Optical fiber network traffic anomaly detection method, device, equipment and medium

Abstract

Embodiments of the present application disclose a method, device, equipment and medium for detecting abnormal traffic of an optical fiber network. The method comprises: obtaining optical power, bit error rate, optical signal-to-noise ratio, traffic value, dynamic traffic mean value and dynamic traffic standard deviation corresponding to each optical fiber transmission path at the current time; determining optical signal quality indexes corresponding to each optical fiber transmission path according to the optical power, bit error rate and optical signal-to-noise ratio corresponding to each optical fiber transmission path; determining traffic abnormality degrees corresponding to each optical fiber transmission path according to the traffic value, dynamic traffic mean value and dynamic traffic standard deviation corresponding to each optical fiber transmission path; determining abnormal probabilities of each optical fiber transmission path according to the corresponding optical signal quality indexes and traffic abnormality degrees; and determining optical fiber transmission paths with abnormal probabilities greater than a preset probability threshold in a plurality of optical fiber transmission paths as abnormal optical fiber transmission paths. The method of the embodiments of the present application can be used to predict traffic abnormality of optical fiber transmission paths.

Description

Technical Field

[0001] This application relates to the field of fiber optic network monitoring technology, and in particular to methods, devices, equipment and media for detecting abnormal traffic in fiber optic networks. Background Technology

[0002] A communication network is a system that transmits information from one location to another using various communication devices and technologies. This information can take many forms, such as voice, video, and data. In practical applications, a communication network typically contains multiple fiber optic transmission paths. When the system detects an anomaly in a running fiber optic transmission path, it switches the communication to another fiber optic transmission path that is functioning correctly.

[0003] However, existing systems lack anomaly prediction mechanisms for fiber optic transmission paths, making it impossible to change paths in advance. For some communication networks with high requirements for real-time performance and stability, anomalies in the running fiber optic transmission path can lead to communication interruptions, excessively high information transmission delays, or excessively high packet loss rates, resulting in poor stability of the communication network. Summary of the Invention

[0004] This application provides a method, apparatus, device, and medium for detecting abnormal traffic in optical fiber networks, which can predict anomalies in optical fiber transmission paths to improve the stability of communication networks.

[0005] In a first aspect, embodiments of this application provide a method for detecting abnormal traffic in an optical fiber network. The method is used to detect abnormal traffic on multiple optical fiber transmission paths in a communication network. The method includes:

[0006] Obtain the optical power, bit error rate, optical signal-to-noise ratio, flow rate, dynamic flow rate mean, and dynamic flow rate standard deviation for each optical fiber transmission path at the current time.

[0007] Based on the optical power, bit error rate and optical signal-to-noise ratio corresponding to each optical fiber transmission path, the optical signal quality index corresponding to each optical fiber transmission path is determined.

[0008] Based on the flow value, the dynamic flow mean, and the flow dynamic standard deviation corresponding to each optical fiber transmission path, the flow anomaly degree corresponding to each optical fiber transmission path is determined.

[0009] Based on the optical signal quality index and the traffic anomaly degree corresponding to each optical fiber transmission path, the anomaly probability corresponding to each optical fiber transmission path at the target time is determined, where the target time is the time after the first preset duration of the current time.

[0010] The fiber optic transmission path with an anomaly probability greater than a preset probability threshold among the multiple fiber optic transmission paths is identified as an abnormal fiber optic transmission path, which is the fiber optic transmission path that is predicted to have abnormal network traffic at the target time.

[0011] In some embodiments, the traffic anomaly prediction model includes an LSTM prediction model; determining the anomaly probability of each optical fiber transmission path at the target time based on the optical signal quality index and the traffic anomaly degree corresponding to each optical fiber transmission path includes:

[0012] Based on the LSTM prediction model and the target time-series feature matrix of each optical fiber transmission path, the anomaly probability of each optical fiber transmission path at the target time is determined.

[0013] The target time-series feature matrix includes the optical signal quality index and traffic anomaly degree corresponding to the optical fiber transmission path at each window time within a preset time window. The end time value of the preset time window is the current time. The time start value and the time end value of the preset time window are spaced apart by a second preset time. The preset time window includes multiple window times, and the multiple window times include the current time.

[0014] In some embodiments, the traffic anomaly prediction model includes a first LSTM prediction model and a second LSTM prediction model; determining the anomaly probability of each optical fiber transmission path at the target time based on the optical signal quality index and the traffic anomaly degree corresponding to each optical fiber transmission path includes:

[0015] Based on the first LSTM prediction model and the first time-series feature matrix corresponding to each optical fiber transmission path, the first probability of each optical fiber transmission path at the target time is determined. The first time-series feature matrix includes the optical signal quality index corresponding to each optical fiber transmission path at each window time within a preset time window. The end time value of the preset time window is the current time. The time start value and the time end value of the preset time window are separated by a third preset time. The preset time window includes multiple window times, and the multiple window times include the current time.

[0016] Based on the second LSTM prediction model and the second time-series feature matrix corresponding to each optical fiber transmission path, the second probability of each optical fiber transmission path at the target time is determined. The second time-series feature matrix includes the traffic anomaly degree of the corresponding optical fiber transmission path at each window time within a preset time window.

[0017] The anomaly probability is determined based on the first probability and the second probability.

[0018] In some embodiments, determining the optical signal quality index corresponding to each of the optical fiber transmission paths based on the optical power, the bit error rate, and the optical signal-to-noise ratio corresponding to each of the optical fiber transmission paths includes:

[0019] Based on the preset optical signal quality index calculation formula, the optical power, bit error rate, and optical signal-to-noise ratio corresponding to each optical fiber transmission path, the optical signal quality index corresponding to each optical fiber transmission path is determined. The optical signal quality index calculation formula is as follows:

[0020]

[0021] in, Here, w1 represents the optical signal quality index, k is the fiber optic transmission path number, t is the current time, and w1, w2, and w3 are all weighting coefficients. The bit error rate is... The optical power, For the optical signal-to-noise ratio, BER ref and P ref All values ​​are reference baselines.

