Network fault detection method, device, equipment, storage medium and program product

Abstract

The present disclosure provides a network fault detection method, device, equipment, storage medium and program product, and relates to the technical field of communication. The method comprises: collecting multi-dimensional data according to a service request initiated by a terminal; pre-processing the multi-dimensional data according to a time sequence to determine multi-dimensional time sequence data; inputting the multi-dimensional time sequence data into a pre-constructed time sequence diffusion model to output reconstructed data; calculating an error between the multi-dimensional time sequence data and the reconstructed data to determine an error value; and outputting alarm information according to a preset alarm grading threshold and the error value. The present disclosure solves the problem that network message fault judgment cannot dynamically match network environment changes by using a time sequence diffusion model combined with an alarm grading processing method.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the field of communication technology, and particularly relates to a network fault detection method and device, equipment, storage medium and program product. BACKGROUND

[0002] As a rich media communication method, the network element architecture system of 5G message is huge, the service types are various, and the protocol stack is complex. With the wide application of 5G message, users have higher requirements for service stability, and any fault may cause user loss. However, with the rapid growth of the number of 5G message users, the network operation and maintenance pressure is increasing, which will cause more network faults. Network faults need to be detected in time to avoid bad experience caused by service request failure encountered by users. At the same time, accurate detection of network faults can also optimize the network performance of operators, improve resource utilization, and reduce operation cost.

[0003] In the related art, it mainly depends on setting service related index threshold. This method sets a series of index thresholds closely related to service operation in advance, and when the actual running data exceeds these thresholds, it is determined that there may be a fault. However, this traditional detection method mainly relies on expert experience to set these thresholds, and expert experience is often accumulated in specific environment and conditions. This leads to the lack of adaptability of this method when facing dynamic network environment. The 5G network environment is complex and changeable, and many factors are changing. The traditional detection method based on fixed threshold is difficult to reflect these changes in time and accurately, so it cannot effectively detect potential faults.

[0004] It should be noted that the information disclosed in the above background section is only used to strengthen the understanding of the background of the present disclosure, and therefore can include information that does not constitute prior art known to those of ordinary skill in the art. SUMMARY

[0005] The present disclosure provides a network fault detection method, device, equipment, storage medium and program product, which at least partly solves the problem that network message fault judgment in the related art cannot dynamically match network environment changes.

[0006] Other characteristics and advantages of the present disclosure will become apparent from the following detailed description, or will be learned by practice of the present disclosure.

[0007] According to one aspect of the present disclosure, a network fault detection method is provided, comprising: collecting multi-dimensional data according to a service request initiated by a terminal; pre-processing the multi-dimensional data according to a time sequence to determine multi-dimensional time sequence data; inputting the multi-dimensional time sequence data into a pre-constructed time sequence diffusion model to output reconstructed data; calculating an error between the multi-dimensional time sequence data and the reconstructed data to determine an error value; and outputting alarm information according to a preset alarm grading threshold and the error value.

[0008] In some embodiments, before the pre-processing the multi-dimensional data according to a time sequence to determine multi-dimensional time sequence data, the method further comprises: calculating a success rate of the service request, and determining whether the success rate of the service request meets a preset condition; if yes, performing the pre-processing the multi-dimensional data according to a time sequence to determine multi-dimensional time sequence data; if no, outputting alarm information of a typical fault.

[0009] In some embodiments, the calculating a success rate of the service request, and determining whether the success rate of the service request meets a preset condition comprises: calculating a success rate of each service type in the service request; and determining whether the success rate of each service type is greater than or equal to a preset threshold.

[0010] In some embodiments, the multi-dimensional data comprises: service data, cloud resource data, and physical resource index data; and the pre-constructed time sequence diffusion model comprises: obtaining service data, cloud resource data, and physical resource index data under a service normal scenario, and grouping the data into a data set according to a time sequence; performing standardization processing, missing value processing, and sliding window processing on the data set to determine a training set; constructing an initial time sequence diffusion model, training the initial time sequence diffusion model according to the training set to obtain the pre-constructed time sequence diffusion model.

[0011] In some embodiments, the preset alarm grading threshold comprises a first threshold, a second threshold, and a third threshold; and the outputting alarm information according to a preset alarm grading threshold and the error value comprises: when the error value is less than the first threshold, outputting alarm information as no fault; when the error value is greater than or equal to the first threshold and less than the second threshold, outputting alarm information as a warning level non-typical fault; when the error value is greater than or equal to the second threshold and less than the third threshold, outputting alarm information as an important level non-typical fault; and when the error value is greater than or equal to the third threshold, outputting alarm information as a fault level non-typical fault.

[0012] In some embodiments, the first threshold is determined according to a mean of a historical normal error sequence, a first coefficient and a standard deviation of a historical normal residual sequence; the second threshold is determined according to the mean of the historical normal error sequence, a second coefficient and the standard deviation of the historical normal residual sequence; and the third threshold is determined according to the mean of the historical normal error sequence, a third coefficient and the standard deviation of the historical normal residual sequence.

