High-throughput satellite ground network alarm monitoring method

Abstract

The invention discloses a high-throughput satellite ground network alarm monitoring method, which comprises the following steps: acquiring heterogeneous data of a ground network subsystem, and carrying out standardization processing on the heterogeneous data; processing the standardized data based on an alarm model to obtain alarm information; wherein when the heterogeneous data is subjected to standardization processing, the heterogeneous data is standardized into a structured tuple R = (TUTC, S, D and Draw), the TUTC represents a UTC millisecond timestamp, the TUTC = LocalTime + delta T, the delta T is time zone offset, the S represents Sourcetype, the D represents the analyzed structured data, and the Draw represents original data. Based on multivariate data fusion analysis, full-link situation presentation of high-throughput satellite network operation quality is realized, abnormal states of satellite-ground subsystem equipment and transmission links are accurately positioned, the service fault discovery time and the problem troubleshooting period are shortened, and the network service response efficiency is improved.

Description

Technical Field

[0001] The present invention relates to the field of information processing technology, and in particular to a high-throughput satellite ground network alarm monitoring method. Background Art

[0002] Traditional IT system alarm monitoring technology is based on IP networks, focusing on standardized equipment such as servers, switches, and routers. It uses network throughput, latency, and equipment performance as core monitoring indicators, and has a relatively unified and centralized architecture. However, high-throughput satellite communication ground systems have complex and diverse monitoring targets, covering subsystems such as satellite links, antennas, RF, baseband, routing, and business operation platforms. Due to the monitoring requirements of geographically distributed deployments (such as central stations and remote stations) and outdoor equipment (such as open-air antennas and sites in remote areas), the network architecture faces challenges such as diverse environments, heterogeneous equipment, and complex link hierarchies (the integration of satellite-to-ground links and ground links). Traditional IT monitoring's single indicator system struggles to cover these multi-dimensional monitoring needs. Summary of the Invention

[0003] The main purpose of the present invention is to provide a high-throughput satellite ground network alarm monitoring method to solve the deficiencies in the related art.

[0004] To achieve the above-mentioned object, according to a first aspect of the present invention, a high-throughput satellite ground network alarm monitoring method is provided, comprising acquiring heterogeneous data of a ground network subsystem and performing standardization processing on the heterogeneous data; processing the standardized data based on an alarm model to obtain alarm information; wherein, when performing standardization processing on the heterogeneous data, the heterogeneous data is standardized into a structured tuple R=(T UTC ,S,D,D raw ), the T UTC Indicates UTC millisecond timestamp, T UTC =LocalTime+ΔT, ΔT is the time zone offset, S represents Source_type, D represents the parsed structured data, raw Represents the original data.

[0005] Optionally, processing the standardized data based on the alarm model includes: normalizing the alarm parameter values ​​in the standardized data; weighting different indicators in a pre-built indicator system, wherein the indicator system includes indicators for implementing alarms for network service quality, indicators for implementing alarms for user experience quality, and indicators for implementing alarms for system design quality; and determining alarm information based on the alarm parameter values ​​and weighted indicators.

[0006] Optionally, when issuing an alarm for network service quality, the method includes: quantifying the impact weights of different data sources on business processes under the indicators used to issue an alarm for network service quality, wherein the data sources include network device logs, application performance monitoring data, and user behavior analysis data.

[0007] Optionally, when determining the influence weight, the method includes: constructing a comparison matrix A; based on the importance influence information a between the indicators in the matrix A ij Determine the weight vector w, where based on Calculate consistency index based on Calculate the consistency ratio, where n is the matrix order.

[0008] Optionally, when issuing an alarm for network service quality, the method includes: identifying key link nodes and parameter thresholds in a business process.

[0009] Optionally, identifying key link nodes and parameter thresholds in a business process includes: constructing a topology graph G(V,E) of the business process, calculating node centrality Among them, σ st is the number of shortest paths from node s to t, σ st (v) is the number of nodes v passed in the path; the threshold T is dynamically adjusted according to historical data, where T = μ + kσ, μ is the mean, σ is the standard deviation, and k is the safety factor.

[0010] Optionally, when issuing an alarm for network service quality, the method includes dynamically adjusting the alarm priority according to the importance of the data source: in, is the basic weight, S i (t) refers to the real-time importance score of data source i at time t, β is the adjustment coefficient, S max Score for maximum importance.

[0011] Optionally, when alerting the network service quality, the method includes verifying the consistency of multi-source data based on logic and trigger rules and a weighted confidence model; wherein the logic and trigger rule is Trigger=N∧A∧U, wherein N is the network device log, A is the application performance monitoring data, and U is the user behavior analysis data; the weighted confidence model is Among them, T conf is the confidence threshold.

[0012] According to a second aspect of the present invention, an electronic device is provided, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor executes the method described in any one implementation of the first aspect.