[0022] In some embodiments, determining the traffic anomaly degree corresponding to each of the optical fiber transmission paths based on the traffic value, the dynamic traffic mean, and the traffic dynamic standard deviation corresponding to each of the optical fiber transmission paths includes:

[0023] Based on the preset traffic anomaly calculation formula, the traffic value corresponding to each of the optical fiber transmission paths, the dynamic traffic mean, and the dynamic standard deviation of traffic, the traffic anomaly degree corresponding to each of the optical fiber transmission paths is determined. The traffic anomaly calculation formula is as follows:

[0024]

[0025] in, The traffic anomaly is defined as k, the fiber optic transmission path number, and t as the current time. The flow rate value, The dynamic average flow rate is... Let the dynamic standard deviation of the flow rate be denoted as . It is a measure of the randomness of the flow distribution within the time window t-Δt:t.

[0026] In some embodiments, after determining the optical fiber transmission path with an anomaly probability greater than a preset probability threshold among the multiple optical fiber transmission paths as an abnormal optical fiber transmission path, the method further includes:

[0027] A fiber optic traffic anomaly warning is sent to a preset user terminal. The fiber optic traffic anomaly warning carries the path identifier of the abnormal fiber optic transmission path.

[0028] In some embodiments, the method further includes:

[0029] Receive real-time monitoring commands for fiber optic network traffic sent by user terminals;

[0030] In response to the real-time monitoring command for fiber optic network traffic, traffic information corresponding to each of the fiber optic transmission paths is obtained;

[0031] The traffic information is returned to the user terminal.

[0032] Secondly, embodiments of this application also provide an optical fiber network traffic anomaly detection device. This device is used to detect traffic anomalies on multiple optical fiber transmission paths in a communication network. The device includes a transceiver unit and a processing unit, wherein:

[0033] The transceiver unit is used to obtain the optical power, bit error rate, optical signal-to-noise ratio, flow rate, dynamic flow rate mean, and flow rate dynamic standard deviation of each optical fiber transmission path at the current time.

[0034] The processing unit is configured to: determine the optical signal quality index corresponding to each optical fiber transmission path based on the optical power, bit error rate, and optical signal-to-noise ratio corresponding to each optical fiber transmission path; determine the traffic anomaly degree corresponding to each optical fiber transmission path based on the traffic value, dynamic traffic mean, and traffic dynamic standard deviation corresponding to each optical fiber transmission path; determine the anomaly probability corresponding to each optical fiber transmission path at a target time based on the optical signal quality index and traffic anomaly degree corresponding to each optical fiber transmission path, wherein the target time is a time after a first preset duration from the current time; and identify the optical fiber transmission paths among the multiple optical fiber transmission paths whose anomaly probability is greater than a preset probability threshold as abnormal optical fiber transmission paths, wherein the abnormal optical fiber transmission paths are optical fiber transmission paths predicted to have network traffic anomalies at the target time.

[0035] Thirdly, embodiments of this application also provide a computer device, which includes a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the above-described method.

[0036] Fourthly, embodiments of this application also provide a computer-readable storage medium storing a computer program, the computer program including program instructions that, when executed by a processor, can implement the above-described method.

[0037] This application provides a method, apparatus, device, and medium for detecting abnormal traffic in optical fiber networks. The method is used to detect abnormal traffic on multiple optical fiber transmission paths in a communication network. The method includes: acquiring the optical power, bit error rate, optical signal-to-noise ratio, traffic value, dynamic average traffic value, and dynamic standard deviation of traffic for each optical fiber transmission path at the current time; determining the optical signal quality index for each optical fiber transmission path based on the optical power, bit error rate, and optical signal-to-noise ratio; determining the traffic anomaly degree for each optical fiber transmission path based on the traffic value, dynamic average traffic value, and dynamic standard deviation of traffic; determining the anomaly probability for each optical fiber transmission path at a target time based on the optical signal quality index and traffic anomaly degree, where the target time is a time after a first preset duration from the current time; and identifying optical fiber transmission paths with an anomaly probability greater than a preset probability threshold as abnormal optical fiber transmission paths, which are predicted to have network traffic anomalies at the target time. The embodiments of this application can predict anomalies in optical fiber transmission paths. Based on the anomaly prediction results, optical fiber transmission paths that are predicted to be abnormal can be switched in advance, thereby improving the stability of the communication network. Attached Figure Description

[0038] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0039] Figure 1 A flowchart illustrating the fiber optic network traffic anomaly detection method provided in this application embodiment;

[0040] Figure 2 A schematic diagram of a sub-process of the fiber optic network traffic anomaly detection method provided in an embodiment of this application;

[0041] Figure 3 This is another schematic diagram of a sub-process of the fiber optic network traffic anomaly detection method provided in the embodiments of this application;

[0042] Figure 4A schematic diagram of an interface for fiber optic network traffic monitoring in the fiber optic network traffic anomaly detection method provided in this application embodiment;

[0043] Figure 5 A schematic block diagram of an optical fiber network traffic anomaly detection device provided in an embodiment of this application;

[0044] Figure 6 A schematic block diagram of a computer device provided in an embodiment of this application. Detailed Implementation

[0045] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this application. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0046] It should be understood that, when used in this specification and the appended claims, the terms "comprising" and "including" indicate the presence of the described features, integrals, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or collections thereof.

[0047] It should also be understood that the terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to limit the scope of the application. As used in this specification and the appended claims, the singular forms “a,” “an,” and “the” are intended to include the plural forms unless the context clearly indicates otherwise.

[0048] It should also be further understood that the term “and / or” as used in this application specification and the appended claims means any combination of one or more of the associated listed items and all possible combinations, and includes such combinations.