[0013] According to another aspect of the present disclosure, a network fault detection apparatus is also provided, comprising: a data collection module configured to collect multi-dimensional data according to a service request initiated by a terminal; a time series data determination module configured to pre-process the multi-dimensional data according to a time series to determine multi-dimensional time series data; a data reconstruction module configured to input the multi-dimensional time series data into a pre-constructed time series diffusion model to output reconstructed data; an error value determination module configured to calculate an error between the multi-dimensional time series data and the reconstructed data to determine an error value; and an alarm module configured to output alarm information according to a preset alarm grading threshold and the error value.

[0014] According to another aspect of the present disclosure, an electronic device is also provided, comprising: a processor; and a memory configured to store executable instructions of the processor; wherein the processor is configured to execute the network fault detection method according to any one of the above aspects via executing the executable instructions.

[0015] According to another aspect of the present disclosure, a computer readable storage medium is also provided, having a computer program stored thereon, the computer program being executed by a processor to implement the network fault detection method according to any one of the above aspects.

[0016] According to another aspect of the present disclosure, a computer program product is also provided, comprising a computer program, the computer program being executed by a processor to implement the network fault detection method according to any one of the above aspects.

[0017] The network fault detection method provided in the embodiments of the present disclosure collects multi-dimensional data according to a service request initiated by a terminal; pre-processes the multi-dimensional data according to a time series to determine multi-dimensional time series data; inputs the multi-dimensional time series data into a pre-constructed time series diffusion model to output reconstructed data; calculates an error between the multi-dimensional time series data and the reconstructed data to determine an error value; and outputs alarm information according to a preset alarm grading threshold and the error value. The present disclosure can overcome the false alarm defect of a fixed threshold in a dynamic network environment, dynamically adapt to changes in a network environment, and solve the problem that network message fault judgment cannot dynamically match changes in a network environment, by using a time series diffusion model in combination with an alarm grading processing method.

[0018] It should be understood that the foregoing general description and the following detailed description are only exemplary and explanatory, and are not limiting of the present disclosure. Attached Figure Description

[0019] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this disclosure and, together with the description, serve to explain the principles of this disclosure. It is obvious that the drawings described below are merely some embodiments of this disclosure, and those skilled in the art can obtain other drawings based on these drawings without any inventive effort.

[0020] Figure 1 This diagram illustrates the structure of a network fault detection system according to an embodiment of the present disclosure.

[0021] Figure 2 This diagram illustrates a flowchart of a network fault detection method according to an embodiment of the present disclosure.

[0022] Figure 3 This is a flowchart illustrating a specific example of a network fault detection method according to an embodiment of the present disclosure;

[0023] Figure 4 A flowchart illustrating another specific example of a network fault detection method according to an embodiment of this disclosure is shown.

[0024] Figure 5 A flowchart illustrating yet another specific example of a network fault detection method according to an embodiment of the present disclosure is shown.

[0025] Figure 6 A flowchart illustrating another specific example of a network fault detection method according to an embodiment of this disclosure is shown.

[0026] Figure 7 This diagram illustrates a network fault detection device according to an embodiment of the present disclosure.

[0027] Figure 8 A structural block diagram of a computer device according to an embodiment of the present disclosure is shown. Detailed Implementation

[0028] Exemplary embodiments will now be described more fully with reference to the accompanying drawings. However, these exemplary embodiments can be implemented in many forms and should not be construed as limited to the examples set forth herein; rather, they are provided so that this disclosure will be more comprehensive and complete, and will fully convey the concept of the exemplary embodiments to those skilled in the art. The described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0029] In addition, the accompanying drawings are included to provide a further understanding of the present disclosure and are incorporated in and constitute a part of this specification. The drawings illustrate embodiments of the present disclosure and, as such, a change in the drawing figures would not limit the present disclosure in any way. Like reference numerals in different drawings represent the same or similar elements unless otherwise stated. Repetitive descriptions of well-known functions and components can be reduced for the purpose of brevity.

[0030] The specific implementation of the embodiments of the present disclosure will be described in detail below with reference to the accompanying drawings.

[0031] Figure 1 An exemplary application system architecture diagram to which the network fault detection method in the embodiments of the present disclosure can be applied is shown. As shown in the figure, the system architecture can include a terminal device 101, a network 102, and a server 103. Figure 1

[0032] The network 102 is a medium for providing a communication link between the terminal device 101 and the server 103, and can be a wired network or a wireless network.

