Network fault detection method and device, equipment, storage medium and program product

Abstract

The invention provides a network fault detection method and device, equipment, a storage medium and a program product, and relates to the technical field of communication. The method comprises the following steps: collecting multi-dimensional data according to a service request initiated by a terminal; preprocessing the multi-dimensional data according to the time sequence, and determining multi-dimensional time sequence data; inputting the multi-dimensional time sequence data into a pre-constructed time sequence diffusion model, and outputting reconstruction data; calculating an error between the multi-dimensional time sequence data and the reconstruction data, and determining an error value; and outputting alarm information according to a preset alarm grading threshold value and the error value. Through the processing method of combining the time sequence diffusion model with the alarm grading, the problem that the network environment change cannot be dynamically matched by network message fault judgment is solved.

Description

Technical Field

[0001] The present disclosure relates to the field of communication technology, and in particular to a network fault detection method, apparatus, device, storage medium, and program product. Background Art

[0002] As a rich media communication method, 5G messaging requires a massive network element architecture, a wide range of services, and a complex protocol stack. With the widespread adoption of 5G messaging, users demand higher service stability, and any failure can lead to user churn. However, the rapid growth in 5G messaging users is increasing the pressure on network operations and maintenance, leading to a high incidence of network failures. Prompt detection of network failures is crucial to avoid user experiences resulting from failed service requests. Accurate detection of network failures can also optimize operators' network performance, improve resource utilization, and reduce operating costs.

[0003] Related technologies primarily rely on setting thresholds for service-related indicators. This approach pre-defines a series of indicator thresholds closely related to service operations. When actual operational data exceeds these thresholds, a potential fault is determined. However, this traditional detection method relies primarily on expert experience to set these thresholds, and this expert experience is often accumulated under specific environments and conditions. This results in a lack of adaptability in dynamically changing network environments. The 5G network environment is complex and ever-changing, with multiple factors constantly changing. Traditional detection methods based on fixed thresholds struggle to reflect these changes in a timely and accurate manner, making it impossible to effectively detect potential faults.

[0004] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present disclosure, and therefore may include information that does not constitute prior art known to ordinary technicians in the field. Summary of the Invention

[0005] The present disclosure provides a network fault detection method, apparatus, device, storage medium and program product, which at least to some extent overcome the problem in related technologies that network message fault judgment cannot dynamically match changes in the network environment.

[0006] Other features and advantages of the present disclosure will become apparent from the following detailed description, or may be learned in part by practice of the present disclosure.

[0007] According to one aspect of the present disclosure, a network fault detection method is provided, comprising: collecting multi-dimensional data based on a service request initiated by a terminal; preprocessing the multi-dimensional data based on a time series to determine multi-dimensional time series data; inputting the multi-dimensional time series data into a pre-built time series diffusion model to output reconstructed data; calculating the error between the multi-dimensional time series data and the reconstructed data to determine an error value; and outputting alarm information based on a preset alarm classification threshold and the error value.

[0008] In some embodiments, before preprocessing the multidimensional data according to the time series to determine the multidimensional time series data, the method further includes: calculating the success rate of the business request and determining whether the success rate of the business request meets the preset conditions; if so, performing preprocessing on the multidimensional data according to the time series to determine the multidimensional time series data; if not, outputting alarm information of a typical fault.

[0009] In some embodiments, calculating the success rate of the business request and determining whether the success rate of the business request meets a preset condition include: calculating the success rate of each business type in the business request; and determining whether the success rate of each business type is greater than or equal to a preset threshold.

[0010] In some embodiments, the multi-dimensional data includes: business data, cloud resource data and physical resource indicator data; the pre-built time series diffusion model includes: obtaining business data, cloud resource data and physical resource indicator data under normal business scenarios, and forming a data set according to time series; standardizing the data set, processing missing values, and sliding window processing to determine a training set; constructing an initial time series diffusion model, and training the initial time series diffusion model according to the training set to obtain the pre-built time series diffusion model.

[0011] In some embodiments, the preset alarm classification threshold includes a first threshold, a second threshold and a third threshold; the output alarm information based on the preset alarm classification threshold and the error value includes: when the error value is less than the first threshold, the output alarm information is no fault; when the error value is greater than or equal to the first threshold and less than the second threshold, the output alarm information is a warning level atypical fault; when the error value is greater than or equal to the second threshold and less than the third threshold, the output alarm information is an important level atypical fault; when the error value is greater than or equal to the third threshold, the output alarm information is a fault level atypical fault.