[0049] This application provides a method, apparatus, device, and medium for detecting abnormal traffic in optical fiber networks.

[0050] The entity executing the fiber optic network traffic anomaly detection method can be the fiber optic network traffic anomaly detection device provided in the embodiments of this application, or a computer device that integrates the fiber optic network traffic anomaly detection device. The fiber optic network traffic anomaly detection method provided in this application is used to detect traffic anomalies in multiple fiber optic transmission paths in a communication network. Specifically, it acquires the optical power, bit error rate, optical signal-to-noise ratio, traffic value, dynamic average traffic value, and dynamic standard deviation of traffic for each fiber optic transmission path at the current time; determines the optical signal quality index for each fiber optic transmission path based on the optical power, bit error rate, and optical signal-to-noise ratio; determines the traffic anomaly degree for each fiber optic transmission path based on the traffic value, dynamic average traffic value, and dynamic standard deviation of traffic; determines the anomaly probability for each fiber optic transmission path at a target time based on the optical signal quality index and traffic anomaly degree, where the target time is a time after a first preset duration from the current time; and identifies fiber optic transmission paths with an anomaly probability greater than a preset probability threshold as abnormal fiber optic transmission paths, which are predicted to have network traffic anomalies at the target time. The embodiments of this application can predict anomalies in optical fiber transmission paths. Based on the anomaly prediction results, the optical fiber transmission paths that are predicted to be abnormal can be switched in advance, reducing the occurrence of communication interruptions and other problems caused by anomalies in optical fiber transmission paths, thereby improving the stability of the communication network.

[0051] Figure 1 This is a flowchart illustrating the fiber optic network traffic anomaly detection method provided in an embodiment of this application. Figure 1 As shown, the method includes the following steps S110-S150.

[0052] S110. Obtain the optical power, bit error rate, optical signal-to-noise ratio, flow rate, dynamic flow rate mean, and flow rate dynamic standard deviation for each optical fiber transmission path at the current time.

[0053] Among them, optical power indicates the power intensity of the optical signal during transmission in the optical fiber, which can be obtained by an optical power meter in the corresponding path; bit error rate indicates the ratio of the number of erroneous bits to the total number of transmitted bits during transmission, and the bit error rate at the current moment is the ratio of the number of erroneous bits to the total number of transmitted bits from the preset period before the current moment (e.g., 3 minutes) to the current moment, which can be obtained by a bit error rate tester in the corresponding path; optical signal-to-noise ratio indicates the ratio of signal power to noise power, which can be obtained by a spectrum analyzer in the corresponding path; traffic flow is the amount of data passing through the current path per unit time, which can be obtained by a port counter in the corresponding path; dynamic traffic mean is the current exponentially smoothed average value based on historical data, reflecting the traffic baseline; and dynamic standard deviation of traffic flow is the dynamic standard deviation of the current traffic flow fluctuation, used to measure burstiness.

[0054] Specifically, the formula for calculating the dynamic average flow rate is as follows:

[0055]

[0056] in, Let be the average dynamic traffic of the k-th fiber optic transmission path at time t (the current time), and α be a smoothing factor, such as 0.9. Let be the average dynamic flow of path k at the previous time (t-1). The flow rate of the k-th fiber optic transmission path at time t.

[0057] The formula for calculating the dynamic standard deviation of flow is:

[0058]

[0059] in, Let be the dynamic standard deviation of the traffic flow along the k-th fiber optic transmission path at time t (the current time), and β be a smoothing factor, such as 0.85. Let be the dynamic standard deviation of the flow of path k at the previous time (t-1). The flow rate of the k-th fiber optic transmission path at time t. Let be the average dynamic traffic of the k-th fiber optic transmission path at time t (the current time).

[0060] S120. Determine the optical signal quality index corresponding to each optical fiber transmission path based on the optical power, bit error rate, and optical signal-to-noise ratio corresponding to each optical fiber transmission path.

[0061] In this embodiment, the optical signal quality index is used to comprehensively quantify the health status of the optical fiber transmission path; the larger the value, the more stable the path.

[0062] In some embodiments, step S120 includes:

[0063] Based on the preset optical signal quality index calculation formula, the optical power, bit error rate, and optical signal-to-noise ratio corresponding to each optical fiber transmission path, the optical signal quality index corresponding to each optical fiber transmission path is determined. The optical signal quality index calculation formula is as follows:

[0064]

[0065] in, Here, w1 represents the optical signal quality index, k is the fiber optic transmission path number, t is the current time, and w1, w2, and w3 are all weighting coefficients. The bit error rate is... The optical power, For the optical signal-to-noise ratio, BER ref and P ref All values ​​are reference baselines.

[0066] Specifically, in some embodiments, w1, w2, and w3 can be set to 0.4, 0.3, and 0.3 by default to balance the importance of different metrics. BER ref It can be 10 -12 P ref It can be -20dBm for normalization calculations.

[0067] S130. Determine the traffic anomaly degree corresponding to each optical fiber transmission path based on the traffic value, the dynamic traffic mean, and the traffic dynamic standard deviation corresponding to each optical fiber transmission path.

[0068] In this embodiment, the traffic anomaly level is used to detect sudden traffic surges (such as DDoS attacks) or abnormal congestion.

[0069] In some embodiments, step S130 includes:

[0070] Based on the preset traffic anomaly calculation formula, the traffic value corresponding to each of the optical fiber transmission paths, the dynamic traffic mean, and the dynamic standard deviation of traffic, the traffic anomaly degree corresponding to each of the optical fiber transmission paths is determined. The traffic anomaly calculation formula is as follows:

[0071]

[0072] in, The traffic anomaly is defined as k, the fiber optic transmission path number, and t as the current time. The flow rate value, The dynamic average flow rate is... Let the dynamic standard deviation of the flow rate be denoted as . It is a measure of the randomness of the flow distribution within the time window t-Δt:t.