[0013] The high-throughput satellite ground network alarm monitoring method of this embodiment includes acquiring heterogeneous data of a ground network subsystem and performing standardization processing on the heterogeneous data; processing the standardized data based on an alarm model to obtain alarm information; wherein, when performing standardization processing on the heterogeneous data, the heterogeneous data is standardized into a structured tuple R=(T UTC ,S,D,D raw ), the T UTC Indicates UTC millisecond timestamp, T UTC =LocalTime+ΔT, ΔT is the time zone offset, S represents Source_type, D represents the parsed structured data, raw Represents raw data. Based on multivariate data fusion analysis, it presents the full-link status of high-throughput satellite network operation quality, accurately locates abnormal conditions of satellite-ground subsystem equipment and transmission links, shortens service fault discovery and troubleshooting cycles, and improves network service response efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] In order to more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the specific embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0015] Figure 1 This is a flow chart of a high-throughput satellite ground network alarm monitoring method according to an embodiment of the present invention;

[0016] Figure 2 is a schematic diagram of an application of the information screening method according to an embodiment of the present invention;

[0017] Figure 3 is a schematic diagram of an electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0018] In order to enable those skilled in the art to better understand the solutions of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the embodiments described are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of the present invention.

[0019] It should be noted that the terms "first," "second," and the like in the specification and claims of the present invention and the accompanying drawings are used to distinguish similar objects and are not necessarily used to describe a particular order or precedence. It should be understood that the terms used in this manner are interchangeable where appropriate for the embodiments of the present invention described herein. In addition, the terms "including," "having," and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product, or apparatus comprising a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units that are not explicitly listed or that are inherent to these processes, methods, products, or apparatuses.

[0020] It should be noted that, in the absence of conflict, the embodiments and features of the embodiments of the present invention can be combined with each other. The present invention will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0021] System architecture reference applicable to the method of this embodiment Figure 1 The High-Throughput Satellite Ground Network Intelligent Collaborative Alarm Monitoring System is a comprehensive operations and maintenance management platform that integrates CMDB configuration management, alarm data collection, aggregation, processing, analysis, and presentation. It provides real-time visualization of the operational status and alarm information of network-wide devices, systems, and applications. The system not only supports diverse alarm collection methods but also possesses powerful data processing and analysis capabilities, enabling in-depth exploration of the underlying causes and trends of alarms. Furthermore, through large-screen alarm monitoring and various notification methods, timely communication of alarm information and efficient response are ensured.

[0022] For example, the specific functional modules of the system are as follows:

[0023] (1) CMDB: Build a CMDB to configure network-wide devices, systems, and applications, and to associate alarm information and provide data queries. CMDB is a database that contains information about the entire lifecycle of configuration items and the relationships between them. It stores and manages various configuration information for devices in the enterprise IT architecture and is closely linked to all service support and service delivery processes, supporting the operation of these processes and leveraging the value of configuration information. This system provides configuration management capabilities and centrally records configuration information such as alarm sources.

[0024] (2) Alarm data collection module, responsible for collecting alarm data from all subsystems in the entire network. This includes network device monitoring, server monitoring, application monitoring, etc. The collection method may include SNMP, agent module, custom scripts, etc.

[0025] (3) Data aggregation module aggregates the collected alarm data using appropriate data transmission methods. This process needs to consider the network architecture and transmission protocol to ensure data security and efficiency.

[0026] (4) Data processing module processes the original alarm data, including standardization (unifying the level classification and semantic expression of different alarm sources), filtering (removing alarms that do not require attention), compression (removing duplicate alarms), and marking (marking alarms in special stages such as maintenance periods).

[0027] (5) Alarm analysis module, which performs in-depth analysis on the processed alarm data, including event clustering, event merging, root cause analysis, event mining, etc. This module may also need to be connected to the CMDB (configuration management database) system to obtain more comprehensive resource information.

[0028] (6) Alarm display module, which is displayed on the big screen, including 1) alarm extension display, which displays the alarm analysis results in a visual manner on the big screen. The display content can include multiple dimensions such as application response time ranking, asset operation status, alarm level distribution, asset classification abnormality statistics, asset alarm ranking, etc.; 2) full network device link topology, which generates the full network link topology based on the device information configured in the CMDB and associates the alarm display.

[0029] (7) Alarm notification module: In addition to displaying alarms on the interface, the unified alarm screen module can also support multiple notification methods such as email, SMS, and IM.