[0033] Optionally, the wireless network or wired network described above uses standard communication technologies and / or protocols. The network is usually the Internet, but can also be any network, including but not limited to a Local Area Network (LAN), a Metropolitan Area Network (MAN), a Wide Area Network (WAN), a mobile, wired or wireless network, a private network or any combination of virtual private networks). In some embodiments, technologies and / or formats including Hyper Text Mark-up Language (HTML), Extensible Markup Language (XML), etc. are used to represent data exchanged through the network. In addition, all or some links can be encrypted using conventional encryption technologies such as Secure Socket Layer (SSL), Transport Layer Security (TLS), Virtual Private Network (VPN), Internet Protocol Security (IPSec), etc. In other embodiments, custom and / or dedicated data communication technologies can be used instead of or in addition to the above data communication technologies.

[0034] ​The terminal device 101 can be various electronic devices, including but not limited to a smartphone, a tablet computer, a laptop computer, a desktop computer, a smart speaker, a smart watch, a wearable device, an augmented reality device, a virtual reality device, etc.

[0035] Optionally, the clients of the application programs installed in different terminal devices 101 are the same, or the clients of the same type of application programs based on different operating systems. Based on the difference of terminal platforms, the specific forms of the clients of the application programs can also be different, for example, the application program client can be a mobile phone client, a PC client, etc.

[0036] The server 103 can be a server providing various services, for example, a background management server providing support for the operation of the device by the user using the terminal device 101. The background management server can analyze and process the received request data, etc., and feed back the processing result to the terminal device.

[0037] Optionally, the server can be a stand-alone physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server providing cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN (Content Delivery Network), and basic cloud computing services such as big data and artificial intelligence platforms.

[0038] In one specific example, the server collects multi-dimensional data according to a service request initiated by a terminal; pre-processes the multi-dimensional data according to a time sequence to determine multi-dimensional time sequence data; inputs the multi-dimensional time sequence data into a pre-constructed time sequence diffusion model to output reconstructed data; calculates an error between the multi-dimensional time sequence data and the reconstructed data to determine an error value; and outputs an alarm information according to a preset alarm grading threshold and the error value.

[0039] Those skilled in the art can know that, Figure 1 The number of terminal devices, networks and servers in the above-mentioned embodiments is only illustrative, and any number of terminal devices, networks and servers can be provided according to actual needs. The embodiments of the present disclosure do not limit this.

[0040] Figure 2 A flow chart of a network fault detection method in the embodiments of the present disclosure is shown in FIG. 2. Figure 2 As shown in FIG. 2, the network fault detection method provided in the embodiments of the present disclosure includes the following steps:

[0041] S202, multi-dimensional data is collected according to a service request initiated by a terminal.

[0042] It should be noted that the above service request can be an operation triggered by a user through a terminal device, requiring the 5G message platform to complete a specific communication function, for example, a rich media communication service interaction instruction. The above multi-dimensional data includes service data, cloud resource data, and physical resource index data. The service data can directly reflect the user experience and business value, for example, request success rate, request delay, request error rate, etc. The cloud resource data is a virtualized environment for business operation, for example, cloud storage service, virtual machine, cloud database, etc. The physical resource index data is a physical hardware resource index, for example, server temperature, power state, central processing unit utilization, etc. The collection can be real-time collection, which can obtain the latest data to provide dynamic and accurate data for subsequent calculation.

[0043] In S204, the multi-dimensional data is preprocessed according to the time sequence to determine multi-dimensional time sequence data.

[0044] It should be noted that the above data sequence can be a time latitude. In one specific example, the multi-dimensional data is processed by cleaning, conversion, etc. according to the time dimension (sorted by time) to generate multi-dimensional time sequence data.

[0045] In S206, the multi-dimensional time sequence data is input into a pre-constructed time sequence diffusion model to output reconstructed data.

[0046] It should be noted that the above time sequence diffusion model can be a model architecture that combines the time sequence information processing capability and the diffusion model characteristics. For example, the time sequence diffusion model is a diffusion model that combines a Transformer decoder. The diffusion model provides a progressive generation framework to control the time evolution of the data generation process. The Transformer decoder is the core of the denoising network, which performs noise prediction or data reconstruction. The parameter tuning strategy of the time sequence diffusion model is: segment tuning according to the training step, the front segment is set to 0%-20% to achieve fast convergence, the middle segment is set to 20%-70% to achieve fine feature learning, and the rear segment is set to 70%-100% to achieve fine-tuning of the generation quality.

[0047] In S208, the error of the multi-dimensional time sequence data and the reconstructed data is calculated to determine the error value.

[0048] In one specific example, the multi-dimensional time sequence data A is input into a pre-constructed time sequence diffusion model to generate reconstructed data sample A 、 , the error value E1 of A and A 、 is calculated, and E1=|A-A 、 | is calculated.

[0049] In S210, an alarm information is output according to the preset alarm grading threshold and the error value.

[0050] It should be noted that the above alarm information can be an active notification mechanism for abnormal state or potential risk, for quickly locating the problem.