[0073] S140. Based on the optical signal quality index and the traffic anomaly degree corresponding to each optical fiber transmission path, determine the anomaly probability corresponding to each optical fiber transmission path at the target time, wherein the target time is the time after the current time for a first preset duration.

[0074] In some embodiments, the traffic anomaly prediction model includes a Long Short Term Memory (LSTM) model, in which case step S140 includes:

[0075] Based on the LSTM prediction model and the target time-series feature matrix of each optical fiber transmission path, the first probability of each optical fiber transmission path at the target time is determined.

[0076] The target time-series feature matrix includes the optical signal quality index and traffic anomaly degree corresponding to the optical fiber transmission path at each window time within a preset time window. The end time value of the preset time window is the current time. The time start value and the time end value of the preset time window are separated by a second preset time. The preset time window includes multiple window times, including the current time. The time interval between each window time is an anomaly detection interval (e.g., 1 minute). The multiple window times include the current time. The second preset time is longer than the first preset time.

[0077] Specifically, X t-n:t The target time-series feature matrix is ​​defined as follows: n is the second preset duration, such as 10 minutes; k is the fiber optic transmission path number; and t is the current time.

[0078] The LSTM prediction model can be used to predict the probability of an anomaly occurring in the fiber optic transmission path at a target time based on short-term fluctuations in data.

[0079] In other embodiments, the anomaly probability can be calculated based on the optical signal quality index and the traffic anomaly degree, and then the final anomaly probability can be determined based on the anomaly probabilities calculated based on the optical signal quality index and the traffic anomaly degree, respectively; in this case, such as Figure 2 As shown, step S140 includes:

[0080] S1401. Based on the first LSTM prediction model and the first time-series feature matrix corresponding to each optical fiber transmission path, determine the first probability of each optical fiber transmission path at the target time. The first time-series feature matrix includes the optical signal quality index corresponding to the optical fiber transmission path at each window time within a preset time window.

[0081] Wherein, the end time value of the preset time window is the current time, the time start value of the preset time window is separated from the time end value by a third preset time, the preset time window includes multiple window times, and the multiple window times include the current time; the third preset time is greater than or equal to the second preset time, or it may not be equal to the second preset time, and the third preset time is greater than the first preset time.

[0082] S1402. Based on the second LSTM prediction model and the second time-series feature matrix corresponding to each optical fiber transmission path, determine the second probability of each optical fiber transmission path at the target time. The second time-series feature matrix includes the traffic anomaly degree of the corresponding optical fiber transmission path at each window time within a preset time window.

[0083] S1403. Determine the anomaly probability based on the first probability and the second probability.

[0084] Specifically, after obtaining the first probability and the second probability, the abnormal probability is determined based on the first probability, the second probability, the preset weight value of the first probability, and the preset weight value of the second probability.

[0085] In this application, the preset time window is a sliding time window.

[0086] S150. Among the multiple optical fiber transmission paths, the optical fiber transmission path with an abnormal probability greater than a preset probability threshold is determined as an abnormal optical fiber transmission path, wherein the abnormal optical fiber transmission path is the optical fiber transmission path that is predicted to have abnormal network traffic at the target time.

[0087] In this embodiment, the preset probability threshold can be 60%, or it can be set to other values ​​as needed. This embodiment does not limit the specific value of the preset probability threshold.

[0088] In some embodiments, when an abnormal fiber optic transmission path is determined to exist, an abnormal fiber optic traffic warning needs to be sent to a preset user terminal. The abnormal fiber optic traffic warning carries the path identifier of the abnormal fiber optic transmission path.

[0089] Specifically, when an abnormal fiber optic transmission path is identified, a fiber optic prediction anomaly alert is sent to staff via SMS or other means, reminding them to investigate fiber optic obstacles, perform fiber optic switching (switching all traffic) or switch some traffic.

[0090] In other embodiments, when an abnormal fiber optic transmission path is identified, or when staff determine that partial traffic switching is necessary based on abnormal fiber optic traffic warnings, this embodiment can also automatically switch the fiber optic transmission path for the abnormal fiber optic transmission path, such as... Figure 3 As shown, the specific switching method is as follows:

[0091] S160. Determine multiple alternative optical fiber transmission paths corresponding to the abnormal optical fiber transmission path.

[0092] S170. Obtain the current bandwidth and delay value corresponding to each of the candidate optical fiber transmission paths.

[0093] S180. Determine the target optical fiber transmission path from the plurality of candidate optical fiber transmission paths based on the current bandwidth and the delay value.

[0094] S190, Switch a portion of the traffic from the abnormal fiber optic transmission path to the target fiber optic transmission path.

[0095] Specifically, based on a preset network topology, multiple alternative fiber optic transmission paths corresponding to abnormal fiber optic transmission paths can be obtained. Then, the current bandwidth and delay value of each alternative fiber optic transmission path can be obtained. Then, the remaining bandwidth of each alternative fiber optic transmission path can be determined based on the current bandwidth and the total bandwidth of each fiber optic transmission path. Then, based on a preset path selection strategy, the target fiber optic transmission path can be determined from the multiple alternative fiber optic transmission paths according to the remaining bandwidth and delay value of each fiber optic transmission path. The path selection strategy indicates that the selected path should have as much remaining bandwidth as possible and as little delay value as possible. Paths with remaining bandwidth less than a preset bandwidth threshold and delay values ​​greater than a preset delay threshold should be excluded.

[0096] The traffic ratio mentioned above can be a ratio specified by the staff or a pre-set ratio.

[0097] In some embodiments, this application also provides a cross-path anomaly analysis strategy, in which case the method further includes:

[0098] Obtain the flow entropy and burst degree corresponding to each of the optical fiber transmission paths; perform cross-path anomaly analysis on multiple optical fiber transmission paths based on the flow entropy and burst degree corresponding to each of the optical fiber transmission paths to obtain cross-path anomaly results.