[0012] In some embodiments, the first threshold is determined according to a mean of a historical normal error sequence, a first coefficient and a standard deviation of a historical normal residual sequence; the second threshold is determined according to the mean of the historical normal error sequence, a second coefficient and the standard deviation of the historical normal residual sequence; and the third threshold is determined according to the mean of the historical normal error sequence, a third coefficient and the standard deviation of the historical normal residual sequence.

[0013] According to another aspect of the present disclosure, a network fault detection apparatus is also provided, comprising: a data collection module configured to collect multi-dimensional data according to a service request initiated by a terminal; a time series data determination module configured to pre-process the multi-dimensional data according to a time series to determine multi-dimensional time series data; a data reconstruction module configured to input the multi-dimensional time series data into a pre-constructed time series diffusion model to output reconstructed data; an error value determination module configured to calculate an error between the multi-dimensional time series data and the reconstructed data to determine an error value; and an alarm module configured to output alarm information according to a preset alarm grading threshold and the error value.

[0014] According to another aspect of the present disclosure, an electronic device is also provided, comprising: a processor; and a memory configured to store executable instructions of the processor; wherein the processor is configured to execute the network fault detection method according to any one of the above aspects via executing the executable instructions.

[0015] According to another aspect of the present disclosure, a computer readable storage medium is also provided, having a computer program stored thereon, the computer program being executed by a processor to implement the network fault detection method according to any one of the above aspects.

[0016] According to another aspect of the present disclosure, a computer program product is also provided, comprising a computer program, the computer program being executed by a processor to implement the network fault detection method according to any one of the above aspects.

[0017] The network fault detection method provided in the embodiments of the present disclosure collects multi-dimensional data according to a service request initiated by a terminal; pre-processes the multi-dimensional data according to a time series to determine multi-dimensional time series data; inputs the multi-dimensional time series data into a pre-constructed time series diffusion model to output reconstructed data; calculates an error between the multi-dimensional time series data and the reconstructed data to determine an error value; and outputs alarm information according to a preset alarm grading threshold and the error value. The present disclosure can overcome the false alarm defect of a fixed threshold in a dynamic network environment, dynamically adapt to changes in a network environment, and solve the problem that network message fault judgment cannot dynamically match changes in a network environment, by using a time series diffusion model in combination with an alarm grading processing method.

[0018] It should be understood that the foregoing general description and the following detailed description are only exemplary and explanatory, and are not limiting of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The accompanying drawings are incorporated into and constitute a part of the specification, illustrate embodiments consistent with the present disclosure, and together with the specification, are used to explain the principles of the present disclosure. Obviously, the drawings described below are only some embodiments of the present disclosure, and those skilled in the art can derive other drawings based on these drawings without inventive effort.

[0020] Figure 1 A schematic diagram showing the structure of a network fault detection system according to an embodiment of the present disclosure is shown; Figure 2 A flow chart of a network fault detection method according to an embodiment of the present disclosure is shown; Figure 3 A flowchart showing a specific example of a network fault detection method according to an embodiment of the present disclosure is provided; Figure 4 A flowchart showing another specific example of a network fault detection method according to an embodiment of the present disclosure; Figure 5 A flowchart showing another specific example of a network fault detection method according to an embodiment of the present disclosure is provided; Figure 6 A flowchart showing another specific example of a network fault detection method according to an embodiment of the present disclosure is provided; Figure 7 A schematic diagram of a network fault detection device according to an embodiment of the present disclosure is shown; Figure 8 A structural block diagram of a computer device in an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0021] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be embodied in many forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that this disclosure will be thorough and complete and will fully convey the concepts of the example embodiments to those skilled in the art. The described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0022] In addition, the accompanying drawings are merely schematic illustrations of the present disclosure and are not necessarily drawn to scale. Identical reference numerals in the figures denote identical or similar parts, and thus repetitive descriptions thereof will be omitted. Some of the block diagrams shown in the accompanying drawings are functional entities that do not necessarily correspond to physically or logically separate entities. These functional entities may be implemented in software, in one or more hardware modules or integrated circuits, or in different networks and / or processor devices and / or microcontroller devices.

[0023] The specific implementation of the embodiments of the present disclosure will be described in detail below with reference to the drawings.