[0030] The high-throughput satellite ground network intelligent collaborative alarm monitoring system adopts a B / S (browser / server) architecture design. Users do not need to install a client and can access it by entering the service URL through a network-accessible computer browser. The front-end web service uses HTML5, JavaScript and a visual framework to build an interactive interface, supporting users to view alarms, configure alarm linkage rules, mark key alarms, and perform other operations; the back-end server is based on the Spring Boot architecture and interacts with the front-end in real time through a RESTful interface. At the same time, it obtains alarm data from each subsystem through the interface layer using HTTPS encryption protocol, message queues and other technologies. The front-end and back-end separation architecture decouples the business logic from the presentation layer. Users can view the alarm screen and operate configuration parameters in real time through the browser, while the back-end focuses on data processing, analysis and interface calls to ensure the system's cross-platform compatibility and ease of use.

[0031] In view of the professionalism and complexity of the monitoring objects of satellite communication ground systems (such as satellite links, antennas, radio frequencies, baseband boards, business operation platforms, etc.), the system breaks through the standardized equipment adaptation framework of traditional IT monitoring and builds a dedicated monitoring indicator system for satellite communication networks.

[0032] It integrates key parameters of the satellite-to-ground link (signal-to-noise ratio, throughput), equipment physical layer status (antenna azimuth, elevation angle, transmit power, baseband board status, etc.), network layer (throughput, latency, equipment performance), and platform layer (business operation logs, application service status, API interface performance, etc.). It supports distributed monitoring of outdoor equipment and remote sites, resolves the barriers to alarm data collection for heterogeneous equipment from multiple manufacturers, and achieves in-depth monitoring of the entire satellite network chain from "physical layer to link layer to business layer", filling the gap in traditional IT monitoring in the field of satellite-specific equipment.

[0033] According to an embodiment of the present invention, a high-throughput satellite ground network alarm monitoring method is provided, such as Figure 2 As shown, it includes the following steps 101 to 102:

[0034] Step 101: Obtain heterogeneous data of a ground network subsystem and perform standardization on the heterogeneous data.

[0035] Step 102: Process the standardized data based on the alarm model to obtain alarm information, wherein when the heterogeneous data is standardized, the heterogeneous data is standardized into a structured tuple R=(T UTC ,S,D,D raw ), the T UTC Indicates UTC millisecond timestamp, T UTC =LocalTime+ΔT, ΔT is the time zone offset, S represents Source_type, D represents the parsed structured data, raw Represents the original data.

[0036] This embodiment addresses the "indicator gap" problem caused by the independence of subsystems, builds a full-link data mapping and coordination mechanism, integrates the discrete data of each subsystem through subsystem status monitoring and unified alarm collection, and establishes a correlation model between the overall network indicators (such as system availability, service interruption rate, etc.) and the overall system indicators of the underlying equipment parameters and the subsystem operation indicators, and realizes network operation status awareness through unified alarm collection of operation status.

[0037] Standardized processing is achieved by integrating monitoring and alarm data from various sources, formats, and protocols. Data collection and standardization are first performed, supporting the access of heterogeneous data from multiple sources, such as logs, time series data, and application performance monitoring. Unstructured text and binary streams are converted using a common data model, with timestamps standardized to UTC millisecond accuracy. Data cleansing and quality enhancement are then performed. An alarm escalation mechanism model is also established, enabling the identification of service quality trends based on fluctuations in parameters across subsystems, devices, and networks, and escalating these to service-level alarms in real time.

[0038] For example, through a common data model and standardized protocols, multi-source heterogeneous data (such as logs, time series data, application performance monitoring, etc.) are integrated, and the timestamps are unified to UTC millisecond accuracy.

[0039] When defining the general data model structure, define a unified data structure and record the standardized data R as a structured tuple: R = (T UTC ,S,D,D raw ), where T UTC Indicates the UTC millisecond timestamp, S indicates Source_type (data source type, such as logs, time series data), D indicates Data (parsed structured data), raw Represents raw data (such as log text or binary stream).

[0040] Furthermore, the timestamp normalization (UTC millisecond level) process includes converting non-UTC timestamps to UTC millisecond level, using the formula: UTC =LocalTime+ΔT, where ΔT is the time zone offset (unit: milliseconds).

[0041] As an optional implementation method of this embodiment, processing the standardized data based on the alarm model includes: normalizing the alarm parameter values ​​in the standardized data; weighting different indicators in a pre-constructed indicator system, wherein the indicator system includes indicators for implementing alarms for network service quality, indicators for implementing alarms for user experience quality, and indicators for implementing alarms for system design quality; and determining alarm information based on the alarm parameter values ​​and the weighted indicators.

[0042] In this optional implementation method, a high-throughput satellite service evaluation index system is established: the three major evaluation indicators of high-throughput satellite network services managed in the current system include: user experience indicators, network operation indicators and network capability indicators.

[0043] For example, the user experience indicators cover the main service types carried by high-throughput satellite networks, including but not limited to IP-based voice services; data services such as files, commands, and images; and video services such as internet video on demand, live video, and video conferencing. Transmission directions include forward transmission, reverse transmission, and two-way interaction. Therefore, based on the perceived service experience requirements of different user types, five service categories, namely voice, web browsing, data transmission, video on demand, and video conferencing, were selected as representative applications for the collection of experience indicators.