[0099] This embodiment can identify multi-path collaborative attacks, making it easier for technicians to analyze multi-path anomalies.

[0100] Furthermore, the method provided in this embodiment is applied to a fiber optic network traffic monitoring platform (the corresponding hardware is the computer equipment provided in this application), and a corresponding fiber optic network traffic monitoring application is provided. Users can access the fiber optic network traffic monitoring platform through user terminals (such as mobile phones or computers) that have the fiber optic network traffic monitoring application installed.

[0101] In some embodiments, the fiber optic network traffic monitoring application provides a real-time fiber optic network traffic function. Users can trigger this function to send a real-time fiber optic network traffic monitoring command to the fiber optic network traffic monitoring platform. Then, the fiber optic network traffic monitoring platform responds to the real-time fiber optic network traffic monitoring command, obtains the traffic information corresponding to each of the fiber optic transmission paths, and returns the traffic information to the user terminal. At this time, the fiber optic network traffic monitoring application in the user terminal refreshes and displays the traffic information in real time. The traffic information includes the real-time traffic value and the traffic fluctuation information over a certain period of time (such as 1 hour).

[0102] In some embodiments, the fiber optic network traffic monitoring application provided in this embodiment can monitor at least one fiber optic transmission path. Users can select which fiber optic transmission path needs to be monitored. The monitoring information of the currently monitored fiber optic transmission path is displayed on the homepage of the fiber optic network traffic monitoring application, such as... Figure 4 As shown, the monitoring information includes total traffic, real-time rate, device status (the number of devices in the figure represents the number of devices connected to the current fiber optic transmission path), and abnormal alarm information.

[0103] In some embodiments, this embodiment can be achieved through, as follows: Figure 4 The anomaly detection button shown triggers the fiber optic network traffic anomaly detection method provided in this application to perform anomaly detection and prediction of the fiber optic transmission path.

[0104] In summary, this application embodiment obtains the optical power, bit error rate, optical signal-to-noise ratio, traffic value, dynamic average traffic value, and dynamic standard deviation of traffic for each optical fiber transmission path at the current time; determines the optical signal quality index for each optical fiber transmission path based on the optical power, bit error rate, and optical signal-to-noise ratio; determines the traffic anomaly degree for each optical fiber transmission path based on the traffic value, dynamic average traffic value, and dynamic standard deviation of traffic for each optical fiber transmission path; determines the anomaly probability for each optical fiber transmission path at a target time based on the optical signal quality index and traffic anomaly degree, where the target time is a time after a first preset duration from the current time; and identifies optical fiber transmission paths with an anomaly probability greater than a preset probability threshold as abnormal optical fiber transmission paths, which are predicted to have network traffic anomalies at the target time. The embodiments of this application can predict anomalies in optical fiber transmission paths. Based on the anomaly prediction results, the optical fiber transmission paths that are predicted to be abnormal can be switched in advance, reducing the occurrence of problems such as communication interruption caused by anomalies in optical fiber transmission paths, thereby improving the stability of the communication network.

[0105] Figure 5 This is a schematic block diagram of a fiber optic network traffic anomaly detection device provided in an embodiment of this application. Figure 5 As shown, corresponding to the above-described fiber optic network traffic anomaly detection method, this application also provides a fiber optic network traffic anomaly detection device 500. This fiber optic network traffic anomaly detection device 500 includes a unit for executing the above-described fiber optic network traffic anomaly detection method. This device 500 is located in a terminal or server and is used to detect traffic anomalies on multiple fiber optic transmission paths in a communication network. Specifically, please refer to... Figure 5 The fiber optic network traffic anomaly detection device 500 includes a transceiver unit 501 and a processing unit 502.

[0106] The transceiver unit 501 is used to obtain the optical power, bit error rate, optical signal-to-noise ratio, flow rate, dynamic flow rate mean, and flow rate dynamic standard deviation corresponding to each of the optical fiber transmission paths at the current time.

[0107] The processing unit 502 is configured to: determine the optical signal quality index corresponding to each optical fiber transmission path based on the optical power, bit error rate, and optical signal-to-noise ratio corresponding to each optical fiber transmission path; determine the traffic anomaly degree corresponding to each optical fiber transmission path based on the traffic value, dynamic traffic mean, and traffic dynamic standard deviation corresponding to each optical fiber transmission path; determine the anomaly probability corresponding to each optical fiber transmission path at a target time based on the optical signal quality index and traffic anomaly degree corresponding to each optical fiber transmission path, wherein the target time is a time after a first preset duration from the current time; and identify the optical fiber transmission path whose anomaly probability is greater than a preset probability threshold as an abnormal optical fiber transmission path, wherein the abnormal optical fiber transmission path is the optical fiber transmission path predicted to have network traffic anomalies at the target time.

[0108] In some embodiments, the traffic anomaly prediction model includes an LSTM prediction model; when the processing unit 502 performs the step of determining the anomaly probability of each optical fiber transmission path at a target time based on the optical signal quality index and the traffic anomaly degree corresponding to each optical fiber transmission path, it is specifically used for:

[0109] Based on the LSTM prediction model and the target time-series feature matrix of each optical fiber transmission path, the anomaly probability of each optical fiber transmission path at the target time is determined.

[0110] The target time-series feature matrix includes the optical signal quality index and traffic anomaly degree corresponding to the optical fiber transmission path at each window time within a preset time window. The end time value of the preset time window is the current time. The time start value and the time end value of the preset time window are spaced apart by a second preset time. The preset time window includes multiple window times, and the multiple window times include the current time.