[0051] The disclosure can overcome the false alarm defects of the fixed threshold in the dynamic network environment, dynamically adapt to the network environment changes, and solve the problem that the network message fault judgment cannot dynamically match the network environment changes by combining the alarm grading processing method with the time series diffusion model.

[0052] In an embodiment of the disclosure, as shown in Figure 3 The network fault detection method provided in the embodiment of the disclosure further includes the following steps before pre-processing the multi-dimensional data according to the time series and determining the multi-dimensional time series data:

[0053] S302, the success rate of the service request is calculated, and it is judged whether the success rate of the service request meets the preset condition.

[0054] It should be noted that the above preset condition can be greater than or equal to a preset threshold.

[0055] S3041, if yes, pre-processing the multi-dimensional data according to the time series and determining the multi-dimensional time series data are performed.

[0056] It should be noted that if yes, the multi-dimensional data is pre-processed according to the time series, the multi-dimensional time series data is determined, the multi-dimensional time series data is input into a pre-constructed time series diffusion model, and the reconstructed data is output; the error between the multi-dimensional time series data and the reconstructed data is calculated to determine the error value; and the alarm information is output according to the preset alarm grading threshold and the error value.

[0057] S3042, if no, the alarm information of the typical fault is output.

[0058] It should be noted that the success rate of the service request can be determined by the ratio of the number of successful requests to the total number of requests.

[0059] The disclosure judges whether the network fault is a typical fault by calculating the success rate of the service request. For a typical fault, it is directly determined by the low service accuracy, and for a non-typical fault, it is further detected and judged by the time series diffusion model. Through the combination of the preset threshold and the time series diffusion model, the speed and accuracy of fault detection are improved.

[0060] In an embodiment of the disclosure, as shown in Figure 4 The method for calculating the success rate of the service request and judging whether the success rate of the service request meets the preset condition in the network fault detection method provided in the embodiment of the disclosure includes the following steps:

[0061] S402, calculate the success rate of each service type in the service request;

[0062] S404, determine whether the success rate of each service type is greater than or equal to a preset threshold.

[0063] For example, the statistical 5G message of each service type includes: user registration; message transmission; account opening; configuration acquisition; file upload and download; short message conversion; MAAP message, i.e. platform and other service scenarios. The success rate set S n includes the success rate of each service type. For example, there are n service types, and the success rate combination is S n ∈{S1, S2, ···, S n}. If any value in the set S is less than a typical failure threshold T (such as 0.95), that is: S∈{S1, S2, ···, S n}<T (T is a threshold value, which can be adjusted by hot loading), it can be determined as a typical failure, and the output is: 5G message appears typical failure; if all values in the set are greater than or equal to the threshold T, that is S∈{S1, S2, ···, S n}>=T, it is not a typical failure, and it needs to continue to determine whether it is a non-typical failure.

[0064] The present disclosure detects 5G message failures by hierarchical detection, uses threshold determination for typical failures (which can be determined by low service accuracy), and combines real-time adjustment strategies with hot loading, which can improve the accuracy and timeliness of network failure determination.

[0065] In an embodiment of the present disclosure, as shown in Figure 5 The network failure detection method provided in the embodiment of the present disclosure includes the following steps:

[0066] S502, obtain service data, cloud resource data and physical resource index data in a normal service scenario, and form a data set according to time sequence;

[0067] S504, standardize the data set, process missing values, and process sliding windows to determine a training set;

[0068] S506, construct an initial time series diffusion model, train the initial time series diffusion model according to the training set, and obtain a pre-constructed time series diffusion model.

[0069] It should be noted that the above standardization processing can be data standardization, normalizing the multi-modal data, eliminating the influence of different dimensions or orders of magnitude on data analysis, so that the comparison between different features is more reasonable; the above missing value processing can be to fill the missing points with moving average method or difference method to ensure time continuity; the above sliding window processing can be to divide the continuous time series data into fixed length subsequences (windows), and dynamically move the window through the sliding step to cover the entire data set, realizing the conversion of the original time series into multiple local sample sets. Through the continuous sliding of the window, the local mode and time sequence dependence in the data are extracted, providing structured input for subsequent construction of time series diffusion model. In addition, the sliding window can be dynamically set according to different actual needs.

[0070] The present disclosure can dynamically adapt to changes in network environment by constructing a time series diffusion model and combining multi-dimensional data for network fault detection, thereby improving the dynamic adaptability of network fault detection.

[0071] In one embodiment of the present disclosure, as shown in Figure 6 The preset alarm grading threshold in the network fault detection method provided in the embodiment of the present disclosure includes a first threshold, a second threshold and a third threshold, and the output alarm information includes the following steps according to the preset alarm grading threshold and the error value:

[0072] S602, when the error value is less than the first threshold, the output alarm information is no fault;

[0073] S604, when the error value is greater than or equal to the first threshold and less than the second threshold, the output alarm information is a warning level atypical fault;

[0074] S606, when the error value is greater than or equal to the second threshold and less than the third threshold, the output alarm information is an important level atypical fault;

[0075] S608, when the error value is greater than or equal to the third threshold, the output alarm information is a fault level atypical fault.