[0044] For example, network operation indicators are key parameters for evaluating network availability, reliability, and network performance. These indicators provide network administrators with overall information about the current operating status of the network, helping to promptly discover and resolve problems and ensure smooth network operation.

[0045] For example, network performance indicators are key criteria for measuring network performance. Monitoring key indicators in network operation is crucial for professionals to optimize performance, solve problems and maintain network uptime.

[0046] The following parameters are for reference only and can be adjusted as needed:

[0047] User experience indicator parameters include, but are not limited to, high-throughput satellite link establishment time, mobile communication beam switching time, call drop rate, page response time, first screen display time, complete loading time, satellite network download rate ratio, satellite network upload rate ratio, satellite network data transmission delay, etc.

[0048] Network operation indicator parameters include, but are not limited to, online user uninterrupted rate, new network user uninterrupted rate, satellite terminal to master station delay, packet loss rate, satellite link jitter, ground link bandwidth utilization, beam bandwidth utilization, rate reachability, network security level protection, etc.;

[0049] Network performance indicator parameters include but are not limited to high-throughput satellite network throughput, number of satellite terminal accesses, number of concurrent services, satellite terminal peak transmission rate, network coverage, etc.

[0050] Since the high-throughput satellite network is a complex system, there are correlations and influences between capability indicators. The values ​​of various indicators have different dimensions. If the value ranges of various indicators vary too much, the role of a certain indicator will be too large or too small, resulting in unreasonable evaluation results. Therefore, it is necessary to normalize the alarm parameters. The steps to implement alarm based on normalization are as follows:

[0051] Step 1: Quantification and normalization of indicators: First, the values ​​of each indicator are dimensionless, and the actual values ​​of the indicators are converted into indicator evaluation values. In combination with the characteristics and needs of the service objects of the high-throughput satellite network, as well as the capabilities of high-throughput satellite networks at home and abroad, scoring rules for each indicator are set, and discrete data with inconsistent measurement units are normalized into quantitative scores within the value range of [0, 10].

[0052] Step 2: Indicator weighting: weight the evaluation indicators and comprehensively examine the contribution and importance of each indicator based on the interaction between the capability elements.

[0053] Step 3: Comprehensive evaluation: Calculate the comprehensive score based on the normalized scores and weights of each indicator.

[0054] As an optional implementation method of this embodiment, when issuing an alarm for network service quality, the method includes: quantifying the impact weights of different data sources under the indicators used to issue an alarm for network service quality on business processes, wherein the data sources include network device logs, application performance monitoring data, and user behavior analysis data.

[0055] As an optional implementation of this embodiment, when issuing an alarm for network service quality, the method includes: identifying key link nodes and parameter thresholds in a service process.

[0056] As an optional implementation of this embodiment, when issuing an alarm for network service quality, the method includes dynamically adjusting the alarm priority according to the importance of the data source: in, is the basic weight, S i (t) refers to the real-time importance score of data source i at time t, β is the adjustment coefficient, S max Score for maximum importance.

[0057] As an optional implementation of this embodiment, when alerting the network service quality, the method includes verifying the consistency of multi-source data based on logic and trigger rules and a weighted confidence model; wherein, the logic and trigger rule is Trigger=N∧A∧U, wherein N is the network device log, A is the application performance monitoring data, and U is the user behavior analysis data; the weighted confidence model is Among them, T conf is the confidence threshold.

[0058] In the aforementioned optional implementations, user experience metrics, network operation metrics, and network performance metrics are the three key aspects of the high-throughput satellite network service quality evaluation model, corresponding to user experience quality, network service quality, and system design quality, respectively. The converged alarm function primarily collects, analyzes, and reports network service quality metrics, with primary data sources including network device logs, application performance monitoring, and user behavior.

[0059] When realizing alarm discovery based on data fusion analysis, the accuracy and timeliness of alarms are improved through multi-dimensional integration and rule analysis, and alarm discovery in the business dimension is realized through alarm analysis. At the business dimension level, based on the network service quality indicator system (such as latency, packet loss rate, user access volume, etc.), the impact weight of each data source on the core business process is quantitatively evaluated, and key link nodes and parameter thresholds are identified. For high-frequency repeated alarm problems, short-term intensive events are marked, and dynamic weight coefficients are assigned according to the importance of the data source to achieve differentiated priority processing. Through the multi-source data cross-validation mechanism, when the same anomaly is triggered simultaneously by the three dimensions of network device logs, application performance monitoring, and user behavior analysis, an effective alarm is generated, effectively filtering out false alarms caused by fluctuations in a single data source.