[0111] In some embodiments, the traffic anomaly prediction model includes a first LSTM prediction model and a second LSTM prediction model; when the processing unit 502 performs the step of determining the anomaly probability of each optical fiber transmission path at a target time based on the optical signal quality index and the traffic anomaly degree corresponding to each optical fiber transmission path, it is specifically used for:

[0112] Based on the first LSTM prediction model and the first time-series feature matrix corresponding to each optical fiber transmission path, a first probability of each optical fiber transmission path at the target time is determined. The first time-series feature matrix includes the optical signal quality index corresponding to each optical fiber transmission path at each window time within a preset time window. The end time value of the preset time window is the current time, and the time start value and the time end value of the preset time window are spaced apart by a third preset time. The preset time window includes multiple window times, including the current time. Based on the second LSTM prediction model and the second time-series feature matrix corresponding to each optical fiber transmission path, a second probability of each optical fiber transmission path at the target time is determined. The second time-series feature matrix includes the traffic anomaly degree corresponding to each optical fiber transmission path at each window time within a preset time window. The anomaly probability is determined based on the first probability and the second probability.

[0113] In some embodiments, after performing the step of determining the optical fiber transmission paths with an anomaly probability greater than a preset probability threshold among the multiple optical fiber transmission paths as abnormal optical fiber transmission paths, the processing unit 502 is further configured to:

[0114] Multiple alternative fiber optic transmission paths are identified corresponding to the abnormal fiber optic transmission path; the current bandwidth and delay value corresponding to each alternative fiber optic transmission path are obtained through the transceiver unit 501; a target fiber optic transmission path is determined from the multiple alternative fiber optic transmission paths based on the current bandwidth and the delay value; and the traffic of the abnormal fiber optic transmission path is switched to the target fiber optic transmission path.

[0115] In some embodiments, when the processing unit 502 performs the step of determining the optical signal quality index corresponding to each optical fiber transmission path based on the optical power, the bit error rate, and the optical signal-to-noise ratio corresponding to each optical fiber transmission path, it is specifically used for:

[0116] Based on the preset optical signal quality index calculation formula, the optical power, bit error rate, and optical signal-to-noise ratio corresponding to each optical fiber transmission path, the optical signal quality index corresponding to each optical fiber transmission path is determined. The optical signal quality index calculation formula is as follows:

[0117]

[0118] in, Here, w1 represents the optical signal quality index, k is the fiber optic transmission path number, t is the current time, and w1, w2, and w3 are all weighting coefficients. The bit error rate is... The optical power, For the optical signal-to-noise ratio, BER ref and P ref All values ​​are reference baselines.

[0119] In some embodiments, when the processing unit 502 performs the step of determining the traffic anomaly degree corresponding to each of the optical fiber transmission paths based on the traffic value, the dynamic traffic mean, and the traffic dynamic standard deviation corresponding to each of the optical fiber transmission paths, it is specifically used for:

[0120] Based on the preset traffic anomaly calculation formula, the traffic value corresponding to each of the optical fiber transmission paths, the dynamic traffic mean, and the dynamic standard deviation of traffic, the traffic anomaly degree corresponding to each of the optical fiber transmission paths is determined. The traffic anomaly calculation formula is as follows:

[0121]

[0122] in, The traffic anomaly is defined as k, the fiber optic transmission path number, and t as the current time. The flow rate value, The dynamic average flow rate is... Let the dynamic standard deviation of the flow rate be denoted as . It is a measure of the randomness of the flow distribution within the time window t-Δt:t.

[0123] In some embodiments, the transceiver unit 501 is further configured to receive a real-time monitoring instruction for fiber optic network traffic sent by a user terminal; in response to the real-time monitoring instruction for fiber optic network traffic, obtain traffic information corresponding to each of the fiber optic transmission paths; and return the traffic information to the user terminal.

[0124] In some embodiments, after performing the step of determining the optical fiber transmission path with an abnormal probability greater than a preset probability threshold among the multiple optical fiber transmission paths as an abnormal optical fiber transmission path, the transceiver unit 501 is further configured to:

[0125] A fiber optic traffic anomaly warning is sent to a preset user terminal. The fiber optic traffic anomaly warning carries the path identifier of the abnormal fiber optic transmission path.

[0126] The fiber optic network traffic anomaly detection device 500 provided in this application embodiment can predict anomalies in fiber optic transmission paths. Based on the anomaly prediction results, it can switch the predicted abnormal fiber optic transmission paths in advance, reducing communication interruptions and other problems caused by abnormal fiber optic transmission paths, thereby improving the stability of the communication network.

[0127] It should be noted that those skilled in the art can clearly understand that the specific implementation process of the above-mentioned fiber optic network traffic anomaly detection device and its various units can be referred to the corresponding descriptions in the foregoing method embodiments. For the sake of convenience and brevity, these details will not be repeated here.

[0128] The aforementioned fiber optic network traffic anomaly detection device can be implemented as a computer program, which can, for example... Figure 6 It runs on the computer device shown.

[0129] Please see Figure 6 , Figure 6 This is a schematic block diagram of a computer device 600 provided in an embodiment of this application. The computer device 600 can be a terminal or a server, used for detecting abnormal traffic on multiple fiber optic transmission paths in a communication network.

[0130] See Figure 6 The computer device 600 includes a processor 602, a memory, and a network interface 605 connected via a system bus 601. The memory may include a non-volatile storage medium 603 and internal memory 604.

[0131] The non-volatile storage medium 603 may store an operating system 6031 and a computer program 6032. The computer program 6032 includes program instructions that, when executed, cause the processor 602 to perform a fiber optic network traffic anomaly detection method.

[0132] The processor 602 provides computing and control capabilities to support the operation of the entire computer device 600.

[0133] The internal memory 604 provides an environment for the operation of the computer program 6032 in the non-volatile storage medium 603. When the computer program 6032 is executed by the processor 602, the processor 602 can execute a fiber optic network traffic anomaly detection method.