[0024] Figure 1 An exemplary application system architecture schematic diagram to which the network fault detection method in the embodiments of the present disclosure can be applied is shown. As shown in the figure, the system architecture can include a terminal device 101, a network 102, and a server 103. Figure 1

[0025] The network 102 is a medium for providing a communication link between the terminal device 101 and the server 103, which can be a wired network or a wireless network.

[0026] Optionally, the wireless network or the wired network described above uses standard communication technologies and / or protocols. The network is usually the Internet, but can also be any network, including but not limited to a local area network (LAN), a metropolitan area network (MAN), a wide area network (WAN), a mobile, wired or wireless network, a private network or any combination of virtual private networks). In some embodiments, technologies and / or formats including Hyper Text Mark-up Language (HTML), Extensible Markup Language (XML), etc. are used to represent data exchanged through the network. In addition, all or some links can be encrypted using conventional encryption technologies such as Secure Socket Layer (SSL), Transport Layer Security (TLS), Virtual Private Network (VPN), Internet Protocol Security (IPSec), etc. In other embodiments, custom and / or dedicated data communication technologies can be used instead of or in addition to the above data communication technologies.

[0027] The terminal device 101 can be various electronic devices, including but not limited to a smartphone, a tablet computer, a laptop computer, a desktop computer, a smart speaker, a smart watch, a wearable device, an augmented reality device, a virtual reality device, etc.

[0028] ​Optionally, the client of the application installed in different terminal devices 101 is the same, or the client of the same type of application based on different operating systems. Based on the different terminal platforms, the specific form of the client of the application can also be different, for example, the application client can be a mobile phone client, a PC client, etc.

[0029] The server 103 may be a server that provides various services, such as a background management server that provides support for the devices operated by the user using the terminal device 101. The background management server may analyze and process the received request and other data, and feed back the processing results to the terminal device.

[0030] Optionally, the server can be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms.

[0031] In a specific example, the server collects multi-dimensional data based on a service request initiated by a terminal; pre-processes the multi-dimensional data according to a time series to determine multi-dimensional time series data; inputs the multi-dimensional time series data into a pre-built time series diffusion model and outputs reconstructed data; calculates the error between the multi-dimensional time series data and the reconstructed data to determine the error value; and outputs alarm information based on a preset alarm classification threshold and the error value.

[0032] Those skilled in the art will know that Figure 1 The number of terminal devices, networks, and servers in the embodiment is merely illustrative, and any number of terminal devices, networks, and servers may be provided based on actual needs. This embodiment of the present disclosure does not limit this.

[0033] Figure 2 A flow chart of a network fault detection method according to an embodiment of the present disclosure is shown as follows: Figure 2 As shown, the network fault detection method provided in the embodiment of the present disclosure includes the following steps: S202: Collect multi-dimensional data according to the service request initiated by the terminal.

[0034] It should be noted that the aforementioned service requests can be operations triggered by users through their terminal devices, requiring the 5G messaging platform to complete specific communication functions, such as rich media communication service interaction instructions. The aforementioned multi-dimensional data includes: service data, cloud resource data, and physical resource indicator data. Service data can directly reflect user experience and commercial value, such as request success rate, request latency, and request error rate. Cloud resource data refers to the virtualized environment in which the service operates, such as cloud storage services, virtual machines, and cloud databases. Physical resource indicator data refers to physical hardware resource indicators, such as server temperature, power status, and CPU utilization. Collection can be real-time, enabling the acquisition of up-to-date data to provide dynamic and accurate data for subsequent calculations.

[0035] S204 , pre-processing the multi-dimensional data according to the time series to determine multi-dimensional time series data.

[0036] It should be noted that the above data series can be time-dimensioned. In a specific example, multi-dimensional data is cleaned, converted, and processed according to the time dimension (sorted by time) to generate multi-dimensional time series data.

[0037] S206 , input the multi-dimensional time series data into a pre-built time series diffusion model, and output reconstructed data.

[0038] It should be noted that the aforementioned time series diffusion model can be a model architecture that combines the capabilities of time series information processing with the characteristics of a diffusion model. For example, the time series diffusion model integrates a diffusion model with a Transformer decoder. The diffusion model provides a progressive generation framework to control the temporal evolution of the data generation process. The Transformer decoder, as the core of the denoising network, performs noise prediction or data reconstruction. The parameter tuning strategy for the time series diffusion model is to perform segmented parameter tuning according to the training step, with the front-end setting ranging from 0% to 20% for rapid convergence, the middle-stage setting ranging from 20% to 70% for fine feature learning, and the back-end setting ranging from 70% to 100% for fine-tuning generation quality.

