sequence are input into a cross-attention layer; in the cross-attention layer, the noise-added index sequence is taken as a query, and the normal encoding vector is taken as a key value, the attention weight between the noise-added index sequence and the normal encoding vector is calculated, so that the noise-added index sequence pays attention to the key information in the normal index data; the key information is integrated into the noise-added index sequence to obtain the fusion sequence; or The noise-added index sequence is subjected to layer normalization operation to obtain a normalized sequence; the normal encoding vector is compressed into a fixed length representation based on global pooling; a scaling factor and an offset are extracted from the fixed length representation based on a multilayer perceptron; the normalization parameters of the normalized sequence are adjusted based on the scaling factor and the offset, so that the information in the normal index data is fused into the noise-added index sequence to obtain the fusion sequence; The inverse operation module is configured to perform an inverse operation of the forward noise adding process on the fusion sequence to obtain diffusion anomaly index data. The model training module is configured to construct network element time series data based on the normal index data and the diffusion anomaly index data, train an anomaly prediction model based on the network element time series data, and perform network element anomaly prediction based on the trained anomaly prediction model.

9. A network device, comprising: comprise: a processor; and a memory configured to store executable instructions of the processor; wherein the processor is configured to execute the executable instructions to perform the network element anomaly prediction method of any one of claims 1-7.

10. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the network element anomaly prediction method of any one of claims 1-7.

11. A computer program product having stored thereon a computer program, the computer program comprising: computer readable program means for causing a computer to perform the steps of the method according to any one of claims 1 to 10. The computer program is executed by the processor to implement the network element anomaly prediction method of any one of claims 1-7.

Images