[0134] This network interface 605 is used for network communication with other devices. Those skilled in the art will understand that... Figure 6 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device 600 to which the present application is applied. The specific computer device 600 may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0135] The processor 602 is used to run a computer program 6032 stored in the memory to perform the following steps:

[0136] Obtain the optical power, bit error rate, optical signal-to-noise ratio, flow rate, dynamic flow rate mean, and dynamic flow rate standard deviation for each optical fiber transmission path at the current time.

[0137] Based on the optical power, bit error rate and optical signal-to-noise ratio corresponding to each optical fiber transmission path, the optical signal quality index corresponding to each optical fiber transmission path is determined.

[0138] Based on the flow value, the dynamic flow mean, and the flow dynamic standard deviation corresponding to each optical fiber transmission path, the flow anomaly degree corresponding to each optical fiber transmission path is determined.

[0139] Based on the optical signal quality index and the traffic anomaly degree corresponding to each optical fiber transmission path, the anomaly probability corresponding to each optical fiber transmission path at the target time is determined, where the target time is the time after the first preset duration of the current time.

[0140] The fiber optic transmission path with an anomaly probability greater than a preset probability threshold among the multiple fiber optic transmission paths is identified as an abnormal fiber optic transmission path, which is the fiber optic transmission path that is predicted to have abnormal network traffic at the target time.

[0141] It should be understood that in the embodiments of this application, the processor 602 may be a central processing unit (CPU), or it may be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor.

[0142] It will be understood by those skilled in the art that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program includes program instructions and can be stored in a storage medium, which is a computer-readable storage medium. The program instructions are executed by at least one processor in the computer system to implement the process steps of the embodiments of the above methods.

[0143] Therefore, this application also provides a storage medium. This storage medium can be a computer-readable storage medium. The storage medium stores a computer program, wherein the computer program includes program instructions. When executed by a processor, the program instructions cause the processor to perform the following steps:

[0144] Obtain the optical power, bit error rate, optical signal-to-noise ratio, flow rate, dynamic flow rate mean, and dynamic flow rate standard deviation for each optical fiber transmission path at the current time.

[0145] Based on the optical power, bit error rate and optical signal-to-noise ratio corresponding to each optical fiber transmission path, the optical signal quality index corresponding to each optical fiber transmission path is determined.

[0146] Based on the flow value, the dynamic flow mean, and the flow dynamic standard deviation corresponding to each optical fiber transmission path, the flow anomaly degree corresponding to each optical fiber transmission path is determined.

[0147] Based on the optical signal quality index and the traffic anomaly degree corresponding to each optical fiber transmission path, the anomaly probability corresponding to each optical fiber transmission path at the target time is determined, where the target time is the time after the first preset duration of the current time.

[0148] The fiber optic transmission path with an anomaly probability greater than a preset probability threshold among the multiple fiber optic transmission paths is identified as an abnormal fiber optic transmission path, which is the fiber optic transmission path that is predicted to have abnormal network traffic at the target time.

[0149] The storage medium can be any computer-readable storage medium capable of storing program code, such as a USB flash drive, portable hard drive, read-only memory (ROM), magnetic disk, or optical disk.

[0150] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this application.

[0151] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative. For example, the division of each unit is merely a logical functional division, and there may be other division methods in actual implementation. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed.

[0152] The steps in the methods of this application embodiment can be adjusted, merged, or deleted according to actual needs. The units in the apparatus of this application embodiment can be merged, divided, or deleted according to actual needs. Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0153] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, a terminal, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application.

[0154] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in this application, and these modifications or substitutions should all be covered within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for detecting abnormal traffic in an optical fiber network, characterized in that, The method is used to detect traffic anomalies in multiple optical fiber transmission paths in a communication network. The method includes: Obtain the optical power, bit error rate, optical signal-to-noise ratio, flow rate, dynamic flow rate mean, and dynamic flow rate standard deviation for each optical fiber transmission path at the current time. Based on the optical power, bit error rate and optical signal-to-noise ratio corresponding to each optical fiber transmission path, the optical signal quality index corresponding to each optical fiber transmission path is determined. Based on the flow value, the dynamic flow mean, and the flow dynamic standard deviation corresponding to each optical fiber transmission path, the flow anomaly degree corresponding to each optical fiber transmission path is determined. Based on the optical signal quality index and the traffic anomaly degree corresponding to each optical fiber transmission path, the anomaly probability corresponding to each optical fiber transmission path at the target time is determined, where the target time is the time after the first preset duration of the current time. The fiber optic transmission path with an abnormal probability greater than a preset probability threshold among the multiple fiber optic transmission paths is identified as an abnormal fiber optic transmission path, which is a fiber optic transmission path that is predicted to have abnormal network traffic at the target time. Determine multiple alternative fiber optic transmission paths corresponding to the abnormal fiber optic transmission path. Obtain the current bandwidth and delay value corresponding to each of the candidate optical fiber transmission paths; The target fiber transmission path is determined from among the multiple candidate fiber transmission paths based on the current bandwidth and the delay value. Switch a portion of the traffic from the abnormal fiber optic transmission path to the target fiber optic transmission path; The step of determining the optical signal quality index corresponding to each of the optical fiber transmission paths based on the optical power, bit error rate, and optical signal-to-noise ratio corresponding to each of the optical fiber transmission paths includes: Based on the preset optical signal quality index calculation formula, the optical power, bit error rate, and optical signal-to-noise ratio corresponding to each optical fiber transmission path, the optical signal quality index corresponding to each optical fiber transmission path is determined. The optical signal quality index calculation formula is as follows: ； in, Here, w1 represents the optical signal quality index, k is the fiber optic transmission path number, t is the current time, and w1, w2, and w3 are all weighting coefficients. The bit error rate is... The optical power, For the optical signal-to-noise ratio, BER ref as well as All values ​​are reference baselines.