[0060] As an optional implementation of this embodiment, the method for determining the influence weight includes: constructing a comparison matrix A; based on the importance influence information a between the indicators in the matrix A ij Determine the weight vector w, where based on Calculate consistency index based on Calculate the consistency ratio, where n is the matrix order.

[0061] In this optional implementation, the business dimension weight quantification model establishes a dynamic weight allocation mechanism by quantitatively evaluating the impact weight of each data source on the core business process.

[0062] For example, weight calculation is based on the Analytic Hierarchy Process (AHP). The AHP (AHP, suitable for multi-criteria decision-making problems) is a systematic, hierarchical analysis method that combines qualitative and quantitative methods. It decomposes complex problems into several levels and compares factors at each level to determine their relative importance. Consistency checks are then performed to ensure the rationality of the decision. This embodiment uses the AHP, combined with the main services of high-throughput satellites, to establish a business dimension weight quantification model to quantitatively assess the impact of each alarm data source on core business processes.

[0063] Specifically, the goal of weight calculation is to quantify the impact of network service quality indicators (such as delay, packet loss rate, user access volume, etc.) on business processes. The steps include constructing a pairwise comparison matrix A, where a ij It indicates the importance of indicator i relative to indicator j, and the scale judgment method adopts the 1-9 scale method.

[0064]

[0065] Among them, when calculating the weight vector w, the formula is

[0066] During consistency verification, the consistency index calculation formula is: Where n is the order of the matrix. The consistency ratio calculation formula is: If CR < 0.1, the judgment matrix is ​​guaranteed to have satisfactory consistency.

[0067] As an optional implementation of this embodiment, identifying key link nodes and parameter thresholds in a business process includes: constructing a topology graph G(V, E) of the business process, calculating node centrality, Among them, σ st is the number of shortest paths from node s to t, σ st (v) is the number of nodes v passed in the path; the threshold T is dynamically adjusted according to historical data, where T = μ + kσ, μ is the mean, σ is the standard deviation, and k is the safety factor.

[0068] In this optional implementation, the key link node identification goal is to identify the key link nodes and parameter thresholds in the business process. The steps include graph centrality analysis: constructing the business process topology graph G(V,E), calculating the node centrality (such as betweenness centrality C b (v)): Among them, σ st is the number of shortest paths from node s to t, σ st (v) is the number of nodes v passed in the path. Threshold determination: The threshold T is dynamically adjusted based on historical data. The formula is: T = μ + kσ, where μ is the mean, σ is the standard deviation, and k is the safety factor.

[0069] When performing high-frequency repeated alarm priority processing, priority differentiation processing is achieved through time series analysis and dynamic weight adjustment of high-frequency alarm information. For example, it includes short-term intensive event detection, using a sliding window statistical algorithm, defining a window time W (such as m minutes), and counting the number of alarms C in the window. The judgment condition is: C>θ and Where θ is the absolute threshold (e.g., m times), and α is the unit time density threshold (e.g., m times / second). It also includes dynamic weight adjustment model processing, the goal of which is to dynamically adjust the alarm priority based on the importance of the data source. Formula: in, is the basic weight (calculated by AHP), S i (t) refers to the real-time importance score of data source i at time t (e.g. based on historical fault correlation), β is the adjustment coefficient, S max Score for maximum importance.

[0070] Furthermore, the multi-source data cross-validation mechanism effectively filters out false alarms caused by fluctuations in a single data source through multi-dimensional data consistency verification. According to the preconditions, the alarm logic and trigger rules are designed. For example, when network device logs (N), application performance monitoring (A), and user behavior analysis (U) trigger an anomaly at the same time, an effective alarm is generated: Trigger = N∧A∧U. The goal of the weighted confidence model is to quantify the consistency of multi-source data and avoid false alarms. Formula Among them, w i represents the weight of data source i (calculated by the dynamic weight model), δ i Indicates the abnormal strength of data source i. Judgment condition: Confidence>T conf And Trigger=True, where T conf is the confidence threshold.

[0071] The following example scenarios are based on the above method. The values ​​are virtual and are only used to illustrate the alarm process:

[0072] (1) Assuming that the latency (weight w1 = 0.4), packet loss rate (weight w2 = 0.3), and user access volume (w3 = 0.3) of a certain business process together constitute an indicator system, then: Weight calculation: Determine the weight of each indicator through AHP.

[0073] (2) Identify key nodes: Find the betweenness centrality C of the core database nodes b =0.75, exceeding the threshold T=0.6, and marked as a key node.

[0074] (3) Dynamic adjustment: If the network device log (N) triggers alarms frequently recently, its importance score S N =0.9, dynamic weight is adjusted to: w N =0.4·(1+0.2·0.9 / 1.0)=0.472

[0075] (4) Cross-validation: When N, A, and U trigger anomalies at the same time and confidence = 0.85 > T conf (Assuming T conf=0.8), a valid alarm is generated.