[0039] S208, calculating the error between the multi-dimensional time series data and the reconstructed data, and determining the error value.

[0040] In a specific example, multi-dimensional time series data A is input into a pre-built time series diffusion model to generate reconstructed data sample A 、 , calculate A and A 、 The error value E1 is calculated as E1=|AA 、 |.

[0041] S210: Output alarm information according to the preset alarm classification threshold and error value.

[0042] It should be noted that the above-mentioned alarm information can be an active notification mechanism for abnormal conditions or potential risks, which is used to quickly locate problems.

[0043] The present disclosure combines a time series diffusion model with an alarm classification processing method to overcome the false alarm defects of fixed thresholds in dynamic network environments, dynamically adapt to changes in the network environment, and solve the problem that network message fault judgment cannot dynamically match changes in the network environment.

[0044] In one embodiment of the present disclosure, Figure 3 As shown, the network fault detection method provided in the embodiment of the present disclosure further includes the following steps before preprocessing the multi-dimensional data according to the time series and determining the multi-dimensional time series data: S302: Calculate the success rate of the service request and determine whether the success rate of the service request meets a preset condition.

[0045] It should be noted that the above preset condition may be greater than or equal to a preset threshold.

[0046] S3041: If yes, preprocess the multi-dimensional data according to the time series to determine the multi-dimensional time series data.

[0047] It should be noted that, if so, the multidimensional data is preprocessed according to the time series to determine the multidimensional time series data; the multidimensional time series data is input into a pre-built time series diffusion model to output the reconstructed data; the error between the multidimensional time series data and the reconstructed data is calculated to determine the error value; and the alarm information is output according to the preset alarm classification threshold and the error value.

[0048] S3042: If not, output typical fault warning information.

[0049] It should be noted that the success rate of the above business requests can be determined by the ratio of the number of successful requests to the total number of requests.

[0050] The present disclosure determines whether a network fault is a typical fault by calculating the success rate of service requests. Typical faults are directly judged by the low service accuracy rate, while atypical faults are further detected and judged using a time series diffusion model. By combining the preset threshold and the time series diffusion model, the speed and accuracy of fault detection are improved.

[0051] In one embodiment of the present disclosure, Figure 4 As shown, in the network fault detection method provided in the embodiment of the present disclosure, calculating the success rate of service requests and determining whether the success rate of service requests meets the preset conditions include the following steps: S402, calculating the success rate of each service type in the service request; S404, determine whether the success rates of each service type are greater than or equal to a preset threshold.

[0052] For example, the statistical service types of the 5G message include user registration, message transmission, account opening, configuration acquisition, file upload and download, short message conversion, MAAP message, and platform service scenarios. The success rate set S n includes the success rates of each service type. For example, there are n service types, and the success rate combination is S n ∈{S1, S2, ···, S n}. If any value in the set S is less than a typical failure threshold T (such as 0.95), that is: S∈{S1, S2, ···, S n}<T (T is a threshold value, which can be adjusted by hot loading), it can be determined as a typical failure, and the output is that the 5G message has a typical failure; if all values in the set are greater than or equal to the threshold T, that is S∈{S1, S2, ···, S n}>=T, it is not a typical failure, and it needs to be determined whether it is a non-typical failure.

[0053] The present disclosure detects the 5G message failure by grading, determines the typical failure (which can be determined by the low service accuracy) by using the threshold value, and combines the real-time adjustment strategy by hot loading, so as to improve the accuracy and timeliness of the network failure determination.

[0054] In one embodiment of the present disclosure, as shown in Figure 5 the network failure detection method provided in the embodiment of the present disclosure includes the following steps: S502, acquire service data, cloud resource data, and physical resource index data in a service normal scenario, and form a data set according to a time sequence; S504, perform standardization processing, missing value processing, and sliding window processing on the data set, and determine a training set; S506, construct an initial time series diffusion model, train the initial time series diffusion model according to the training set, and obtain a pre-constructed time series diffusion model.

[0055] It should be noted that the aforementioned standardization can be data normalization, normalizing multimodal data to eliminate the influence of different dimensions or magnitudes on data analysis, making comparisons between different features more reasonable. The aforementioned missing value processing can be performed by filling missing points with a moving average or differencing method to ensure temporal continuity. The aforementioned sliding window processing can be performed by segmenting continuous time series data into fixed-length subsequences (windows) and dynamically moving the window to cover the entire dataset using a sliding step, thereby converting the original time series into multiple local sample sets. By continuously sliding the window, local patterns and temporal dependencies in the data are extracted, providing structured input for the subsequent construction of a time series diffusion model. Furthermore, the sliding window can be dynamically set based on different practical needs.