[0076] In one example of the present disclosure, the first threshold is determined according to the mean of the historical normal error sequence, the first coefficient and the standard deviation of the historical normal residual sequence; the second threshold is determined according to the mean of the historical normal error sequence, the second coefficient and the standard deviation of the historical normal residual sequence; and the third threshold is determined according to the mean of the historical normal error sequence, the third coefficient and the standard deviation of the historical normal residual sequence.

[0077] Specifically, the error value is E1, the mean of the historical normal error sequence is μ hist , and the standard deviation of the historical normal error sequence is σ hist .

[0078] Generate a first-level alarm threshold: Twarn = μ hist + α σ hist wherein the first coefficient α preferably ranges from 1 ≤ α ≤ 1.8;

[0079] generate a secondary important threshold: T impo = μ hist + β σ hist wherein the second coefficient β preferably ranges from 2.0 ≤ β ≤ 2.8;

[0080] generate a tertiary fault threshold: T error = μ hist + γ σ hist wherein the third coefficient γ preferably ranges from 3.0 ≤ γ ≤ 3.8.

[0081] The real-time error value E1 satisfies:

[0082] E1 < T warn : no fault state;

[0083] T warn ≤ E1 < T impo : warning level atypical fault;

[0084] T impo ≤ E1 < T error : important level atypical fault;

[0085] E1 ≥ T error : fault level atypical fault.

[0086] In addition, different alarm levels can correspond to different response actions. The different value ranges of the respective coefficients are adaptive adjustments for different scene changes. In a specific example, the first coefficient is adjusted to 1.5 for a traffic fluctuation scene when there is a traffic surge activity; the second coefficient is adjusted to 2.5 for a service upgrade scene when there is a service upgrade; and the third coefficient is adjusted to 3.5 for a network element device scene when the historical fault rate of the network element rises.

[0087] The present disclosure uses historical statistics μ hist and σ hist to construct an adaptive threshold, dynamically adjusts the threshold according to the communication environment, and overcomes the false alarm defect of a fixed threshold in a traffic fluctuation scene. In addition, the present disclosure realizes a three-level gradient response (warning / important / fault) through the coefficients α, β, and γ, accurately locates the fault source, and shortens the troubleshooting time.

[0088] Based on the same inventive concept, the embodiment of the present disclosure also provides a network fault detection device, as described in the following embodiment. Since the principle of solving the problem of the device embodiment is similar to the above-mentioned method embodiment, the implementation of the device embodiment can be referred to the implementation of the above-mentioned method embodiment, and the repeated parts will not be described here.

[0089] Figure 7 A schematic diagram of a network fault detection device in an embodiment of the present disclosure is shown, as shown in the figure, the device comprises a data acquisition module 71, a time series data determination module 72, a data reconstruction module 73, an error value determination module 74 and an alarm module 75. Figure 7

[0090] The data acquisition module 71 is configured to acquire multi-dimensional data according to a service request initiated by a terminal.

[0091] The time series data determination module 72 is configured to preprocess the multi-dimensional data according to a time sequence to determine multi-dimensional time series data.

[0092] The data reconstruction module 73 is configured to input the multi-dimensional time series data into a pre-constructed time series diffusion model to output reconstructed data.

[0093] The error value determination module 74 is configured to calculate the error between the multi-dimensional time series data and the reconstructed data to determine an error value.

[0094] The alarm module 75 is configured to output alarm information according to a preset alarm grading threshold and the error value.

[0095] In one example of the present disclosure, the network fault detection device described above further comprises a success rate calculation module configured to calculate the success rate of the service request and determine whether the success rate of the service request meets a preset condition; if yes, the multi-dimensional data is preprocessed according to a time sequence to determine multi-dimensional time series data; if not, the alarm information of a typical fault is output.

[0096] In one example of the present disclosure, the success rate calculation module described above is further configured to calculate the success rate of each service type in the service request; and determine whether the success rate of each service type is greater than or equal to a preset threshold.

[0097] In one example of the present disclosure, the multi-dimensional data in the network fault detection device described above comprises service data, cloud resource data and physical resource index data; and the pre-constructed time series diffusion model in the data reconstruction module comprises: obtaining service data, cloud resource data and physical resource index data under a normal service scenario, and forming a data set according to a time sequence; performing standardization processing, missing value processing and sliding window processing on the data set to determine a training set; constructing an initial time series diffusion model, training the initial time series diffusion model according to the training set to obtain the pre-constructed time series diffusion model.​

[0098] In one example of the present disclosure, the preset alarm grading threshold in the alarm module includes a first threshold, a second threshold and a third threshold; according to the preset alarm grading threshold and the error value, the output alarm information includes: when the error value is less than the first threshold, the output alarm information is no fault; when the error value is greater than or equal to the first threshold and less than the second threshold, the output alarm information is a warning level atypical fault; when the error value is greater than or equal to the second threshold and less than the third threshold, the output alarm information is an important level atypical fault; and when the error value is greater than or equal to the third threshold, the output alarm information is a fault level atypical fault.