2. The method according to claim 1, characterized in that, The traffic anomaly prediction model includes an LSTM prediction model; determining the anomaly probability of each optical fiber transmission path at the target time based on the optical signal quality index and the traffic anomaly degree corresponding to each optical fiber transmission path includes: Based on the LSTM prediction model and the target time-series feature matrix of each optical fiber transmission path, the anomaly probability of each optical fiber transmission path at the target time is determined. The target time-series feature matrix includes the optical signal quality index and traffic anomaly degree corresponding to the optical fiber transmission path at each window time within a preset time window. The end time value of the preset time window is the current time. The time start value and the time end value of the preset time window are spaced apart by a second preset time. The preset time window includes multiple window times, and the multiple window times include the current time.

3. The method according to claim 1, characterized in that, The traffic anomaly prediction model includes a first LSTM prediction model and a second LSTM prediction model; determining the anomaly probability of each optical fiber transmission path at the target time based on the optical signal quality index and the traffic anomaly degree corresponding to each optical fiber transmission path includes: Based on the first LSTM prediction model and the first time-series feature matrix corresponding to each optical fiber transmission path, the first probability of each optical fiber transmission path at the target time is determined. The first time-series feature matrix includes the optical signal quality index corresponding to each optical fiber transmission path at each window time within a preset time window. The end time value of the preset time window is the current time. The time start value and the time end value of the preset time window are separated by a third preset time. The preset time window includes multiple window times, and the multiple window times include the current time. Based on the second LSTM prediction model and the second time-series feature matrix corresponding to each optical fiber transmission path, the second probability of each optical fiber transmission path at the target time is determined. The second time-series feature matrix includes the traffic anomaly degree of the corresponding optical fiber transmission path at each window time within a preset time window. The anomaly probability is determined based on the first probability and the second probability.

4. The method according to any one of claims 1 to 3, characterized in that, The step of determining the traffic anomaly degree corresponding to each of the optical fiber transmission paths based on the traffic value, the dynamic traffic mean, and the traffic dynamic standard deviation for each of the optical fiber transmission paths includes: Based on the preset traffic anomaly calculation formula, the traffic value corresponding to each of the optical fiber transmission paths, the dynamic traffic mean, and the dynamic standard deviation of traffic, the traffic anomaly degree corresponding to each of the optical fiber transmission paths is determined. The traffic anomaly calculation formula is as follows: ； in, The traffic anomaly is defined as k, the fiber optic transmission path number, and t as the current time. The flow rate value, The dynamic average flow rate is... Let the dynamic standard deviation of the flow rate be denoted as . For traffic in the time window A measure of the randomness of the flow distribution within the area.

5. The method according to claim 1, characterized in that, After determining the fiber optic transmission path with an anomaly probability greater than a preset probability threshold among the multiple fiber optic transmission paths as an abnormal fiber optic transmission path, the method further includes: A fiber optic traffic anomaly warning is sent to a preset user terminal. The fiber optic traffic anomaly warning carries the path identifier of the abnormal fiber optic transmission path.

6. The method according to claim 1, characterized in that, The method further includes: Receive real-time monitoring commands for fiber optic network traffic sent by user terminals; In response to the real-time monitoring command for fiber optic network traffic, traffic information corresponding to each of the fiber optic transmission paths is obtained; The traffic information is returned to the user terminal.

7. A fiber optic network traffic anomaly detection device, characterized in that, The fiber optic network traffic anomaly detection device is used to detect traffic anomalies on multiple fiber optic transmission paths in a communication network. The device includes a transceiver unit and a processing unit, wherein: The transceiver unit is used to obtain the optical power, bit error rate, optical signal-to-noise ratio, flow rate, dynamic flow rate mean, and flow rate dynamic standard deviation of each optical fiber transmission path at the current time. The processing unit is configured to: determine the optical signal quality index corresponding to each optical fiber transmission path based on the optical power, bit error rate, and optical signal-to-noise ratio corresponding to each optical fiber transmission path; determine the traffic anomaly degree corresponding to each optical fiber transmission path based on the traffic value, dynamic traffic mean, and traffic dynamic standard deviation corresponding to each optical fiber transmission path; determine the anomaly probability corresponding to each optical fiber transmission path at a target time based on the optical signal quality index and traffic anomaly degree, wherein the target time is a time after a first preset duration from the current time; identify optical fiber transmission paths among the multiple optical fiber transmission paths whose anomaly probability is greater than a preset probability threshold as abnormal optical fiber transmission paths, wherein the abnormal optical fiber transmission paths are optical fiber transmission paths predicted to have network traffic anomalies at the target time; determine multiple candidate optical fiber transmission paths corresponding to the abnormal optical fiber transmission paths; obtain the current bandwidth and latency value corresponding to each candidate optical fiber transmission path; determine the target optical fiber transmission path from the multiple candidate optical fiber transmission paths based on the current bandwidth and latency value; and switch a portion of the traffic of the abnormal optical fiber transmission path to the target optical fiber transmission path. When the processing unit performs the step of determining the optical signal quality index corresponding to each optical fiber transmission path based on the optical power, bit error rate, and optical signal-to-noise ratio corresponding to each optical fiber transmission path, it is specifically used for: Based on the preset optical signal quality index calculation formula, the optical power, bit error rate, and optical signal-to-noise ratio corresponding to each optical fiber transmission path, the optical signal quality index corresponding to each optical fiber transmission path is determined. The optical signal quality index calculation formula is as follows: ； in, Here, w1 represents the optical signal quality index, k is the fiber optic transmission path number, t is the current time, and w1, w2, and w3 are all weighting coefficients. The bit error rate is... The optical power, For the optical signal-to-noise ratio, BER ref as well as All values ​​are reference baselines.

8. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the fiber optic network traffic anomaly detection method as described in any one of claims 1-6.

9. A storage medium, characterized in that, The storage medium stores a computer program, which includes program instructions that, when executed by a processor, cause the processor to perform the fiber optic network traffic anomaly detection method as described in any one of claims 1-6.

Images