[0056] The present disclosure constructs a time series diffusion model and combines it with multi-dimensional data to perform network fault detection, thereby being able to dynamically adapt to changes in the network environment and improving the dynamic adaptability of network fault detection.

[0057] In one embodiment of the present disclosure, Figure 6 As shown, in the network fault detection method provided in the embodiment of the present disclosure, the preset alarm classification thresholds include a first threshold, a second threshold, and a third threshold. Outputting alarm information according to the preset alarm classification thresholds and the error value includes the following steps: S602, when the error value is less than the first threshold, outputting an alarm message indicating no fault; S604: When the error value is greater than or equal to the first threshold and less than the second threshold, output an alarm message of a warning-level atypical fault; S606: When the error value is greater than or equal to the second threshold and less than the third threshold, output an alarm message of a major level atypical fault; S608: When the error value is greater than or equal to the third threshold, output alarm information as a fault level atypical fault.

[0058] In one example of the present disclosure, the above-mentioned first threshold is determined based on the mean of the historical normal error sequence, the first coefficient and the standard deviation of the historical normal residual sequence; the second threshold is determined based on the mean of the historical normal error sequence, the second coefficient and the standard deviation of the historical normal residual sequence; the third threshold is determined based on the mean of the historical normal error sequence, the third coefficient and the standard deviation of the historical normal residual sequence.

[0059] Specifically, the error value is E1, and the mean of the historical normal error sequence is μ hist , the standard deviation of the historical normal error series is σ hist ; Generate a level 1 alarm threshold: T warn =μ hist +α σ hist, wherein the preferred implementation range of the first coefficient α is 1≤α≤1.8; Generate secondary importance threshold: T impo =μ hist +β σ hist , wherein the preferred implementation range of the second coefficient β is 2.0≤β≤2.8; Generate three-level fault threshold: T error =μ hist +γ σ hist , wherein the preferred implementation range of the third coefficient γ is 3.0≤γ≤3.8.

[0060] The real-time error value E1 satisfies: E1 <T warn : No fault status; T warn ≤E1 <T impo : Warning level atypical fault; T impo ≤E1 <T error : Important atypical fault; E1≥T error : Fault level atypical fault.

[0061] Furthermore, different alarm levels can correspond to different response actions. The different value ranges of each coefficient allow for adaptive adjustments to different scenarios. In a specific example, the first coefficient can be adjusted to 1.5 for traffic fluctuation scenarios when there is a sudden increase in traffic; the second coefficient can be adjusted to 2.5 for service upgrade scenarios; and the third coefficient can be adjusted to 3.5 for network element equipment scenarios when the historical failure rate of network elements increases.

[0062] This paper adopts historical statistics μ hist and σ hist Adaptive thresholds are built to dynamically adjust based on the communication environment, overcoming the false alarm flaws of fixed thresholds in traffic fluctuation scenarios. Furthermore, this disclosure implements a three-level gradient response (warning / critical / fault) using coefficients α, β, and γ, accurately locating the root cause of faults and shortening troubleshooting time.

[0063] Based on the same inventive concept, the present disclosure also provides a network fault detection device, as described in the following embodiments. Since the principle of solving the problem in the device embodiment is similar to that in the above method embodiment, the implementation of the device embodiment can refer to the implementation of the above method embodiment, and the repeated parts will not be repeated.

[0064] Figure 7 A schematic diagram of a network fault detection device according to an embodiment of the present disclosure is shown. Figure 7 As shown in the figure, the device comprises a data collection module 71, a time series data determination module 72, a data reconstruction module 73, an error value determination module 74, and an alarm module 75.

[0065] The data collection module 71 is configured to collect multi-dimensional data according to a service request initiated by a terminal.

[0066] The time series data determination module 72 is configured to pre-process the multi-dimensional data according to a time sequence to determine multi-dimensional time series data.

[0067] The data reconstruction module 73 is configured to input the multi-dimensional time series data into a pre-constructed time series diffusion model to output reconstructed data.

[0068] The error value determination module 74 is configured to calculate the error between the multi-dimensional time series data and the reconstructed data to determine an error value.

[0069] The alarm module 75 is configured to output alarm information according to a preset alarm grading threshold and the error value.