[0099] In one example of the present disclosure, the first threshold in the alarm module is determined according to the mean of the historical normal error sequence, the first coefficient and the standard deviation of the historical normal residual sequence; the second threshold is determined according to the mean of the historical normal error sequence, the second coefficient and the standard deviation of the historical normal residual sequence; and the third threshold is determined according to the mean of the historical normal error sequence, the third coefficient and the standard deviation of the historical normal residual sequence.

[0100] It should be noted that the data acquisition module 71, the time series data determination module 72, the data reconstruction module 73, the error value determination module 74 and the alarm module 75 correspond to S202-S210 in the method embodiment, and the above modules and the corresponding steps have the same examples and application scenarios, but are not limited to the content disclosed in the above method embodiment. It should be noted that the above modules as part of the device can be executed in a computer system such as a group of computer executable instructions.

[0101] Those skilled in the art can understand that each aspect of the present disclosure can be implemented as a system, a method or a program product. Therefore, each aspect of the present disclosure can be specifically implemented as a complete hardware embodiment, a complete software embodiment (including firmware, microcode, etc.), or an embodiment combined with hardware and software aspects, which can be collectively referred to as "circuitry", "module" or "system" here.

[0102] The electronic device 800 according to this embodiment of the present disclosure will be described below with reference to Figure 8 Figure 8 The electronic device 800 shown is merely an example and should not impose any limitation on the function and use range of the embodiments of the present disclosure.

[0103] As shown in Figure 8 , the electronic device 800 is in the form of a general computing device. The components of the electronic device 800 can include but are not limited to the above-mentioned at least one processing unit 810, the above-mentioned at least one storage unit 820, and a bus 830 connecting different system components (including the storage unit 820 and the processing unit 810). ​

[0104] The storage unit stores program codes which can be executed by the processing unit 810, so that the processing unit 810 performs the steps of various exemplary embodiments according to the present disclosure described in the above “Exemplary Method” section of the present specification.

[0105] For example, the processing unit 810 can perform the following steps of the above method embodiments: collecting multi-dimensional data according to a service request initiated by a terminal; pre-processing the multi-dimensional data according to a time sequence to determine multi-dimensional time sequence data; inputting the multi-dimensional time sequence data into a pre-constructed time sequence diffusion model to output reconstructed data; calculating an error between the multi-dimensional time sequence data and the reconstructed data to determine an error value; and outputting an alarm information according to a preset alarm grading threshold and the error value.

[0106] For example, the processing unit 810 can perform the following steps of the above method embodiments: calculating a success rate of a service request, and determining whether the success rate of the service request meets a preset condition; if yes, pre-processing multi-dimensional data according to a time sequence to determine multi-dimensional time sequence data; and if no, outputting an alarm information of a typical fault.

[0107] For example, the processing unit 810 can perform the following steps of the above method embodiments: calculating a success rate of each service type in a service request; and determining whether the success rate of each service type is greater than or equal to a preset threshold.

[0108] For example, the processing unit 810 can perform the following steps of the above method embodiments: obtaining service data, cloud resource data and physical resource index data under a normal service scenario, and grouping the data into a data set according to a time sequence; performing standardization processing, missing value processing and sliding window processing on the data set to determine a training set; constructing an initial time sequence diffusion model, training the initial time sequence diffusion model according to the training set, and obtaining a pre-constructed time sequence diffusion model.

[0109] For example, the processing unit 810 can perform the following steps of the above method embodiments: when the error value is less than a first threshold, outputting an alarm information of no fault; when the error value is greater than or equal to the first threshold and less than a second threshold, outputting an alarm information of a warning level non-typical fault; when the error value is greater than or equal to the second threshold and less than a third threshold, outputting an alarm information of an important level non-typical fault; and when the error value is greater than or equal to the third threshold, outputting an alarm information of a fault level non-typical fault.

[0110] For example, the processing unit 810 can perform the following steps of the above-mentioned method embodiments: the first threshold is determined according to the mean of the historical normal error sequence, the first coefficient and the standard deviation of the historical normal residual sequence; the second threshold is determined according to the mean of the historical normal error sequence, the second coefficient and the standard deviation of the historical normal residual sequence; the third threshold is determined according to the mean of the historical normal error sequence, the third coefficient and the standard deviation of the historical normal residual sequence.

[0111] The storage unit 820 can include a readable medium in the form of volatile storage such as a random access memory (RAM) 8201 and / or cache 8202, and also can further include a read-only memory (ROM) 8203.