[0076] As an optional implementation of this embodiment, when issuing an alarm for network service quality, the method includes obtaining a user-defined high-throughput satellite link joint criterion rule; and determining alarm information based on the criterion rule.

[0077] When implementing multi-parameter joint judgment and cross-system correlation orchestration, the original monitoring alarm data has problems such as data redundancy and inconsistent formats. The data is cleaned through alarm resource normalization processing technology to extract effective alarm information; data conversion is performed to unify time units and convert non-numeric data into numerical data to meet analysis requirements; data aggregation is implemented to integrate alarm information of the same source, type, and effect to reduce the complexity of alarm analysis.

[0078] Innovative custom correlation orchestration technology supports operations and maintenance personnel in defining custom alarm linkage rules based on business logic, such as sequential linkage relationships, time aggregation relationships, and trend triggering relationships. By applying rules based on operation and maintenance experience, we break through the limitations of single-system threshold alarms in traditional IT monitoring and build a multi-parameter joint judgment mechanism unique to satellite networks, improving the accuracy of fault diagnosis in complex scenarios. A unified alarm monitoring screen is established, and the system generates alarm information priority and relevance based on rules. The system can indicate the alarm urgency and ensure that critical alarms receive immediate response.

[0079] For example, the multi-parameter joint judgment mechanism and customized correlation orchestration technology support operation and maintenance personnel to customize alarm linkage rules based on business logic, build a multi-parameter joint judgment mechanism unique to high-throughput satellite networks, and generate corresponding alarms based on this judgment mechanism, thereby improving the accuracy of fault diagnosis in complex scenarios.

[0080] For example, the joint criterion formula for high-throughput satellite links is as follows:

[0081] if(m link >X)and(m beam >Y)and(m loss >Z) then alarm level = High, where m link Indicates the satellite link establishment time, m beam represents the beam switching time, m loss Indicates the packet loss rate;

[0082] In the above formula, if any two parameter indicators exceed the threshold, the alarm level is set to Middle;

[0083] In the above formula, if any parameter index exceeds the threshold, the alarm level is set to Low.

[0084] The above is an example of alarm association. The system supports operation and maintenance personnel to customize alarm linkage rules based on business logic, so that alarm rules can be flexibly responded to different alarm scenarios.

[0085] Furthermore, in combination with high-throughput satellite services, an alarm classification strategy can be established based on three dimensions: network device logs, application performance monitoring, and user behavior analysis. This allows alarm classification to be performed according to the alarm classification strategy when an alarm is generated. Alarm classification can be divided into physical level, link level, and business level. The physical level is directly related to alarms of hardware (antennas, radio frequency, baseband boards, routing equipment, etc.) or basic services (business operation platform anomalies); the link level affects the operating status of the satellite network, including alarms of terminal-to-master station delay, packet loss rate, satellite link jitter, ground link bandwidth utilization, beam bandwidth utilization, rate reachability, and network security level protection; the business level: indicators that affect business logic or user experience, including alarms of page response time, service establishment time, interaction delay, and timeout of freeze time.

[0086] Furthermore, this embodiment allows users to configure support for determining service quality trends based on fluctuations in parameters such as subsystem equipment and networks, and escalating them to service-level alarms in real time. For example, this includes triggering a primary alarm based on abnormal equipment parameters (e.g., CPU usage consistently exceeding 90%); performing trend analysis after detecting a continuous deterioration of an indicator (e.g., a Z-score exceeding a threshold and an increasing trend) through the streaming computing engine; and pre-setting an upgrade rule library to match upgrade rules and implement alarm upgrades. For example, if the upgrade rules are met, the alarm level is upgraded from "equipment level" to "service level," and relevant personnel are notified for timely handling.

[0087] The intelligent collaborative alarm monitoring method and system for high-throughput satellite ground networks proposed in this embodiment focuses on the three core requirements of satellite communication networks: "dedicated equipment alarm monitoring, cross-system collaboration, and adaptation to complex environments." It breaks through the universal limitations of traditional IT monitoring technology and builds a new alarm monitoring system with "specialized data collection, intelligent correlation analysis, global alarm presentation, and flexible operation and maintenance management." It provides full-link, high-precision, and highly reliable alarm monitoring capabilities for high-throughput satellite ground networks, effectively solves the "chimney-style" alarm monitoring defects of existing subsystems, and lays the technical foundation for network operation and maintenance services for large-scale user services.

[0088] The intelligent collaborative alarm monitoring method and system for high-throughput satellite ground networks addresses the technical challenges of monitoring and ensuring service quality as existing high-throughput satellite networks expand in user base. To address the high service quality requirements of satellite networks in sectors such as aviation, maritime navigation, and emergency communications, the system establishes a user-oriented indicator system that explores the inherent correlation between satellite-to-ground link equipment parameters, transmission line operation data, network service capabilities, and user perception indicators, enabling platform-wide alarm monitoring across the entire network.