[0070] In one example of the present disclosure, the network fault detection device further comprises a success rate calculation module configured to calculate the success rate of the service request and determine whether the success rate of the service request meets a preset condition; if yes, the multi-dimensional data is pre-processed according to a time sequence to determine multi-dimensional time series data; if not, the alarm information of a typical fault is output.

[0071] In one example of the present disclosure, the success rate calculation module is further configured to calculate the success rate of each service type in the service request and determine whether the success rate of each service type is greater than or equal to a preset threshold.

[0072] In one example of the present disclosure, the multi-dimensional data in the network fault detection device comprises service data, cloud resource data, and physical resource index data; and the pre-constructed time series diffusion model in the data reconstruction module comprises: obtaining service data, cloud resource data, and physical resource index data under a normal service scenario, and forming a data set according to a time sequence; performing standardization processing, missing value processing, and sliding window processing on the data set to determine a training set; constructing an initial time series diffusion model, training the initial time series diffusion model according to the training set, and obtaining the pre-constructed time series diffusion model.

[0073] In one example of the present disclosure, the preset alarm classification thresholds in the above-mentioned alarm module include a first threshold, a second threshold and a third threshold; according to the preset alarm classification thresholds and the error value, the output alarm information includes: when the error value is less than the first threshold, the output alarm information is no fault; when the error value is greater than or equal to the first threshold and less than the second threshold, the output alarm information is a warning level atypical fault; when the error value is greater than or equal to the second threshold and less than the third threshold, the output alarm information is an important level atypical fault; when the error value is greater than or equal to the third threshold, the output alarm information is a fault level atypical fault.

[0074] In one example of the present disclosure, the first threshold in the above-mentioned alarm module is determined based on the mean of the historical normal error sequence, the first coefficient and the standard deviation of the historical normal residual sequence; the second threshold is determined based on the mean of the historical normal error sequence, the second coefficient and the standard deviation of the historical normal residual sequence; and the third threshold is determined based on the mean of the historical normal error sequence, the third coefficient and the standard deviation of the historical normal residual sequence.

[0075] It should be noted that the aforementioned data acquisition module 71, time series data determination module 72, data reconstruction module 73, error value determination module 74, and alarm module 75 correspond to S202 to S210 in the method embodiment. The examples and application scenarios implemented by these modules and corresponding steps are the same, but are not limited to the contents disclosed in the aforementioned method embodiment. It should be noted that the aforementioned modules, as part of the apparatus, can be executed in a computer system, such as a set of computer-executable instructions.

[0076] Those skilled in the art will appreciate that various aspects of the present disclosure may be implemented as systems, methods, or program products. Therefore, various aspects of the present disclosure may be implemented in the following forms: entirely in hardware, entirely in software (including firmware, microcode, etc.), or in a combination of hardware and software, collectively referred to herein as "circuits," "modules," or "systems."

[0077] Refer to the following Figure 8 800 according to this embodiment of the present disclosure will be described. Figure 8 The electronic device 800 shown is merely an example and should not limit the functions and scope of use of the embodiments of the present disclosure.

[0078] like Figure 8 As shown, electronic device 800 is implemented as a general-purpose computing device. Components of electronic device 800 may include, but are not limited to, the aforementioned at least one processing unit 810, the aforementioned at least one storage unit 820, and a bus 830 connecting various system components (including storage unit 820 and processing unit 810).

[0079] The storage unit stores program codes, which can be executed by the processing unit 810, so that the processing unit 810 performs the steps described in the above “Exemplary Method” section of this specification according to various exemplary embodiments of the present disclosure.

[0080] For example, the processing unit 810 can execute the following steps of the above-mentioned method embodiment: collecting multi-dimensional data according to the service request initiated by the terminal; pre-processing the multi-dimensional data according to the time series to determine the multi-dimensional time series data; inputting the multi-dimensional time series data into a pre-built time series diffusion model and outputting reconstructed data; calculating the error between the multi-dimensional time series data and the reconstructed data and determining the error value; outputting alarm information according to the preset alarm classification threshold and error value.

[0081] For example, the processing unit 810 can execute the following steps of the above-mentioned method embodiment: calculate the success rate of the business request and determine whether the success rate of the business request meets the preset conditions; if so, perform preprocessing of the multi-dimensional data according to the time series to determine the multi-dimensional time series data; if not, output alarm information of typical faults.