[0112] The storage unit 820 can also include a program / utility 8204 having a set of program modules 8205 including, but not limited to, an operating system, one or more application programs, other program modules, and program data, each of which can include an implementation of a network environment, or a combination thereof.

[0113] The bus 830 can represent one or more of several types of bus structures, including a storage bus or bus controller, a peripheral bus, a graphics acceleration bus, a processor or local bus using any of a variety of bus structures, and the like.

[0114] The electronic device 800 can also communicate with one or more external devices 840 such as a keyboard or pointing device, a Bluetooth device, etc.; other devices that enable a user to interact with the electronic device 800; and / or one or more devices that enable the electronic device 800 to communicate with one or more other computing devices. Such communication can be facilitated by an Input / Output (I / O) interface 850. Still yet, the electronic device 800 can communicate with one or more networks, such as a local area network (LAN), a wide area network (WAN), and / or the Internet, through a network adapter 860. As depicted, the network adapter 860 can communicate with the other components of the electronic device 800 through the bus 830. It should be appreciated that although not shown, other hardware and / or software components could be used in conjunction with the electronic device 800. These include, but are not limited to, microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data archival storage systems, etc.

[0115] Through the description of the above embodiments, those skilled in the art can easily understand that the example embodiments described herein can be implemented by software, or by software in combination with necessary hardware. Therefore, the technical solutions according to the embodiments of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a U disk, a mobile hard disk, etc.) or a network, and includes a number of instructions to make a computing device (which can be a personal computer, a server, a terminal device, or a network device, etc.) execute the method according to the embodiments of the present disclosure.

[0116] In particular, according to the embodiments of the present disclosure, the processes described above with reference to the flowcharts can be implemented as a computer program product, which includes a computer program that, when executed by a processor, implements the network fault detection method described above.

[0117] In the example embodiments of the present disclosure, a computer readable storage medium is also provided, which can be a readable signal medium or a readable storage medium. A program product capable of implementing the method of the present disclosure is stored thereon. In some possible embodiments, various aspects of the present disclosure can also be implemented in the form of a program product, which includes program code for causing the terminal device to perform the steps according to various example embodiments of the present disclosure described in the above "example method" section of the specification when the program product is run on the terminal device.

[0118] More specific examples of the computer readable storage medium in the present disclosure can include, but are not limited to, an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0119] In the present disclosure, the computer readable storage medium can include a data signal propagating in a baseband or as part of a carrier wave propagating through a transmission medium, in which readable program code is borne. Such a propagating data signal can take various forms, including but not limited to an electromagnetic signal, an optical signal, or any suitable combination of the above. The readable signal medium can also be any readable medium other than the readable storage medium, which can send, propagate or transmit programs for use by or in connection with an instruction execution system, apparatus or device.

[0120] Optionally, the program code contained on the computer readable storage medium can be transmitted by any suitable medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the above.

[0121] In an implementation, the program code, which can be written in any combination of one or more programming languages, including an object oriented programming language such as Java, C++, or the like, and conventional procedural programming languages, such as the "C" programming language or similar programming languages, can be executed by one or more computing devices in system 1000. The program code can execute entirely on the user's computing device, partly on the user's computing device, as a stand-alone software package, partly on the user's computing device and partly on a remote computing device or entirely on the remote computing device or server. In the latter scenario, the remote computing device can be connected to the user's computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computing device, such as through the Internet using an Internet Service Provider.

[0122] It should be noted that, although several modules or units of devices for action execution are mentioned in the foregoing detailed description, such a division is not mandatory. Indeed, features and functionalities of two or more modules or units described above can be embodied in one module or unit according to embodiments of the present disclosure. Conversely, features and functionalities of one module or unit described above can be further divided into embodied by multiple modules or units.

[0123] Moreover, although the various steps of the methods in the present disclosure are described in a particular order in the drawings, this is not required or implied as to the order of execution of the steps, nor is it required that all of the steps be executed to achieve the desired result. Additionally or alternatively, certain steps can be omitted, multiple steps can be combined into one step, one step can be broken into multiple steps, etc.

[0124] From the above description of the embodiments, those skilled in the art will readily perceive that the example embodiments described herein can be implemented by software and / or by hardware and / or by a combination of software and hardware. The embodiments according to the present disclosure can be realized in the form of a software program which can be stored on a non-volatile storage medium, e.g., a CD-ROM, a USB stick, a mobile hard disk, etc., or which can be stored on a network, and which can be loaded into a computing device, e.g., a personal computer, a server, a mobile terminal, or a network device, etc., and executed by the computing device. The software program comprises program code which, when executed by the computing device, causes the computing device to carry out the methods according to the embodiments of the present disclosure.