[0089] Based on multi-dimensional data fusion analysis, this system provides a comprehensive overview of the operational quality of high-throughput satellite networks, accurately pinpointing abnormalities in satellite-to-ground subsystem equipment and transmission links, shortening service fault discovery and troubleshooting cycles, and improving network service response efficiency. Dynamic monitoring and intelligent alerting can effectively improve the quality of network user service, providing stable and reliable technical support for large-scale user access. This system facilitates the efficient application of high-throughput satellite networks in complex scenarios such as remote area communications and natural resource monitoring, laying the foundation for future network operations and maintenance for large-scale user services.

[0090] This embodiment overcomes the following defects in the related art through the above method:

[0091] (1) The monitoring objects and architecture of related technologies are more complex than those of traditional IT facilities. For example, traditional IT system alarm monitoring technology is based on IP networks, focusing on standardized equipment such as servers, switches, and routers, with network throughput, latency, and equipment performance as core monitoring indicators. The architecture is relatively unified and centralized. However, the monitoring objects of high-throughput satellite communication ground systems are complex and diverse, covering subsystems such as satellite links, antennas, radio frequency, baseband, routing, and business operation platforms. Due to the monitoring requirements of geographically distributed deployment (such as central stations and remote stations) and outdoor equipment (such as open-air antennas and sites in remote areas), the network architecture faces challenges such as environmental diversity, equipment heterogeneity, and link layer complexity (integration of satellite-to-ground links and ground links). The single indicator system of traditional IT monitoring is difficult to cover its multi-dimensional monitoring needs.

[0092] (2) The independence of the technical subsystems leads to a lack of indicator mapping. Due to different construction goals, technical routes, and management entities, the subsystems of the high-throughput satellite ground network form independent and closed technical systems. The alarm specifications, data formats, and interface protocols of each system vary significantly. The current lack of a unified indicator association model leads to a vague mapping relationship between the overall network operation indicators (such as link availability and service interruption rate) and the underlying parameters of the subsystem equipment (such as RF signal power and antenna pointing deviation). It is impossible to reversely infer the root cause of the underlying fault from the upper-layer service anomaly, and it is difficult to judge the service quality trend from the fluctuation of equipment parameters, which restricts the ability to locate and coordinate faults in the entire link.

[0093] (3) The weak management efficiency of relevant technical data restricts analytical capabilities. The network management servers of various subsystems mostly use general-purpose storage devices rather than professional-grade data storage systems, making it difficult to carry massive amounts of monitoring data such as logs, traffic, and equipment status. As the monitoring dimensions become more refined and the frequency of data collection increases, the storage capacity bottleneck problem becomes more prominent, making it difficult to trace historical data and limiting long-term trend analysis. Operation and maintenance personnel are unable to identify equipment performance degradation patterns or potential risks to network operations through alarm data, and the value of data is not fully utilized.

[0094] (4) Related technologies: The IT monitoring technology system lacks adaptability. Traditional IT monitoring relies on standardized protocols (such as SNMP, API) and centralized data collection modes, which are suitable for network environments with high equipment homogeneity and standardized interfaces. However, the high-throughput satellite ground network subsystems collaborate closely and the cross-system fault correlation is complex. It is necessary to realize the fusion analysis and cross-system alarm linkage of multi-source heterogeneous data (such as RF signal parameters, baseband board status, and business platform logs). Due to the lack of the ability to parse special equipment protocols, the ability to model complex environmental parameters, and the logic engine for multi-system collaboration, the traditional technology system cannot meet the core requirements of high-throughput ground networks for "full-link alarm monitoring, cross-system linkage, and both real-time and reliability". Targeted technical architectures and solutions are urgently needed.

[0095] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0096] Figure 3 A schematic block diagram of an example electronic device 300 that can be used to implement embodiments of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smartphones, wearable devices, and other similar computing devices.

[0097] like Figure 3 As shown, the electronic device 300 includes a computing unit 301, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 302 or a computer program loaded from a storage unit 308 into a random access memory (RAM) 303. Various programs and data required for the operation of the electronic device 300 can also be stored in the RAM 303. The computing unit 301, the ROM 302, and the RAM 303 are connected to each other via a bus 304. An input / output (I / O) interface 305 is also connected to the bus 304.

[0098] Multiple components in the electronic device 300 are connected to the I / O interface 305, including an input unit 306, such as a keyboard, a mouse, etc.; an output unit 307, such as various types of displays, speakers, etc.; a storage unit 308, such as a magnetic disk, an optical disk, etc.; and a communication unit 309, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 309 allows the electronic device 300 to exchange information / data with other devices via a computer network such as the Internet and / or various telecommunication networks.