[0082] For example, the processing unit 810 may execute the following steps of the above method embodiment: calculating the success rate of each service type in the service request; and determining whether the success rate of each service type is greater than or equal to a preset threshold.

[0083] For example, the processing unit 810 can execute the following steps of the above-mentioned method embodiment: obtain business data, cloud resource data and physical resource indicator data under normal business scenarios, and form a data set according to time series; standardize the data set, process missing values, and perform sliding window processing to determine the training set; construct an initial time series diffusion model, train the initial time series diffusion model according to the training set, and obtain a pre-constructed time series diffusion model.

[0084] For example, the processing unit 810 can execute the following steps of the above method embodiment: when the error value is less than the first threshold, the output alarm information is no fault; when the error value is greater than or equal to the first threshold and less than the second threshold, the output alarm information is a warning level atypical fault; when the error value is greater than or equal to the second threshold and less than the third threshold, the output alarm information is an important level atypical fault; when the error value is greater than or equal to the third threshold, the output alarm information is a fault level atypical fault.

[0085] For example, the processing unit 810 can perform the following steps of the above method embodiment: the first threshold is determined based on the mean of the historical normal error sequence, the first coefficient and the standard deviation of the historical normal residual sequence; the second threshold is determined based on the mean of the historical normal error sequence, the second coefficient and the standard deviation of the historical normal residual sequence; the third threshold is determined based on the mean of the historical normal error sequence, the third coefficient and the standard deviation of the historical normal residual sequence.

[0086] The storage unit 820 may include a readable medium in the form of a volatile storage unit, such as a random access memory unit (RAM) 8201 and / or a cache 8202 , and may further include a read-only memory unit (ROM) 8203 .

[0087] The storage unit 820 may also include a program / utility 8204 having a set (at least one) of program modules 8205, such program modules 8205 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0088] Bus 830 may represent one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

[0089] The electronic device 800 may also communicate with one or more external devices 840 (e.g., a keyboard, pointing device, Bluetooth device, etc.), one or more devices that enable a user to interact with the electronic device 800, and / or any device that enables the electronic device 800 to communicate with one or more other computing devices (e.g., a router, modem, etc.). This communication may occur via an input / output (I / O) interface 850. Furthermore, the electronic device 800 may also communicate with one or more networks (e.g., a local area network (LAN), a wide area network (WAN), and / or a public network such as the Internet) via a network adapter 860. As shown, the network adapter 860 communicates with other modules of the electronic device 800 via a bus 830. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 800, including but not limited to microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0090] Through the description of the above embodiments, it will be readily understood by those skilled in the art that the example embodiments described herein can be implemented via software or via a combination of software and necessary hardware. Therefore, the technical solutions according to the embodiments of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, or mobile hard drive) or on a network and includes several instructions for enabling a computing device (such as a personal computer, server, terminal device, or network device) to execute the methods according to the embodiments of the present disclosure.

[0091] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart may be implemented as a computer program product, which includes: a computer program, which implements the above-mentioned network fault detection method when executed by a processor.

[0092] In an exemplary embodiment of the present disclosure, a computer-readable storage medium is also provided. The computer-readable storage medium may be a readable signal medium or a readable storage medium. A program product capable of implementing the above-mentioned method of the present disclosure is stored thereon. In some possible implementations, various aspects of the present disclosure may also be implemented in the form of a program product, which includes program code. When the program product is run on a terminal device, the program code is used to cause the terminal device to execute the steps according to various exemplary embodiments of the present disclosure described in the "Exemplary Methods" section above of this specification.

[0093] More specific examples of computer-readable storage media in the present disclosure may include, but are not limited to, an electrical connection having one or more conductors, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), optical fibers, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0094] In the present disclosure, a computer-readable storage medium may include a data signal propagated in baseband or as part of a carrier wave, which carries readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A readable signal medium may also be any readable medium other than a readable storage medium that can transmit, propagate, or transfer a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0095] Alternatively, the program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination thereof.

[0096] In a specific implementation, the program code for performing the operations of the present disclosure may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, and conventional procedural programming languages ​​such as C or similar programming languages. The program code may be executed entirely on the user's computing device, partially on the user's device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server. In the case of a remote computing device, the remote computing device may be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0097] It should be noted that although several modules or units of the device for action execution are mentioned in the detailed description above, this division is not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more modules or units described above can be concretized in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided into multiple modules or units to be concretized.

[0098] Furthermore, although the steps of the method of the present disclosure are described in a particular order in the accompanying drawings, this does not require or imply that the steps must be performed in this particular order, or that all steps shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps.