[0125] Other embodiments of the disclosure will be apparent to those skilled in the art from consideration of the specification and practice of the features disclosed herein. It is intended that the disclosure be construed as including any patents, patent applications, publications, publications, or other disclosure of complementary subject matter that is within the scope of the disclosure. It is intended that the specification and examples be considered exemplary only, with the true scope and spirit of the disclosure being indicated by the following claims.

Claims

1. A network fault detection method, characterized in that, include: Collect multi-dimensional data based on the business requests initiated by the terminal; The multi-dimensional data is preprocessed based on the time series to determine the multi-dimensional time series data; The multi-dimensional time series data is input into a pre-constructed time series diffusion model, and the reconstructed data is output. Calculate the error between the multi-dimensional time-series data and the reconstructed data, and determine the error value; Based on the preset alarm classification threshold and the error value, alarm information is output; The multi-dimensional data includes business data, cloud resource data, and physical resource indicator data. The pre-built time-series diffusion model includes: acquiring business data, cloud resource data, and physical resource indicator data under normal business scenarios, and forming a dataset according to time series; standardizing, handling missing values, and performing sliding window processing on the dataset to determine the training set; constructing an initial time-series diffusion model, and training the initial time-series diffusion model based on the training set to obtain the pre-built time-series diffusion model. The time-series diffusion model is a model architecture that integrates time series information processing capabilities and diffusion model characteristics. The preset alarm classification thresholds include a first threshold, a second threshold, and a third threshold. The first threshold is determined based on the mean of the historical normal error sequence, the first coefficient, and the standard deviation of the historical normal residual sequence. The second threshold is determined based on the mean of the historical normal error sequence, the second coefficient, and the standard deviation of the historical normal residual sequence. The third threshold is determined based on the mean of the historical normal error sequence, the third coefficient, and the standard deviation of the historical normal residual sequence.

2. The network fault detection method according to claim 1, characterized in that, Before preprocessing the multi-dimensional data according to the time series to determine the multi-dimensional time series data, the method further includes: Calculate the success rate of the business request and determine whether the success rate of the business request meets a preset condition; If so, then perform preprocessing on the multi-dimensional data according to the time series to determine the multi-dimensional time series data; If not, output alarm information for typical faults.

3. The network fault detection method according to claim 2, characterized in that, The step of calculating the success rate of the service request and determining whether the success rate of the service request meets the preset conditions includes: Calculate the success rate of each business type in the business request; Determine whether the success rate of each business type is greater than or equal to the preset threshold.

4. The network fault detection method according to any one of claims 1 to 3, characterized in that, The step of outputting alarm information based on the preset alarm classification threshold and the error value includes: When the error value is less than the first threshold, the alarm message "No fault" is output. When the error value is greater than or equal to the first threshold and less than the second threshold, an alarm message of warning level atypical fault is output. When the error value is greater than or equal to the second threshold and less than the third threshold, an alarm message is output indicating an important level atypical fault. When the error value is greater than or equal to the third threshold, an alarm message is output indicating an atypical fault.

5. A network fault detection device, characterized in that, include: The data acquisition module is used to collect multi-dimensional data based on business requests initiated by the terminal. The time series data determination module is used to preprocess the multi-dimensional data according to the time series to determine the multi-dimensional time series data; The data reconstruction module is used to input the multi-dimensional time series data into a pre-built time series diffusion model and output reconstructed data. An error value determination module is used to calculate the error between the multi-dimensional time series data and the reconstructed data, and determine the error value. The alarm module is used to output alarm information based on the preset alarm classification threshold and the error value; The multi-dimensional data includes business data, cloud resource data, and physical resource indicator data. The pre-built time-series diffusion model includes: acquiring business data, cloud resource data, and physical resource indicator data under normal business scenarios, and forming a dataset according to time series; standardizing, handling missing values, and performing sliding window processing on the dataset to determine the training set; constructing an initial time-series diffusion model, and training the initial time-series diffusion model based on the training set to obtain the pre-built time-series diffusion model. The time-series diffusion model is a model architecture that integrates time series information processing capabilities and diffusion model characteristics. The preset alarm classification thresholds include a first threshold, a second threshold, and a third threshold. The first threshold is determined based on the mean of the historical normal error sequence, the first coefficient, and the standard deviation of the historical normal residual sequence. The second threshold is determined based on the mean of the historical normal error sequence, the second coefficient, and the standard deviation of the historical normal residual sequence. The third threshold is determined based on the mean of the historical normal error sequence, the third coefficient, and the standard deviation of the historical normal residual sequence.

6. An electronic device, characterized in that, include: processor; as well as Memory for storing the executable instructions of the processor; The processor is configured to execute the network fault detection method according to any one of claims 1 to 4 by executing the executable instructions.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the network fault detection method according to any one of claims 1 to 4.

8. A computer program product comprising: A computer program or instruction, characterized in that, when executed by a processor, the computer program or instruction implements the network fault detection method according to any one of claims 1 to 4.

Images