[0099] The computing unit 301 can be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 301 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units that run machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The computing unit 301 performs the various methods and processes described above, such as the object matching method. For example, in some embodiments, the object matching method can be implemented as a computer software program that is tangibly contained in a machine-readable medium, such as the storage unit 308. In some embodiments, part or all of the computer program can be loaded and / or installed on the electronic device 300 via the ROM 302 and / or the communication unit 309. When the computer program is loaded into the RAM 303 and executed by the computing unit 301, one or more steps of the method described above can be performed.

[0100] Various embodiments of the systems and techniques described herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), system-on-chip systems (SOCs), programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments can include being implemented in one or more computer programs that are executable and / or interpreted on a programmable system that includes at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0101] The program code for implementing the method of the present invention can be written in any combination of one or more programming languages. Such program code can be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device so that when the program code is executed by the processor or controller, the functions / operations specified in the flow chart and / or block diagram are implemented. The program code can be executed entirely on the machine, partially on the machine, as a stand-alone software package, partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0102] In the context of the present invention, machine-readable medium can be a tangible medium that can contain or store a program for use with an instruction execution system, device or equipment or used in combination with an instruction execution system, device or equipment. Machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. Machine-readable medium can include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. More specific examples of machine-readable storage media can include electrical connections based on one or more lines, portable computer disks, hard disks, random access memories (RAM), read-only memories (ROM), erasable programmable read-only memories (EPROM or flash memory), optical fibers, portable compact disk read-only memories (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

Claims

1. A high-throughput satellite ground network alarm monitoring method, characterized in that: include: Acquiring heterogeneous data of a ground network subsystem and performing standardization on the heterogeneous data; Processing the standardized data based on the alarm model to obtain alarm information; When the heterogeneous data is standardized, the heterogeneous data is standardized into a structured tuple R=(T UTC ,S,D,D raw ), the T UTC Indicates UTC millisecond timestamp, T UTC =LocalTime+ΔT, ΔT is the time zone offset, S represents Source_type, D represents the parsed structured data, raw Represents the original data.

2. The high-throughput satellite ground network alarm monitoring method according to claim 1, characterized in that: Processing the standardized data based on the alarm model includes: Normalize the alarm parameter values ​​in the standardized data; Assigning weights to different indicators in a pre-built indicator system, where the indicator system includes indicators for implementing alerts on network service quality, indicators for implementing alerts on user experience quality, and indicators for implementing alerts on system design quality; Alarm information is determined based on the alarm parameter value and the weighted indicator.

3. The high-throughput satellite ground network alarm monitoring method according to claim 2, characterized in that: When issuing an alarm for network service quality, the method includes: quantifying the impact weights of different data sources under the indicators used to issue an alarm for network service quality on business processes, wherein the data sources include network device logs, application performance monitoring data, and user behavior analysis data.

4. The high-throughput satellite ground network alarm monitoring method according to claim 3, characterized in that: Methods for determining impact weights include: Construct comparison matrix A; Based on the importance influence information a between the indicators in matrix A ij Determine the weight vector w, where based on Calculate consistency index based on Calculate the consistency ratio, where n is the matrix order.

5. The high-throughput satellite ground network alarm monitoring method according to claim 3, characterized in that: When issuing an alarm for network service quality, the method includes: identifying key link nodes and parameter thresholds in the business process.

6. The high-throughput satellite ground network alarm monitoring method according to claim 5, characterized in that: Identifying key link nodes and parameter thresholds in business processes includes: Build the topology graph G(V,E) of the business process and calculate the node centrality Among them, σ st is the number of shortest paths from node s to t, σ st (v) is the number of nodes v passed through in the path; The threshold T is dynamically adjusted according to historical data, where T = μ + kσ, μ is the mean, σ is the standard deviation, and k is the safety factor.

7. The high-throughput satellite ground network alarm monitoring method according to claim 5, characterized in that: When alerting on network service quality, methods include dynamically adjusting the alert priority based on the importance of the data source: in, is the basic weight, S i (t) refers to the real-time importance score of data source i at time t, β is the adjustment coefficient, S max Score for maximum importance.

8. The high-throughput satellite ground network alarm monitoring method according to claim 7, characterized in that: When alerting on network service quality, the method includes consistency verification of multi-source data based on logic and trigger rules and weighted confidence models; The logic-and trigger rule is Trigger = N∧A∧U, where N is the network device log, A is the application performance monitoring data, and U is the user behavior analysis data; The weighted confidence model is Among them, T conf is the confidence threshold.

9. The high-throughput satellite ground network alarm monitoring method according to any one of claims 1 to 8, characterized in that: When issuing an alarm for network service quality, the method includes obtaining a user-defined high-throughput satellite link joint criterion rule; and determining alarm information based on the criterion rule.

10. An electronic device, characterized in that: include: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor to enable the at least one processor to perform the method according to any one of claims 1 to 7.

Images