[0099] Through the description of the above embodiments, it will be readily understood by those skilled in the art that the example embodiments described herein can be implemented via software or via a combination of software and necessary hardware. Therefore, the technical solutions according to the embodiments of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, or mobile hard drive) or on a network and includes several instructions for enabling a computing device (such as a personal computer, server, mobile terminal, or network device) to execute the methods according to the embodiments of the present disclosure.

[0100] Other embodiments of the present disclosure will readily occur to those skilled in the art after considering the specification and practicing the invention disclosed herein. This disclosure is intended to cover any variations, uses, or adaptations of the present disclosure that follow the general principles of the present disclosure and include common knowledge or customary techniques in the art not disclosed herein. The description and examples are to be considered as exemplary only, with the true scope and spirit of the present disclosure being indicated by the appended claims.

Claims

1. A network fault detection method, characterized in that: include: Collect multi-dimensional data based on business requests initiated by terminals; Preprocessing the multidimensional data according to the time series to determine multidimensional time series data; Input the multi-dimensional time series data into a pre-built time series diffusion model and output reconstructed data; Calculating an error between the multi-dimensional time series data and the reconstructed data to determine an error value; Output alarm information according to the preset alarm classification threshold and the error value.

2. The network fault detection method according to claim 1, wherein: Before preprocessing the multi-dimensional data according to the time series to determine the multi-dimensional time series data, the method further includes: Calculate the success rate of the service request and determine whether the success rate of the service request meets the preset conditions; If so, preprocessing the multi-dimensional data according to the time series is performed to determine the multi-dimensional time series data; If not, a typical fault warning message is output.

3. The network fault detection method according to claim 2, characterized in that: Calculating the success rate of the service request and determining whether the success rate of the service request meets a preset condition includes: Calculating the success rate of each service type in the service request; Determine whether the success rate of each service type is greater than or equal to a preset threshold.

4. The network fault detection method according to claim 1, wherein: The multi-dimensional data includes: business data, cloud resource data and physical resource indicator data; the pre-built time series diffusion model includes: Obtain business data, cloud resource data, and physical resource indicator data under normal business scenarios, and organize them into data sets in time series. The data set is subjected to standardization, missing value processing, and sliding window processing to determine a training set; An initial time series diffusion model is constructed, and the initial time series diffusion model is trained according to the training set to obtain the pre-constructed time series diffusion model.

5. The network fault detection method according to any one of claims 1 to 4, characterized in that: The preset alarm classification thresholds include a first threshold, a second threshold and a third threshold; Outputting alarm information according to the preset alarm classification threshold and the error value includes: When the error value is less than the first threshold, outputting an alarm message indicating no fault; When the error value is greater than or equal to the first threshold and less than the second threshold, outputting an alarm message of a warning-level atypical fault; When the error value is greater than or equal to the second threshold and less than the third threshold, outputting an alarm message of a major level atypical fault; When the error value is greater than or equal to the third threshold, the output alarm information is a fault level atypical fault.

6. The network fault detection method according to claim 5, characterized in that: The first threshold is determined based on the mean of the historical normal error sequence, the first coefficient, and the standard deviation of the historical normal residual sequence; The second threshold is determined based on the mean of the historical normal error sequence, the second coefficient, and the standard deviation of the historical normal residual sequence; The third threshold is determined according to the mean of the historical normal error sequence, the third coefficient and the standard deviation of the historical normal residual sequence.

7. A network fault detection device, characterized in that: include: The data collection module is used to collect multi-dimensional data based on the service request initiated by the terminal; A time series data determination module, configured to pre-process the multi-dimensional data according to a time series to determine the multi-dimensional time series data; A data reconstruction module, configured to input the multi-dimensional time series data into a pre-built time series diffusion model and output reconstructed data; an error value determination module, configured to calculate an error between the multi-dimensional time series data and the reconstructed data, and determine an error value; The alarm module is used to output alarm information according to a preset alarm classification threshold and the error value.

8. An electronic device, characterized in that: include: processor; as well as a memory for storing executable instructions of the processor; The processor is configured to execute the network fault detection method according to any one of claims 1 to 6 by executing the executable instructions.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the network fault detection method according to any one of claims 1 to 6 is implemented.

10. A computer program product comprising: A computer program or instruction, characterized in that when the computer program or instruction is executed by a processor, it implements the network fault detection method according to any one of claims 1 to 6.

Images